This repository has been archived by the owner on Feb 24, 2020. It is now read-only.
/
mount.go
297 lines (262 loc) · 8.9 KB
/
mount.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
// Copyright 2015 The rkt Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package common
import (
"errors"
"fmt"
"os"
"path/filepath"
"strconv"
"syscall"
"github.com/rkt/rkt/common"
"github.com/rkt/rkt/pkg/fileutil"
"github.com/rkt/rkt/pkg/fs"
"github.com/rkt/rkt/pkg/user"
"github.com/appc/spec/schema"
"github.com/appc/spec/schema/types"
"github.com/hashicorp/errwrap"
)
/*
* Some common stage1 mount tasks
*
* TODO(cdc) De-duplicate code from stage0/gc.go
*/
// Mount extends schema.Mount with additional rkt specific fields.
type Mount struct {
schema.Mount
Volume types.Volume
DockerImplicit bool
ReadOnly bool
}
// ConvertedFromDocker determines if an app's image has been converted
// from docker. This is needed because implicit docker empty volumes have
// different behavior from AppC
func ConvertedFromDocker(im *schema.ImageManifest) bool {
if im == nil { // nil sometimes sneaks in here due to unit tests
return false
}
ann := im.Annotations
_, ok := ann.Get("appc.io/docker/repository")
return ok
}
// Source computes the real volume source for a volume.
// Volumes of type 'empty' use a workdir relative to podRoot
func (m *Mount) Source(podRoot string) string {
switch m.Volume.Kind {
case "host":
return m.Volume.Source
case "empty":
return filepath.Join(common.SharedVolumesPath(podRoot), m.Volume.Name.String())
}
return "" // We validate in GenerateMounts that it's valid
}
// GenerateMounts maps MountPoint paths to volumes, returning a list of mounts,
// each with a parameter indicating if it's an implicit empty volume from a
// Docker image.
func GenerateMounts(ra *schema.RuntimeApp, podVolumes []types.Volume, convertedFromDocker bool) ([]Mount, error) {
app := ra.App
var genMnts []Mount
vols := make(map[types.ACName]types.Volume)
for _, v := range podVolumes {
vols[v.Name] = v
}
// RuntimeApps have mounts, whereas Apps have mountPoints. mountPoints are partially for
// Docker compat; since apps can declare mountpoints. However, if we just run with rkt run,
// then we'll only have a Mount and no corresponding MountPoint.
// Furthermore, Mounts can have embedded volumes in the case of the CRI.
// So, we generate a pile of Mounts and their corresponding Volume
// Map of hostpath -> Mount
mnts := make(map[string]schema.Mount)
// Check runtimeApp's Mounts
for _, m := range ra.Mounts {
mnts[m.Path] = m
vol := m.AppVolume // Mounts can supply a volume
if vol == nil {
vv, ok := vols[m.Volume]
if !ok {
return nil, fmt.Errorf("could not find volume %s", m.Volume)
}
vol = &vv
}
// Find a corresponding MountPoint, which is optional
ro := false
for _, mp := range ra.App.MountPoints {
if mp.Name == m.Volume {
ro = mp.ReadOnly
break
}
}
if vol.ReadOnly != nil {
ro = *vol.ReadOnly
}
switch vol.Kind {
case "host":
case "empty":
default:
return nil, fmt.Errorf("Volume %s has invalid kind %s", vol.Name, vol.Kind)
}
genMnts = append(genMnts,
Mount{
Mount: m,
DockerImplicit: false,
ReadOnly: ro,
Volume: *vol,
})
}
// Now, match up MountPoints with Mounts or Volumes
// If there's no Mount and no Volume, generate an empty volume
for _, mp := range app.MountPoints {
// there's already a Mount for this MountPoint, stop
if _, ok := mnts[mp.Path]; ok {
continue
}
// No Mount, try to match based on volume name
vol, ok := vols[mp.Name]
// there is no volume for this mount point, creating an "empty" volume
// implicitly
if !ok {
defaultMode := "0755"
defaultUID := 0
defaultGID := 0
uniqName := ra.Name + "-" + mp.Name
emptyVol := types.Volume{
Name: uniqName,
Kind: "empty",
Mode: &defaultMode,
UID: &defaultUID,
GID: &defaultGID,
}
log.Printf("warning: no volume specified for mount point %q, implicitly creating an \"empty\" volume. This volume will be removed when the pod is garbage-collected.", mp.Name)
if convertedFromDocker {
log.Printf("Docker converted image, initializing implicit volume with data contained at the mount point %q.", mp.Name)
}
vols[uniqName] = emptyVol
genMnts = append(genMnts,
Mount{
Mount: schema.Mount{
Volume: uniqName,
Path: mp.Path,
},
Volume: emptyVol,
ReadOnly: mp.ReadOnly,
DockerImplicit: convertedFromDocker,
})
} else {
ro := mp.ReadOnly
if vol.ReadOnly != nil {
ro = *vol.ReadOnly
}
genMnts = append(genMnts,
Mount{
Mount: schema.Mount{
Volume: vol.Name,
Path: mp.Path,
},
Volume: vol,
ReadOnly: ro,
DockerImplicit: false,
})
}
}
return genMnts, nil
}
// PrepareMountpoints creates and sets permissions for empty volumes.
// If the mountpoint comes from a Docker image and it is an implicit empty
// volume, we copy files from the image to the volume, see
// https://docs.docker.com/engine/userguide/containers/dockervolumes/#data-volumes
func PrepareMountpoints(volPath string, targetPath string, vol *types.Volume, dockerImplicit bool) error {
if vol.Kind != "empty" {
return nil
}
diag.Printf("creating an empty volume folder for sharing: %q", volPath)
m, err := strconv.ParseUint(*vol.Mode, 8, 32)
if err != nil {
return errwrap.Wrap(fmt.Errorf("invalid mode %q for volume %q", *vol.Mode, vol.Name), err)
}
mode := os.FileMode(m)
Uid := *vol.UID
Gid := *vol.GID
if dockerImplicit {
fi, err := os.Stat(targetPath)
if err == nil {
// the directory exists in the image, let's set the same
// permissions and copy files from there to the empty volume
mode = fi.Mode()
Uid = int(fi.Sys().(*syscall.Stat_t).Uid)
Gid = int(fi.Sys().(*syscall.Stat_t).Gid)
if err := fileutil.CopyTree(targetPath, volPath, user.NewBlankUidRange()); err != nil {
return errwrap.Wrap(fmt.Errorf("error copying image files to empty volume %q", volPath), err)
}
}
}
if err := os.MkdirAll(volPath, 0770); err != nil {
return errwrap.Wrap(fmt.Errorf("error creating %q", volPath), err)
}
if err := os.Chown(volPath, Uid, Gid); err != nil {
return errwrap.Wrap(fmt.Errorf("could not change owner of %q", volPath), err)
}
if err := os.Chmod(volPath, mode); err != nil {
return errwrap.Wrap(fmt.Errorf("could not change permissions of %q", volPath), err)
}
return nil
}
// BindMount, well, bind mounts a source in to a destination. This will
// do some bookkeeping:
// * evaluate all symlinks
// * ensure the source exists
// * recursively create the destination
func BindMount(mnt fs.MountUnmounter, source, destination string, readOnly bool) error {
absSource, err := filepath.EvalSymlinks(source)
if err != nil {
return errwrap.Wrap(fmt.Errorf("Could not resolve symlink for source %v", source), err)
}
if err := EnsureTargetExists(absSource, destination); err != nil {
return errwrap.Wrap(fmt.Errorf("Could not create destination mount point: %v", destination), err)
} else if err := mnt.Mount(absSource, destination, "bind", syscall.MS_BIND, ""); err != nil {
return errwrap.Wrap(fmt.Errorf("Could not bind mount %v to %v", absSource, destination), err)
}
if readOnly {
err := mnt.Mount(source, destination, "bind", syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_BIND, "")
// If we failed to remount ro, unmount
if err != nil {
mnt.Unmount(destination, 0) // if this fails, oh well
return errwrap.Wrap(fmt.Errorf("Could not remount %v read-only", destination), err)
}
}
return nil
}
// EnsureTargetExists will recursively create a given mountpoint. If directories
// are created, their permissions are initialized to common.SharedVolumePerm
func EnsureTargetExists(source, destination string) error {
fileInfo, err := os.Stat(source)
if err != nil {
return errwrap.Wrap(fmt.Errorf("could not stat source location: %v", source), err)
}
targetPathParent, _ := filepath.Split(destination)
if err := os.MkdirAll(targetPathParent, common.SharedVolumePerm); err != nil {
return errwrap.Wrap(fmt.Errorf("could not create parent directory: %v", targetPathParent), err)
}
if fileInfo.IsDir() {
if err := os.Mkdir(destination, common.SharedVolumePerm); err != nil && !os.IsExist(err) {
return errwrap.Wrap(errors.New("could not create destination directory "+destination), err)
}
} else {
if file, err := os.OpenFile(destination, os.O_CREATE, common.SharedVolumePerm); err != nil {
return errwrap.Wrap(errors.New("could not create destination file"), err)
} else {
file.Close()
}
}
return nil
}