// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:

//go:build go1.22 && (linux || freebsd)

package daemon // import "github.com/docker/docker/daemon"

import (

"bufio"

"context"

"fmt"

"net"

"net/netip"

"os"

"path/filepath"

"runtime"

"runtime/debug"

"slices"

"strconv"

"strings"

"sync"

"syscall"

"time"

"github.com/containerd/cgroups/v3"

"github.com/containerd/log"

"github.com/docker/docker/api/types/blkiodev"

pblkiodev "github.com/docker/docker/api/types/blkiodev"

containertypes "github.com/docker/docker/api/types/container"

"github.com/docker/docker/api/types/network"

"github.com/docker/docker/container"

"github.com/docker/docker/daemon/config"

"github.com/docker/docker/daemon/initlayer"

"github.com/docker/docker/errdefs"

"github.com/docker/docker/internal/nlwrap"

"github.com/docker/docker/libcontainerd/remote"

"github.com/docker/docker/libnetwork"

nwconfig "github.com/docker/docker/libnetwork/config"

"github.com/docker/docker/libnetwork/drivers/bridge"

"github.com/docker/docker/libnetwork/netlabel"

"github.com/docker/docker/libnetwork/options"

lntypes "github.com/docker/docker/libnetwork/types"

"github.com/docker/docker/opts"

"github.com/docker/docker/pkg/idtools"

"github.com/docker/docker/pkg/parsers/kernel"

"github.com/docker/docker/pkg/sysinfo"

"github.com/docker/docker/runconfig"

volumemounts "github.com/docker/docker/volume/mounts"

"github.com/moby/sys/mount"

"github.com/opencontainers/runtime-spec/specs-go"

"github.com/opencontainers/selinux/go-selinux"

"github.com/opencontainers/selinux/go-selinux/label"

"github.com/pkg/errors"

"github.com/vishvananda/netlink"

"golang.org/x/sys/unix"

)

const (

isWindows = false

// These values were used to adjust the CPU-shares for older API versions,

// but were not used for validation.

//

// TODO(thaJeztah): validate min/max values for CPU-shares, similar to Windows: https://github.com/moby/moby/issues/47340

// https://github.com/moby/moby/blob/27e85c7b6885c2d21ae90791136d9aba78b83d01/daemon/daemon_windows.go#L97-L99

//

// See https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/tree/kernel/sched/sched.h?id=8cd9234c64c584432f6992fe944ca9e46ca8ea76#n269

// linuxMinCPUShares = 2

// linuxMaxCPUShares = 262144

// It's not kernel limit, we want this 6M limit to account for overhead during startup, and to supply a reasonable functional container

linuxMinMemory = 6291456

// constants for remapped root settings

defaultIDSpecifier = "default"

defaultRemappedID = "dockremap"

// constant for cgroup drivers

cgroupFsDriver = "cgroupfs"

cgroupSystemdDriver = "systemd"

cgroupNoneDriver = "none"

)

type containerGetter interface {

GetContainer(string) (*container.Container, error)

}

func getMemoryResources(config containertypes.Resources) *specs.LinuxMemory {

memory := specs.LinuxMemory{}

if config.Memory > 0 {

memory.Limit = &config.Memory

}

if config.MemoryReservation > 0 {

memory.Reservation = &config.MemoryReservation

}

if config.MemorySwap > 0 {

memory.Swap = &config.MemorySwap

}

if config.MemorySwappiness != nil {

swappiness := uint64(*config.MemorySwappiness)

memory.Swappiness = &swappiness

}

if config.OomKillDisable != nil {

memory.DisableOOMKiller = config.OomKillDisable

}

if config.KernelMemory != 0 { //nolint:staticcheck // ignore SA1019: memory.Kernel is deprecated: kernel-memory limits are not supported in cgroups v2, and were obsoleted in [kernel v5.4]. This field should no longer be used, as it may be ignored by runtimes.

memory.Kernel = &config.KernelMemory //nolint:staticcheck // ignore SA1019: memory.Kernel is deprecated: kernel-memory limits are not supported in cgroups v2, and were obsoleted in [kernel v5.4]. This field should no longer be used, as it may be ignored by runtimes.

}

if config.KernelMemoryTCP != 0 {

memory.KernelTCP = &config.KernelMemoryTCP

}

if memory != (specs.LinuxMemory{}) {

return &memory

}

return nil

}

func getPidsLimit(config containertypes.Resources) *specs.LinuxPids {

if config.PidsLimit == nil {

return nil

}

if *config.PidsLimit <= 0 {

// docker API allows 0 and negative values to unset this to be consistent

// with default values. When updating values, runc requires -1 to unset

// the previous limit.

return &specs.LinuxPids{Limit: -1}

}

return &specs.LinuxPids{Limit: *config.PidsLimit}

}

func getCPUResources(config containertypes.Resources) (*specs.LinuxCPU, error) {

cpu := specs.LinuxCPU{}

if config.CPUShares < 0 {

return nil, fmt.Errorf("shares: invalid argument")

}

if config.CPUShares > 0 {

shares := uint64(config.CPUShares)

cpu.Shares = &shares

}

if config.CpusetCpus != "" {

cpu.Cpus = config.CpusetCpus

}

if config.CpusetMems != "" {

cpu.Mems = config.CpusetMems

}

if config.NanoCPUs > 0 {

// https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt

period := uint64(100 * time.Millisecond / time.Microsecond)

quota := config.NanoCPUs * int64(period) / 1e9

cpu.Period = &period

cpu.Quota = &quota

}

if config.CPUPeriod != 0 {

period := uint64(config.CPUPeriod)

cpu.Period = &period

}

if config.CPUQuota != 0 {

q := config.CPUQuota

cpu.Quota = &q

}

if config.CPURealtimePeriod != 0 {

period := uint64(config.CPURealtimePeriod)

cpu.RealtimePeriod = &period

}

if config.CPURealtimeRuntime != 0 {

c := config.CPURealtimeRuntime

cpu.RealtimeRuntime = &c

}

if cpu != (specs.LinuxCPU{}) {

return &cpu, nil

}

return nil, nil

}

func getBlkioWeightDevices(config containertypes.Resources) ([]specs.LinuxWeightDevice, error) {

var stat unix.Stat_t

var blkioWeightDevices []specs.LinuxWeightDevice

for _, weightDevice := range config.BlkioWeightDevice {

if err := unix.Stat(weightDevice.Path, &stat); err != nil {

return nil, errors.WithStack(&os.PathError{Op: "stat", Path: weightDevice.Path, Err: err})

}

weight := weightDevice.Weight

d := specs.LinuxWeightDevice{Weight: &weight}

// The type is 32bit on mips.

d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert

d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert

blkioWeightDevices = append(blkioWeightDevices, d)

}

return blkioWeightDevices, nil

}

func (daemon *Daemon) parseSecurityOpt(cfg *config.Config, securityOptions *container.SecurityOptions, hostConfig *containertypes.HostConfig) error {

securityOptions.NoNewPrivileges = cfg.NoNewPrivileges

return parseSecurityOpt(securityOptions, hostConfig)

}

func parseSecurityOpt(securityOptions *container.SecurityOptions, config *containertypes.HostConfig) error {

var (

labelOpts []string

err error

)

for _, opt := range config.SecurityOpt {

if opt == "no-new-privileges" {

securityOptions.NoNewPrivileges = true

continue

}

if opt == "disable" {

labelOpts = append(labelOpts, "disable")

continue

}

var k, v string

var ok bool

if strings.Contains(opt, "=") {

k, v, ok = strings.Cut(opt, "=")

} else if strings.Contains(opt, ":") {

k, v, ok = strings.Cut(opt, ":")

log.G(context.TODO()).Warn("Security options with `:` as a separator are deprecated and will be completely unsupported in 17.04, use `=` instead.")

}

if !ok {

return fmt.Errorf("invalid --security-opt 1: %q", opt)

}

switch k {

case "label":

labelOpts = append(labelOpts, v)

case "apparmor":

securityOptions.AppArmorProfile = v

case "seccomp":

securityOptions.SeccompProfile = v

case "no-new-privileges":

nnp, err := strconv.ParseBool(v)

if err != nil {

return fmt.Errorf("invalid --security-opt 2: %q", opt)

}

securityOptions.NoNewPrivileges = nnp

default:

return fmt.Errorf("invalid --security-opt 2: %q", opt)

}

}

securityOptions.ProcessLabel, securityOptions.MountLabel, err = label.InitLabels(labelOpts)

return err

}

func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.LinuxThrottleDevice, error) {

var throttleDevices []specs.LinuxThrottleDevice

var stat unix.Stat_t

for _, d := range devs {

if err := unix.Stat(d.Path, &stat); err != nil {

return nil, errors.WithStack(&os.PathError{Op: "stat", Path: d.Path, Err: err})

}

d := specs.LinuxThrottleDevice{Rate: d.Rate}

// the type is 32bit on mips

d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert

d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert

throttleDevices = append(throttleDevices, d)

}

return throttleDevices, nil

}

// adjustParallelLimit takes a number of objects and a proposed limit and

// figures out if it's reasonable (and adjusts it accordingly). This is only

// used for daemon startup, which does a lot of parallel loading of containers

// (and if we exceed RLIMIT_NOFILE then we're in trouble).

func adjustParallelLimit(n int, limit int) int {

// Rule-of-thumb overhead factor (how many files will each goroutine open

// simultaneously). Yes, this is ugly but to be frank this whole thing is

// ugly.

const overhead = 2

// On Linux, we need to ensure that parallelStartupJobs doesn't cause us to

// exceed RLIMIT_NOFILE. If parallelStartupJobs is too large, we reduce it

// and give a warning (since in theory the user should increase their

// ulimits to the largest possible value for dockerd).

var rlim unix.Rlimit

if err := unix.Getrlimit(unix.RLIMIT_NOFILE, &rlim); err != nil {

log.G(context.TODO()).Warnf("Couldn't find dockerd's RLIMIT_NOFILE to double-check startup parallelism factor: %v", err)

return limit

}

softRlimit := int(rlim.Cur)

// Much fewer containers than RLIMIT_NOFILE. No need to adjust anything.

if softRlimit > overhead*n {

return limit

}

// RLIMIT_NOFILE big enough, no need to adjust anything.

if softRlimit > overhead*limit {

return limit

}

log.G(context.TODO()).Warnf("Found dockerd's open file ulimit (%v) is far too small -- consider increasing it significantly (at least %v)", softRlimit, overhead*limit)

return softRlimit / overhead

}

// adaptContainerSettings is called during container creation to modify any

// settings necessary in the HostConfig structure.

func (daemon *Daemon) adaptContainerSettings(daemonCfg *config.Config, hostConfig *containertypes.HostConfig) error {

if hostConfig.Memory > 0 && hostConfig.MemorySwap == 0 {

// By default, MemorySwap is set to twice the size of Memory.

hostConfig.MemorySwap = hostConfig.Memory * 2

}

if hostConfig.ShmSize == 0 {

hostConfig.ShmSize = config.DefaultShmSize

if daemonCfg != nil {

hostConfig.ShmSize = int64(daemonCfg.ShmSize)

}

}

// Set default IPC mode, if unset for container

if hostConfig.IpcMode.IsEmpty() {

m := config.DefaultIpcMode

if daemonCfg != nil {

m = containertypes.IpcMode(daemonCfg.IpcMode)

}

hostConfig.IpcMode = m

}

// Set default cgroup namespace mode, if unset for container

if hostConfig.CgroupnsMode.IsEmpty() {

// for cgroup v2: unshare cgroupns even for privileged containers

// https://github.com/containers/libpod/pull/4374#issuecomment-549776387

if hostConfig.Privileged && cgroups.Mode() != cgroups.Unified {

hostConfig.CgroupnsMode = containertypes.CgroupnsModeHost

} else {

m := containertypes.CgroupnsModeHost

if cgroups.Mode() == cgroups.Unified {

m = containertypes.CgroupnsModePrivate

}

if daemonCfg != nil {

m = containertypes.CgroupnsMode(daemonCfg.CgroupNamespaceMode)

}

hostConfig.CgroupnsMode = m

}

}

adaptSharedNamespaceContainer(daemon, hostConfig)

var err error

secOpts, err := daemon.generateSecurityOpt(hostConfig)

if err != nil {

return err

}

hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, secOpts...)

if hostConfig.OomKillDisable == nil {

defaultOomKillDisable := false

hostConfig.OomKillDisable = &defaultOomKillDisable

}

return nil

}

// adaptSharedNamespaceContainer replaces container name with its ID in hostConfig.

// To be more precisely, it modifies `container:name` to `container:ID` of PidMode, IpcMode

// and NetworkMode.

//

// When a container shares its namespace with another container, use ID can keep the namespace

// sharing connection between the two containers even the another container is renamed.

func adaptSharedNamespaceContainer(daemon containerGetter, hostConfig *containertypes.HostConfig) {

containerPrefix := "container:"

if hostConfig.PidMode.IsContainer() {

pidContainer := hostConfig.PidMode.Container()

// if there is any error returned here, we just ignore it and leave it to be

// handled in the following logic

if c, err := daemon.GetContainer(pidContainer); err == nil {

hostConfig.PidMode = containertypes.PidMode(containerPrefix + c.ID)

}

}

if hostConfig.IpcMode.IsContainer() {

ipcContainer := hostConfig.IpcMode.Container()

if c, err := daemon.GetContainer(ipcContainer); err == nil {

hostConfig.IpcMode = containertypes.IpcMode(containerPrefix + c.ID)

}

}

if hostConfig.NetworkMode.IsContainer() {

netContainer := hostConfig.NetworkMode.ConnectedContainer()

if c, err := daemon.GetContainer(netContainer); err == nil {

hostConfig.NetworkMode = containertypes.NetworkMode(containerPrefix + c.ID)

}

}

}

// verifyPlatformContainerResources performs platform-specific validation of the container's resource-configuration

func verifyPlatformContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) (warnings []string, err error) {

fixMemorySwappiness(resources)

// memory subsystem checks and adjustments

if resources.Memory != 0 && resources.Memory < linuxMinMemory {

return warnings, fmt.Errorf("Minimum memory limit allowed is 6MB")

}

if resources.Memory > 0 && !sysInfo.MemoryLimit {

warnings = append(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")

resources.Memory = 0

resources.MemorySwap = -1

}

if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {

warnings = append(warnings, "Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.")

resources.MemorySwap = -1

}

if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {

return warnings, fmt.Errorf("Minimum memoryswap limit should be larger than memory limit, see usage")

}

if resources.Memory == 0 && resources.MemorySwap > 0 && !update {

return warnings, fmt.Errorf("You should always set the Memory limit when using Memoryswap limit, see usage")

}

if resources.MemorySwappiness != nil && !sysInfo.MemorySwappiness {

warnings = append(warnings, "Your kernel does not support memory swappiness capabilities or the cgroup is not mounted. Memory swappiness discarded.")

resources.MemorySwappiness = nil

}

if resources.MemorySwappiness != nil {

swappiness := *resources.MemorySwappiness

if swappiness < 0 || swappiness > 100 {

return warnings, fmt.Errorf("Invalid value: %v, valid memory swappiness range is 0-100", swappiness)

}

}

if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {

warnings = append(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")

resources.MemoryReservation = 0

}

if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory {

return warnings, fmt.Errorf("Minimum memory reservation allowed is 6MB")

}

if resources.Memory > 0 && resources.MemoryReservation > 0 && resources.Memory < resources.MemoryReservation {

return warnings, fmt.Errorf("Minimum memory limit can not be less than memory reservation limit, see usage")

}

if resources.KernelMemory > 0 {

// Kernel memory limit is not supported on cgroup v2.

// Even on cgroup v1, kernel memory limit (`kmem.limit_in_bytes`) has been deprecated since kernel 5.4.

// https://github.com/torvalds/linux/commit/0158115f702b0ba208ab0b5adf44cae99b3ebcc7

if !sysInfo.KernelMemory {

warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")

resources.KernelMemory = 0

}

if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {

return warnings, fmt.Errorf("Minimum kernel memory limit allowed is 6MB")

}

if !kernel.CheckKernelVersion(4, 0, 0) {

warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")

}

}

if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {

// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point

// warning the caller if they already wanted the feature to be off

if *resources.OomKillDisable {

warnings = append(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")

}

resources.OomKillDisable = nil

}

if resources.OomKillDisable != nil && *resources.OomKillDisable && resources.Memory == 0 {

warnings = append(warnings, "OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.")

}

if resources.PidsLimit != nil && !sysInfo.PidsLimit {

if *resources.PidsLimit > 0 {

warnings = append(warnings, "Your kernel does not support PIDs limit capabilities or the cgroup is not mounted. PIDs limit discarded.")

}

resources.PidsLimit = nil

}

// cpu subsystem checks and adjustments

if resources.NanoCPUs > 0 && resources.CPUPeriod > 0 {

return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Period cannot both be set")

}

if resources.NanoCPUs > 0 && resources.CPUQuota > 0 {

return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Quota cannot both be set")

}

if resources.NanoCPUs > 0 && !sysInfo.CPUCfs {

return warnings, fmt.Errorf("NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler or the cgroup is not mounted")

}

// The highest precision we could get on Linux is 0.001, by setting

// cpu.cfs_period_us=1000ms

// cpu.cfs_quota=1ms

// See the following link for details:

// https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt

// Here we don't set the lower limit and it is up to the underlying platform (e.g., Linux) to return an error.

// The error message is 0.01 so that this is consistent with Windows

if resources.NanoCPUs != 0 {

nc := sysinfo.NumCPU()

if resources.NanoCPUs < 0 || resources.NanoCPUs > int64(nc)*1e9 {

return warnings, fmt.Errorf("range of CPUs is from 0.01 to %[1]d.00, as there are only %[1]d CPUs available", nc)

}

}

if resources.CPUShares > 0 && !sysInfo.CPUShares {

warnings = append(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")

resources.CPUShares = 0

}

if (resources.CPUPeriod != 0 || resources.CPUQuota != 0) && !sysInfo.CPUCfs {

warnings = append(warnings, "Your kernel does not support CPU CFS scheduler. CPU period/quota discarded.")

resources.CPUPeriod = 0

resources.CPUQuota = 0

}

if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) {

return warnings, fmt.Errorf("CPU cfs period can not be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")

}

if resources.CPUQuota > 0 && resources.CPUQuota < 1000 {

return warnings, fmt.Errorf("CPU cfs quota can not be less than 1ms (i.e. 1000)")

}

if resources.CPUPercent > 0 {

warnings = append(warnings, fmt.Sprintf("%s does not support CPU percent. Percent discarded.", runtime.GOOS))

resources.CPUPercent = 0

}

// cpuset subsystem checks and adjustments

if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {

warnings = append(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")

resources.CpusetCpus = ""

resources.CpusetMems = ""

}

cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(resources.CpusetCpus)

if err != nil {

return warnings, errors.Wrapf(err, "Invalid value %s for cpuset cpus", resources.CpusetCpus)

}

if !cpusAvailable {

return warnings, fmt.Errorf("Requested CPUs are not available - requested %s, available: %s", resources.CpusetCpus, sysInfo.Cpus)

}

memsAvailable, err := sysInfo.IsCpusetMemsAvailable(resources.CpusetMems)

if err != nil {

return warnings, errors.Wrapf(err, "Invalid value %s for cpuset mems", resources.CpusetMems)

}

if !memsAvailable {

return warnings, fmt.Errorf("Requested memory nodes are not available - requested %s, available: %s", resources.CpusetMems, sysInfo.Mems)

}

// blkio subsystem checks and adjustments

if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {

warnings = append(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")

resources.BlkioWeight = 0

}

if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {

return warnings, fmt.Errorf("Range of blkio weight is from 10 to 1000")

}

if resources.IOMaximumBandwidth != 0 || resources.IOMaximumIOps != 0 {

return warnings, fmt.Errorf("Invalid QoS settings: %s does not support Maximum IO Bandwidth or Maximum IO IOps", runtime.GOOS)

}

if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {

warnings = append(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")

resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}

}

if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {

warnings = append(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded.")

resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}

}

if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {

warnings = append(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")

resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}

}

if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {

warnings = append(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")

resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}

}

if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {

warnings = append(warnings, "Your kernel does not support IOPS Block write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")

resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}

}

return warnings, nil

}

func cgroupDriver(cfg *config.Config) string {

if UsingSystemd(cfg) {

return cgroupSystemdDriver

}

if cfg.Rootless {

return cgroupNoneDriver

}

return cgroupFsDriver

}

// getCD gets the raw value of the native.cgroupdriver option, if set.

func getCD(config *config.Config) string {

for _, option := range config.ExecOptions {

key, val, ok := strings.Cut(option, "=")

if ok && strings.EqualFold(strings.TrimSpace(key), "native.cgroupdriver") {

return strings.TrimSpace(val)

}

}

return ""

}

// verifyCgroupDriver validates native.cgroupdriver

func verifyCgroupDriver(config *config.Config) error {

cd := getCD(config)

if cd == "" || cd == cgroupFsDriver || cd == cgroupSystemdDriver {

return nil

}

if cd == cgroupNoneDriver {

return fmt.Errorf("native.cgroupdriver option %s is internally used and cannot be specified manually", cd)

}

return fmt.Errorf("native.cgroupdriver option %s not supported", cd)

}

// UsingSystemd returns true if cli option includes native.cgroupdriver=systemd

func UsingSystemd(config *config.Config) bool {

cd := getCD(config)

if cd == cgroupSystemdDriver {

return true

}

// On cgroup v2 hosts, default to systemd driver

if cd == "" && cgroups.Mode() == cgroups.Unified && isRunningSystemd() {

return true

}

return false

}

var (

runningSystemd bool

detectSystemd sync.Once

)

// isRunningSystemd checks whether the host was booted with systemd as its init

// system. This functions similarly to systemd's `sd_booted(3)`: internally, it

// checks whether /run/systemd/system/ exists and is a directory.

// http://www.freedesktop.org/software/systemd/man/sd_booted.html

//

// NOTE: This function comes from package github.com/coreos/go-systemd/util

// It was borrowed here to avoid a dependency on cgo.

func isRunningSystemd() bool {

detectSystemd.Do(func() {

fi, err := os.Lstat("/run/systemd/system")

if err != nil {

return

}

runningSystemd = fi.IsDir()

})

return runningSystemd

}

// verifyPlatformContainerSettings performs platform-specific validation of the

// hostconfig and config structures.

func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *configStore, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {

if hostConfig == nil {

return nil, nil

}

sysInfo := daemon.RawSysInfo()

w, err := verifyPlatformContainerResources(&hostConfig.Resources, sysInfo, update)

// no matter err is nil or not, w could have data in itself.

warnings = append(warnings, w...)

if err != nil {

return warnings, err

}

if !hostConfig.IpcMode.Valid() {

return warnings, errors.Errorf("invalid IPC mode: %v", hostConfig.IpcMode)

}

if !hostConfig.PidMode.Valid() {

return warnings, errors.Errorf("invalid PID mode: %v", hostConfig.PidMode)

}

if hostConfig.ShmSize < 0 {

return warnings, fmt.Errorf("SHM size can not be less than 0")

}

if !hostConfig.UTSMode.Valid() {

return warnings, errors.Errorf("invalid UTS mode: %v", hostConfig.UTSMode)

}

if hostConfig.OomScoreAdj < -1000 || hostConfig.OomScoreAdj > 1000 {

return warnings, fmt.Errorf("Invalid value %d, range for oom score adj is [-1000, 1000]", hostConfig.OomScoreAdj)

}

// ip-forwarding does not affect container with '--net=host' (or '--net=none')

if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) {

warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")

}

if hostConfig.NetworkMode.IsHost() && len(hostConfig.PortBindings) > 0 {

warnings = append(warnings, "Published ports are discarded when using host network mode")

}

// check for various conflicting options with user namespaces

if daemonCfg.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {

if hostConfig.Privileged {

return warnings, fmt.Errorf("privileged mode is incompatible with user namespaces. You must run the container in the host namespace when running privileged mode")

}

if hostConfig.NetworkMode.IsHost() && !hostConfig.UsernsMode.IsHost() {

return warnings, fmt.Errorf("cannot share the host's network namespace when user namespaces are enabled")

}

if hostConfig.PidMode.IsHost() && !hostConfig.UsernsMode.IsHost() {

return warnings, fmt.Errorf("cannot share the host PID namespace when user namespaces are enabled")

}

}

if hostConfig.CgroupParent != "" && UsingSystemd(&daemonCfg.Config) {

// CgroupParent for systemd cgroup should be named as "xxx.slice"

if len(hostConfig.CgroupParent) <= 6 || !strings.HasSuffix(hostConfig.CgroupParent, ".slice") {

return warnings, fmt.Errorf(`cgroup-parent for systemd cgroup should be a valid slice named as "xxx.slice"`)

}

}

if hostConfig.Runtime == "" {

hostConfig.Runtime = daemonCfg.Runtimes.Default

}

if _, _, err := daemonCfg.Runtimes.Get(hostConfig.Runtime); err != nil {

return warnings, err

}

parser := volumemounts.NewParser()

for dest := range hostConfig.Tmpfs {

if err := parser.ValidateTmpfsMountDestination(dest); err != nil {

return warnings, err

}

}

if !hostConfig.CgroupnsMode.Valid() {

return warnings, fmt.Errorf("invalid cgroup namespace mode: %v", hostConfig.CgroupnsMode)

}

if hostConfig.CgroupnsMode.IsPrivate() {

if !sysInfo.CgroupNamespaces {

warnings = append(warnings, "Your kernel does not support cgroup namespaces. Cgroup namespace setting discarded.")

}

}

return warnings, nil

}

// verifyDaemonSettings performs validation of daemon config struct

func verifyDaemonSettings(conf *config.Config) error {

if conf.ContainerdNamespace == conf.ContainerdPluginNamespace {

return errors.New("containers namespace and plugins namespace cannot be the same")

}

// Check for mutually incompatible config options

if conf.BridgeConfig.Iface != "" && conf.BridgeConfig.IP != "" {

return fmt.Errorf("You specified -b & --bip, mutually exclusive options. Please specify only one")

}

if conf.BridgeConfig.Iface != "" && conf.BridgeConfig.IP6 != "" {

return fmt.Errorf("You specified -b & --bip6, mutually exclusive options. Please specify only one")

}

if !conf.BridgeConfig.InterContainerCommunication {

if !conf.BridgeConfig.EnableIPTables {

return fmt.Errorf("You specified --iptables=false with --icc=false. ICC=false uses iptables to function. Please set --icc or --iptables to true")

}

if conf.BridgeConfig.EnableIPv6 && !conf.BridgeConfig.EnableIP6Tables {

return fmt.Errorf("You specified --ip6tables=false with --icc=false. ICC=false uses ip6tables to function. Please set --icc or --ip6tables to true")

}

}

if !conf.BridgeConfig.EnableIPTables && conf.BridgeConfig.EnableIPMasq {

conf.BridgeConfig.EnableIPMasq = false

}

if err := verifyCgroupDriver(conf); err != nil {

return err

}

if conf.CgroupParent != "" && UsingSystemd(conf) {

if len(conf.CgroupParent) <= 6 || !strings.HasSuffix(conf.CgroupParent, ".slice") {

return fmt.Errorf(`cgroup-parent for systemd cgroup should be a valid slice named as "xxx.slice"`)

}

}

if conf.Rootless && UsingSystemd(conf) && cgroups.Mode() != cgroups.Unified {

return fmt.Errorf("exec-opt native.cgroupdriver=systemd requires cgroup v2 for rootless mode")

}

return nil

}

// checkSystem validates platform-specific requirements

func checkSystem() error {

return nil

}

// configureMaxThreads sets the Go runtime max threads threshold

// which is 90% of the kernel setting from /proc/sys/kernel/threads-max

func configureMaxThreads(config *config.Config) error {

mt, err := os.ReadFile("/proc/sys/kernel/threads-max")

if err != nil {

return err

}

mtint, err := strconv.Atoi(strings.TrimSpace(string(mt)))

if err != nil {

return err

}

maxThreads := (mtint / 100) * 90

debug.SetMaxThreads(maxThreads)

log.G(context.TODO()).Debugf("Golang's threads limit set to %d", maxThreads)

return nil

}

func overlaySupportsSelinux() (bool, error) {

f, err := os.Open("/proc/kallsyms")

if err != nil {

if os.IsNotExist(err) {

return false, nil

}

return false, err

}

defer f.Close()

s := bufio.NewScanner(f)

for s.Scan() {

if strings.HasSuffix(s.Text(), " security_inode_copy_up") {

return true, nil

}

}

return false, s.Err()

}

// configureKernelSecuritySupport configures and validates security support for the kernel

func configureKernelSecuritySupport(config *config.Config, driverName string) error {

if config.EnableSelinuxSupport {

if !selinux.GetEnabled() {

log.G(context.TODO()).Warn("Docker could not enable SELinux on the host system")

return nil

}

if driverName == "overlay2" || driverName == "overlayfs" {

// If driver is overlay2, make sure kernel

// supports selinux with overlay.

supported, err := overlaySupportsSelinux()

if err != nil {

return err

}

if !supported {

log.G(context.TODO()).Warnf("SELinux is not supported with the %v graph driver on this kernel", driverName)

}

}

} else {

selinux.SetDisabled()

}

return nil

}

// initNetworkController initializes the libnetwork controller and configures

// network settings. If there's active sandboxes, configuration changes will not

// take effect.

func (daemon *Daemon) initNetworkController(cfg *config.Config, activeSandboxes map[string]interface{}) error {

netOptions, err := daemon.networkOptions(cfg, daemon.PluginStore, daemon.id, activeSandboxes)

if err != nil {

return err

}

daemon.netController, err = libnetwork.New(netOptions...)

if err != nil {

return fmt.Errorf("error obtaining controller instance: %v", err)

}

if len(activeSandboxes) > 0 {

log.G(context.TODO()).Info("there are running containers, updated network configuration will not take affect")

} else if err := configureNetworking(daemon.netController, cfg); err != nil {

return err

}

// Set HostGatewayIP to the default bridge's IP if it is empty

setHostGatewayIP(daemon.netController, cfg)

return nil

}

func configureNetworking(controller *libnetwork.Controller, conf *config.Config) error {

// Create predefined network "none"

if n, _ := controller.NetworkByName(network.NetworkNone); n == nil {

if _, err := controller.NewNetwork("null", network.NetworkNone, "", libnetwork.NetworkOptionPersist(true)); err != nil {

return errors.Wrapf(err, `error creating default %q network`, network.NetworkNone)

}

}

// Create predefined network "host"

if n, _ := controller.NetworkByName(network.NetworkHost); n == nil {

if _, err := controller.NewNetwork("host", network.NetworkHost, "", libnetwork.NetworkOptionPersist(true)); err != nil {

return errors.Wrapf(err, `error creating default %q network`, network.NetworkHost)

}

}

// Clear stale bridge network

if n, err := controller.NetworkByName(network.NetworkBridge); err == nil {

if err = n.Delete(); err != nil {

return errors.Wrapf(err, `could not delete the default %q network`, network.NetworkBridge)

}

if len(conf.NetworkConfig.DefaultAddressPools.Value()) > 0 && !conf.LiveRestoreEnabled {

removeDefaultBridgeInterface()

}

}

if !conf.DisableBridge {

// Initialize default driver "bridge"

if err := initBridgeDriver(controller, conf.BridgeConfig); err != nil {

return err

}

} else {

removeDefaultBridgeInterface()

}

return nil

}

// setHostGatewayIP sets cfg.HostGatewayIP to the default bridge's IP if it is empty.

func setHostGatewayIP(controller *libnetwork.Controller, config *config.Config) {

if len(config.HostGatewayIPs) > 0 {

return

}

if n, err := controller.NetworkByName(network.NetworkBridge); err == nil {

v4Info, v6Info := n.IpamInfo()

if len(v4Info) > 0 {

addr, _ := netip.AddrFromSlice(v4Info[0].Gateway.IP)

config.HostGatewayIPs = append(config.HostGatewayIPs, addr)

}

if len(v6Info) > 0 {

addr, _ := netip.AddrFromSlice(v6Info[0].Gateway.IP)

config.HostGatewayIPs = append(config.HostGatewayIPs, addr)

}

}

}

func driverOptions(config *config.Config) nwconfig.Option {

return nwconfig.OptionDriverConfig("bridge", options.Generic{

netlabel.GenericData: options.Generic{

"EnableIPForwarding": config.BridgeConfig.EnableIPForward,

"DisableFilterForwardDrop": config.BridgeConfig.DisableFilterForwardDrop,

"EnableIPTables": config.BridgeConfig.EnableIPTables,

"EnableIP6Tables": config.BridgeConfig.EnableIP6Tables,

"EnableUserlandProxy": config.BridgeConfig.EnableUserlandProxy,

"UserlandProxyPath": config.BridgeConfig.UserlandProxyPath,

"Rootless": config.Rootless,

},

})

}

type defBrOptsV4 struct {

cfg config.BridgeConfig

}

func (o defBrOptsV4) nlFamily() int {

return netlink.FAMILY_V4

}

func (o defBrOptsV4) fixedCIDR() (fCIDR, optName string) {

return o.cfg.FixedCIDR, "fixed-cidr"

}

func (o defBrOptsV4) bip() (bip, optName string) {

return o.cfg.IP, "bip"

}

func (o defBrOptsV4) defGw() (gw net.IP, optName, auxAddrLabel string) {

return o.cfg.DefaultGatewayIPv4, "default-gateway", "DefaultGatewayIPv4"

}

type defBrOptsV6 struct {

cfg config.BridgeConfig

}

func (o defBrOptsV6) nlFamily() int {

return netlink.FAMILY_V6

}

func (o defBrOptsV6) fixedCIDR() (fCIDR, optName string) {

return o.cfg.FixedCIDRv6, "fixed-cidr-v6"

}

func (o defBrOptsV6) bip() (bip, optName string) {

return o.cfg.IP6, "bip6"

}

func (o defBrOptsV6) defGw() (gw net.IP, optName, auxAddrLabel string) {

return o.cfg.DefaultGatewayIPv6, "default-gateway-v6", "DefaultGatewayIPv6"

}

type defBrOpts interface {

nlFamily() int

fixedCIDR() (fCIDR, optName string)

bip() (bip, optName string)

defGw() (gw net.IP, optName, auxAddrLabel string)

}

func initBridgeDriver(controller *libnetwork.Controller, cfg config.BridgeConfig) error {

bridgeName, userManagedBridge := getDefaultBridgeName(cfg)

netOption := map[string]string{

bridge.BridgeName: bridgeName,

bridge.DefaultBridge: strconv.FormatBool(true),

netlabel.DriverMTU: strconv.Itoa(cfg.MTU),

bridge.EnableIPMasquerade: strconv.FormatBool(cfg.EnableIPMasq),

bridge.EnableICC: strconv.FormatBool(cfg.InterContainerCommunication),

}

// --ip processing

if cfg.DefaultIP != nil {

netOption[bridge.DefaultBindingIP] = cfg.DefaultIP.String()

}

ipamV4Conf, err := getDefaultBridgeIPAMConf(bridgeName, userManagedBridge, defBrOptsV4{cfg})

if err != nil {

return err

}