mirror of
https://github.com/opencontainers/runc.git
synced 2025-10-07 08:21:01 +08:00
fde0b7aa0d
Remove veth interfaces on the host if an error occurs. Provide the host interface name, temporary peer interface name and the name of the peer once it is inside the container's namespace in the Network config. Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
94 lines
2.4 KiB
Go
94 lines
2.4 KiB
Go
// +build linux
|
|
|
|
package libcontainer
|
|
|
|
import (
|
|
"syscall"
|
|
|
|
"github.com/docker/libcontainer/apparmor"
|
|
"github.com/docker/libcontainer/configs"
|
|
"github.com/docker/libcontainer/label"
|
|
"github.com/docker/libcontainer/system"
|
|
)
|
|
|
|
type linuxStandardInit struct {
|
|
config *initConfig
|
|
}
|
|
|
|
func (l *linuxStandardInit) Init() error {
|
|
// join any namespaces via a path to the namespace fd if provided
|
|
if err := joinExistingNamespaces(l.config.Config.Namespaces); err != nil {
|
|
return err
|
|
}
|
|
consolePath := l.config.Config.Console
|
|
if consolePath != "" {
|
|
console := newConsoleFromPath(consolePath)
|
|
if err := console.dupStdio(); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if _, err := syscall.Setsid(); err != nil {
|
|
return err
|
|
}
|
|
if consolePath != "" {
|
|
if err := system.Setctty(); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := setupNetwork(l.config); err != nil {
|
|
return err
|
|
}
|
|
if err := setupRoute(l.config.Config); err != nil {
|
|
return err
|
|
}
|
|
if err := setupRlimits(l.config.Config); err != nil {
|
|
return err
|
|
}
|
|
label.Init()
|
|
// InitializeMountNamespace() can be executed only for a new mount namespace
|
|
if l.config.Config.Namespaces.Contains(configs.NEWNS) {
|
|
if err := setupRootfs(l.config.Config); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if hostname := l.config.Config.Hostname; hostname != "" {
|
|
if err := syscall.Sethostname([]byte(hostname)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
|
|
return err
|
|
}
|
|
if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
|
|
return err
|
|
}
|
|
if l.config.Config.RestrictSys {
|
|
for _, path := range []string{"proc/sys", "proc/sysrq-trigger", "proc/irq", "proc/bus"} {
|
|
if err := remountReadonly(path); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := maskProckcore(); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
pdeath, err := system.GetParentDeathSignal()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := finalizeNamespace(l.config); err != nil {
|
|
return err
|
|
}
|
|
// finalizeNamespace can change user/group which clears the parent death
|
|
// signal, so we restore it here.
|
|
if err := pdeath.Restore(); err != nil {
|
|
return err
|
|
}
|
|
// Signal self if parent is already dead. Does nothing if running in a new
|
|
// PID namespace, as Getppid will always return 0.
|
|
if syscall.Getppid() == 1 {
|
|
return syscall.Kill(syscall.Getpid(), syscall.SIGKILL)
|
|
}
|
|
return system.Execv(l.config.Args[0], l.config.Args[0:], l.config.Env)
|
|
}
|