9
"github.com/containers/common/libnetwork/types"
10
"github.com/containers/common/pkg/secrets"
11
"github.com/containers/image/v5/manifest"
12
"github.com/containers/podman/v5/libpod/define"
13
"github.com/containers/podman/v5/pkg/namespaces"
14
"github.com/containers/podman/v5/pkg/specgen"
15
"github.com/containers/storage"
16
spec "github.com/opencontainers/runtime-spec/specs-go"
19
// ContainerConfig contains all information that was used to create the
20
// container. It may not be changed once created.
21
// It is stored, read-only, on disk in Libpod's State.
22
// Any changes will not be written back to the database, and will cause
23
// inconsistencies with other Libpod instances.
24
type ContainerConfig struct {25
// Spec is OCI runtime spec used to create the container. This is passed
26
// in when the container is created, but it is not the final spec used
27
// to run the container - it will be modified by Libpod to add things we
28
// manage (e.g. bind mounts for /etc/resolv.conf, named volumes, a
29
// network namespace prepared by the network backend) in the
30
// generateSpec() function.
31
Spec *spec.Spec `json:"spec"`
33
// ID is a hex-encoded 256-bit pseudorandom integer used as a unique
34
// identifier for the container. IDs are globally unique in Libpod -
35
// once an ID is in use, no other container or pod will be created with
36
// the same one until the holder of the ID has been removed.
37
// ID is generated by Libpod, and cannot be chosen or influenced by the
38
// user (except when restoring a checkpointed container).
39
// ID is guaranteed to be 64 characters long.
42
// Name is a human-readable name for the container. All containers must
43
// have a non-empty name. Name may be provided when the container is
44
// created; if no name is chosen, a name will be auto-generated.
45
Name string `json:"name"`
47
// Pod is the full ID of the pod the container belongs to. If the
48
// container does not belong to a pod, this will be empty.
49
// If this is not empty, a pod with this ID is guaranteed to exist in
50
// the state for the duration of this container's existence.
51
Pod string `json:"pod,omitempty"`
53
// Namespace is the libpod Namespace the container is in.
54
// Namespaces are used to divide containers in the state.
55
Namespace string `json:"namespace,omitempty"`
57
// LockID is the ID of this container's lock. Each container, pod, and
58
// volume is assigned a unique Lock (from one of several backends) by
59
// the libpod Runtime. This lock will belong only to this container for
60
// the duration of the container's lifetime.
61
LockID uint32 `json:"lockID"`
63
// CreateCommand is the full command plus arguments that were used to
64
// create the container. It is shown in the output of Inspect, and may
65
// be used to recreate an identical container for automatic updates or
66
// portable systemd unit files.
67
CreateCommand []string `json:"CreateCommand,omitempty"`
69
// RawImageName is the raw and unprocessed name of the image when creating
70
// the container (as specified by the user). May or may not be set. One
71
// use case to store this data are auto-updates where we need the _exact_
72
// name and not some normalized instance of it.
73
RawImageName string `json:"RawImageName,omitempty"`
75
// IDMappings are UID/GID mappings used by the container's user
76
// namespace. They are used by the OCI runtime when creating the
77
// container, and by c/storage to ensure that the container's files have
78
// the appropriate owner.
79
IDMappings storage.IDMappingOptions `json:"idMappingsOptions,omitempty"`
81
// Dependencies are the IDs of dependency containers.
82
// These containers must be started before this container is started.
85
// rewrite is an internal bool to indicate that the config was modified after
86
// a read from the db, e.g. to migrate config fields after an upgrade.
87
// This field should never be written to the db, the json tag ensures this.
88
rewrite bool `json:"-"`
90
// embedded sub-configs
92
ContainerSecurityConfig
93
ContainerNameSpaceConfig
94
ContainerNetworkConfig
99
// ContainerRootFSConfig is an embedded sub-config providing config info
100
// about the container's root fs.
101
type ContainerRootFSConfig struct {102
// RootfsImageID is the ID of the image used to create the container.
103
// If the container was created from a Rootfs, this will be empty.
104
// If non-empty, Podman will create a root filesystem for the container
105
// based on an image with this ID.
106
// This conflicts with Rootfs.
107
RootfsImageID string `json:"rootfsImageID,omitempty"`
108
// RootfsImageName is the (normalized) name of the image used to create
109
// the container. If the container was created from a Rootfs, this will
111
RootfsImageName string `json:"rootfsImageName,omitempty"`
112
// Rootfs is a directory to use as the container's root filesystem.
113
// If RootfsImageID is set, this will be empty.
114
// If this is set, Podman will not create a root filesystem for the
115
// container based on an image, and will instead use the given directory
116
// as the container's root.
117
// Conflicts with RootfsImageID.
118
Rootfs string `json:"rootfs,omitempty"`
119
// RootfsOverlay tells if rootfs has to be mounted as an overlay
120
RootfsOverlay bool `json:"rootfs_overlay,omitempty"`
121
// RootfsMapping specifies if there are mappings to apply to the rootfs.
122
RootfsMapping *string `json:"rootfs_mapping,omitempty"`
123
// ShmDir is the path to be mounted on /dev/shm in container.
124
// If not set manually at creation time, Libpod will create a tmpfs
125
// with the size specified in ShmSize and populate this with the path of
127
ShmDir string `json:"ShmDir,omitempty"`
128
// NoShmShare indicates whether /dev/shm can be shared with other containers
129
NoShmShare bool `json:"NOShmShare,omitempty"`
130
// NoShm indicates whether a tmpfs should be created and mounted on /dev/shm
131
NoShm bool `json:"NoShm,omitempty"`
132
// ShmSize is the size of the container's SHM. Only used if ShmDir was
133
// not set manually at time of creation.
134
ShmSize int64 `json:"shmSize"`
135
// ShmSizeSystemd is the size of systemd-specific tmpfs mounts
136
ShmSizeSystemd int64 `json:"shmSizeSystemd"`
137
// Static directory for container content that will persist across
139
// StaticDir is a persistent directory for Libpod files that will
140
// survive system reboot. It is not part of the container's rootfs and
141
// is not mounted into the container. It will be removed when the
142
// container is removed.
143
// Usually used to store container log files, files that will be bind
144
// mounted into the container (e.g. the resolv.conf we made for the
145
// container), and other per-container content.
146
StaticDir string `json:"staticDir"`
147
// Mounts contains all additional mounts into the container rootfs.
148
// It is presently only used for the container's SHM directory.
149
// These must be unmounted before the container's rootfs is unmounted.
150
Mounts []string `json:"mounts,omitempty"`
151
// NamedVolumes lists the Libpod named volumes to mount into the
152
// container. Each named volume is guaranteed to exist so long as this
154
NamedVolumes []*ContainerNamedVolume `json:"namedVolumes,omitempty"`
155
// OverlayVolumes lists the overlay volumes to mount into the container.
156
OverlayVolumes []*ContainerOverlayVolume `json:"overlayVolumes,omitempty"`
157
// ImageVolumes lists the image volumes to mount into the container.
158
// Please note that this is named ctrImageVolumes in JSON to
159
// distinguish between these and the old `imageVolumes` field in Podman
160
// pre-1.8, which was used in very old Podman versions to determine how
161
// image volumes were handled in Libpod (support for these eventually
162
// moved out of Libpod into pkg/specgen).
163
// Please DO NOT reuse the `imageVolumes` name in container JSON again.
164
ImageVolumes []*ContainerImageVolume `json:"ctrImageVolumes,omitempty"`
165
// CreateWorkingDir indicates that Libpod should create the container's
166
// working directory if it does not exist. Some OCI runtimes do this by
167
// default, but others do not.
168
CreateWorkingDir bool `json:"createWorkingDir,omitempty"`
169
// Secrets lists secrets to mount into the container
170
Secrets []*ContainerSecret `json:"secrets,omitempty"`
171
// SecretPath is the secrets location in storage
172
SecretsPath string `json:"secretsPath"`
173
// StorageOpts to be used when creating rootfs
174
StorageOpts map[string]string `json:"storageOpts"`
175
// Volatile specifies whether the container storage can be optimized
176
// at the cost of not syncing all the dirty files in memory.
177
Volatile bool `json:"volatile,omitempty"`
178
// Passwd allows to user to override podman's passwd/group file setup
179
Passwd *bool `json:"passwd,omitempty"`
180
// ChrootDirs is an additional set of directories that need to be
181
// treated as root directories. Standard bind mounts will be mounted
182
// into paths relative to these directories.
183
ChrootDirs []string `json:"chroot_directories,omitempty"`
186
// ContainerSecurityConfig is an embedded sub-config providing security configuration
188
type ContainerSecurityConfig struct {189
// Privileged is whether the container is privileged. Privileged
190
// containers have lessened security and increased access to the system.
191
// Note that this does NOT directly correspond to Podman's --privileged
192
// flag - most of the work of that flag is done in creating the OCI spec
193
// given to Libpod. This only enables a small subset of the overall
194
// operation, mostly around mounting the container image with reduced
196
Privileged bool `json:"privileged"`
197
// ProcessLabel is the SELinux process label for the container.
198
ProcessLabel string `json:"ProcessLabel,omitempty"`
199
// MountLabel is the SELinux mount label for the container's root
200
// filesystem. Only used if the container was created from an image.
201
// If not explicitly set, an unused random MLS label will be assigned by
202
// containers/storage (but only if SELinux is enabled).
203
MountLabel string `json:"MountLabel,omitempty"`
204
// LabelOpts are options passed in by the user to set up SELinux labels.
205
// These are used by the containers/storage library.
206
LabelOpts []string `json:"labelopts,omitempty"`
207
// User and group to use in the container. Can be specified as only user
208
// (in which case we will attempt to look up the user in the container
209
// to determine the appropriate group) or user and group separated by a
211
// Can be specified by name or UID/GID.
212
// If unset, this will default to UID and GID 0 (root).
213
User string `json:"user,omitempty"`
214
// Groups are additional groups to add the container's user to. These
215
// are resolved within the container using the container's /etc/passwd.
216
Groups []string `json:"groups,omitempty"`
217
// HostUsers are a list of host user accounts to add to /etc/passwd
218
HostUsers []string `json:"HostUsers,omitempty"`
219
// AddCurrentUserPasswdEntry indicates that Libpod should ensure that
220
// the container's /etc/passwd contains an entry for the user running
221
// Libpod - mostly used in rootless containers where the user running
222
// Libpod wants to retain their UID inside the container.
223
AddCurrentUserPasswdEntry bool `json:"addCurrentUserPasswdEntry,omitempty"`
224
// LabelNested, allow labeling separation from within a container
225
LabelNested bool `json:"label_nested"`
228
// ContainerNameSpaceConfig is an embedded sub-config providing
229
// namespace configuration to the container.
230
type ContainerNameSpaceConfig struct {231
// IDs of container to share namespaces with
232
// NetNsCtr conflicts with the CreateNetNS bool
233
// These containers are considered dependencies of the given container
234
// They must be started before the given container is started
235
IPCNsCtr string `json:"ipcNsCtr,omitempty"`
236
MountNsCtr string `json:"mountNsCtr,omitempty"`
237
NetNsCtr string `json:"netNsCtr,omitempty"`
238
PIDNsCtr string `json:"pidNsCtr,omitempty"`
239
UserNsCtr string `json:"userNsCtr,omitempty"`
240
UTSNsCtr string `json:"utsNsCtr,omitempty"`
241
CgroupNsCtr string `json:"cgroupNsCtr,omitempty"`
244
// ContainerNetworkConfig is an embedded sub-config providing network configuration
246
type ContainerNetworkConfig struct {247
// CreateNetNS indicates that libpod should create and configure a new
248
// network namespace for the container.
249
// This cannot be set if NetNsCtr is also set.
250
CreateNetNS bool `json:"createNetNS"`
251
// StaticIP is a static IP to request for the container.
252
// This cannot be set unless CreateNetNS is set.
253
// If not set, the container will be dynamically assigned an IP by CNI.
254
// Deprecated: Do no use this anymore, this is only for DB backwards compat.
255
StaticIP net.IP `json:"staticIP,omitempty"`
256
// StaticMAC is a static MAC to request for the container.
257
// This cannot be set unless CreateNetNS is set.
258
// If not set, the container will be dynamically assigned a MAC by CNI.
259
// Deprecated: Do no use this anymore, this is only for DB backwards compat.
260
StaticMAC types.HardwareAddr `json:"staticMAC,omitempty"`
261
// PortMappings are the ports forwarded to the container's network
263
// These are not used unless CreateNetNS is true
264
PortMappings []types.PortMapping `json:"newPortMappings,omitempty"`
265
// OldPortMappings are the ports forwarded to the container's network
266
// namespace. As of podman 4.0 this field is deprecated, use PortMappings
267
// instead. The db will convert the old ports to the new structure for you.
268
// These are not used unless CreateNetNS is true
269
OldPortMappings []types.OCICNIPortMapping `json:"portMappings,omitempty"`
270
// ExposedPorts are the ports which are exposed but not forwarded
271
// into the container.
272
// The map key is the port and the string slice contains the protocols,
274
// These are only set when exposed ports are given but not published.
275
ExposedPorts map[uint16][]string `json:"exposedPorts,omitempty"`
276
// UseImageResolvConf indicates that resolv.conf should not be
277
// bind-mounted inside the container.
278
// Conflicts with DNSServer, DNSSearch, DNSOption.
279
UseImageResolvConf bool
280
// DNS servers to use in container resolv.conf
281
// Will override servers in host resolv if set
282
DNSServer []net.IP `json:"dnsServer,omitempty"`
283
// DNS Search domains to use in container resolv.conf
284
// Will override search domains in host resolv if set
285
DNSSearch []string `json:"dnsSearch,omitempty"`
286
// DNS options to be set in container resolv.conf
287
// With override options in host resolv if set
288
DNSOption []string `json:"dnsOption,omitempty"`
289
// UseImageHosts indicates that /etc/hosts should not be
290
// bind-mounted inside the container.
291
// Conflicts with HostAdd.
293
// BaseHostsFile is the path to a hosts file, the entries from this file
294
// are added to the containers hosts file. As special value "image" is
295
// allowed which uses the /etc/hosts file from within the image and "none"
296
// which uses no base file at all. If it is empty we should default
297
// to the base_hosts_file configuration in containers.conf.
298
BaseHostsFile string `json:"baseHostsFile,omitempty"`
299
// Hosts to add in container
300
// Will be appended to host's host file
301
HostAdd []string `json:"hostsAdd,omitempty"`
302
// Network names with the network specific options.
303
// Please note that these can be altered at runtime. The actual list is
304
// stored in the DB and should be retrieved from there via c.networks()
305
// this value is only used for container create.
306
// Added in podman 4.0, previously NetworksDeprecated was used. Make
307
// sure to not change the json tags.
308
Networks map[string]types.PerNetworkOptions `json:"newNetworks,omitempty"`
309
// Network names to add container to. Empty to use default network.
310
// Please note that these can be altered at runtime. The actual list is
311
// stored in the DB and should be retrieved from there; this is only the
312
// set of networks the container was *created* with.
313
// Deprecated: Do no use this anymore, this is only for DB backwards compat.
314
// Also note that we need to keep the old json tag to decode from DB correctly
315
NetworksDeprecated []string `json:"networks,omitempty"`
316
// Network mode specified for the default network.
317
NetMode namespaces.NetworkMode `json:"networkMode,omitempty"`
318
// NetworkOptions are additional options for each network
319
NetworkOptions map[string][]string `json:"network_options,omitempty"`
322
// ContainerImageConfig is an embedded sub-config providing image configuration
324
type ContainerImageConfig struct {325
// UserVolumes contains user-added volume mounts in the container.
326
// These will not be added to the container's spec, as it is assumed
327
// they are already present in the spec given to Libpod. Instead, it is
328
// used when committing containers to generate the VOLUMES field of the
329
// image that is created, and for triggering some OCI hooks which do not
330
// fire unless user-added volume mounts are present.
331
UserVolumes []string `json:"userVolumes,omitempty"`
332
// Entrypoint is the container's entrypoint.
333
// It is not used in spec generation, but will be used when the
334
// container is committed to populate the entrypoint of the new image.
335
Entrypoint []string `json:"entrypoint,omitempty"`
336
// Command is the container's command.
337
// It is not used in spec generation, but will be used when the
338
// container is committed to populate the command of the new image.
339
Command []string `json:"command,omitempty"`
342
// ContainerMiscConfig is an embedded sub-config providing misc configuration
344
type ContainerMiscConfig struct {345
// Whether to keep container STDIN open
346
Stdin bool `json:"stdin,omitempty"`
347
// Labels is a set of key-value pairs providing additional information
349
Labels map[string]string `json:"labels,omitempty"`
350
// StopSignal is the signal that will be used to stop the container
351
StopSignal uint `json:"stopSignal,omitempty"`
352
// StopTimeout is the signal that will be used to stop the container
353
StopTimeout uint `json:"stopTimeout,omitempty"`
354
// Timeout is maximum time a container will run before getting the kill signal
355
Timeout uint `json:"timeout,omitempty"`
356
// Time container was created
357
CreatedTime time.Time `json:"createdTime"`
358
// CgroupManager is the cgroup manager used to create this container.
359
// If empty, the runtime default will be used.
360
CgroupManager string `json:"cgroupManager,omitempty"`
361
// NoCgroups indicates that the container will not create Cgroups. It is
362
// incompatible with CgroupParent. Deprecated in favor of CgroupsMode.
363
NoCgroups bool `json:"noCgroups,omitempty"`
364
// CgroupsMode indicates how the container will create cgroups
365
// (disabled, no-conmon, enabled). It supersedes NoCgroups.
366
CgroupsMode string `json:"cgroupsMode,omitempty"`
367
// Cgroup parent of the container.
368
CgroupParent string `json:"cgroupParent"`
369
// GroupEntry specifies arbitrary data to append to a file.
370
GroupEntry string `json:"group_entry,omitempty"`
371
// KubeExitCodePropagation of the service container.
372
KubeExitCodePropagation define.KubeExitCodePropagation `json:"kubeExitCodePropagation"`
373
// LogPath log location
374
LogPath string `json:"logPath"`
375
// LogTag is the tag used for logging
376
LogTag string `json:"logTag"`
377
// LogSize is the tag used for logging
378
LogSize int64 `json:"logSize"`
379
// LogDriver driver for logs
380
LogDriver string `json:"logDriver"`
381
// File containing the conmon PID
382
ConmonPidFile string `json:"conmonPidFile,omitempty"`
383
// RestartPolicy indicates what action the container will take upon
384
// exiting naturally.
385
// Allowed options are "no" (take no action), "on-failure" (restart on
386
// non-zero exit code, up to a maximum of RestartRetries times),
387
// and "always" (always restart the container on any exit code).
388
// The empty string is treated as the default ("no")389
RestartPolicy string `json:"restart_policy,omitempty"`
390
// RestartRetries indicates the number of attempts that will be made to
391
// restart the container. Used only if RestartPolicy is set to
393
RestartRetries uint `json:"restart_retries,omitempty"`
394
// PostConfigureNetNS needed when a user namespace is created by an OCI runtime
395
// if the network namespace is created before the user namespace it will be
396
// owned by the wrong user namespace.
397
PostConfigureNetNS bool `json:"postConfigureNetNS"`
398
// OCIRuntime used to create the container
399
OCIRuntime string `json:"runtime,omitempty"`
400
// IsInfra is a bool indicating whether this container is an infra container used for
401
// sharing kernel namespaces in a pod
402
IsInfra bool `json:"pause"`
403
// IsService is a bool indicating whether this container is a service container used for
404
// tracking the life cycle of K8s service.
405
IsService bool `json:"isService"`
406
// SdNotifyMode tells libpod what to do with a NOTIFY_SOCKET if passed
407
SdNotifyMode string `json:"sdnotifyMode,omitempty"`
408
// SdNotifySocket stores NOTIFY_SOCKET in use by the container
409
SdNotifySocket string `json:"sdnotifySocket,omitempty"`
410
// Systemd tells libpod to set up the container in systemd mode, a value of nil denotes false
411
Systemd *bool `json:"systemd,omitempty"`
412
// HealthCheckConfig has the health check command and related timings
413
HealthCheckConfig *manifest.Schema2HealthConfig `json:"healthcheck"`
414
// HealthCheckOnFailureAction defines an action to take once the container turns unhealthy.
415
HealthCheckOnFailureAction define.HealthCheckOnFailureAction `json:"healthcheck_on_failure_action"`
416
// StartupHealthCheckConfig is the configuration of the startup
417
// healthcheck for the container. This will run before the regular HC
418
// runs, and when it passes the regular HC will be activated.
419
StartupHealthCheckConfig *define.StartupHealthCheck `json:"startupHealthCheck,omitempty"`
420
// PreserveFDs is a number of additional file descriptors (in addition
421
// to 0, 1, 2) that will be passed to the executed process. The total FDs
422
// passed will be 3 + PreserveFDs.
423
PreserveFDs uint `json:"preserveFds,omitempty"`
424
// PreserveFD is a list of additional file descriptors (in addition
425
// to 0, 1, 2) that will be passed to the executed process.
426
PreserveFD []uint `json:"preserveFd,omitempty"`
427
// Timezone is the timezone inside the container.
428
// Local means it has the same timezone as the host machine
429
Timezone string `json:"timezone,omitempty"`
430
// Umask is the umask inside the container.
431
Umask string `json:"umask,omitempty"`
432
// PidFile is the file that saves the pid of the container process
433
PidFile string `json:"pid_file,omitempty"`
434
// CDIDevices contains devices that use the CDI
435
CDIDevices []string `json:"cdiDevices,omitempty"`
436
// DeviceHostSrc contains the original source on the host
437
DeviceHostSrc []spec.LinuxDevice `json:"device_host_src,omitempty"`
438
// EnvSecrets are secrets that are set as environment variables
439
EnvSecrets map[string]*secrets.Secret `json:"secret_env,omitempty"`
440
// InitContainerType specifies if the container is an initcontainer
441
// and if so, what type: always or once are possible non-nil entries
442
InitContainerType string `json:"init_container_type,omitempty"`
443
// PasswdEntry specifies arbitrary data to append to a file.
444
PasswdEntry string `json:"passwd_entry,omitempty"`
445
// MountAllDevices is an option to indicate whether a privileged container
446
// will mount all the host's devices
447
MountAllDevices bool `json:"mountAllDevices"`
448
// ReadWriteTmpfs indicates whether all tmpfs should be mounted readonly when in ReadOnly mode
449
ReadWriteTmpfs bool `json:"readWriteTmpfs"`
452
// InfraInherit contains the compatible options inheritable from the infra container
453
type InfraInherit struct {454
ApparmorProfile string `json:"apparmor_profile,omitempty"`
455
CapAdd []string `json:"cap_add,omitempty"`
456
CapDrop []string `json:"cap_drop,omitempty"`
457
HostDeviceList []spec.LinuxDevice `json:"host_device_list,omitempty"`
458
ImageVolumes []*specgen.ImageVolume `json:"image_volumes,omitempty"`
459
Mounts []spec.Mount `json:"mounts,omitempty"`
460
NoNewPrivileges bool `json:"no_new_privileges,omitempty"`
461
OverlayVolumes []*specgen.OverlayVolume `json:"overlay_volumes,omitempty"`
462
SeccompPolicy string `json:"seccomp_policy,omitempty"`
463
SeccompProfilePath string `json:"seccomp_profile_path,omitempty"`
464
SelinuxOpts []string `json:"selinux_opts,omitempty"`
465
Volumes []*specgen.NamedVolume `json:"volumes,omitempty"`
466
ShmSize *int64 `json:"shm_size"`
467
ShmSizeSystemd *int64 `json:"shm_size_systemd"`
470
// IsDefaultShmSize determines if the user actually set the shm in the parent ctr or if it has been set to the default size
471
func (inherit *InfraInherit) IsDefaultShmSize() bool {472
return inherit.ShmSize == nil || *inherit.ShmSize == 65536000