summaryrefslogtreecommitdiff
path: root/daemon/graphdriver/devmapper
Commit message (Collapse)AuthorAgeFilesLines
* daemon/graphdriver/devicemapper: simplify Udev log, and update linkSebastiaan van Stijn2022-12-311-7/+1
| | | | | | | | | | Simplify the error message so that we don't have to distinguish between static- and non-static builds. Also update the link to the storage-driver section to use a "/go/" redirect in the docs, as the anchor link was no longer correct. Using a "/go/" redirect makes sure the link remains functional if docs is moving around. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon/graphdriver/devmapper: use filepath.WalkDir instead of filepath.WalkSebastiaan van Stijn2022-10-091-9/+9
| | | | | | | WalkDir is more performant as it doesn't perform an os.Lstat on every visited file or directory. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon/graphdriver: fix empty-lines (revive)Sebastiaan van Stijn2022-09-281-5/+0
| | | | | | | | | | | | | | | | | daemon/graphdriver/aufs/aufs.go:239:80: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/graphtest/graphbench_unix.go:249:27: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/graphtest/testutil.go:271:30: empty-lines: extra empty line at the end of a block (revive) daemon/graphdriver/graphtest/graphbench_unix.go:179:32: empty-block: this block is empty, you can remove it (revive) daemon/graphdriver/zfs/zfs.go:375:48: empty-lines: extra empty line at the end of a block (revive) daemon/graphdriver/overlay/overlay.go:248:89: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/devmapper/deviceset.go:636:21: empty-lines: extra empty line at the end of a block (revive) daemon/graphdriver/devmapper/deviceset.go:1150:70: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/devmapper/deviceset.go:1613:30: empty-lines: extra empty line at the end of a block (revive) daemon/graphdriver/devmapper/deviceset.go:1645:65: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/btrfs/btrfs.go:53:101: empty-lines: extra empty line at the start of a block (revive) daemon/graphdriver/devmapper/deviceset.go:1944:89: empty-lines: extra empty line at the start of a block (revive) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* pkg/containerfs: drop ContainerFS type aliasCory Snider2022-09-231-2/+1
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: alias ContainerFS to stringCory Snider2022-09-231-2/+2
| | | | | | Drop the constructor and redundant string() type-casts. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: simplify ContainerFS typeCory Snider2022-09-231-5/+5
| | | | | | Iterate towards dropping the type entirely. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Finish refactor of UID/GID usage to a new structCory Snider2022-03-143-34/+17
| | | | | | | | | | | | | | | | | | | | | | Finish the refactor which was partially completed with commit 34536c498d56, passing around IdentityMapping structs instead of pairs of []IDMap slices. Existing code which uses []IDMap relies on zero-valued fields to be valid, empty mappings. So in order to successfully finish the refactoring without introducing bugs, their replacement therefore also needs to have a useful zero value which represents an empty mapping. Change IdentityMapping to be a pass-by-value type so that there are no nil pointers to worry about. The functionality provided by the deprecated NewIDMappingsFromMaps function is required by unit tests to to construct arbitrary IdentityMapping values. And the daemon will always need to access the mappings to pass them to the Linux kernel. Accommodate these use cases by exporting the struct fields instead. BuildKit currently depends on the UIDs and GIDs methods so we cannot get rid of them yet. Signed-off-by: Cory Snider <csnider@mirantis.com>
* refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-273-15/+12
| | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Update to Go 1.17.0, and gofmt with Go 1.17Sebastiaan van Stijn2021-08-244-0/+4
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #42193 from lzhfromustc/3_23Brian Goff2021-07-281-1/+1
|\ | | | | discovery & test: Fix goroutine leaks by adding 1 buffer to channel
| * discovery & test: Fix goroutine leaks by adding 1 buffer to channellzhfromustc2021-03-241-1/+1
| | | | | | | | Signed-off-by: Ziheng Liu <lzhfromustc@gmail.com>
* | reformat "nolint" commentsSebastiaan van Stijn2021-06-102-3/+3
|/ | | | | | Unlike regular comments, nolint comments should not have a leading space. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* replace pkg/locker with github.com/moby/lockerSebastiaan van Stijn2020-09-101-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Really switch to moby/sys/mount*Kir Kolyshkin2020-03-202-2/+2
| | | | | | | | | | | | | | | | | | | | Switch to moby/sys/mount and mountinfo. Keep the pkg/mount for potential outside users. This commit was generated by the following bash script: ``` set -e -u -o pipefail for file in $(git grep -l 'docker/docker/pkg/mount"' | grep -v ^pkg/mount); do sed -i -e 's#/docker/docker/pkg/mount"#/moby/sys/mount"#' \ -e 's#mount\.\(GetMounts\|Mounted\|Info\|[A-Za-z]*Filter\)#mountinfo.\1#g' \ $file goimports -w $file done ``` Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* daemon/graphdriver: normalize comment formattingSebastiaan van Stijn2019-11-272-4/+4
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* devmapper: fix unit testKir Kolyshkin2019-10-071-2/+3
| | | | | | | | | | | | | | | | | | | | | | It has been pointed out that sometimes device mapper unit tests fail with the following diagnostics: > --- FAIL: TestDevmapperSetup (0.02s) > graphtest_unix.go:44: graphdriver: loopback attach failed > graphtest_unix.go:48: loopback attach failed The root cause is the absence of udev inside the container used for testing, which causes device nodes (/dev/loop*) to not be created. The test suite itself already has a workaround, but it only creates 8 devices (loop0 till loop7). It might very well be the case that the first few devices are already used by the system (on my laptop 15 devices are busy). The fix is to raise the number of devices being manually created. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Merge pull request #38930 from daym/fewer-modprobesAkihiro Suda2019-09-241-2/+8
|\ | | | | Use fewer modprobes
| * Use fewer modprobesDanny Milosavljevic2019-09-211-2/+8
| | | | | | | | Signed-off-by: Danny Milosavljevic <dannym@scratchpost.org>
* | unconvert: remove unnescessary conversionsSebastiaan van Stijn2019-09-181-1/+1
| | | | | | | | | | Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | goimports: fix importsSebastiaan van Stijn2019-09-182-2/+2
| | | | | | | | | | | | | | Format the source according to latest goimports. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | cast Dev and Rdev of Stat_t to uint64 for mipsDominic2019-08-011-2/+4
|/ | | | | Signed-off-by: Dominic <yindongchao@inspur.com> Signed-off-by: Dominic Yin <yindongchao@inspur.com>
* pkg/mount: wrap mount/umount errorsKir Kolyshkin2018-12-102-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | The errors returned from Mount and Unmount functions are raw syscall.Errno errors (like EPERM or EINVAL), which provides no context about what has happened and why. Similar to os.PathError type, introduce mount.Error type with some context. The error messages will now look like this: > mount /tmp/mount-tests/source:/tmp/mount-tests/target, flags: 0x1001: operation not permitted or > mount tmpfs:/tmp/mount-test-source-516297835: operation not permitted Before this patch, it was just > operation not permitted [v2: add Cause()] [v3: rename MountError to Error, document Cause()] [v4: fixes; audited all users] [v5: make Error type private; changes after @cpuguy83 reviews] Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* gd/dm: fix error messageKir Kolyshkin2018-10-021-1/+1
| | | | | | The parameter name was wrong, which may mislead a user. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Add ADD/COPY --chown flag support to WindowsSalahuddin Khan2018-08-132-5/+5
| | | | | | | | | | | | | | | | | | | | This implements chown support on Windows. Built-in accounts as well as accounts included in the SAM database of the container are supported. NOTE: IDPair is now named Identity and IDMappings is now named IdentityMapping. The following are valid examples: ADD --chown=Guest . <some directory> COPY --chown=Administrator . <some directory> COPY --chown=Guests . <some directory> COPY --chown=ContainerUser . <some directory> On Windows an owner is only granted the permission to read the security descriptor and read/write the discretionary access control list. This fix also grants read/write and execute permissions to the owner. Signed-off-by: Salahuddin Khan <salah@docker.com>
* Various code-cleanupSebastiaan van Stijn2018-05-232-4/+4
| | | | | | remove unnescessary import aliases, brackets, and so on. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Standardized log messages accross the different storage drivers.Alejandro González Hevia2018-03-272-105/+122
| | | | | | | | | | | | | | Now all of the storage drivers use the field "storage-driver" in their log messages, which is set to name of the respective driver. Storage drivers changed: - Aufs - Btrfs - Devicemapper - Overlay - Overlay 2 - Zfs Signed-off-by: Alejandro GonzÃlez Hevia <alejandrgh11@gmail.com>
* Merge pull request #36307 from kolyshkin/dm-miscTõnis Tiigi2018-03-072-42/+43
|\ | | | | devmapper cleanup improvements
| * devmapper.shutdown: optimizeKir Kolyshkin2018-03-051-39/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the "unmount and deactivate" code into a separate method, and optimize it a bit: 1. Do not use filepath.Walk() as there's no requirement to recursively go into every directory under home/mnt; a list of directories in mnt is sufficient. With filepath.Walk(), in case some container will fail to unmount, it'll go through the whole container filesystem which is excessive and useless. 2. Do not use GetMounts() and check if a directory is mounted; just unmount it and ignore "not mounted" error. Note the same error is returned in case of wrong flags set, but as flags are hardcoded we can safely ignore such case. While at it, promote "can't unmount" log level from debug to warning. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
| * devmapper cleanup: improve error msgKir Kolyshkin2018-03-051-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | 1. Make sure it's clear the error is from unmount. 2. Simplify the code a bit to make it more readable. [v2: use errors.Wrap] [v3: use errors.Wrapf] [v4: lowercase the error message] Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | Merge pull request #36437 from kolyshkin/dm-unusedBrian Goff2018-03-051-22/+0
|\ \ | |/ |/| devmapper.Mounted: remove
| * devmapper.Mounted: removeKir Kolyshkin2018-02-271-22/+0
| | | | | | | | | | | | It looks like no one uses this function. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | devmapper/Remove(): use Rmdir, ignore errorsKir Kolyshkin2018-03-021-5/+18
|/ | | | | | | | | | | | | 1. Replace EnsureRemoveAll() with Rmdir(), as here we are removing the container's mount point, which is already properly unmounted and is therefore an empty directory. 2. Ignore the Rmdir() error (but log it unless it's ENOENT). This is a mount point, currently unmounted (i.e. an empty directory), and an older kernel can return EBUSY if e.g. the mount was leaked to other mount namespaces. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Add canonical import commentDaniel Nephin2018-02-056-6/+6
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Do not make graphdriver homes private mounts.Brian Goff2018-01-181-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The idea behind making the graphdrivers private is to prevent leaking mounts into other namespaces. Unfortunately this is not really what happens. There is one case where this does work, and that is when the namespace was created before the daemon's namespace. However with systemd each system servie winds up with it's own mount namespace. This causes a race betwen daemon startup and other system services as to if the mount is actually private. This also means there is a negative impact when other system services are started while the daemon is running. Basically there are too many things that the daemon does not have control over (nor should it) to be able to protect against these kinds of leakages. One thing is certain, setting the graphdriver roots to private disconnects the mount ns heirarchy preventing propagation of unmounts... new mounts are of course not propagated either, but the behavior is racey (or just bad in the case of restarting services)... so it's better to just be able to keep mount propagation in tact. It also does not protect situations like `-v /var/lib/docker:/var/lib/docker` where all mounts are recursively bound into the container anyway. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Golint: remove redundant ifsSebastiaan van Stijn2018-01-153-37/+7
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* devmapper: Log fstype and mount options during mount errorVivek Goyal2017-12-111-2/+2
| | | | | | | | | Right now we only log source and destination (and demsg) if mount operation fails. fstype and mount options are available easily. It probably is a good idea to log these as well. Especially sometimes failures can happen due to mount options. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
* Simplify/fix MkdirAll usageKir Kolyshkin2017-11-272-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This subtle bug keeps lurking in because error checking for `Mkdir()` and `MkdirAll()` is slightly different wrt to `EEXIST`/`IsExist`: - for `Mkdir()`, `IsExist` error should (usually) be ignored (unless you want to make sure directory was not there before) as it means "the destination directory was already there" - for `MkdirAll()`, `IsExist` error should NEVER be ignored. Mostly, this commit just removes ignoring the IsExist error, as it should not be ignored. Also, there are a couple of cases then IsExist is handled as "directory already exist" which is wrong. As a result, some code that never worked as intended is now removed. NOTE that `idtools.MkdirAndChown()` behaves like `os.MkdirAll()` rather than `os.Mkdir()` -- so its description is amended accordingly, and its usage is handled as such (i.e. IsExist error is not ignored). For more details, a quote from my runc commit 6f82d4b (July 2015): TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in #2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of #1, IsExist check after MkdirAll is not needed. Because of #2 and #3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Remove deprecated MkdirAllAs(), MkdirAs()Sebastiaan van Stijn2017-11-212-5/+5
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #34573 from cyphar/dm-dos-prevention-remove-mountpointVincent Demeester2017-11-083-1/+68
|\ | | | | devicemapper: remove container rootfs mountPath after umount
| * devmapper: add a test for mount leak workaroundAleksa Sarai2017-11-081-0/+53
| | | | | | | | | | | | | | | | | | | | | | In order to avoid reverting our fix for mount leakage in devicemapper, add a test which checks that devicemapper's Get() and Put() cycle can survive having a command running in an rprivate mount propagation setup in-between. While this is quite rudimentary, it should be sufficient. We have to skip this test for pre-3.18 kernels. Signed-off-by: Aleksa Sarai <asarai@suse.de>
| * devicemapper: remove container rootfs mountPath after umountAleksa Sarai2017-09-062-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libdm currently has a fairly substantial DoS bug that makes certain operations fail on a libdm device if the device has active references through mountpoints. This is a significant problem with the advent of mount namespaces and MS_PRIVATE, and can cause certain --volume mounts to cause libdm to no longer be able to remove containers: % docker run -d --name testA busybox top % docker run -d --name testB -v /var/lib/docker:/docker busybox top % docker rm -f testA [fails on libdm with dm_task_run errors.] This also solves the problem of unprivileged users being able to DoS docker by using unprivileged mount namespaces to preseve mounts that Docker has dropped. Signed-off-by: Aleksa Sarai <asarai@suse.de>
* | Improve devicemapper driver-status outputSebastiaan van Stijn2017-10-271-10/+19
| | | | | | | | | | | | | | Do not print "Data file" and "Metadata file" if they're not used, and sort/group output. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | devmapper: tell why xfs is not supportedKir Kolyshkin2017-09-171-10/+11
| | | | | | | | | | | | | | Instead of providing a generic message listing all possible reasons why xfs is not available on the system, let's be specific. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | devmapper: show dmesg if mount failsKir Kolyshkin2017-09-171-2/+3
| | | | | | | | | | | | | | If mount fails, the reason might be right there in the kernel log ring buffer. Let's include it in the error message, it might be of great help. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | devmapper: don't create too new xfsKir Kolyshkin2017-09-171-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the update to Debian Stretch, devmapper unit test fails. One reason is, the combination of somewhat old (less than 3.16) kernel and relatively new xfsprogs leads to creating a filesystem which is not supported by the kernel: > [12206.467518] XFS (dm-1): Superblock has unknown read-only compatible features (0x1) enabled. > [12206.472046] XFS (dm-1): Attempted to mount read-only compatible filesystem read-write. > Filesystem can only be safely mounted read only. > [12206.472079] XFS (dm-1): SB validate failed with error 22. Ideally, that would be automatically and implicitly handled by xfsprogs. In real life, we have to take care about it here. Sigh. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | LCOW: Implemented support for docker cp + buildAkash Gupta2017-09-141-9/+10
| | | | | | | | | | | | | | | | | | | | This enables docker cp and ADD/COPY docker build support for LCOW. Originally, the graphdriver.Get() interface returned a local path to the container root filesystem. This does not work for LCOW, so the Get() method now returns an interface that LCOW implements to support copying to and from the container. Signed-off-by: Akash Gupta <akagup@microsoft.com>
* | Add gosimple linterDaniel Nephin2017-09-122-24/+17
|/ | | | | | Update gometalinter Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Fix golint errors.Daniel Nephin2017-08-181-2/+2
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* devmapper autosetup: add check for thin_checkKir Kolyshkin2017-08-141-30/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | I was able to successfully use device mapper autoconfig feature (commit 5ef07d79c) but it stopped working after a reboot. Investigation shown that the dm device was not activated because of a missing binary, that is not used during initial setup, but every following time. Here's an error shown when trying to manually activate the device: > kir@kd:~/go/src/github.com/docker/docker$ sudo lvchange -a y /dev/docker/thinpool > /usr/sbin/thin_check: execvp failed: No such file or directory > Check of pool docker/thinpool failed (status:2). Manual repair required! Surely, there is no solution to this other than to have a package that provides the thin_check binary installed beforehand. Due to the fact the issue revealed itself way later than DM setup was performed, it was somewhat harder to investigate. With this in mind, let's check for binary presense before setting up DM, refusing to proceed if the binary is not there, saving a user from later frustration. While at it, eliminate repeated binary checking code. The downside is that the binary lookup is happening more than once now -- I think the clarity of code overweights this minor de-optimization. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* devmapper: refer to dockerd man pageKir Kolyshkin2017-08-141-1/+1
| | | | | | ...not the docker one. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
View Lorry Controller Status