Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

perhaps docker daemon should check for pid _first_ #6973

Closed
vbatts opened this issue Jul 11, 2014 · 0 comments · Fixed by #6976
Closed

perhaps docker daemon should check for pid _first_ #6973

vbatts opened this issue Jul 11, 2014 · 0 comments · Fixed by #6976

Comments

@vbatts
Copy link
Contributor

vbatts commented Jul 11, 2014

While testing #6950, I noticed that the iptables rules are excuted, before checking that a docker pid is present. This could be problematic.

[debug] server.go:1227 docker group found. gid: 213
[debug] deviceset.go:554 Generated prefix: docker-253:2-14286850
[debug] deviceset.go:557 Checking for existence of the pool 'docker-253:2-14286850-pool'
[debug] deviceset.go:576 Pool doesn't exist. Creating it.
[debug] deviceset.go:176 Creating loopback file /home/docker/devicemapper/devicemapper/data for device-manage use
[debug] attach_loopback.go:94 Error retrieving the next available loopback: open /dev/loop-control: no such file or directory
[debug] deviceset.go:176 Creating loopback file /home/docker/devicemapper/devicemapper/metadata for device-manage use
[debug] attach_loopback.go:94 Error retrieving the next available loopback: open /dev/loop-control: no such file or directory
[debug] deviceset.go:393 Initializing base device-manager snapshot
[debug] devmapper.go:494 [devmapper] createDevice(poolName=/dev/mapper/docker-253:2-14286850-pool, deviceId=0)
[debug] deviceset.go:405 Registering base device (id 0) with FS size 10737418240
[debug] deviceset.go:254 registerDevice(0, )
[debug] deviceset.go:412 Creating filesystem on base device-manager snapshot
[debug] deviceset.go:280 activateDeviceIfNeeded()
[debug] daemon.go:780 Using graph driver devicemapper
[debug] daemon.go:798 Creating images graph
[debug] graph.go:67 Restored 0 elements
[debug] daemon.go:810 Creating volumes graph
[debug] graph.go:67 Restored 0 elements
[debug] daemon.go:815 Creating repository list
[63304b54] +job init_networkdriver()
[debug] /sbin/iptables, [-C POSTROUTING -t nat -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE]
[debug] /sbin/iptables, [-D POSTROUTING -t nat -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE]
[debug] /sbin/iptables, [-I POSTROUTING -t nat -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE]
[debug] /sbin/iptables, [-D FORWARD -i docker0 -o docker0 -j DROP]
[debug] /sbin/iptables, [-C FORWARD -i docker0 -o docker0 -j ACCEPT]
[debug] /sbin/iptables, [-D FORWARD -i docker0 -o docker0 -j ACCEPT]
[debug] driver.go:210 Enable inter-container communication
[debug] /sbin/iptables, [-I FORWARD -i docker0 -o docker0 -j ACCEPT]
[debug] /sbin/iptables, [-C FORWARD -i docker0 ! -o docker0 -j ACCEPT]
[debug] /sbin/iptables, [-D FORWARD -i docker0 ! -o docker0 -j ACCEPT]
[debug] /sbin/iptables, [-I FORWARD -i docker0 ! -o docker0 -j ACCEPT]
[debug] /sbin/iptables, [-C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]
[debug] /sbin/iptables, [-D FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]
[debug] /sbin/iptables, [-I FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]
[debug] /sbin/iptables, [-t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]
[debug] /sbin/iptables, [-t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER]
[debug] /sbin/iptables, [-t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]
[debug] /sbin/iptables, [-t nat -D PREROUTING -j DOCKER]
[debug] /sbin/iptables, [-t nat -D OUTPUT -j DOCKER]
[debug] /sbin/iptables, [-t nat -F DOCKER]
[debug] /sbin/iptables, [-t nat -X DOCKER]
[debug] /sbin/iptables, [-t nat -N DOCKER]
[debug] /sbin/iptables, [-t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]
[debug] /sbin/iptables, [-t nat -A OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER]
[63304b54] -job init_networkdriver() = OK (0)
[63304b54.initserver()] Creating pidfile
2014/07/11 11:48:39 pid file found, ensure docker is not running or delete /var/run/docker.pid
vbatts added a commit to vbatts/moby that referenced this issue Jul 12, 2014
fixes moby#6973

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
shykes pushed a commit to shykes/docker-dev that referenced this issue Oct 2, 2014
fixes moby/moby#6973

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant