Add sysctls support #2729

dperny · 2018-08-22T14:38:28Z

- What I did

Adds support for sysctl options to the container spec. This is equivalent to the --sysctl flag on docker run.

- How I did it
Added a field to the protocol buffer for sysctl options.

Only API changes are required for swarmkit. All of the other changes involving plumbing through these options happens downstream in the engine.

- How to test it

N/A, we don't even use this field directly in swarmkit.

- Description for the changelog

Added support for sysctls in services. This is equivalent to the --sysctl flag on docker run.

ctelfer

LGTM FWIW

Obviously swarm doesn't care much about this ... just needs to carry the information.

Adds support for sysctl options in docker services. * Adds API plumbing for creating services with sysctl options set. * Adds swagger.yaml documentation for new API field. * Changes executor package to make use of the Sysctls field on objects * Includes integration test to verify that new behavior works. Essentially, everything needed to support the equivalent of docker run's `--sysctl` option except the CLI. Depends on docker/swarmkit#2729, which is not merged yet, and so has my fork branch of swarmkit vendored in to demonstrate passing integration test. Signed-off-by: Drew Erny <drew.erny@docker.com>

anshulpundir · 2018-08-22T21:45:15Z

api/specs.proto

+	// Sysctls sets namespaced kernel parameters (sysctls) in the container. This
+	// option is equivalent to passing --sysctl to docker run.
+	//
+	// Note that while options are are subject to the same restrictions as


remove one 'are'

Adds support for sysctl options in docker services. * Adds API plumbing for creating services with sysctl options set. * Adds swagger.yaml documentation for new API field. * Updates the API version history document. * Changes executor package to make use of the Sysctls field on objects * Includes integration test to verify that new behavior works. Essentially, everything needed to support the equivalent of docker run's `--sysctl` option except the CLI. Depends on docker/swarmkit#2729, which is not merged yet, and so has my fork branch of swarmkit vendored in to demonstrate passing integration test. Signed-off-by: Drew Erny <drew.erny@docker.com>

thaJeztah

LGTM (perhaps after @anshulpundir's nit was addressed, but not a blocker for me)

thaJeztah · 2018-08-23T15:53:49Z

api/specs.pb.go

@@ -2064,6 +2085,25 @@ func (m *ContainerSpec) MarshalTo(dAtA []byte) (int, error) {
 		i++
 		i = encodeVarintSpecs(dAtA, i, uint64(m.PidsLimit))
 	}
+	if len(m.Sysctls) > 0 {


~~this check looks redundant; the code inside the for loop won't be executed if it's empty; https://play.golang.org/p/SkHL_G_iJtv~~

edit: nevermind. Didn't notice I was looking at generated code ("Code generated by protoc-gen-gogo. DO NOT EDIT.") 😊

thaJeztah · 2018-08-23T15:53:49Z

api/specs.pb.go

@@ -2781,6 +2821,14 @@ func (m *ContainerSpec) Size() (n int) {
 	if m.PidsLimit != 0 {
 		n += 2 + sovSpecs(uint64(m.PidsLimit))
 	}
+	if len(m.Sysctls) > 0 {


~~Same here; this check looks redundant~~

edit: nevermind. Didn't notice I was looking at generated code ("Code generated by protoc-gen-gogo. DO NOT EDIT.") 😊

Adds support for sysctl options to the container spec. This is equivalent to the --sysctl flag on `docker run`. Only API changes are required for swarmkit. All of the other changes involving plumbing through these options happens downstream in the engine. Signed-off-by: Drew Erny <drew.erny@docker.com>

dperny · 2018-08-24T14:35:43Z

Removed one of two consecutive "are"s.

codecov · 2018-08-24T14:45:53Z

Codecov Report

Merging #2729 into master will increase coverage by <.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #2729      +/-   ##
==========================================
+ Coverage   61.71%   61.72%   +<.01%     
==========================================
  Files         134      134              
  Lines       21888    21888              
==========================================
+ Hits        13508    13510       +2     
+ Misses       6916     6912       -4     
- Partials     1464     1466       +2

Adds support for sysctl options in docker services. * Adds API plumbing for creating services with sysctl options set. * Adds swagger.yaml documentation for new API field. * Updates the API version history document. * Changes executor package to make use of the Sysctls field on objects * Includes integration test to verify that new behavior works. Essentially, everything needed to support the equivalent of docker run's `--sysctl` option except the CLI. Depends on docker/swarmkit#2729, which is not merged yet, and so has my fork branch of swarmkit vendored in to demonstrate passing integration test. Signed-off-by: Drew Erny <drew.erny@docker.com>

anshulpundir · 2018-08-24T20:26:42Z

api/specs.proto

@@ -315,9 +315,24 @@ message ContainerSpec {
 	// Runtimes that don't support it ignore that field
 	Isolation isolation = 24;

-	// PidsLimit prevents from OS resource damage by applications inside the container 
+	// PidsLimit prevents from OS resource damage by applications inside the container


supernit: remove 'from'

cballou · 2018-09-15T17:08:57Z

I see this was merged into master. What version of docker-ce can we find this in? Edge? Experimental? I'm looking for docker compose support of sysctls when using docker stack deploy -f docker-compose.yaml.

I'm currently running docker version 18.06.1-ce with a docker-compose.yaml file on version 3.7 which continues to include the warning: Ignoring unsupported options: sysctls when running docker stack deploy.

gittycat · 2018-09-17T07:20:50Z

@thaJeztah The #2729 was pushed to SwarmKit on Aug 25. SwarmKit hasn't been updated in docker-ce since Aug 4th. You did the bump. This would be an important missing feature to add to docker-ce 18.9.0 while it's still in beta. Is this a possibility?

This also brings in these PRs from swarmkit: - docker/swarmkit#2691 - docker/swarmkit#2744 - docker/swarmkit#2732 - docker/swarmkit#2729 - docker/swarmkit#2748 Signed-off-by: Tibor Vass <tibor@docker.com>

This also brings in these PRs from swarmkit: - docker/swarmkit#2691 - docker/swarmkit#2744 - docker/swarmkit#2732 - docker/swarmkit#2729 - docker/swarmkit#2748 Signed-off-by: Tibor Vass <tibor@docker.com> Upstream-commit: cce1763d57b5c8fc446b0863517bb5313e7e53be Component: engine

nadworny · 2019-06-14T14:27:57Z

Support for swarm and sysctls is available in 19.03 RC2

ctelfer approved these changes Aug 22, 2018

View changes

dperny mentioned this pull request Aug 22, 2018

Add support for sysctl options in services moby/moby#37701

Merged

anshulpundir approved these changes Aug 22, 2018

View changes

thaJeztah approved these changes Aug 23, 2018

View changes

dperny force-pushed the dperny:add-sysctls-support branch from 0e685ac to ae22e33 Aug 24, 2018

anshulpundir reviewed Aug 24, 2018

View changes

anshulpundir approved these changes Aug 24, 2018

View changes

anshulpundir merged commit 27f5625 into docker:master Aug 24, 2018
3 checks passed

3 checks passed

ci/circleci Your tests passed on CircleCI!
Details

codecov/project 61.72% (target 0%)
Details

dco-signed All commits are signed

thaJeztah mentioned this pull request Sep 12, 2018

Global Default AddressPool - Update moby/moby#37736

Merged

tiborvass mentioned this pull request Sep 22, 2018

[18.09] Remove boltdb dependency docker/engine#60

Merged

docker / swarmkit

Add sysctls support #2729

Add sysctls support #2729

dperny commented Aug 22, 2018

ctelfer left a comment

This comment has been minimized.

thaJeztah left a comment

This comment has been minimized.

This comment has been minimized.

dperny commented Aug 24, 2018

codecov bot commented Aug 24, 2018

This comment has been minimized.

cballou commented Sep 15, 2018 •

edited

gittycat commented Sep 17, 2018

nadworny commented Jun 14, 2019

docker / swarmkit

Add sysctls support #2729

Add sysctls support #2729

Conversation

dperny commented Aug 22, 2018

ctelfer left a comment

This comment has been minimized.

anshulpundir Aug 22, 2018 Contributor

thaJeztah left a comment

This comment has been minimized.

thaJeztah Aug 23, 2018 Member

This comment has been minimized.

thaJeztah Aug 23, 2018 Member

dperny commented Aug 24, 2018

codecov bot commented Aug 24, 2018

Codecov Report

This comment has been minimized.

anshulpundir Aug 24, 2018 Contributor

cballou commented Sep 15, 2018 • edited

gittycat commented Sep 17, 2018

nadworny commented Jun 14, 2019

anshulpundir Aug 22, 2018
Contributor

thaJeztah Aug 23, 2018
Member

thaJeztah Aug 23, 2018
Member

anshulpundir Aug 24, 2018
Contributor

cballou commented Sep 15, 2018 •

edited