lcow: Allow the client to adjust capabilities and device cgroup rules#37294
Conversation
|
@jhowardmsft PTAL |
Signed-off-by: John Starks <[email protected]>
Signed-off-by: John Starks <[email protected]>
jstarks
changed the title
thaJeztah
left a comment
thaJeztah
left a comment
There was a problem hiding this comment.
Two minor nits, but overall looks okay
| s.Root.Path = "rootfs" | ||
| s.Root.Readonly = c.HostConfig.ReadonlyRootfs | ||
| if err := setCapabilities(s, c); err != nil { | ||
| return fmt.Errorf("linux spec capabilities: %v", err) |
There was a problem hiding this comment.
Perhaps "failed to set ....." ?
Also may want to use errors.Wrap(err, "failed to set ...") to preserve the original error
There was a problem hiding this comment.
I copied these errors from the Linux use of the functions. Do you want me to update both places or leave it as is?
(Maybe better to avoid duplication altogether but doing that in this change seemed to be more trouble than its worth right now.)
There was a problem hiding this comment.
Ah! Didn't check be Linux equivalent, but now recall I saw those at some point and wanted to update them.
Let's keep them as-is for now to be consistent, and keep it for a separate PR to improve if we want to
| } | ||
| devPermissions, err := appendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules) | ||
| if err != nil { | ||
| return fmt.Errorf("linux runtime spec devices: %v", err) |
There was a problem hiding this comment.
Same here (errors.Wrap()), and perhaps failed to .... (or something along that line)
|
The only failure is: which I think is unrelated. |
|
That failure will be addressed through #37315 |
|
same test failed again; but it's unrelated, so merging |
thaJeztah
added
the
area/lcow
|
Is there a edge release available for this yet? |
|
@itsgk92 this was merged un June last year, and is part of Docker 18.06 and up |
|
I couldn't find it working. #38631 |
9 participants
- What I did
Allowed LCOW clients to pass --cap-add, --device-group-rule etc. to customize the capabilities and device cgroup rules for their containers.
- How I did it
Moved the capabilities- and device cgroup-related OCI spec creation code from Linux-specific code to a common area.
- How to verify it
docker run --cap-add=SYSLOG ubuntu dmesgnow succeeds on LCOW.- Description for the changelog
Allow the client to customize capabilities and device cgroup rules for LCOW containers
- A picture of a cute animal (not mandatory but encouraged)