oci

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 30, 2025 License: Apache-2.0 Imports: 70 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	AttachPipeStdin  = 1
	AttachPipeStdout = 2
	AttachPipeStderr = 3
)

Sync with stdpipe_t in conmon.c.

View Source 
const (
	// ContainerStateCreated represents the created state of a container.
	ContainerStateCreated = "created"
	// ContainerStatePaused represents the paused state of a container.
	ContainerStatePaused = "paused"
	// ContainerStateRunning represents the running state of a container.
	ContainerStateRunning = "running"
	// ContainerStateStopped represents the stopped state of a container.
	ContainerStateStopped = "stopped"
	// ContainerCreateTimeout represents the value of container creating timeout.
	ContainerCreateTimeout = 240 * time.Second
)
View Source 
const InfraContainerName = "POD"
View Source 
const (
	KataVirtualVolumeOptionName = "io.katacontainers.volume"
)
View Source 
const (
	// RuntimeTypeOCI is the type representing the RuntimeOCI implementation.
	RuntimeTypeOCI = "oci"
)

Variables

View Source 
var (
	ErrContainerStopped = errors.New("container is already stopped")
	ErrNotFound         = errors.New("container process not found")
	ErrNotInitialized   = errors.New("container PID not initialized")
)

Functions

func EncodeKataVirtualVolumeToBase64 

func EncodeKataVirtualVolumeToBase64(ctx context.Context, volume *katavolume.KataVirtualVolume) (string, error)

func GetPidStartTimeFromFile 

func GetPidStartTimeFromFile(file string) (string, error)

GetPidStartTimeFromFile reads a file as if it were a /proc/<PID>/stat file, looking for a process start time for a given PID. It is abstracted out to allow for unit testing.

func Kill 

func Kill(pid int) error

func LabelsToDescription 

func LabelsToDescription(labels map[string]string) string

LabelsToDescription returns a string description from the provided labels.

func ReadConmonPidFile 

func ReadConmonPidFile(c *Container) (int, error)

ReadConmonPidFile attempts to read conmon's pid from its pid file This function makes no verification that this file should exist it is up to the caller to verify that this container has a conmon.

func TruncateAndReadFile 

func TruncateAndReadFile(ctx context.Context, path string, size int64) ([]byte, error)

Types

type Container 

type Container struct {
	// contains filtered or unexported fields
}

Container represents a runtime container.

func NewContainer 

func NewContainer(id, name, bundlePath, logPath string, labels, crioAnnotations, annotations map[string]string, userRequestedImage string, someNameOfTheImage *storage.NameTag, imageID string, someRepoDigest string, md *types.ContainerMetadata, sandbox string, terminal, stdin, stdinOnce bool, runtimeHandler, dir string, created time.Time, stopSignal string) (*Container, error)

NewContainer creates a container object. userRequestedImage is the users' input originally used to find imageID; it might evaluate to a different image (or to a different kind of reference!) at any future time. someNameOftheImage, if set, is _some_ name of the image imageID; it may have NO RELATIONSHIP to the users’ requested image name. imageID is nil for infra containers. someRepoDigest, if set, is some repo@some digest of the image imageID; it may have NO RELATIONSHIP to the users’ requested image name (and, which should be fixed eventually, may be a repo@digest combination which has never existed on a registry).

func NewSpoofedContainer 

func NewSpoofedContainer(id, name string, labels map[string]string, sandbox string, created time.Time, dir string) *Container

func (*Container) AddExecPID 

func (c *Container) AddExecPID(pid int, shouldKill bool) error

AddExecPID registers a PID associated with an exec session. It is tracked so exec sessions can be cancelled when the container is being stopped. If the PID is conmon, shouldKill should be false, as we should not call SIGKILL on conmon. If it is an exec session, shouldKill should be true, as we can't guarantee the exec process will have a SIGINT handler.

func (*Container) AddManagedPIDNamespace 

func (c *Container) AddManagedPIDNamespace(ns nsmgr.Namespace)

func (*Container) AddVolume 

func (c *Container) AddVolume(v ContainerVolume)

AddVolume adds a volume to list of container volumes.

func (*Container) Annotations 

func (c *Container) Annotations() map[string]string

Annotations returns the annotations of the container.

func (*Container) BundlePath 

func (c *Container) BundlePath() string

BundlePath returns the bundlePath of the container.

func (*Container) CRIAttributes 

func (c *Container) CRIAttributes() *types.ContainerAttributes

func (*Container) CRIContainer 

func (c *Container) CRIContainer() *types.Container

func (*Container) CheckpointPath 

func (c *Container) CheckpointPath() string

CheckpointPath returns the path to the directory containing the checkpoint.

func (*Container) CleanupConmonCgroup 

func (c *Container) CleanupConmonCgroup(ctx context.Context)

CleanupConmonCgroup cleans up conmon's group when using cgroupfs.

func (*Container) ConmonCgroupfsPath 

func (c *Container) ConmonCgroupfsPath() string

ConmonCgroupfsPath returns the path to conmon's cgroup. This is only set when cgroupfs is used as a cgroup manager.

func (*Container) Created 

func (c *Container) Created() bool

Created returns whether the container was created successfully.

func (*Container) CreatedAt 

func (c *Container) CreatedAt() time.Time

CreatedAt returns the container creation time.

func (*Container) CrioAnnotations 

func (c *Container) CrioAnnotations() map[string]string

CrioAnnotations returns the crio annotations of the container.

func (*Container) DeleteExecPID 

func (c *Container) DeleteExecPID(pid int)

DeleteExecPID is for deregistering a pid after it has exited.

func (*Container) Description 

func (c *Container) Description() string

Description returns a description for the container.

func (*Container) Dir 

func (c *Container) Dir() string

Dir returns the dir of the container.

func (*Container) FromDisk 

func (c *Container) FromDisk() error

FromDisk restores container's state from disk Calls to FromDisk should always be preceded by call to Runtime.UpdateContainerStatus. This is because FromDisk() initializes the InitStartTime for the saved container state when CRI-O is being upgraded to a version that supports tracking PID, but does no verification the container is actually still running. If we assume the container is still running, we could incorrectly think a process with the same PID running on the host is our container. A call to `$runtime state` will protect us against this.

func (*Container) GetResources 

func (c *Container) GetResources() *types.ContainerResources

GetResources returns a copy of the Linux resources from Container.

func (*Container) GetStopSignal 

func (c *Container) GetStopSignal() string

GetStopSignal returns the container's own stop signal configured from the image configuration or the default one.

func (*Container) ID 

func (c *Container) ID() string

ID returns the id of the container.

func (*Container) ImageID 

func (c *Container) ImageID() string

ImageID returns the image ID of the container, or nil for infra containers.

func (*Container) IsInfra 

func (c *Container) IsInfra() bool

func (*Container) KillExecPIDs 

func (c *Container) KillExecPIDs()

KillExecPIDs loops through the saved execPIDs and sends a signal to them. If shouldKill is true, the signal is SIGKILL. Otherwise, SIGINT.

func (*Container) Labels 

func (c *Container) Labels() map[string]string

Labels returns the labels of the container.

func (*Container) Living 

func (c *Container) Living() error

Living checks if a container's init PID exists and it's running, without calling a given runtime directly to check the state, which is expensive. This can't be used for runtimeVM because it uses the VM's pid as a container pid, and the VM doesn't necessarily stop when the container stops.

func (*Container) LogPath 

func (c *Container) LogPath() string

LogPath returns the log path of the container.

func (*Container) Metadata 

func (c *Container) Metadata() *types.ContainerMetadata

Metadata returns the metadata of the container.

func (*Container) MountPoint 

func (c *Container) MountPoint() string

MountPoint returns the container mount point.

func (*Container) Name 

func (c *Container) Name() string

Name returns the name of the container.

func (*Container) Pid 

func (c *Container) Pid() (int, error)

Pid returns the container's init PID. It will fail if the saved PID no longer belongs to the container.

func (*Container) ProcessState 

func (c *Container) ProcessState() (string, error)

ProcessState checks if a container's init PID exists and it's running without calling a given runtime directly to check the state, which is expensive, and additionally returns the current state of the init process as reported by the operating system.

func (*Container) RemoveManagedPIDNamespace 

func (c *Container) RemoveManagedPIDNamespace() error

func (*Container) RuntimePathForPlatform 

func (c *Container) RuntimePathForPlatform(r *runtimeOCI) string

RuntimePathForPlatform returns the runtime path for a given platform.

func (*Container) RuntimeUser 

func (c *Container) RuntimeUser() *types.ContainerUser

RuntimeUser returns the runtime user for the container.

func (*Container) Sandbox 

func (c *Container) Sandbox() string

Sandbox returns the sandbox name of the container.

func (*Container) SeccompProfilePath 

func (c *Container) SeccompProfilePath() string

SeccompProfilePath returns the seccomp profile path.

func (*Container) SetAsDoneStopping 

func (c *Container) SetAsDoneStopping()

func (*Container) SetAsStopping 

func (c *Container) SetAsStopping() (setToStopping bool)

SetAsStopping marks a container as being stopped. Returns true if the container was not set as stopping before, and false otherwise (i.e. on subsequent calls).".

func (*Container) SetCreated 

func (c *Container) SetCreated()

SetCreated sets the created flag to true once container is created.

func (*Container) SetMountPoint 

func (c *Container) SetMountPoint(mp string)

SetMountPoint sets the container mount point.

func (*Container) SetResources 

func (c *Container) SetResources(s *specs.Spec)

SetResources loads the OCI Spec.Linux.Resources in the container struct.

func (*Container) SetRuntimePathForPlatform 

func (c *Container) SetRuntimePathForPlatform(runtimePath string)

SetRuntimePathForPlatform sets the runtime path for a given platform.

func (*Container) SetRuntimeUser 

func (c *Container) SetRuntimeUser(runtimeSpec *specs.Spec)

SetRuntimeUser sets the runtime user for the container.

func (*Container) SetSandbox 

func (c *Container) SetSandbox(podSandboxID string)

SetSandbox sets the ID of the Sandbox.

func (*Container) SetSeccompProfilePath 

func (c *Container) SetSeccompProfilePath(pp string)

SetSeccompProfilePath sets the seccomp profile path.

func (*Container) SetSpec 

func (c *Container) SetSpec(s *specs.Spec)

SetSpec loads the OCI spec in the container struct.

func (*Container) SetStartFailed 

func (c *Container) SetStartFailed(err error)

SetStartFailed sets the container state appropriately after a start failure.

func (*Container) SomeNameOfTheImage 

func (c *Container) SomeNameOfTheImage() *storage.NameTag

SomeNameOfTheImage returns _some_ name of the image imageID, if any; it may have NO RELATIONSHIP to the users’ requested image name.

func (*Container) Spec 

func (c *Container) Spec() specs.Spec

Spec returns a copy of the spec for the container.

func (*Container) Spoofed 

func (c *Container) Spoofed() bool

Spoofed returns whether this container is spoofed. A container should be spoofed when it doesn't have to exist in the container runtime, but does need to exist in the storage. The main use of this is when an infra container is not needed, but sandbox metadata should be stored with a spoofed infra container.

func (*Container) State 

func (c *Container) State() *ContainerState

State returns the state of the running container.

func (*Container) StateNoLock 

func (c *Container) StateNoLock() *ContainerState

StateNoLock returns the state of a container without using a lock. It has been known to cause segfaults in the past so it really should be used sparingly.

func (*Container) StatePath 

func (c *Container) StatePath() string

StatePath returns the containers state.json path.

func (*Container) StdinOnce 

func (c *Container) StdinOnce() bool

StdinOnce returns whether stdin once is set for the container.

func (*Container) StopSignal 

func (c *Container) StopSignal() syscall.Signal

StopSignal returns the container's own stop signal configured from the image configuration or the default one.

func (*Container) UserRequestedImage 

func (c *Container) UserRequestedImage() string

UserRequestedImage returns the users' input originally used to find imageID; it might evaluate to a different image (or to a different kind of reference!) at any future time.

func (*Container) Volumes 

func (c *Container) Volumes() []ContainerVolume

Volumes returns the list of container volumes.

func (*Container) WaitOnStopTimeout 

func (c *Container) WaitOnStopTimeout(ctx context.Context, timeout int64)

type ContainerState 

type ContainerState struct {
	specs.State
	Created       time.Time `json:"created"`
	Started       time.Time `json:"started,omitempty"`
	Finished      time.Time `json:"finished,omitempty"`
	ExitCode      *int32    `json:"exitCode,omitempty"`
	OOMKilled     bool      `json:"oomKilled,omitempty"`
	SeccompKilled bool      `json:"seccompKilled,omitempty"`
	Error         string    `json:"error,omitempty"`
	InitPid       int       `json:"initPid,omitempty"`
	// The unix start time of the container's init PID.
	// This is used to track whether the PID we have stored
	// is the same as the corresponding PID on the host.
	InitStartTime string `json:"initStartTime,omitempty"`
}

ContainerState represents the status of a container.

func (*ContainerState) SetInitPid 

func (cstate *ContainerState) SetInitPid(pid int) error

SetInitPid initializes the InitPid and InitStartTime for the container state given a PID. These values should be set once, and not changed again.

type ContainerVolume 

type ContainerVolume struct {
	ContainerPath     string                 `json:"container_path"`
	HostPath          string                 `json:"host_path"`
	Readonly          bool                   `json:"readonly"`
	RecursiveReadOnly bool                   `json:"recursive_read_only"`
	Propagation       types.MountPropagation `json:"propagation"`
	SelinuxRelabel    bool                   `json:"selinux_relabel"`
	Image             *types.ImageSpec       `json:"image,omitempty"` // A possible image for OCI volume mounts
}

ContainerVolume is a bind mount for the container.

type ExecSyncError 

type ExecSyncError struct {
	Stdout   bytes.Buffer
	Stderr   bytes.Buffer
	ExitCode int32
	Err      error
}

ExecSyncError wraps command's streams, exit code and error on ExecSync error.

func (*ExecSyncError) Error 

func (e *ExecSyncError) Error() string

type Runtime 

type Runtime struct {
	// contains filtered or unexported fields
}

Runtime is the generic structure holding both global and specific information about the runtime.

func New 

func New(c *config.Config) (*Runtime, error)

New creates a new Runtime with options provided.

func (*Runtime) AllowedAnnotations 

func (r *Runtime) AllowedAnnotations(handler string) ([]string, error)

AllowedAnnotations returns the allowed annotations for this runtime.

func (*Runtime) AttachContainer 

func (r *Runtime) AttachContainer(ctx context.Context, c *Container, inputStream io.Reader, outputStream, errorStream io.WriteCloser, tty bool, resizeChan <-chan remotecommand.TerminalSize) error

AttachContainer attaches IO to a running container.

func (*Runtime) CheckpointContainer 

func (r *Runtime) CheckpointContainer(ctx context.Context, c *Container, specgen *rspec.Spec, leaveRunning bool) error

CheckpointContainer checkpoints a container.

func (*Runtime) ContainerStats 

func (r *Runtime) ContainerStats(ctx context.Context, c *Container, cgroup string) (*cgmgr.CgroupStats, error)

ContainerStats provides statistics of a container.

func (*Runtime) CreateContainer 

func (r *Runtime) CreateContainer(ctx context.Context, c *Container, cgroupParent string, restore bool) error

CreateContainer creates a container.

func (*Runtime) DeleteContainer 

func (r *Runtime) DeleteContainer(ctx context.Context, c *Container) (err error)

DeleteContainer deletes a container.

func (*Runtime) ExecContainer 

func (r *Runtime) ExecContainer(ctx context.Context, c *Container, cmd []string, stdin io.Reader, stdout, stderr io.WriteCloser, tty bool, resizeChan <-chan remotecommand.TerminalSize) error

ExecContainer prepares a streaming endpoint to execute a command in the container.

func (*Runtime) ExecSyncContainer 

func (r *Runtime) ExecSyncContainer(ctx context.Context, c *Container, command []string, timeout int64) (*types.ExecSyncResponse, error)

ExecSyncContainer execs a command in a container and returns it's stdout, stderr and return code.

func (*Runtime) GetContainerMinMemory 

func (r *Runtime) GetContainerMinMemory(runtimeHandler string) (int64, error)

GetContainerMinMemory returns the minimum memory for a container for a given runtime handler.

func (*Runtime) IsContainerAlive 

func (r *Runtime) IsContainerAlive(c *Container) (bool, error)

func (*Runtime) PauseContainer 

func (r *Runtime) PauseContainer(ctx context.Context, c *Container) error

PauseContainer pauses a container.

func (*Runtime) PlatformRuntimePath 

func (r *Runtime) PlatformRuntimePath(handler, platform string) (string, error)

PlatformRuntimePath returns the runtime path for a given platform.

func (*Runtime) PortForwardContainer 

func (r *Runtime) PortForwardContainer(ctx context.Context, c *Container, netNsPath string, port int32, stream io.ReadWriteCloser) error

PortForwardContainer forwards the specified port provides statistics of a container.

func (*Runtime) PrivilegedWithoutHostDevices 

func (r *Runtime) PrivilegedWithoutHostDevices(handler string) (bool, error)

PrivilegedWithoutHostDevices returns a boolean value configured for the runtimeHandler indicating if devices on the host are passed/not passed to a container running as privileged.

func (*Runtime) ReopenContainerLog 

func (r *Runtime) ReopenContainerLog(ctx context.Context, c *Container) error

ReopenContainerLog reopens the log file of a container.

func (*Runtime) RestoreContainer 

func (r *Runtime) RestoreContainer(ctx context.Context, c *Container, cgroupParent, mountLabel string) error

RestoreContainer restores a container.

func (*Runtime) RuntimeDefaultAnnotations 

func (r *Runtime) RuntimeDefaultAnnotations(runtimeHandler string) (map[string]string, error)

RuntimeDefaultAnnotations returns the default annotations for this runtime handler.

func (*Runtime) RuntimeImpl 

func (r *Runtime) RuntimeImpl(c *Container) (RuntimeImpl, error)

RuntimeImpl returns the runtime implementation for a given container.

func (*Runtime) RuntimeSupportsIDMap 

func (r *Runtime) RuntimeSupportsIDMap(runtimeHandler string) bool

RuntimeSupportsIDMap returns whether the runtime of runtimeHandler supports the "runtime features" command, and that the output of that command advertises IDMapped mounts as an option.

func (*Runtime) RuntimeSupportsRROMounts 

func (r *Runtime) RuntimeSupportsRROMounts(runtimeHandler string) bool

RuntimeSupportsRROMounts returns whether the runtime of runtimeHandler supports the "runtime features" command and that the output advertises support for the Recursive Read-only (RRO) mount as an option.

func (*Runtime) RuntimeType 

func (r *Runtime) RuntimeType(runtimeHandler string) (string, error)

RuntimeType returns the type of runtimeHandler This is needed when callers need to do specific work for oci vs vm containers, like monitor an oci container's conmon.

func (*Runtime) Runtimes 

func (r *Runtime) Runtimes() config.Runtimes

Runtimes returns the map of OCI runtimes.

func (*Runtime) SignalContainer 

func (r *Runtime) SignalContainer(ctx context.Context, c *Container, sig syscall.Signal) error

SignalContainer sends a signal to a container process.

func (*Runtime) StartContainer 

func (r *Runtime) StartContainer(ctx context.Context, c *Container) error

StartContainer starts a container.

func (*Runtime) StopContainer 

func (r *Runtime) StopContainer(ctx context.Context, c *Container, timeout int64) error

StopContainer stops a container. Timeout is given in seconds.

func (*Runtime) Timezone 

func (r *Runtime) Timezone() string

Timezone returns the timezone configured inside the container.

func (*Runtime) UnpauseContainer 

func (r *Runtime) UnpauseContainer(ctx context.Context, c *Container) error

UnpauseContainer unpauses a container.

func (*Runtime) UpdateContainer 

func (r *Runtime) UpdateContainer(ctx context.Context, c *Container, res *rspec.LinuxResources) error

UpdateContainer updates container resources.

func (*Runtime) UpdateContainerStatus 

func (r *Runtime) UpdateContainerStatus(ctx context.Context, c *Container) error

UpdateContainerStatus refreshes the status of the container.

func (*Runtime) ValidateRuntimeHandler 

func (r *Runtime) ValidateRuntimeHandler(handler string) (*config.RuntimeHandler, error)

ValidateRuntimeHandler returns an error if the runtime handler string provided does not match any valid use case.

type RuntimeImpl 

type RuntimeImpl interface {
	CreateContainer(context.Context, *Container, string, bool) error
	StartContainer(context.Context, *Container) error
	ExecContainer(context.Context, *Container, []string, io.Reader, io.WriteCloser, io.WriteCloser,
		bool, <-chan remotecommand.TerminalSize) error
	ExecSyncContainer(context.Context, *Container, []string, int64) (*types.ExecSyncResponse, error)
	UpdateContainer(context.Context, *Container, *rspec.LinuxResources) error
	StopContainer(context.Context, *Container, int64) error
	DeleteContainer(context.Context, *Container) error
	UpdateContainerStatus(context.Context, *Container) error
	PauseContainer(context.Context, *Container) error
	UnpauseContainer(context.Context, *Container) error
	ContainerStats(context.Context, *Container, string) (*cgmgr.CgroupStats, error)
	SignalContainer(context.Context, *Container, syscall.Signal) error
	AttachContainer(context.Context, *Container, io.Reader, io.WriteCloser, io.WriteCloser,
		bool, <-chan remotecommand.TerminalSize) error
	PortForwardContainer(context.Context, *Container, string,
		int32, io.ReadWriteCloser) error
	ReopenContainerLog(context.Context, *Container) error
	CheckpointContainer(context.Context, *Container, *rspec.Spec, bool) error
	RestoreContainer(context.Context, *Container, string, string) error
	IsContainerAlive(*Container) bool
}

RuntimeImpl is an interface used by the caller to interact with the container runtime. The purpose of this interface being to abstract implementations and their associated assumptions regarding the way to interact with containers. This will allow for new implementations of this interface, especially useful for the case of VM based container runtimes. Assumptions based on the fact that a container process runs on the host will be limited to the RuntimeOCI implementation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.