Skip to content

Commit f776141

Browse files
dmcgowandmcgowan
authored
Merge pull request #3424 from crosbymichael/devices
Add linux device options and --devices flag to ctr
2 parents 49fdb9e + 725d3ad commit f776141

6 files changed

Lines changed: 188 additions & 0 deletions

File tree

‎cmd/ctr/commands/commands.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ var (
126126
Name: "memory-limit",
127127
Usage: "memory limit (in bytes) for the container",
128128
},
129+
cli.StringSliceFlag{
130+
Name: "device",
131+
Usage: "add a device to a container",
132+
},
129133
}
130134
// ImageDecryptionFlags are cli flags needed when decrypting an image
131135
ImageDecryptionFlags = []cli.Flag{

‎cmd/ctr/commands/run/run_unix.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,9 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli
155155
if limit != 0 {
156156
opts = append(opts, oci.WithMemoryLimit(limit))
157157
}
158+
for _, dev := range context.StringSlice("device") {
159+
opts = append(opts, oci.WithLinuxDevice(dev, "rwm"))
160+
}
158161
}
159162

160163
cOpts = append(cOpts, containerd.WithRuntime(context.String("runtime"), nil))

‎oci/spec_opts.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,20 @@ func setLinux(s *Spec) {
7676
}
7777
}
7878

79+
// nolint
80+
func setResources(s *Spec) {
81+
if s.Linux != nil {
82+
if s.Linux.Resources == nil {
83+
s.Linux.Resources = &specs.LinuxResources{}
84+
}
85+
}
86+
if s.Windows != nil {
87+
if s.Windows.Resources == nil {
88+
s.Windows.Resources = &specs.WindowsResources{}
89+
}
90+
}
91+
}
92+
7993
// setCapabilities sets Linux Capabilities to empty if unset
8094
func setCapabilities(s *Spec) {
8195
setProcess(s)
@@ -1139,3 +1153,39 @@ func WithAnnotations(annotations map[string]string) SpecOpts {
11391153
return nil
11401154
}
11411155
}
1156+
1157+
// WithLinuxDevices adds the provided linux devices to the spec
1158+
func WithLinuxDevices(devices []specs.LinuxDevice) SpecOpts {
1159+
return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
1160+
setLinux(s)
1161+
s.Linux.Devices = append(s.Linux.Devices, devices...)
1162+
return nil
1163+
}
1164+
}
1165+
1166+
var ErrNotADevice = errors.New("not a device node")
1167+
1168+
// WithLinuxDevice adds the device specified by path to the spec
1169+
func WithLinuxDevice(path, permissions string) SpecOpts {
1170+
return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
1171+
setLinux(s)
1172+
setResources(s)
1173+
1174+
dev, err := deviceFromPath(path, permissions)
1175+
if err != nil {
1176+
return err
1177+
}
1178+
1179+
s.Linux.Devices = append(s.Linux.Devices, *dev)
1180+
1181+
s.Linux.Resources.Devices = append(s.Linux.Resources.Devices, specs.LinuxDeviceCgroup{
1182+
Type: dev.Type,
1183+
Allow: true,
1184+
Major: &dev.Major,
1185+
Minor: &dev.Minor,
1186+
Access: permissions,
1187+
})
1188+
1189+
return nil
1190+
}
1191+
}

‎oci/spec_opts_linux.go‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// +build linux
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package oci
20+
21+
import (
22+
"os"
23+
24+
specs "github.com/opencontainers/runtime-spec/specs-go"
25+
"golang.org/x/sys/unix"
26+
)
27+
28+
func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {
29+
var stat unix.Stat_t
30+
if err := unix.Lstat(path, &stat); err != nil {
31+
return nil, err
32+
}
33+
34+
var (
35+
devNumber = stat.Rdev
36+
major = unix.Major(devNumber)
37+
minor = unix.Minor(devNumber)
38+
)
39+
if major == 0 {
40+
return nil, ErrNotADevice
41+
}
42+
43+
var (
44+
devType string
45+
mode = stat.Mode
46+
)
47+
switch {
48+
case mode&unix.S_IFBLK == unix.S_IFBLK:
49+
devType = "b"
50+
case mode&unix.S_IFCHR == unix.S_IFCHR:
51+
devType = "c"
52+
}
53+
fm := os.FileMode(mode)
54+
return &specs.LinuxDevice{
55+
Type: devType,
56+
Path: path,
57+
Major: int64(major),
58+
Minor: int64(minor),
59+
FileMode: &fm,
60+
UID: &stat.Uid,
61+
GID: &stat.Gid,
62+
}, nil
63+
}

‎oci/spec_opts_unix.go‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// +build !linux,!windows
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package oci
20+
21+
import (
22+
"os"
23+
24+
specs "github.com/opencontainers/runtime-spec/specs-go"
25+
"golang.org/x/sys/unix"
26+
)
27+
28+
func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {
29+
var stat unix.Stat_t
30+
if err := unix.Lstat(path, &stat); err != nil {
31+
return nil, err
32+
}
33+
34+
var (
35+
devNumber = uint64(stat.Rdev)
36+
major = unix.Major(devNumber)
37+
minor = unix.Minor(devNumber)
38+
)
39+
if major == 0 {
40+
return nil, ErrNotADevice
41+
}
42+
43+
var (
44+
devType string
45+
mode = stat.Mode
46+
)
47+
switch {
48+
case mode&unix.S_IFBLK == unix.S_IFBLK:
49+
devType = "b"
50+
case mode&unix.S_IFCHR == unix.S_IFCHR:
51+
devType = "c"
52+
}
53+
fm := os.FileMode(mode)
54+
return &specs.LinuxDevice{
55+
Type: devType,
56+
Path: path,
57+
Major: int64(major),
58+
Minor: int64(minor),
59+
FileMode: &fm,
60+
UID: &stat.Uid,
61+
GID: &stat.Gid,
62+
}, nil
63+
}

‎oci/spec_opts_windows.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
"github.com/containerd/containerd/containers"
2525
specs "github.com/opencontainers/runtime-spec/specs-go"
26+
"github.com/pkg/errors"
2627
)
2728

2829
// WithWindowsCPUCount sets the `Windows.Resources.CPU.Count` section to the
@@ -65,3 +66,7 @@ func WithWindowNetworksAllowUnqualifiedDNSQuery() SpecOpts {
6566
return nil
6667
}
6768
}
69+
70+
func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {
71+
return nil, errors.New("device from path not supported on Windows")
72+
}

0 commit comments

Comments
 (0)