Merge dev branch

.dockerignore

@@ -1,2 +1 @@
 downloads
-test

.travis.yml

@@ -40,7 +40,6 @@ install:
 
 script:
   - make deps
-  - make vet
   - make build-devserver
   - make build-devjmstest
   - eval "$DOCKER_DOWNGRADE"

Dockerfile-server

@@ -17,11 +17,12 @@ ARG BASE_IMAGE=ubuntu:16.04
 ###############################################################################
 # Build stage to build Go code
 ###############################################################################
-FROM golang:1.10 as builder 
+FROM mq-golang-sdk:9.0.5.0-x86_64-ubuntu-16.04 as builder
 WORKDIR /go/src/github.com/ibm-messaging/mq-container/
 COPY cmd/ ./cmd
 COPY internal/ ./internal
 COPY vendor/ ./vendor
+COPY test/ ./test
 RUN go build ./cmd/runmqserver/
 RUN go build ./cmd/chkmqready/
 RUN go build ./cmd/chkmqhealthy/
@@ -30,6 +31,7 @@ RUN go test -v ./cmd/runmqserver/
 RUN go test -v ./cmd/chkmqready/
 RUN go test -v ./cmd/chkmqhealthy/
 RUN go test -v ./internal/...
+RUN go vet ./cmd/... ./internal/... ./test/...
 
 ###############################################################################
 # Main build stage, to build MQ image
@@ -62,8 +64,8 @@ RUN chmod ug+x /usr/local/bin/runmqserver \
   && chown mqm:mqm /usr/local/bin/*mq* \
   && chmod ug+xs /usr/local/bin/chkmq*
 
-# Always use port 1414
-EXPOSE 1414
+# Always use port 1414 for MQ & 9157 for the metrics
+EXPOSE 1414 9157
 
 ENV LANG=en_US.UTF-8 AMQ_DIAGNOSTIC_MSG_SEVERITY=1 AMQ_ADDITIONAL_JSON_LOG=1 LOG_FORMAT=basic
 

Makefile

@@ -33,6 +33,10 @@ TEST_OPTS_DOCKER ?=
 MQ_IMAGE_ADVANCEDSERVER ?=mqadvanced-server:$(MQ_VERSION)-$(ARCH)-$(BASE_IMAGE_TAG)
 # MQ_IMAGE_DEVSERVER is the name and tag of the built MQ Advanced for Developers image
 MQ_IMAGE_DEVSERVER ?=mqadvanced-server-dev:$(MQ_VERSION)-$(ARCH)-$(BASE_IMAGE_TAG)
+# MQ_IMAGE_SDK is the name and tag of the built MQ Advanced for Developers SDK image
+MQ_IMAGE_SDK ?=mq-sdk:$(MQ_VERSION)-$(ARCH)-$(BASE_IMAGE_TAG)
+# MQ_IMAGE_GOLANG_SDK is the name and tag of the built MQ Advanced for Developers SDK image, plus Go tools
+MQ_IMAGE_GOLANG_SDK ?=mq-golang-sdk:$(MQ_VERSION)-$(ARCH)-$(BASE_IMAGE_TAG)
 # DOCKER is the Docker command to run
 DOCKER ?= docker
 # MQ_PACKAGES specifies the MQ packages (.deb or .rpm) to install.  Defaults vary on base image.
@@ -100,7 +104,7 @@ all: build-devserver build-advancedserver
 test-all: test-devserver test-advancedserver
 
 .PHONY: precommit
-precommit: vet fmt lint all test-all
+precommit: fmt lint all test-all
 
 .PHONY: devserver
 devserver: build-devserver test-devserver
@@ -138,7 +142,7 @@ build-cov:
 
 # Shortcut to just run the unit tests
 .PHONY: test-unit
-test-unit:
+test-unit: test/docker/vendor
 	docker build --target builder --file Dockerfile-server .
 
 .PHONY: test-advancedserver
@@ -196,7 +200,6 @@ define docker-build-mq
 	  nginx:alpine
 	# Build the new image (use --pull to make sure we have the latest base image)
 	$(DOCKER) build \
-	  --pull \
 	  --tag $1 \
 	  --file $2 \
 	  --network build \
@@ -217,14 +220,14 @@ docker-version:
 	@test "$(word 1,$(subst ., ,$(DOCKER_SERVER_VERSION)))" -ge "17" || ("$(word 1,$(subst ., ,$(DOCKER_SERVER_VERSION)))" -eq "17" && "$(word 2,$(subst ., ,$(DOCKER_CLIENT_VERSION)))" -ge "05") || (echo "Error: Docker server 17.05 or greater is required" && exit 1)
 
 .PHONY: build-advancedserver
-build-advancedserver: downloads/$(MQ_ARCHIVE) docker-version
+build-advancedserver: downloads/$(MQ_ARCHIVE) docker-version build-golang-sdk test/docker/vendor
 	$(info $(SPACER)$(shell printf $(TITLE)"Build $(MQ_IMAGE_ADVANCEDSERVER)"$(END)))
 	$(call docker-build-mq,$(MQ_IMAGE_ADVANCEDSERVER),Dockerfile-server,$(MQ_ARCHIVE),"4486e8c4cc9146fd9b3ce1f14a2dfc5b","IBM MQ Advanced",$(MQ_VERSION))
 
 .PHONY: build-devserver
 # Target-specific variable to add web server into devserver image
 build-devserver: MQ_PACKAGES=ibmmq-server ibmmq-java ibmmq-jre ibmmq-gskit ibmmq-msg-.* ibmmq-samples ibmmq-ams ibmmq-web
-build-devserver: downloads/$(MQ_ARCHIVE_DEV) docker-version
+build-devserver: downloads/$(MQ_ARCHIVE_DEV) docker-version build-golang-sdk test/docker/vendor
 	$(info $(shell printf $(TITLE)"Build $(MQ_IMAGE_DEVSERVER_BASE)"$(END)))
 	$(call docker-build-mq,$(MQ_IMAGE_DEVSERVER_BASE),Dockerfile-server,$(MQ_ARCHIVE_DEV),"98102d16795c4263ad9ca075190a2d4d","IBM MQ Advanced for Developers (Non-Warranted)",$(MQ_VERSION))
 	docker build --tag $(MQ_IMAGE_DEVSERVER) --file incubating/mqadvanced-server-dev/Dockerfile .
@@ -233,18 +236,25 @@ build-devserver: downloads/$(MQ_ARCHIVE_DEV) docker-version
 build-advancedserver-cover: docker-version
 	$(DOCKER) build --build-arg BASE_IMAGE=$(MQ_IMAGE_ADVANCEDSERVER) -t $(MQ_IMAGE_ADVANCEDSERVER)-cover -f Dockerfile-server.cover .
 
-.PHONY: build-explorer
+.PHONY: build-explorer docker-pull
 build-explorer: downloads/$(MQ_ARCHIVE_DEV)
 	$(call docker-build-mq,mq-explorer:latest-$(ARCH),incubating/mq-explorer/Dockerfile-mq-explorer,$(MQ_ARCHIVE_DEV),"98102d16795c4263ad9ca075190a2d4d","IBM MQ Advanced for Developers (Non-Warranted)",$(MQ_VERSION))
 
+build-sdk: downloads/$(MQ_ARCHIVE_DEV) docker-version docker-pull
+	$(call docker-build-mq,$(MQ_IMAGE_SDK),incubating/mq-sdk/Dockerfile,$(MQ_ARCHIVE_DEV),"98102d16795c4263ad9ca075190a2d4d","IBM MQ Advanced for Developers SDK (Non-Warranted)",$(MQ_VERSION))
+
+build-golang-sdk: build-sdk
+	$(DOCKER) build --build-arg BASE_IMAGE=$(MQ_IMAGE_SDK) -t $(MQ_IMAGE_GOLANG_SDK) -f incubating/mq-golang-sdk/Dockerfile .
+#	$(call docker-build-mq,$(MQ_IMAGE_GOLANG_SDK),incubating/mq-golang-sdk/Dockerfile,$(MQ_ARCHIVE),"98102d16795c4263ad9ca075190a2d4d","IBM MQ Advanced for Developers SDK (Non-Warranted)",$(MQ_VERSION))
+
+docker-pull:
+	$(DOCKER) pull $(BASE_IMAGE)
+
 GO_PKG_DIRS = ./cmd ./internal ./test
 
 fmt: $(addsuffix /$(wildcard *.go), $(GO_PKG_DIRS))
 	go fmt $(addsuffix /..., $(GO_PKG_DIRS))
 
-vet: $(addsuffix /$(wildcard *.go), $(GO_PKG_DIRS)) test/docker/vendor
-	go vet $(addsuffix /..., $(GO_PKG_DIRS))
-
 lint: $(addsuffix /$(wildcard *.go), $(GO_PKG_DIRS))
 	@# This expression is necessary because /... includes the vendor directory in golint
 	@# As of 11/04/2018 there is an open issue to fix it: https://github.com/golang/lint/issues/320

NOTICES.txt

@@ -20,6 +20,14 @@ Affected Components:
 * golang.org/x/sys
   Copyright (c) 2009 The Go Authors. All rights reserved.
 
+B.2 MIT license
+* github.com/genuinetools/amicontained
+  Copyright (c) 2018 The Genuinetools Authors
+
+B.3 BSD 2-Clause license
+* github.com/syndtr/gocapability/
+  Copyright 2013 Suryandaru Triandana <syndtr@gmail.com>
+
 ===============================================================================
 END OF A. SUMMARY
 ===============================================================================
@@ -58,6 +66,58 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 END OF B.1 BSD 3-Clause license
 ==========================================================================
 
+==========================================================================
+B.2 MIT license
+==========================================================================
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+==========================================================================
+END OF B.2 MIT license
+==========================================================================
+
+==========================================================================
+B.3 BSD 2-Clause license
+==========================================================================
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+==========================================================================
+END OF B.3 BSD 2-Clause license
+==========================================================================
+
 ==========================================================================
 END OF B. LICENSE FILES AND OTHER INFORMATION
 ==========================================================================

cmd/runmqserver/main.go

@@ -23,6 +23,7 @@ import (
 	"os"
 	"sync"
 
+	"github.com/ibm-messaging/mq-container/internal/metrics"
 	"github.com/ibm-messaging/mq-container/internal/name"
 	"github.com/ibm-messaging/mq-container/internal/ready"
 )
@@ -117,6 +118,14 @@ func doMain() error {
 		return err
 	}
 	configureQueueManager()
+
+	enableMetrics := os.Getenv("MQ_ENABLE_METRICS")
+	if enableMetrics == "true" || enableMetrics == "1" {
+		go metrics.GatherMetrics(name, log)
+	} else {
+		log.Println("Metrics are disabled")
+	}
+
 	// Start reaping zombies from now on.
 	// Start this here, so that we don't reap any sub-processes created
 	// by this process (e.g. for crtmqm or strmqm)

cmd/runmqserver/mqconfig.go

@@ -22,9 +22,18 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/ibm-messaging/mq-container/internal/capabilities"
+	"github.com/genuinetools/amicontained/container"
 )
 
+func logContainerRuntime() error {
+	r, err := container.DetectRuntime()
+	if err != nil {
+		return err
+	}
+	log.Printf("Container runtime: %v", r)
+	return nil
+}
+
 func logBaseImage() error {
 	buf, err := ioutil.ReadFile("/etc/os-release")
 	if err != nil {
@@ -35,7 +44,7 @@ func logBaseImage() error {
 		if strings.HasPrefix(l, "PRETTY_NAME=") {
 			words := strings.Split(l, "\"")
 			if len(words) >= 2 {
-				log.Printf("Base image detected: %v", words[1])
+				log.Printf("Base image: %v", words[1])
 				return nil
 			}
 		}
@@ -46,20 +55,50 @@ func logBaseImage() error {
 func logUser() {
 	u, err := user.Current()
 	if err == nil {
-		log.Printf("Running as user ID %v (%v) with primary group %v", u.Uid, u.Name, u.Gid)
+		g, err := u.GroupIds()
+		if err != nil {
+			log.Printf("Running as user ID %v (%v) with primary group %v", u.Uid, u.Name, u.Gid)
+		} else {
+			// Look for the primary group in the list of group IDs
+			for i, v := range g {
+				if v == u.Gid {
+					// Remove the element from the slice
+					g = append(g[:i], g[i+1:]...)
+				}
+			}
+			log.Printf("Running as user ID %v (%v) with primary group %v, and supplemental groups %v", u.Uid, u.Name, u.Gid, strings.Join(g, ","))
+		}
 	}
 }
 
-func logCapabilities() {
-	status, err := readProc("/proc/1/status")
+// logCapabilities logs the Linux capabilities (e.g. setuid, setgid).  See https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
+func logCapabilities() error {
+	caps, err := container.Capabilities()
 	if err != nil {
-		// Ignore
-		return
+		return err
 	}
-	caps, err := capabilities.DetectCapabilities(status)
-	if err == nil {
-		log.Printf("Detected capabilities: %v", strings.Join(caps, ","))
+	for k, v := range caps {
+		if len(v) > 0 {
+			log.Printf("Capabilities (%s set): %v", strings.ToLower(k), strings.Join(v, ","))
+		}
 	}
+	return nil
+}
+
+// logSeccomp logs the seccomp enforcing mode, which affects which kernel calls can be made
+func logSeccomp() error {
+	s, err := container.SeccompEnforcingMode()
+	if err != nil {
+		return err
+	}
+	log.Printf("seccomp enforcing mode: %v", s)
+	return nil
+}
+
+func logAppArmor() error {
+	s := container.AppArmorProfile()
+	log.Printf("AppArmor profile: %v", s)
+	return nil
 }
 
 func readProc(filename string) (value string, err error) {
@@ -106,6 +145,7 @@ func logConfig() error {
 		} else {
 			log.Printf("Linux kernel version: %v", osr)
 		}
+		logContainerRuntime()
 		logBaseImage()
 		fileMax, err := readProc("/proc/sys/fs/file-max")
 		if err != nil {
@@ -115,6 +155,8 @@ func logConfig() error {
 		}
 		logUser()
 		logCapabilities()
+		logSeccomp()
+		logAppArmor()
 		err = readMounts()
 		if err != nil {
 			return err