resmgr: disallow docker-based runtimes by default.

Disallow docker-based CRI runtime emulation unless
explicitly enabled on the command line.

pkg/cri/resource-manager/flags.go

@@ -28,6 +28,7 @@ type options struct {
 	RuntimeSocket       string
 	RelaySocket         string
 	RelayDir            string
+	AllowDocker         bool
 	AgentSocket         string
 	ConfigSocket        string
 	PidFile             string
@@ -56,6 +57,9 @@ func init() {
 		"Unix domain socket path where the resource manager should serve requests on.")
 	flag.StringVar(&opt.RelayDir, "relay-dir", "/var/lib/cri-resmgr",
 		"Permanent storage directory path for the resource manager to store its state in.")
+	flag.BoolVar(&opt.AllowDocker, "allow-docker", false,
+		"Allow cri-dockerd/docker-shim as a CRI runtime. Usually this is not a good idea.")
+
 	flag.StringVar(&opt.AgentSocket, "agent-socket", sockets.ResourceManagerAgent,
 		"local socket of the cri-resmgr agent to connect")
 	flag.StringVar(&opt.ConfigSocket, "config-socket", sockets.ResourceManagerConfig,

pkg/cri/resource-manager/requests.go

@@ -17,6 +17,7 @@ package resmgr
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	criapi "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
 
@@ -28,6 +29,11 @@ import (
 	"github.com/intel/cri-resource-manager/pkg/cri/server"
 )
 
+const (
+	kubeAPIVersion    = "0.1.0"
+	dockerRuntimeName = "docker"
+)
+
 // setupRequestProcessing prepares the resource manager for CRI request processing.
 func (m *resmgr) setupRequestProcessing() error {
 	interceptors := map[string]server.Interceptor{
@@ -158,6 +164,18 @@ func (m *resmgr) startRequestProcessing() error {
 
 // syncWithCRI synchronizes cache pods and containers with the CRI runtime.
 func (m *resmgr) syncWithCRI(ctx context.Context) ([]cache.Container, []cache.Container, error) {
+	version, err := m.relay.Client().Version(ctx, &criapi.VersionRequest{
+		Version: kubeAPIVersion,
+	})
+	if err != nil {
+		return nil, nil, resmgrError("failed to query runtime version: %v", err)
+	}
+	if strings.HasPrefix(version.RuntimeName, dockerRuntimeName) {
+		if !opt.AllowDocker {
+			return nil, nil, resmgrError("%s runtime disallowed", version.RuntimeName)
+		}
+	}
+
 	if m.policy.Bypassed() || !m.relay.Client().HasRuntimeService() {
 		return nil, nil, nil
 	}