Skip to content

Commit 24f173a

Browse files
cpuguy83cpuguy83
committed
Replace service "Capabilities" w/ add/drop API
After dicussing with maintainers, it was decided putting the burden of providing the full cap list on the client is not a good design. Instead we decided to follow along with the container API and use cap add/drop. This brings in the changes already merged into swarmkit. Signed-off-by: Brian Goff <[email protected]>
1 parent baa3212 commit 24f173a

15 files changed

Lines changed: 86 additions & 230 deletions

File tree

‎api/server/router/container/container_routes.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -489,9 +489,6 @@ func (s *containerRouter) postContainersCreate(ctx context.Context, w http.Respo
489489
// Ignore KernelMemoryTCP because it was added in API 1.40.
490490
hostConfig.KernelMemoryTCP = 0
491491

492-
// Ignore Capabilities because it was added in API 1.40.
493-
hostConfig.Capabilities = nil
494-
495492
// Older clients (API < 1.40) expects the default to be shareable, make them happy
496493
if hostConfig.IpcMode.IsEmpty() {
497494
hostConfig.IpcMode = container.IpcMode("shareable")

‎api/server/router/swarm/helpers.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ func adjustForAPIVersion(cliVersion string, service *swarm.ServiceSpec) {
9999
if service.TaskTemplate.ContainerSpec != nil {
100100
// Capabilities for docker swarm services weren't
101101
// supported before API version 1.41
102-
service.TaskTemplate.ContainerSpec.Capabilities = nil
102+
service.TaskTemplate.ContainerSpec.CapabilityAdd = nil
103+
service.TaskTemplate.ContainerSpec.CapabilityDrop = nil
103104
}
104105
if service.TaskTemplate.Resources != nil && service.TaskTemplate.Resources.Limits != nil {
105106
// Limits.Pids not supported before API version 1.41

‎api/swagger.yaml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -906,15 +906,6 @@ definitions:
906906
$ref: "#/definitions/Mount"
907907

908908
# Applicable to UNIX platforms
909-
Capabilities:
910-
type: "array"
911-
description: |
912-
A list of kernel capabilities to be available for container (this
913-
overrides the default set).
914-
915-
Conflicts with options 'CapAdd' and 'CapDrop'"
916-
items:
917-
type: "string"
918909
CapAdd:
919910
type: "array"
920911
description: |
@@ -3276,18 +3267,27 @@ definitions:
32763267
additionalProperties:
32773268
type: "string"
32783269
# This option is not used by Windows containers
3279-
Capabilities:
3270+
CapabilityAdd:
32803271
type: "array"
32813272
description: |
3282-
A list of kernel capabilities to be available for container (this
3283-
overrides the default set).
3273+
A list of kernel capabilities to add to the default set
3274+
for the container.
32843275
items:
32853276
type: "string"
32863277
example:
32873278
- "CAP_NET_RAW"
32883279
- "CAP_SYS_ADMIN"
32893280
- "CAP_SYS_CHROOT"
32903281
- "CAP_SYSLOG"
3282+
CapabilityDrop:
3283+
type: "array"
3284+
description: |
3285+
A list of kernel capabilities to drop from the default set
3286+
for the container.
3287+
items:
3288+
type: "string"
3289+
example:
3290+
- "CAP_NET_RAW"
32913291
NetworkAttachmentSpec:
32923292
description: |
32933293
Read-only spec type for non-swarm containers attached to swarm overlay

‎api/types/container/host_config.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -403,7 +403,6 @@ type HostConfig struct {
403403
// Applicable to UNIX platforms
404404
CapAdd strslice.StrSlice // List of kernel capabilities to add to the container
405405
CapDrop strslice.StrSlice // List of kernel capabilities to remove from the container
406-
Capabilities []string `json:"Capabilities"` // List of kernel capabilities to be available for container (this overrides the default set)
407406
CgroupnsMode CgroupnsMode // Cgroup namespace mode to use for the container
408407
DNS []string `json:"Dns"` // List of DNS server to lookup
409408
DNSOptions []string `json:"DnsOptions"` // List of DNSOption to look for

‎api/types/swarm/container.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,12 @@ type ContainerSpec struct {
6767
// The format of extra hosts on swarmkit is specified in:
6868
// http://man7.org/linux/man-pages/man5/hosts.5.html
6969
// IP_address canonical_hostname [aliases...]
70-
Hosts []string `json:",omitempty"`
71-
DNSConfig *DNSConfig `json:",omitempty"`
72-
Secrets []*SecretReference `json:",omitempty"`
73-
Configs []*ConfigReference `json:",omitempty"`
74-
Isolation container.Isolation `json:",omitempty"`
75-
Sysctls map[string]string `json:",omitempty"`
76-
Capabilities []string `json:",omitempty"`
70+
Hosts []string `json:",omitempty"`
71+
DNSConfig *DNSConfig `json:",omitempty"`
72+
Secrets []*SecretReference `json:",omitempty"`
73+
Configs []*ConfigReference `json:",omitempty"`
74+
Isolation container.Isolation `json:",omitempty"`
75+
Sysctls map[string]string `json:",omitempty"`
76+
CapabilityAdd []string `json:",omitempty"`
77+
CapabilityDrop []string `json:",omitempty"`
7778
}

‎daemon/cluster/convert/container.go‎

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -18,26 +18,27 @@ func containerSpecFromGRPC(c *swarmapi.ContainerSpec) *types.ContainerSpec {
1818
return nil
1919
}
2020
containerSpec := &types.ContainerSpec{
21-
Image: c.Image,
22-
Labels: c.Labels,
23-
Command: c.Command,
24-
Args: c.Args,
25-
Hostname: c.Hostname,
26-
Env: c.Env,
27-
Dir: c.Dir,
28-
User: c.User,
29-
Groups: c.Groups,
30-
StopSignal: c.StopSignal,
31-
TTY: c.TTY,
32-
OpenStdin: c.OpenStdin,
33-
ReadOnly: c.ReadOnly,
34-
Hosts: c.Hosts,
35-
Secrets: secretReferencesFromGRPC(c.Secrets),
36-
Configs: configReferencesFromGRPC(c.Configs),
37-
Isolation: IsolationFromGRPC(c.Isolation),
38-
Init: initFromGRPC(c.Init),
39-
Sysctls: c.Sysctls,
40-
Capabilities: c.Capabilities,
21+
Image: c.Image,
22+
Labels: c.Labels,
23+
Command: c.Command,
24+
Args: c.Args,
25+
Hostname: c.Hostname,
26+
Env: c.Env,
27+
Dir: c.Dir,
28+
User: c.User,
29+
Groups: c.Groups,
30+
StopSignal: c.StopSignal,
31+
TTY: c.TTY,
32+
OpenStdin: c.OpenStdin,
33+
ReadOnly: c.ReadOnly,
34+
Hosts: c.Hosts,
35+
Secrets: secretReferencesFromGRPC(c.Secrets),
36+
Configs: configReferencesFromGRPC(c.Configs),
37+
Isolation: IsolationFromGRPC(c.Isolation),
38+
Init: initFromGRPC(c.Init),
39+
Sysctls: c.Sysctls,
40+
CapabilityAdd: c.CapabilityAdd,
41+
CapabilityDrop: c.CapabilityDrop,
4142
}
4243

4344
if c.DNSConfig != nil {
@@ -246,25 +247,26 @@ func configReferencesFromGRPC(sr []*swarmapi.ConfigReference) []*types.ConfigRef
246247

247248
func containerToGRPC(c *types.ContainerSpec) (*swarmapi.ContainerSpec, error) {
248249
containerSpec := &swarmapi.ContainerSpec{
249-
Image: c.Image,
250-
Labels: c.Labels,
251-
Command: c.Command,
252-
Args: c.Args,
253-
Hostname: c.Hostname,
254-
Env: c.Env,
255-
Dir: c.Dir,
256-
User: c.User,
257-
Groups: c.Groups,
258-
StopSignal: c.StopSignal,
259-
TTY: c.TTY,
260-
OpenStdin: c.OpenStdin,
261-
ReadOnly: c.ReadOnly,
262-
Hosts: c.Hosts,
263-
Secrets: secretReferencesToGRPC(c.Secrets),
264-
Isolation: isolationToGRPC(c.Isolation),
265-
Init: initToGRPC(c.Init),
266-
Sysctls: c.Sysctls,
267-
Capabilities: c.Capabilities,
250+
Image: c.Image,
251+
Labels: c.Labels,
252+
Command: c.Command,
253+
Args: c.Args,
254+
Hostname: c.Hostname,
255+
Env: c.Env,
256+
Dir: c.Dir,
257+
User: c.User,
258+
Groups: c.Groups,
259+
StopSignal: c.StopSignal,
260+
TTY: c.TTY,
261+
OpenStdin: c.OpenStdin,
262+
ReadOnly: c.ReadOnly,
263+
Hosts: c.Hosts,
264+
Secrets: secretReferencesToGRPC(c.Secrets),
265+
Isolation: isolationToGRPC(c.Isolation),
266+
Init: initToGRPC(c.Init),
267+
Sysctls: c.Sysctls,
268+
CapabilityAdd: c.CapabilityAdd,
269+
CapabilityDrop: c.CapabilityDrop,
268270
}
269271

270272
if c.DNSConfig != nil {

‎daemon/cluster/executor/container/container.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,8 @@ func (c *containerConfig) hostConfig() *enginecontainer.HostConfig {
360360
Isolation: c.isolation(),
361361
Init: c.init(),
362362
Sysctls: c.spec().Sysctls,
363-
Capabilities: c.spec().Capabilities,
363+
CapAdd: c.spec().CapabilityAdd,
364+
CapDrop: c.spec().CapabilityDrop,
364365
}
365366

366367
if c.spec().DNSConfig != nil {

‎daemon/container.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -305,21 +305,12 @@ func validateHostConfig(hostConfig *containertypes.HostConfig, platform string)
305305
}
306306

307307
func validateCapabilities(hostConfig *containertypes.HostConfig) error {
308-
if len(hostConfig.CapAdd) > 0 && hostConfig.Capabilities != nil {
309-
return errdefs.InvalidParameter(errors.Errorf("conflicting options: Capabilities and CapAdd"))
310-
}
311-
if len(hostConfig.CapDrop) > 0 && hostConfig.Capabilities != nil {
312-
return errdefs.InvalidParameter(errors.Errorf("conflicting options: Capabilities and CapDrop"))
313-
}
314308
if _, err := caps.NormalizeLegacyCapabilities(hostConfig.CapAdd); err != nil {
315309
return errors.Wrap(err, "invalid CapAdd")
316310
}
317311
if _, err := caps.NormalizeLegacyCapabilities(hostConfig.CapDrop); err != nil {
318312
return errors.Wrap(err, "invalid CapDrop")
319313
}
320-
if err := caps.ValidateCapabilities(hostConfig.Capabilities); err != nil {
321-
return errors.Wrap(err, "invalid Capabilities")
322-
}
323314
// TODO consider returning warnings if "Privileged" is combined with Capabilities, CapAdd and/or CapDrop
324315
return nil
325316
}

‎daemon/oci_linux.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,6 @@ func WithCapabilities(c *container.Container) coci.SpecOpts {
162162
caps.DefaultCapabilities(),
163163
c.HostConfig.CapAdd,
164164
c.HostConfig.CapDrop,
165-
c.HostConfig.Capabilities,
166165
c.HostConfig.Privileged,
167166
)
168167
if err != nil {

‎daemon/oci_windows.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,7 @@ func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spe
390390
// Note these are against the UVM.
391391
setResourcesInSpec(c, s, true) // LCOW is Hyper-V only
392392

393-
capabilities, err := caps.TweakCapabilities(caps.DefaultCapabilities(), c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Capabilities, c.HostConfig.Privileged)
393+
capabilities, err := caps.TweakCapabilities(caps.DefaultCapabilities(), c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Privileged)
394394
if err != nil {
395395
return fmt.Errorf("linux spec capabilities: %v", err)
396396
}

0 commit comments

Comments
 (0)