Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Show "seccomp" in docker info (#20909). #21172

Merged
merged 1 commit into from Apr 14, 2016
Merged

Show "seccomp" in docker info (#20909). #21172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 12 additions & 0 deletions daemon/info.go
View file
Open in desktop
Expand Up @@ -67,6 +67,17 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
}
})

var securityOptions []string
if sysInfo.AppArmor {
securityOptions = append(securityOptions, "apparmor")
}
if sysInfo.Seccomp {
securityOptions = append(securityOptions, "seccomp")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seccomp and apparmor (?) can have a custom profile loaded. I don't see why this is useful w/o showing what's there. This output is just basically telling me that I have seccomp|apparmor|selinux on my system :| I find this superfluous

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i.e. we have a bug report mentioning it's using seccomp but we don't have the profile (if it isn't the default)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The main aim is so when triaging issues we know what a user has installed, which is very hard to find now.

For seccomp the profile is per container run, so the daemon cannot print it. For apparmor it could be useful, but we dont want to always print it I dont think, it is large.

}
if selinuxEnabled() {
securityOptions = append(securityOptions, "selinux")
}

v := &types.Info{
ID: daemon.ID,
Containers: int(cRunning + cPaused + cStopped),
Expand Down Expand Up @@ -104,6 +115,7 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
HTTPProxy: sockets.GetProxyEnv("http_proxy"),
HTTPSProxy: sockets.GetProxyEnv("https_proxy"),
NoProxy: sockets.GetProxyEnv("no_proxy"),
SecurityOptions: securityOptions,
}

// TODO Windows. Refactor this more once sysinfo is refactored into
Expand Down
1 change: 1 addition & 0 deletions docs/reference/api/docker_remote_api.md
View file
Open in desktop
Expand Up @@ -117,6 +117,7 @@ This section lists each version from latest to oldest. Each listing includes a
[Docker Remote API v1.24](docker_remote_api_v1.24.md) documentation

* `POST /containers/create` now takes `StorageOpt` field.
* `GET /info` now returns `SecurityOptions` field, showing if `apparmor`, `seccomp`, or `selinux` is supported.

### v1.23 API changes

Expand Down
5 changes: 5 additions & 0 deletions docs/reference/api/docker_remote_api_v1.24.md
View file
Open in desktop
Expand Up @@ -2239,6 +2239,11 @@ Display system-wide information
"127.0.0.0/8"
]
},
"SecurityOptions": [
"apparmor",
"seccomp",
"selinux"
],
"ServerVersion": "1.9.0",
"SwapLimit": false,
"SystemStatus": [["State", "Healthy"]],
Expand Down
3 changes: 2 additions & 1 deletion integration-cli/docker_api_info_test.go
View file
Open in desktop
Expand Up @@ -31,7 +31,8 @@ func (s *DockerSuite) TestInfoApi(c *check.C) {
"MemTotal",
"KernelVersion",
"Driver",
"ServerVersion"}
"ServerVersion",
"SecurityOptions"}

out := string(body)
for _, linePrefix := range stringsToCheck {
Expand Down