Skip to content

Commit 3d86b0c

Browse files
tonistiigitonistiigi
committed
Implement content addressability for plugins
Move plugins to shared distribution stack with images. Create immutable plugin config that matches schema2 requirements. Ensure data being pushed is same as pulled/created. Store distribution artifacts in a blobstore. Run init layer setup for every plugin start. Fix breakouts from unsafe file accesses. Add support for `docker plugin install --alias` Uses normalized references for default names to avoid collisions when using default hosts/tags. Some refactoring of the plugin manager to support the change, like removing the singleton manager and adding manager config struct. Signed-off-by: Tonis Tiigi <[email protected]> Signed-off-by: Derek McGowan <[email protected]>
1 parent d1dfc1a commit 3d86b0c

61 files changed

Lines changed: 1672 additions & 1345 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api/server/router/plugin/backend.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"net/http"
66

77
enginetypes "github.com/docker/docker/api/types"
8+
"github.com/docker/docker/reference"
89
"golang.org/x/net/context"
910
)
1011

@@ -13,11 +14,11 @@ type Backend interface {
1314
Disable(name string, config *enginetypes.PluginDisableConfig) error
1415
Enable(name string, config *enginetypes.PluginEnableConfig) error
1516
List() ([]enginetypes.Plugin, error)
16-
Inspect(name string) (enginetypes.Plugin, error)
17+
Inspect(name string) (*enginetypes.Plugin, error)
1718
Remove(name string, config *enginetypes.PluginRmConfig) error
1819
Set(name string, args []string) error
19-
Privileges(name string, metaHeaders http.Header, authConfig *enginetypes.AuthConfig) (enginetypes.PluginPrivileges, error)
20-
Pull(name string, metaHeaders http.Header, authConfig *enginetypes.AuthConfig, privileges enginetypes.PluginPrivileges) error
21-
Push(name string, metaHeaders http.Header, authConfig *enginetypes.AuthConfig) error
22-
CreateFromContext(ctx context.Context, tarCtx io.Reader, options *enginetypes.PluginCreateOptions) error
20+
Privileges(ctx context.Context, ref reference.Named, metaHeaders http.Header, authConfig *enginetypes.AuthConfig) (enginetypes.PluginPrivileges, error)
21+
Pull(ctx context.Context, ref reference.Named, name string, metaHeaders http.Header, authConfig *enginetypes.AuthConfig, privileges enginetypes.PluginPrivileges, outStream io.Writer) error
22+
Push(ctx context.Context, name string, metaHeaders http.Header, authConfig *enginetypes.AuthConfig, outStream io.Writer) error
23+
CreateFromContext(ctx context.Context, tarCtx io.ReadCloser, options *enginetypes.PluginCreateOptions) error
2324
}

‎api/server/router/plugin/plugin.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ func (r *pluginRouter) initRoutes() {
3030
router.NewDeleteRoute("/plugins/{name:.*}", r.removePlugin),
3131
router.NewPostRoute("/plugins/{name:.*}/enable", r.enablePlugin), // PATCH?
3232
router.NewPostRoute("/plugins/{name:.*}/disable", r.disablePlugin),
33-
router.NewPostRoute("/plugins/pull", r.pullPlugin),
34-
router.NewPostRoute("/plugins/{name:.*}/push", r.pushPlugin),
33+
router.Cancellable(router.NewPostRoute("/plugins/pull", r.pullPlugin)),
34+
router.Cancellable(router.NewPostRoute("/plugins/{name:.*}/push", r.pushPlugin)),
3535
router.NewPostRoute("/plugins/{name:.*}/set", r.setPlugin),
3636
router.NewPostRoute("/plugins/create", r.createPlugin),
3737
}

‎api/server/router/plugin/plugin_routes.go‎

Lines changed: 115 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,13 @@ import (
77
"strconv"
88
"strings"
99

10+
distreference "github.com/docker/distribution/reference"
1011
"github.com/docker/docker/api/server/httputils"
1112
"github.com/docker/docker/api/types"
13+
"github.com/docker/docker/pkg/ioutils"
14+
"github.com/docker/docker/pkg/streamformatter"
15+
"github.com/docker/docker/reference"
16+
"github.com/pkg/errors"
1217
"golang.org/x/net/context"
1318
)
1419

@@ -34,14 +39,61 @@ func parseHeaders(headers http.Header) (map[string][]string, *types.AuthConfig)
3439
return metaHeaders, authConfig
3540
}
3641

42+
// parseRemoteRef parses the remote reference into a reference.Named
43+
// returning the tag associated with the reference. In the case the
44+
// given reference string includes both digest and tag, the returned
45+
// reference will have the digest without the tag, but the tag will
46+
// be returned.
47+
func parseRemoteRef(remote string) (reference.Named, string, error) {
48+
// Parse remote reference, supporting remotes with name and tag
49+
// NOTE: Using distribution reference to handle references
50+
// containing both a name and digest
51+
remoteRef, err := distreference.ParseNamed(remote)
52+
if err != nil {
53+
return nil, "", err
54+
}
55+
56+
var tag string
57+
if t, ok := remoteRef.(distreference.Tagged); ok {
58+
tag = t.Tag()
59+
}
60+
61+
// Convert distribution reference to docker reference
62+
// TODO: remove when docker reference changes reconciled upstream
63+
ref, err := reference.WithName(remoteRef.Name())
64+
if err != nil {
65+
return nil, "", err
66+
}
67+
if d, ok := remoteRef.(distreference.Digested); ok {
68+
ref, err = reference.WithDigest(ref, d.Digest())
69+
if err != nil {
70+
return nil, "", err
71+
}
72+
} else if tag != "" {
73+
ref, err = reference.WithTag(ref, tag)
74+
if err != nil {
75+
return nil, "", err
76+
}
77+
} else {
78+
ref = reference.WithDefaultTag(ref)
79+
}
80+
81+
return ref, tag, nil
82+
}
83+
3784
func (pr *pluginRouter) getPrivileges(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
3885
if err := httputils.ParseForm(r); err != nil {
3986
return err
4087
}
4188

4289
metaHeaders, authConfig := parseHeaders(r.Header)
4390

44-
privileges, err := pr.backend.Privileges(r.FormValue("name"), metaHeaders, authConfig)
91+
ref, _, err := parseRemoteRef(r.FormValue("remote"))
92+
if err != nil {
93+
return err
94+
}
95+
96+
privileges, err := pr.backend.Privileges(ctx, ref, metaHeaders, authConfig)
4597
if err != nil {
4698
return err
4799
}
@@ -50,20 +102,66 @@ func (pr *pluginRouter) getPrivileges(ctx context.Context, w http.ResponseWriter
50102

51103
func (pr *pluginRouter) pullPlugin(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
52104
if err := httputils.ParseForm(r); err != nil {
53-
return err
105+
return errors.Wrap(err, "failed to parse form")
54106
}
55107

56108
var privileges types.PluginPrivileges
57-
if err := json.NewDecoder(r.Body).Decode(&privileges); err != nil {
58-
return err
109+
dec := json.NewDecoder(r.Body)
110+
if err := dec.Decode(&privileges); err != nil {
111+
return errors.Wrap(err, "failed to parse privileges")
112+
}
113+
if dec.More() {
114+
return errors.New("invalid privileges")
59115
}
60116

61117
metaHeaders, authConfig := parseHeaders(r.Header)
62118

63-
if err := pr.backend.Pull(r.FormValue("name"), metaHeaders, authConfig, privileges); err != nil {
119+
ref, tag, err := parseRemoteRef(r.FormValue("remote"))
120+
if err != nil {
64121
return err
65122
}
66-
w.WriteHeader(http.StatusCreated)
123+
124+
name := r.FormValue("name")
125+
if name == "" {
126+
if _, ok := ref.(reference.Canonical); ok {
127+
trimmed := reference.TrimNamed(ref)
128+
if tag != "" {
129+
nt, err := reference.WithTag(trimmed, tag)
130+
if err != nil {
131+
return err
132+
}
133+
name = nt.String()
134+
} else {
135+
name = reference.WithDefaultTag(trimmed).String()
136+
}
137+
} else {
138+
name = ref.String()
139+
}
140+
} else {
141+
localRef, err := reference.ParseNamed(name)
142+
if err != nil {
143+
return err
144+
}
145+
if _, ok := localRef.(reference.Canonical); ok {
146+
return errors.New("cannot use digest in plugin tag")
147+
}
148+
if distreference.IsNameOnly(localRef) {
149+
// TODO: log change in name to out stream
150+
name = reference.WithDefaultTag(localRef).String()
151+
}
152+
}
153+
w.Header().Set("Docker-Plugin-Name", name)
154+
155+
w.Header().Set("Content-Type", "application/json")
156+
output := ioutils.NewWriteFlusher(w)
157+
158+
if err := pr.backend.Pull(ctx, ref, name, metaHeaders, authConfig, privileges, output); err != nil {
159+
if !output.Flushed() {
160+
return err
161+
}
162+
output.Write(streamformatter.NewJSONStreamFormatter().FormatError(err))
163+
}
164+
67165
return nil
68166
}
69167

@@ -125,12 +223,21 @@ func (pr *pluginRouter) removePlugin(ctx context.Context, w http.ResponseWriter,
125223

126224
func (pr *pluginRouter) pushPlugin(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
127225
if err := httputils.ParseForm(r); err != nil {
128-
return err
226+
return errors.Wrap(err, "failed to parse form")
129227
}
130228

131229
metaHeaders, authConfig := parseHeaders(r.Header)
132230

133-
return pr.backend.Push(vars["name"], metaHeaders, authConfig)
231+
w.Header().Set("Content-Type", "application/json")
232+
output := ioutils.NewWriteFlusher(w)
233+
234+
if err := pr.backend.Push(ctx, vars["name"], metaHeaders, authConfig, output); err != nil {
235+
if !output.Flushed() {
236+
return err
237+
}
238+
output.Write(streamformatter.NewJSONStreamFormatter().FormatError(err))
239+
}
240+
return nil
134241
}
135242

136243
func (pr *pluginRouter) setPlugin(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {

‎api/swagger.yaml‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1347,16 +1347,13 @@ definitions:
13471347
Plugin:
13481348
description: "A plugin for the Engine API"
13491349
type: "object"
1350-
required: [Settings, Enabled, Config, Name, Tag]
1350+
required: [Settings, Enabled, Config, Name]
13511351
properties:
13521352
Id:
13531353
type: "string"
13541354
Name:
13551355
type: "string"
13561356
x-nullable: false
1357-
Tag:
1358-
type: "string"
1359-
x-nullable: false
13601357
Enabled:
13611358
description: "True when the plugin is running. False when the plugin is not running, only installed."
13621359
type: "boolean"
@@ -1392,7 +1389,7 @@ definitions:
13921389
- Documentation
13931390
- Interface
13941391
- Entrypoint
1395-
- Workdir
1392+
- WorkDir
13961393
- Network
13971394
- Linux
13981395
- PropagatedMount
@@ -1423,7 +1420,7 @@ definitions:
14231420
type: "array"
14241421
items:
14251422
type: "string"
1426-
Workdir:
1423+
WorkDir:
14271424
type: "string"
14281425
x-nullable: false
14291426
User:
@@ -1490,6 +1487,15 @@ definitions:
14901487
type: "array"
14911488
items:
14921489
type: "string"
1490+
rootfs:
1491+
type: "object"
1492+
properties:
1493+
type:
1494+
type: "string"
1495+
diff_ids:
1496+
type: "array"
1497+
items:
1498+
type: "string"
14931499
example:
14941500
Id: "5724e2c8652da337ab2eedd19fc6fc0ec908e4bd907c7421bf6a8dfc70c4c078"
14951501
Name: "tiborvass/no-remove"
@@ -1528,7 +1534,7 @@ definitions:
15281534
Entrypoint:
15291535
- "plugin-no-remove"
15301536
- "/data"
1531-
Workdir: ""
1537+
WorkDir: ""
15321538
User: {}
15331539
Network:
15341540
Type: "host"
@@ -6397,7 +6403,7 @@ paths:
63976403
Entrypoint:
63986404
- "plugin-no-remove"
63996405
- "/data"
6400-
Workdir: ""
6406+
WorkDir: ""
64016407
User: {}
64026408
Network:
64036409
Type: "host"
@@ -6503,14 +6509,22 @@ paths:
65036509
schema:
65046510
$ref: "#/definitions/ErrorResponse"
65056511
parameters:
6506-
- name: "name"
6512+
- name: "remote"
65076513
in: "query"
65086514
description: |
6509-
The plugin to install.
6515+
Remote reference for plugin to install.
65106516
65116517
The `:latest` tag is optional, and is used as the default if omitted.
65126518
required: true
65136519
type: "string"
6520+
- name: "name"
6521+
in: "query"
6522+
description: |
6523+
Local name for the pulled plugin.
6524+
6525+
The `:latest` tag is optional, and is used as the default if omitted.
6526+
required: false
6527+
type: "string"
65146528
- name: "X-Registry-Auth"
65156529
in: "header"
65166530
description: "A base64-encoded auth configuration to use when pulling a plugin from a registry. [See the authentication section for details.](#section/Authentication)"

‎api/types/client.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -350,6 +350,7 @@ type PluginInstallOptions struct {
350350
Disabled bool
351351
AcceptAllPermissions bool
352352
RegistryAuth string // RegistryAuth is the base64 encoded credentials for the registry
353+
RemoteRef string // RemoteRef is the plugin name on the registry
353354
PrivilegeFunc RequestPrivilegeFunc
354355
AcceptPermissionsFunc func(PluginPrivileges) (bool, error)
355356
Args []string

‎api/types/plugin.go‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,6 @@ type Plugin struct {
2525
// settings
2626
// Required: true
2727
Settings PluginSettings `json:"Settings"`
28-
29-
// tag
30-
// Required: true
31-
Tag string `json:"Tag"`
3228
}
3329

3430
// PluginConfig The config of a plugin.
@@ -78,9 +74,12 @@ type PluginConfig struct {
7874
// user
7975
User PluginConfigUser `json:"User,omitempty"`
8076

81-
// workdir
77+
// work dir
8278
// Required: true
83-
Workdir string `json:"Workdir"`
79+
WorkDir string `json:"WorkDir"`
80+
81+
// rootfs
82+
Rootfs *PluginConfigRootfs `json:"rootfs,omitempty"`
8483
}
8584

8685
// PluginConfigArgs plugin config args
@@ -143,6 +142,17 @@ type PluginConfigNetwork struct {
143142
Type string `json:"Type"`
144143
}
145144

145+
// PluginConfigRootfs plugin config rootfs
146+
// swagger:model PluginConfigRootfs
147+
type PluginConfigRootfs struct {
148+
149+
// diff ids
150+
DiffIds []string `json:"diff_ids"`
151+
152+
// type
153+
Type string `json:"type,omitempty"`
154+
}
155+
146156
// PluginConfigUser plugin config user
147157
// swagger:model PluginConfigUser
148158
type PluginConfigUser struct {

‎cli/command/plugin/create.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,8 @@ func newCreateCommand(dockerCli *command.DockerCli) *cobra.Command {
6464
options := pluginCreateOptions{}
6565

6666
cmd := &cobra.Command{
67-
Use: "create [OPTIONS] PLUGIN[:tag] PATH-TO-ROOTFS(rootfs + config.json)",
68-
Short: "Create a plugin from a rootfs and config",
67+
Use: "create [OPTIONS] PLUGIN PLUGIN-DATA-DIR",
68+
Short: "Create a plugin from a rootfs and configuration. Plugin data directory must contain config.json and rootfs directory.",
6969
Args: cli.RequiresMinArgs(2),
7070
RunE: func(cmd *cobra.Command, args []string) error {
7171
options.repoName = args[0]

‎cli/command/plugin/disable.go‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"github.com/docker/docker/api/types"
77
"github.com/docker/docker/cli"
88
"github.com/docker/docker/cli/command"
9-
"github.com/docker/docker/reference"
109
"github.com/spf13/cobra"
1110
"golang.org/x/net/context"
1211
)
@@ -29,18 +28,7 @@ func newDisableCommand(dockerCli *command.DockerCli) *cobra.Command {
2928
}
3029

3130
func runDisable(dockerCli *command.DockerCli, name string, force bool) error {
32-
named, err := reference.ParseNamed(name) // FIXME: validate
33-
if err != nil {
34-
return err
35-
}
36-
if reference.IsNameOnly(named) {
37-
named = reference.WithDefaultTag(named)
38-
}
39-
ref, ok := named.(reference.NamedTagged)
40-
if !ok {
41-
return fmt.Errorf("invalid name: %s", named.String())
42-
}
43-
if err := dockerCli.Client().PluginDisable(context.Background(), ref.String(), types.PluginDisableOptions{Force: force}); err != nil {
31+
if err := dockerCli.Client().PluginDisable(context.Background(), name, types.PluginDisableOptions{Force: force}); err != nil {
4432
return err
4533
}
4634
fmt.Fprintln(dockerCli.Out(), name)

0 commit comments

Comments
 (0)