// Package daemon exposes the functions that occur on the host server

// that the Docker daemon is running.

//

// In implementing the various functions of the daemon, there is often

// a method-specific struct for configuring the runtime behavior.

package daemon

import (

"context"

"crypto/sha256"

"encoding/binary"

"fmt"

"maps"

"net"

"net/netip"

"os"

"path"

"path/filepath"

"runtime"

"slices"

"sync"

"sync/atomic"

"time"

containerd "github.com/containerd/containerd/v2/client"

"github.com/containerd/containerd/v2/defaults"

"github.com/containerd/containerd/v2/pkg/dialer"

cerrdefs "github.com/containerd/errdefs"

"github.com/containerd/log"

"github.com/distribution/reference"

dist "github.com/docker/distribution"

"github.com/docker/go-units"

"github.com/moby/buildkit/util/grpcerrors"

"github.com/moby/buildkit/util/tracing"

"github.com/moby/locker"

containertypes "github.com/moby/moby/api/types/container"

networktypes "github.com/moby/moby/api/types/network"

registrytypes "github.com/moby/moby/api/types/registry"

"github.com/moby/moby/api/types/swarm"

"github.com/moby/moby/v2/daemon/internal/nri"

"github.com/moby/sys/user"

"github.com/moby/sys/userns"

"github.com/pkg/errors"

bolt "go.etcd.io/bbolt"

"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"

"go.opentelemetry.io/otel"

"golang.org/x/sync/semaphore"

"google.golang.org/grpc"

"google.golang.org/grpc/backoff"

"google.golang.org/grpc/credentials/insecure"

"resenje.org/singleflight"

"tags.cncf.io/container-device-interface/pkg/cdi"

"github.com/moby/moby/v2/daemon/builder"

executorpkg "github.com/moby/moby/v2/daemon/cluster/executor"

"github.com/moby/moby/v2/daemon/config"

"github.com/moby/moby/v2/daemon/container"

ctrd "github.com/moby/moby/v2/daemon/containerd"

"github.com/moby/moby/v2/daemon/containerd/migration"

"github.com/moby/moby/v2/daemon/events"

_ "github.com/moby/moby/v2/daemon/graphdriver/register" // register graph drivers

"github.com/moby/moby/v2/daemon/images"

"github.com/moby/moby/v2/daemon/internal/distribution"

dmetadata "github.com/moby/moby/v2/daemon/internal/distribution/metadata"

"github.com/moby/moby/v2/daemon/internal/idtools"

"github.com/moby/moby/v2/daemon/internal/image"

"github.com/moby/moby/v2/daemon/internal/layer"

"github.com/moby/moby/v2/daemon/internal/libcontainerd"

libcontainerdtypes "github.com/moby/moby/v2/daemon/internal/libcontainerd/types"

"github.com/moby/moby/v2/daemon/internal/metrics"

pluginexec "github.com/moby/moby/v2/daemon/internal/plugin/executor/containerd"

refstore "github.com/moby/moby/v2/daemon/internal/refstore"

"github.com/moby/moby/v2/daemon/libnetwork"

"github.com/moby/moby/v2/daemon/libnetwork/cluster"

nwconfig "github.com/moby/moby/v2/daemon/libnetwork/config"

"github.com/moby/moby/v2/daemon/libnetwork/ipamutils"

"github.com/moby/moby/v2/daemon/libnetwork/ipbits"

dlogger "github.com/moby/moby/v2/daemon/logger"

"github.com/moby/moby/v2/daemon/network"

"github.com/moby/moby/v2/daemon/pkg/plugin"

"github.com/moby/moby/v2/daemon/pkg/registry"

"github.com/moby/moby/v2/daemon/server/backend"

"github.com/moby/moby/v2/daemon/snapshotter"

"github.com/moby/moby/v2/daemon/stats"

volumesservice "github.com/moby/moby/v2/daemon/volume/service"

"github.com/moby/moby/v2/dockerversion"

"github.com/moby/moby/v2/pkg/authorization"

"github.com/moby/moby/v2/pkg/plugingetter"

"github.com/moby/moby/v2/pkg/sysinfo"

)

type configStore struct {

config.Config

Runtimes runtimes

}

// Daemon holds information about the Docker daemon.

type Daemon struct {

id string

repository string

containers container.Store

containersReplica *container.ViewDB

execCommands *container.ExecStore

imageService ImageService

configStore atomic.Pointer[configStore]

configReload sync.Mutex

statsCollector *stats.Collector

defaultLogConfig containertypes.LogConfig

registryService *registry.Service

EventsService *events.Events

netController *libnetwork.Controller

volumes *volumesservice.VolumesService

root string

sysInfoOnce sync.Once

sysInfo *sysinfo.SysInfo

shutdown bool

idMapping user.IdentityMapping

PluginStore *plugin.Store // TODO: remove

nri *nri.NRI

pluginManager *plugin.Manager

linkIndex *linkIndex

containerdClient *containerd.Client

containerd libcontainerdtypes.Client

defaultIsolation containertypes.Isolation // Default isolation mode on Windows

clusterProvider cluster.Provider

cluster Cluster

genericResources []swarm.GenericResource

ReferenceStore refstore.Store

machineMemory uint64

seccompProfile []byte

seccompProfilePath string

usageContainers singleflight.Group[bool, *backend.ContainerDiskUsage]

usageImages singleflight.Group[bool, *backend.ImageDiskUsage]

usageVolumes singleflight.Group[bool, *backend.VolumeDiskUsage]

usageLayer singleflight.Group[struct{}, int64]

pruneRunning atomic.Bool

hosts map[string]bool // hosts stores the addresses the daemon is listening on

startupDone chan struct{}

attachmentStore network.AttachmentStore

attachableNetworkLock *locker.Locker

// This is used for Windows which doesn't currently support running on containerd

// It stores metadata for the content store (used for manifest caching)

// This needs to be closed on daemon exit

mdDB *bolt.DB

usesSnapshotter bool

CDICache *cdi.Cache

}

// ID returns the daemon id

func (daemon *Daemon) ID() string {

return daemon.id

}

// StoreHosts stores the addresses the daemon is listening on

func (daemon *Daemon) StoreHosts(hosts []string) {

if daemon.hosts == nil {

daemon.hosts = make(map[string]bool)

}

for _, h := range hosts {

daemon.hosts[h] = true

}

}

// config returns an immutable snapshot of the current daemon configuration.

// Multiple calls to this function will return the same pointer until the

// configuration is reloaded so callers must take care not to modify the

// returned value.

//

// To ensure that the configuration used remains consistent throughout the

// lifetime of an operation, the configuration pointer should be passed down the

// call stack, like one would a [context.Context] value. Only the entrypoints

// for operations, the outermost functions, should call this function.

func (daemon *Daemon) config() *configStore {

cfg := daemon.configStore.Load()

if cfg == nil {

return &configStore{}

}

return cfg

}

// Config returns daemon's config.

func (daemon *Daemon) Config() config.Config {

return daemon.config().Config

}

// HasExperimental returns whether the experimental features of the daemon are enabled or not

func (daemon *Daemon) HasExperimental() bool {

return daemon.config().Experimental

}

// Features returns the features map from configStore

func (daemon *Daemon) Features() map[string]bool {

return daemon.config().Features

}

// UsesSnapshotter returns true if feature flag to use containerd snapshotter is enabled

func (daemon *Daemon) UsesSnapshotter() bool {

return daemon.usesSnapshotter

}

// DefaultIsolation returns the default isolation mode for the daemon to run in (only applicable on Windows).

func (daemon *Daemon) DefaultIsolation() containertypes.Isolation {

return daemon.defaultIsolation

}

func (daemon *Daemon) loadContainers(ctx context.Context) (map[string]map[string]*container.Container, error) {

var mapLock sync.Mutex

driverContainers := make(map[string]map[string]*container.Container)

log.G(ctx).Info("Loading containers: start.")

dir, err := os.ReadDir(daemon.repository)

if err != nil {

return nil, err

}

// parallelLimit is the maximum number of parallel startup jobs that we

// allow (this is the limited used for all startup semaphores). The multiplier

// (128) was chosen after some fairly significant benchmarking -- don't change

// it unless you've tested it significantly (this value is adjusted if

// RLIMIT_NOFILE is small to avoid EMFILE).

parallelLimit := adjustParallelLimit(len(dir), 128*runtime.NumCPU())

// Re-used for all parallel startup jobs.

var group sync.WaitGroup

sem := semaphore.NewWeighted(int64(parallelLimit))

for _, v := range dir {

group.Add(1)

go func(id string) {

defer group.Done()

_ = sem.Acquire(context.Background(), 1)

defer sem.Release(1)

logger := log.G(ctx).WithField("container", id)

c, err := daemon.load(id)

if err != nil {

logger.WithError(err).Error("failed to load container")

return

}

mapLock.Lock()

if containers, ok := driverContainers[c.Driver]; !ok {

driverContainers[c.Driver] = map[string]*container.Container{

c.ID: c,

}

} else {

containers[c.ID] = c

}

mapLock.Unlock()

}(v.Name())

}

group.Wait()

return driverContainers, nil

}

func (daemon *Daemon) restore(ctx context.Context, cfg *configStore, containers map[string]*container.Container) error {

var mapLock sync.Mutex

log.G(ctx).Info("Restoring containers: start.")

// parallelLimit is the maximum number of parallel startup jobs that we

// allow (this is the limited used for all startup semaphores). The multipler

// (128) was chosen after some fairly significant benchmarking -- don't change

// it unless you've tested it significantly (this value is adjusted if

// RLIMIT_NOFILE is small to avoid EMFILE).

parallelLimit := adjustParallelLimit(len(containers), 128*runtime.NumCPU())

// Re-used for all parallel startup jobs.

var group sync.WaitGroup

sem := semaphore.NewWeighted(int64(parallelLimit))

removeContainers := make(map[string]*container.Container)

restartContainers := make(map[*container.Container]chan struct{})

activeSandboxes := make(map[string]any)

for _, c := range containers {

group.Add(1)

go func(c *container.Container) {

defer group.Done()

_ = sem.Acquire(context.Background(), 1)

defer sem.Release(1)

logger := log.G(ctx).WithField("container", c.ID)

rwlayer, err := daemon.imageService.GetLayerByID(c.ID)

if err != nil {

logger.WithError(err).Error("failed to load container mount")

return

}

c.RWLayer = rwlayer

logger.WithFields(log.Fields{

"running": c.State.IsRunning(),

"paused": c.State.IsPaused(),

}).Debug("loaded container")

if err := daemon.registerName(c); err != nil {

log.G(ctx).WithError(err).Errorf("failed to register container name: %s", c.Name)

mapLock.Lock()

delete(containers, c.ID)

mapLock.Unlock()

return

}

if err := daemon.register(context.TODO(), c); err != nil {

log.G(ctx).WithError(err).Error("failed to register container")

mapLock.Lock()

delete(containers, c.ID)

mapLock.Unlock()

return

}

}(c)

}

group.Wait()

for _, c := range containers {

group.Add(1)

go func(c *container.Container) {

defer group.Done()

_ = sem.Acquire(context.Background(), 1)

defer sem.Release(1)

baseLogger := log.G(ctx).WithField("container", c.ID)

// Fill in missing platform information with platform from image for older containers

// Remove this in a future release

if c.ImagePlatform.Architecture == "" {

migration := daemonPlatformReader{

imageService: daemon.imageService,

}

if daemon.containerdClient != nil {

migration.content = daemon.containerdClient.ContentStore()

}

migrateContainerOS(ctx, migration, c)

}

if c.HostConfig != nil {

// Migrate containers that don't have the default ("no") restart-policy set.

// The RestartPolicy.Name field may be empty for containers that were

// created with versions before v25.0.0.

//

// We also need to set the MaximumRetryCount to 0, to prevent

// validation from failing (MaximumRetryCount is not allowed if

// no restart-policy ("none") is set).

if c.HostConfig.RestartPolicy.Name == "" {

baseLogger.Debug("migrated restart-policy")

c.HostConfig.RestartPolicy.Name = containertypes.RestartPolicyDisabled

c.HostConfig.RestartPolicy.MaximumRetryCount = 0

}

// Normalize the "default" network mode into the network mode

// it aliases ("bridge on Linux and "nat" on Windows). This is

// also done by the container router, for new containers. But

// we need to do it here too to handle containers that were

// created prior to v26.0.

//

// TODO(aker): remove this migration code once the next LTM version of MCR is released.

if c.HostConfig.NetworkMode.IsDefault() {

c.HostConfig.NetworkMode = network.DefaultNetwork

if nw, ok := c.NetworkSettings.Networks[networktypes.NetworkDefault]; ok {

c.NetworkSettings.Networks[c.HostConfig.NetworkMode.NetworkName()] = nw

delete(c.NetworkSettings.Networks, networktypes.NetworkDefault)

}

}

// The logger option 'fluentd-async-connect' has been

// deprecated in v20.10 in favor of 'fluentd-async', and

// removed in v28.0.

// TODO(aker): remove this migration once the next LTS version of MCR is released.

if v, ok := c.HostConfig.LogConfig.Config["fluentd-async-connect"]; ok {

if _, ok := c.HostConfig.LogConfig.Config["fluentd-async"]; !ok {

c.HostConfig.LogConfig.Config["fluentd-async"] = v

}

delete(c.HostConfig.LogConfig.Config, "fluentd-async-connect")

}

}

if err := daemon.checkpointAndSave(c); err != nil {

baseLogger.WithError(err).Error("failed to save migrated container config to disk")

}

daemon.setStateCounter(c)

logger := func(c *container.Container) *log.Entry {

return baseLogger.WithFields(log.Fields{

"running": c.State.IsRunning(),

"paused": c.State.IsPaused(),

"restarting": c.State.IsRestarting(),

})

}

logger(c).Debug("restoring container")

var es *containerd.ExitStatus

if err := c.RestoreTask(context.Background(), daemon.containerd); err != nil && !cerrdefs.IsNotFound(err) {

logger(c).WithError(err).Error("failed to restore container with containerd")

return

}

alive := false

status := containerd.Unknown

if tsk, ok := c.State.Task(); ok {

s, err := tsk.Status(context.Background())

if err != nil {

logger(c).WithError(err).Error("failed to get task status")

} else {

status = s.Status

alive = status != containerd.Stopped

if !alive {

logger(c).Debug("cleaning up dead container process")

es, err = tsk.Delete(context.Background())

if err != nil && !cerrdefs.IsNotFound(err) {

logger(c).WithError(err).Error("failed to delete task from containerd")

return

}

} else if !cfg.LiveRestoreEnabled {

logger(c).Debug("shutting down container considered alive by containerd")

if err := daemon.shutdownContainer(c); err != nil && !cerrdefs.IsNotFound(err) {

baseLogger.WithError(err).Error("error shutting down container")

return

}

status = containerd.Stopped

alive = false

c.ResetRestartManager(false)

}

}

}

// If the containerd task for the container was not found, docker's view of the

// container state will be updated accordingly via SetStopped further down.

if c.State.IsRunning() || c.State.IsPaused() {

logger(c).Debug("syncing container on disk state with real state")

c.RestartManager().Cancel() // manually start containers because some need to wait for swarm networking

switch {

case c.State.IsPaused() && alive:

logger(c).WithField("state", status).Info("restored container paused")

switch status {

case containerd.Paused, containerd.Pausing:

// nothing to do

case containerd.Unknown, containerd.Stopped, "":

baseLogger.WithField("status", status).Error("unexpected status for paused container during restore")

default:

// running

c.Lock()

c.State.Paused = false

daemon.setStateCounter(c)

daemon.initHealthMonitor(c)

if err := c.CheckpointTo(context.TODO(), daemon.containersReplica); err != nil {

baseLogger.WithError(err).Error("failed to update paused container state")

}

c.Unlock()

}

case !c.State.IsPaused() && alive:

logger(c).Debug("restoring healthcheck")

c.Lock()

daemon.initHealthMonitor(c)

c.Unlock()

}

if !alive {

logger(c).Debug("setting stopped state")

c.Lock()

var ces container.ExitStatus

if es != nil {

ces.ExitCode = int(es.ExitCode())

ces.ExitedAt = es.ExitTime()

} else {

ces.ExitCode = 255

}

c.State.SetStopped(&ces)

daemon.Cleanup(context.TODO(), c)

if err := c.CheckpointTo(context.TODO(), daemon.containersReplica); err != nil {

baseLogger.WithError(err).Error("failed to update stopped container state")

}

c.Unlock()

logger(c).Debug("set stopped state")

}

// we call Mount and then Unmount to get BaseFs of the container

if err := daemon.Mount(c); err != nil {

// The mount is unlikely to fail. However, in case mount fails

// the container should be allowed to restore here. Some functionalities

// (like docker exec -u user) might be missing but container is able to be

// stopped/restarted/removed.

// See #29365 for related information.

// The error is only logged here.

logger(c).WithError(err).Warn("failed to mount container to get BaseFs path")

} else {

if err := daemon.Unmount(c); err != nil {

logger(c).WithError(err).Warn("failed to umount container to get BaseFs path")

}

}

c.ResetRestartManager(false)

if !c.HostConfig.NetworkMode.IsContainer() && c.State.IsRunning() {

options, err := buildSandboxOptions(&cfg.Config, c)

if err != nil {

logger(c).WithError(err).Warn("failed to build sandbox option to restore container")

}

mapLock.Lock()

activeSandboxes[c.NetworkSettings.SandboxID] = options

mapLock.Unlock()

}

}

// get list of containers we need to restart

// Do not autostart containers which

// has endpoints in a swarm scope

// network yet since the cluster is

// not initialized yet. We will start

// it after the cluster is

// initialized.

if cfg.AutoRestart && c.ShouldRestart() && !c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

mapLock.Lock()

restartContainers[c] = make(chan struct{})

mapLock.Unlock()

} else if c.HostConfig != nil && c.HostConfig.AutoRemove {

// Remove the container if live-restore is disabled or if the container has already exited.

if !cfg.LiveRestoreEnabled || !alive {

mapLock.Lock()

removeContainers[c.ID] = c

mapLock.Unlock()

}

}

c.Lock()

// TODO(thaJeztah): we no longer persist RemovalInProgress on disk, so this code is likely redundant; see https://github.com/moby/moby/pull/49968

if c.State.RemovalInProgress {

// We probably crashed in the middle of a removal, reset

// the flag.

//

// We DO NOT remove the container here as we do not

// know if the user had requested for either the

// associated volumes, network links or both to also

// be removed. So we put the container in the "dead"

// state and leave further processing up to them.

c.State.RemovalInProgress = false

c.State.Dead = true

if err := c.CheckpointTo(context.TODO(), daemon.containersReplica); err != nil {

baseLogger.WithError(err).Error("failed to update RemovalInProgress container state")

} else {

baseLogger.Debugf("reset RemovalInProgress state for container")

}

}

c.Unlock()

logger(c).Debug("done restoring container")

}(c)

}

group.Wait()

// Initialize the network controller and configure network settings.

//

// Note that we cannot initialize the network controller earlier, as it

// needs to know if there's active sandboxes (running containers).

if err := daemon.initNetworkController(&cfg.Config, activeSandboxes); err != nil {

return fmt.Errorf("Error initializing network controller: %v", err)

}

for _, c := range containers {

sb, err := daemon.netController.SandboxByID(c.NetworkSettings.SandboxID)

if err != nil {

// If this container's sandbox doesn't exist anymore, that's because

// the netController gc'ed it during its initialization. In that case,

// we need to clear all the network-related state carried by that

// container.

daemon.releaseNetwork(context.WithoutCancel(context.TODO()), c)

continue

}

// If port-mapping failed during live-restore of a container, perhaps because

// a host port that was previously mapped to a container is now in-use by some

// other process - ports will not be mapped for the restored container, but it

// will be running. Replace the restored mappings in NetworkSettings with the

// current state so that the problem is visible in 'inspect'.

c.NetworkSettings.Ports = getPortMapInfo(sb)

}

// Now that all the containers are registered, register the links

for _, c := range containers {

group.Add(1)

go func(c *container.Container) {

_ = sem.Acquire(context.Background(), 1)

if err := daemon.registerLinks(c); err != nil {

log.G(ctx).WithField("container", c.ID).WithError(err).Error("failed to register link for container")

}

sem.Release(1)

group.Done()

}(c)

}

group.Wait()

for c, notifyChan := range restartContainers {

group.Add(1)

go func(c *container.Container, chNotify chan struct{}) {

_ = sem.Acquire(context.Background(), 1)

logger := log.G(ctx).WithField("container", c.ID)

logger.Debug("starting container")

// ignore errors here as this is a best effort to wait for children

// (legacy links or container network) to be running before we try to start the container

if children := daemon.GetDependentContainers(c); len(children) > 0 {

timeout := time.NewTimer(5 * time.Second)

defer timeout.Stop()

for _, child := range children {

if notifier, exists := restartContainers[child]; exists {

select {

case <-notifier:

case <-timeout.C:

}

}

}

}

if err := daemon.prepareMountPoints(c); err != nil {

logger.WithError(err).Error("failed to prepare mount points for container")

}

if err := daemon.containerStart(context.Background(), cfg, c, "", "", true); err != nil {

logger.WithError(err).Error("failed to start container")

}

close(chNotify)

sem.Release(1)

group.Done()

}(c, notifyChan)

}

group.Wait()

for id := range removeContainers {

group.Add(1)

go func(cid string) {

_ = sem.Acquire(context.Background(), 1)

if err := daemon.containerRm(&cfg.Config, cid, &backend.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {

log.G(ctx).WithField("container", cid).WithError(err).Error("failed to remove container")

}

sem.Release(1)

group.Done()

}(id)

}

group.Wait()

// any containers that were started above would already have had this done,

// however we need to now prepare the mountpoints for the rest of the containers as well.

// This shouldn't cause any issue running on the containers that already had this run.

// This must be run after any containers with a restart policy so that containerized plugins

// can have a chance to be running before we try to initialize them.

for _, c := range containers {

// if the container has restart policy, do not

// prepare the mountpoints since it has been done on restarting.

// This is to speed up the daemon start when a restart container

// has a volume and the volume driver is not available.

if _, ok := restartContainers[c]; ok {

continue

} else if _, ok := removeContainers[c.ID]; ok {

// container is automatically removed, skip it.

continue

}

group.Add(1)

go func(c *container.Container) {

_ = sem.Acquire(context.Background(), 1)

if err := daemon.prepareMountPoints(c); err != nil {

log.G(ctx).WithField("container", c.ID).WithError(err).Error("failed to prepare mountpoints for container")

}

sem.Release(1)

group.Done()

}(c)

}

group.Wait()

log.G(ctx).Info("Loading containers: done.")

return nil

}

// RestartSwarmContainers restarts any autostart container which has a

// swarm endpoint.

func (daemon *Daemon) RestartSwarmContainers() {

daemon.restartSwarmContainers(context.Background(), daemon.config())

}

func (daemon *Daemon) restartSwarmContainers(ctx context.Context, cfg *configStore) {

// parallelLimit is the maximum number of parallel startup jobs that we

// allow (this is the limited used for all startup semaphores). The multiplier

// (128) was chosen after some fairly significant benchmarking -- don't change

// it unless you've tested it significantly (this value is adjusted if

// RLIMIT_NOFILE is small to avoid EMFILE).

parallelLimit := adjustParallelLimit(len(daemon.List()), 128*runtime.NumCPU())

var group sync.WaitGroup

sem := semaphore.NewWeighted(int64(parallelLimit))

for _, c := range daemon.List() {

if !c.State.IsRunning() && !c.State.IsPaused() {

// Autostart all the containers which has a

// swarm endpoint now that the cluster is

// initialized.

if cfg.AutoRestart && c.ShouldRestart() && c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

group.Add(1)

go func(c *container.Container) {

if err := sem.Acquire(ctx, 1); err != nil {

// ctx is done.

group.Done()

return

}

if err := daemon.containerStart(ctx, cfg, c, "", "", true); err != nil {

log.G(ctx).WithField("container", c.ID).WithError(err).Error("failed to start swarm container")

}

sem.Release(1)

group.Done()

}(c)

}

}

}

group.Wait()

}

func (daemon *Daemon) registerLink(parent, child *container.Container, alias string) error {

fullName := path.Join(parent.Name, alias)

if err := daemon.containersReplica.ReserveName(fullName, child.ID); err != nil {

if cerrdefs.IsConflict(err) {

log.G(context.TODO()).Warnf("error registering link for %s, to %s, as alias %s, ignoring: %v", parent.ID, child.ID, alias, err)

return nil

}

return err

}

daemon.linkIndex.link(parent, child, fullName)

return nil

}

// DaemonJoinsCluster informs the daemon has joined the cluster and provides

// the handler to query the cluster component

func (daemon *Daemon) DaemonJoinsCluster(clusterProvider cluster.Provider) {

daemon.setClusterProvider(clusterProvider)

}

// DaemonLeavesCluster informs the daemon has left the cluster

func (daemon *Daemon) DaemonLeavesCluster() {

// Daemon is in charge of removing the attachable networks with

// connected containers when the node leaves the swarm

daemon.clearAttachableNetworks()

// We no longer need the cluster provider, stop it now so that

// the network agent will stop listening to cluster events.

daemon.setClusterProvider(nil)

// Wait for the networking cluster agent to stop

daemon.netController.AgentStopWait()

// Daemon is in charge of removing the ingress network when the

// node leaves the swarm. Wait for job to be done or timeout.

// This is called also on graceful daemon shutdown. We need to

// wait, because the ingress release has to happen before the

// network controller is stopped.

if done, err := daemon.ReleaseIngress(); err == nil {

timeout := time.NewTimer(5 * time.Second)

defer timeout.Stop()

select {

case <-done:

case <-timeout.C:

log.G(context.TODO()).Warn("timeout while waiting for ingress network removal")

}

} else {

log.G(context.TODO()).Warnf("failed to initiate ingress network removal: %v", err)

}

daemon.attachmentStore.ClearAttachments()

}

// setClusterProvider sets a component for querying the current cluster state.

func (daemon *Daemon) setClusterProvider(clusterProvider cluster.Provider) {

daemon.clusterProvider = clusterProvider

daemon.netController.SetClusterProvider(clusterProvider)

daemon.attachableNetworkLock = locker.New()

}

// IsSwarmCompatible verifies if the current daemon

// configuration is compatible with the swarm mode

func (daemon *Daemon) IsSwarmCompatible() error {

return daemon.config().IsSwarmCompatible()

}

// NewDaemon sets up everything for the daemon to be able to service

// requests from the webserver.

func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.Store, authzMiddleware *authorization.Middleware) (_ *Daemon, retErr error) {

// Verify platform-specific requirements.

// TODO(thaJeztah): this should be called before we try to create the daemon; perhaps together with the config validation.

if err := checkSystem(); err != nil {

return nil, err

}

registryService, err := registry.NewService(config.ServiceOptions)

if err != nil {

return nil, err

}

// Ensure that we have a correct root key limit for launching containers.

if err := modifyRootKeyLimit(); err != nil {

log.G(ctx).Warnf("unable to modify root key limit, number of containers could be limited by this quota: %v", err)

}

// Ensure we have compatible and valid configuration options

if err := verifyDaemonSettings(config); err != nil {

return nil, err

}

// Do we have a disabled network?

config.DisableBridge = isBridgeNetworkDisabled(config)

// Setup the resolv.conf

setupResolvConf(config)

idMapping, err := setupRemappedRoot(config)

if err != nil {

return nil, err

}

uid, gid := idMapping.RootPair()

// set up the tmpDir to use a canonical path

tmp, err := prepareTempDir(config.Root)

if err != nil {

return nil, fmt.Errorf("Unable to get the TempDir under %s: %s", config.Root, err)

}

realTmp, err := resolveSymlinkedDirectory(tmp)

if err != nil {

return nil, fmt.Errorf("Unable to get the full path to the TempDir (%s): %s", tmp, err)

}

if isWindows {

if err := os.MkdirAll(realTmp, 0); err != nil {

return nil, fmt.Errorf("Unable to create the TempDir (%s): %s", realTmp, err)

}

_ = os.Setenv("TEMP", realTmp)

_ = os.Setenv("TMP", realTmp)

} else {

_ = os.Setenv("TMPDIR", realTmp)

}

if err := initRuntimesDir(config); err != nil {

return nil, err

}

rts, err := setupRuntimes(config)

if err != nil {

return nil, err

}

d := &Daemon{

PluginStore: pluginStore,

startupDone: make(chan struct{}),

}

cfgStore := &configStore{

Config: *config,

Runtimes: rts,

}

d.configStore.Store(cfgStore)

imgStoreChoice, err := determineImageStoreChoice(config, determineImageStoreChoiceOptions{})

if err != nil {

return nil, err

}

migrationThreshold := int64(-1)

if config.Features["containerd-migration"] {

if ts := os.Getenv("DOCKER_MIGRATE_SNAPSHOTTER_THRESHOLD"); ts != "" {

v, err := units.FromHumanSize(ts)

if err == nil {

migrationThreshold = v

} else {

log.G(ctx).WithError(err).WithField("size", ts).Warn("Invalid migration threshold value, defaulting to 0")

migrationThreshold = 0

}

} else {

migrationThreshold = 0

}

if migrationThreshold > 0 {

log.G(ctx).WithField("max_size", migrationThreshold).Info("(Experimental) Migration to containerd is enabled, driver will be switched to snapshotter after migration is complete")

} else {

log.G(ctx).WithField("env", os.Environ()).Info("Migration to containerd is enabled, driver will be switched to snapshotter if there are no images or containers")

}

}

// Ensure the daemon is properly shutdown if there is a failure during

// initialization

defer func() {

if retErr != nil {

// Use a fresh context here. Passed context could be cancelled.

if err := d.Shutdown(context.Background()); err != nil {

log.G(ctx).Error(err)

}

}

}()

if err := d.setGenericResources(&cfgStore.Config); err != nil {

return nil, err

}

// set up SIGUSR1 handler on Unix-like systems, or a Win32 global event

// on Windows to dump Go routine stacks

stackDumpDir := cfgStore.Root

if execRoot := cfgStore.GetExecRoot(); execRoot != "" {

stackDumpDir = execRoot

}

d.setupDumpStackTrap(stackDumpDir)

if err := d.setupSeccompProfile(&cfgStore.Config); err != nil {

return nil, err

}

// Set the default isolation mode (only applicable on Windows)

if err := d.setDefaultIsolation(&cfgStore.Config); err != nil {

return nil, fmt.Errorf("error setting default isolation mode: %v", err)

}

if err := configureMaxThreads(ctx); err != nil {

log.G(ctx).Warnf("Failed to configure golang's threads limit: %v", err)

}

// ensureDefaultAppArmorProfile does nothing if apparmor is disabled

if err := ensureDefaultAppArmorProfile(); err != nil {

log.G(ctx).WithError(err).Error("Failed to ensure default apparmor profile is loaded")

}

daemonRepo := filepath.Join(cfgStore.Root, "containers")

if err := user.MkdirAllAndChown(daemonRepo, 0o710, os.Getuid(), gid); err != nil {

return nil, err

}

if isWindows {

// Note that permissions (0o700) are ignored on Windows; passing them to

// show intent only. We could consider using idtools.MkdirAndChown here

// to apply an ACL.

if err = os.Mkdir(filepath.Join(cfgStore.Root, "credentialspecs"), 0o700); err != nil && !errors.Is(err, os.ErrExist) {

return nil, err

}

}

d.registryService = registryService

dlogger.RegisterPluginGetter(d.PluginStore)

if err := metrics.RegisterPlugin(d.PluginStore, filepath.Join(cfgStore.ExecRoot, "metrics.sock")); err != nil {

return nil, err

}

const connTimeout = 60 * time.Second

// Set the max backoff delay to match our containerd.WithTimeout(),

// aligning with how containerd client's defaults sets this;

// https://github.com/containerd/containerd/blob/v2.0.2/client/client.go#L129-L136

backoffConfig := backoff.DefaultConfig

backoffConfig.MaxDelay = connTimeout

connParams := grpc.ConnectParams{

Backoff: backoffConfig,

}

gopts := []grpc.DialOption{

// ------------------------------------------------------------------

// options below are copied from containerd client's default options

//

// We need to set these options, because setting any custom DialOptions

// currently overwrites (not appends to) the defaults;

// https://github.com/containerd/containerd/blob/v2.0.2/client/client.go#L129-L141

//

// TODO(thaJeztah): use containerd.WithExtraDialOpts() once https://github.com/containerd/containerd/pull/11276 is merged and in a release.

// ------------------------------------------------------------------

grpc.WithTransportCredentials(insecure.NewCredentials()),

grpc.WithConnectParams(connParams),

grpc.WithContextDialer(dialer.ContextDialer),

// ------------------------------------------------------------------

// end of options copied from containerd client's default

// ------------------------------------------------------------------

grpc.WithStatsHandler(tracing.ClientStatsHandler(otelgrpc.WithTracerProvider(otel.GetTracerProvider()))),

grpc.WithUnaryInterceptor(grpcerrors.UnaryClientInterceptor),

grpc.WithStreamInterceptor(grpcerrors.StreamClientInterceptor),

}

if cfgStore.ContainerdAddr != "" {

log.G(ctx).WithFields(log.Fields{

"address": cfgStore.ContainerdAddr,

"timeout": connTimeout,

}).Info("Creating a containerd client")