de40a3037a
This is a pretty large patch, and adds support for OCI runtime bundles to nspawn. A new switch --oci-bundle= is added that takes a path to an OCI bundle. The JSON file included therein is read similar to a .nspawn settings files, however with a different feature set. Implementation-wise this mostly extends the pre-existing Settings object to carry additional properties for OCI. However, OCI supports some concepts .nspawn files did not support yet, which this patch also adds: 1. Support for "masking" files and directories. This functionatly is now also available via the new --inaccesible= cmdline command, and Inaccessible= in .nspawn files. 2. Support for mounting arbitrary file systems. (not exposed through nspawn cmdline nor .nspawn files, because probably not a good idea) 3. Ability to configure the console settings for a container. This functionality is now also available on the nspawn cmdline in the new --console= switch (not added to .nspawn for now, as it is something specific to the invocation really, not a property of the container) 4. Console width/height configuration. Not exposed through .nspawn/cmdline, but this may be controlled through $COLUMNS and $LINES like in most other UNIX tools. 5. UID/GID configuration by raw numbers. (not exposed in .nspawn and on the cmdline, since containers likely have different user tables, and the existing --user= switch appears to be the better option) 6. OCI hook commands (no exposed in .nspawn/cmdline, as very specific to OCI) 7. Creation of additional devices nodes in /dev. Most likely not a good idea, hence not exposed in .nspawn/cmdline. There's already --bind= to achieve the same, which is the better alternative. 8. Explicit syscall filters. This is not a good idea, due to the skewed arch support, hence not exposed through .nspawn/cmdline. 9. Configuration of some sysctls on a whitelist. Questionnable, not supported in .nspawn/cmdline for now. 10. Configuration of all 5 types of capabilities. Not a useful concept, since the kernel will reduce the caps on execve() anyway. Not exposed through .nspawn/cmdline as this is not very useful hence. Note that this only implements the OCI runtime logic itself. It does not provide a runc-compatible command line tool. This is left for a later PR. Only with that in place tools such as "buildah" can use the OCI support in nspawn as drop-in replacement. Currently still missing is OCI hook support, but it's already parsed and everything, and should be easy to add. Other than that it's OCI is implemented pretty comprehensively. There's a list of incompatibilities in the nspawn-oci.c file. In a later PR I'd like to convert this into proper markdown and add it to the documentation directory.
59 lines
1.4 KiB
Meson
59 lines
1.4 KiB
Meson
# SPDX-License-Identifier: LGPL-2.1+
|
|
|
|
libnspawn_core_sources = files('''
|
|
nspawn-cgroup.c
|
|
nspawn-cgroup.h
|
|
nspawn-def.h
|
|
nspawn-expose-ports.c
|
|
nspawn-expose-ports.h
|
|
nspawn-mount.c
|
|
nspawn-mount.h
|
|
nspawn-network.c
|
|
nspawn-network.h
|
|
nspawn-oci.c
|
|
nspawn-oci.h
|
|
nspawn-patch-uid.c
|
|
nspawn-patch-uid.h
|
|
nspawn-register.c
|
|
nspawn-register.h
|
|
nspawn-seccomp.c
|
|
nspawn-seccomp.h
|
|
nspawn-settings.c
|
|
nspawn-settings.h
|
|
nspawn-setuid.c
|
|
nspawn-setuid.h
|
|
nspawn-stub-pid1.c
|
|
nspawn-stub-pid1.h
|
|
'''.split())
|
|
|
|
nspawn_gperf_c = custom_target(
|
|
'nspawn-gperf.c',
|
|
input : 'nspawn-gperf.gperf',
|
|
output : 'nspawn-gperf.c',
|
|
command : [gperf, '@INPUT@', '--output-file', '@OUTPUT@'])
|
|
|
|
libnspawn_core_sources += [nspawn_gperf_c]
|
|
|
|
libnspawn_core = static_library(
|
|
'nspawn-core',
|
|
libnspawn_core_sources,
|
|
include_directories : includes,
|
|
dependencies : [libacl,
|
|
libseccomp,
|
|
libselinux])
|
|
|
|
systemd_nspawn_sources = files('nspawn.c')
|
|
|
|
tests += [
|
|
[['src/nspawn/test-nspawn-tables.c'],
|
|
[libnspawn_core,
|
|
libshared],
|
|
[]],
|
|
|
|
[['src/nspawn/test-patch-uid.c'],
|
|
[libnspawn_core,
|
|
libshared],
|
|
[libacl],
|
|
'', 'manual'],
|
|
]
|