Latest commit a9610f2 Jan 13, 2017 @hqhq hqhq committed on GitHub Merge pull request #1249 from datawolf/small-refactor
small refactor
Permalink
..
Failed to load latest commit information.
apparmor Updating error condition in applying apparmor profile May 4, 2016
cgroups Merge pull request #1249 from datawolf/small-refactor Jan 13, 2017
configs Fix go_vet errors Jan 6, 2017
criurpc libcontainer: update criurpc.proto Feb 18, 2016
devices Don't add device to list if it doesn't exist anymore Dec 7, 2016
integration *: fix go-vet failures Jan 3, 2017
keys libcontainer: rename keyctl package to keys Jul 25, 2016
label fix typos Nov 30, 2016
nsenter Set init processes as non-dumpable Jan 11, 2017
seccomp seccomp: Add ppc and s390x to seccomp/config.go May 31, 2016
selinux Fix thread safety of SelinuxEnabled and getSelinuxMountPoint Dec 6, 2016
specconv Bump runtime-spec to v1.0.0-rc3 Dec 17, 2016
stacktrace fix typos Nov 30, 2016
system Fix issue in `GetProcessStartTime` Oct 20, 2016
user Cleanup: remove redundant code Jan 9, 2017
utils Fix typos Jan 6, 2017
xattr Fixing xattr test step issue Nov 29, 2015
README.md Updating container state and status API in README Oct 27, 2016
SPEC.md Do not create /dev/fuse by default Aug 12, 2016
capabilities_ambient.go Move ambient capabilties behind build tag Nov 2, 2016
capabilities_linux.go Move ambient capabilties behind build tag Nov 2, 2016
capabilities_noambient.go Move ambient capabilties behind build tag Nov 2, 2016
compat_1.5_linux.go Don't set /proc/<PID>/setgroups to deny in Go1.5 Aug 3, 2015
console.go Merge pull request #1018 from cyphar/console-rewrite Dec 7, 2016
console_freebsd.go console: don't chown(2) the slave PTY Dec 1, 2016
console_linux.go runc: implement --console-socket Dec 1, 2016
console_solaris.go console: don't chown(2) the slave PTY Dec 1, 2016
console_windows.go console: don't chown(2) the slave PTY Dec 1, 2016
container.go Add --all flag to kill Nov 8, 2016
container_linux.go Merge pull request #1110 from avagin/cpt-in-userns Jan 10, 2017
container_linux_test.go Fix trivial style errors reported by `go vet` and `golint` Apr 12, 2016
container_solaris.go Get runc to build clean on Solaris Apr 12, 2016
container_windows.go Windows: Refactor Container interface Nov 2, 2015
criu_opts_unix.go Fix trivial style errors reported by `go vet` and `golint` Apr 12, 2016
criu_opts_windows.go Windows: Factor down criu_opts Oct 23, 2015
error.go Fix the outdated comment for Error interface Jan 3, 2017
error_test.go [unittest] add extra ErrorCode in TestErrorCode testcase Sep 22, 2016
factory.go Update import paths for new repository Jun 22, 2015
factory_linux.go libcontainer: refactor syncT handling Dec 1, 2016
factory_linux_test.go Serialize CommandHooks to state Mar 3, 2016
generic_error.go libcontainer: refactor syncT handling Dec 1, 2016
generic_error_test.go Move libcontainer into subdirectory Jun 22, 2015
init_linux.go Set init processes as non-dumpable Jan 11, 2017
message_linux.go *: console rewrite Dec 1, 2016
network_linux.go libcontainer: network_linux.go: fix go vet Nov 30, 2015
notify_linux.go libcontainer: Add support for memcg pressure notifications Dec 28, 2015
notify_linux_test.go libcontainer: Add support for memcg pressure notifications Dec 28, 2015
process.go tests: fix all the things Dec 1, 2016
process_linux.go sync up `HookState` with OCI spec `State` Dec 19, 2016
restored_process.go Add signal API to Container interface Aug 4, 2015
rootfs_linux.go Do not create cgroup dir name from combining subsystems Jan 11, 2017
rootfs_linux_test.go Remove check for binding to / Sep 29, 2016
setgroups_linux.go Don't set /proc/<PID>/setgroups to deny in Go1.5 Aug 3, 2015
setns_init_linux.go Set init processes as non-dumpable Jan 11, 2017
standard_init_linux.go Set init processes as non-dumpable Jan 11, 2017
state_linux.go sync up `HookState` with OCI spec `State` Dec 19, 2016
state_linux_test.go Fix signal handling for unit tests May 31, 2016
stats.go Move libcontainer into subdirectory Jun 22, 2015
stats_freebsd.go Move libcontainer into subdirectory Jun 22, 2015
stats_linux.go Update import paths for new repository Jun 22, 2015
stats_solaris.go Get runc to build clean on Solaris Apr 12, 2016
stats_windows.go Move libcontainer into subdirectory Jun 22, 2015
sync.go *: console rewrite Dec 1, 2016

README.md

Libcontainer provides a native Go implementation for creating containers with namespaces, cgroups, capabilities, and filesystem access controls. It allows you to manage the lifecycle of the container performing additional operations after the container is created.

Container

A container is a self contained execution environment that shares the kernel of the host system and which is (optionally) isolated from other containers in the system.

Using libcontainer

Because containers are spawned in a two step process you will need a binary that will be executed as the init process for the container. In libcontainer, we use the current binary (/proc/self/exe) to be executed as the init process, and use arg "init", we call the first step process "bootstrap", so you always need a "init" function as the entry of "bootstrap".

func init() {
    if len(os.Args) > 1 && os.Args[1] == "init" {
        runtime.GOMAXPROCS(1)
        runtime.LockOSThread()
        factory, _ := libcontainer.New("")
        if err := factory.StartInitialization(); err != nil {
            logrus.Fatal(err)
        }
        panic("--this line should have never been executed, congratulations--")
    }
}

Then to create a container you first have to initialize an instance of a factory that will handle the creation and initialization for a container.

factory, err := libcontainer.New("/var/lib/container", libcontainer.Cgroupfs, libcontainer.InitArgs(os.Args[0], "init"))
if err != nil {
    logrus.Fatal(err)
    return
}

Once you have an instance of the factory created we can create a configuration struct describing how the container is to be created. A sample would look similar to this:

defaultMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
config := &configs.Config{
    Rootfs: "/your/path/to/rootfs",
    Capabilities: []string{
        "CAP_CHOWN",
        "CAP_DAC_OVERRIDE",
        "CAP_FSETID",
        "CAP_FOWNER",
        "CAP_MKNOD",
        "CAP_NET_RAW",
        "CAP_SETGID",
        "CAP_SETUID",
        "CAP_SETFCAP",
        "CAP_SETPCAP",
        "CAP_NET_BIND_SERVICE",
        "CAP_SYS_CHROOT",
        "CAP_KILL",
        "CAP_AUDIT_WRITE",
    },
    Namespaces: configs.Namespaces([]configs.Namespace{
        {Type: configs.NEWNS},
        {Type: configs.NEWUTS},
        {Type: configs.NEWIPC},
        {Type: configs.NEWPID},
        {Type: configs.NEWUSER},
        {Type: configs.NEWNET},
    }),
    Cgroups: &configs.Cgroup{
        Name:   "test-container",
        Parent: "system",
        Resources: &configs.Resources{
            MemorySwappiness: nil,
            AllowAllDevices:  nil,
            AllowedDevices:   configs.DefaultAllowedDevices,
        },
    },
    MaskPaths: []string{
        "/proc/kcore",
        "/sys/firmware",
    },
    ReadonlyPaths: []string{
        "/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
    },
    Devices:  configs.DefaultAutoCreatedDevices,
    Hostname: "testing",
    Mounts: []*configs.Mount{
        {
            Source:      "proc",
            Destination: "/proc",
            Device:      "proc",
            Flags:       defaultMountFlags,
        },
        {
            Source:      "tmpfs",
            Destination: "/dev",
            Device:      "tmpfs",
            Flags:       syscall.MS_NOSUID | syscall.MS_STRICTATIME,
            Data:        "mode=755",
        },
        {
            Source:      "devpts",
            Destination: "/dev/pts",
            Device:      "devpts",
            Flags:       syscall.MS_NOSUID | syscall.MS_NOEXEC,
            Data:        "newinstance,ptmxmode=0666,mode=0620,gid=5",
        },
        {
            Device:      "tmpfs",
            Source:      "shm",
            Destination: "/dev/shm",
            Data:        "mode=1777,size=65536k",
            Flags:       defaultMountFlags,
        },
        {
            Source:      "mqueue",
            Destination: "/dev/mqueue",
            Device:      "mqueue",
            Flags:       defaultMountFlags,
        },
        {
            Source:      "sysfs",
            Destination: "/sys",
            Device:      "sysfs",
            Flags:       defaultMountFlags | syscall.MS_RDONLY,
        },
    },
    UidMappings: []configs.IDMap{
        {
            ContainerID: 0,
            HostID: 1000,
            Size: 65536,
        },
    },
    GidMappings: []configs.IDMap{
        {
            ContainerID: 0,
            HostID: 1000,
            Size: 65536,
        },
    },
    Networks: []*configs.Network{
        {
            Type:    "loopback",
            Address: "127.0.0.1/0",
            Gateway: "localhost",
        },
    },
    Rlimits: []configs.Rlimit{
        {
            Type: syscall.RLIMIT_NOFILE,
            Hard: uint64(1025),
            Soft: uint64(1025),
        },
    },
}

Once you have the configuration populated you can create a container:

container, err := factory.Create("container-id", config)
if err != nil {
    logrus.Fatal(err)
    return
}

To spawn bash as the initial process inside the container and have the processes pid returned in order to wait, signal, or kill the process:

process := &libcontainer.Process{
    Args:   []string{"/bin/bash"},
    Env:    []string{"PATH=/bin"},
    User:   "daemon",
    Stdin:  os.Stdin,
    Stdout: os.Stdout,
    Stderr: os.Stderr,
}

err := container.Run(process)
if err != nil {
    container.Destroy()
    logrus.Fatal(err)
    return
}

// wait for the process to finish.
_, err := process.Wait()
if err != nil {
    logrus.Fatal(err)
}

// destroy the container.
container.Destroy()

Additional ways to interact with a running container are:

// return all the pids for all processes running inside the container.
processes, err := container.Processes()

// get detailed cpu, memory, io, and network statistics for the container and
// it's processes.
stats, err := container.Stats()

// pause all processes inside the container.
container.Pause()

// resume all paused processes.
container.Resume()

// send signal to container's init process.
container.Signal(signal)

// update container resource constraints.
container.Set(config)

// get current status of the container.
status, err := container.Status()

// get current container's state information.
state, err := container.State()

Checkpoint & Restore

libcontainer now integrates CRIU for checkpointing and restoring containers. This let's you save the state of a process running inside a container to disk, and then restore that state into a new process, on the same machine or on another machine.

criu version 1.5.2 or higher is required to use checkpoint and restore. If you don't already have criu installed, you can build it from source, following the online instructions. criu is also installed in the docker image generated when building libcontainer with docker.

Copyright and license

Code and documentation copyright 2014 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.