podman

1
//go:build !remote
2

3
package generate
4

5
import (
6
	"context"
7
	"fmt"
8
	"strings"
9

10
	"github.com/containers/common/libimage"
11
	"github.com/containers/common/pkg/config"
12
	"github.com/containers/podman/v5/libpod"
13
	"github.com/containers/podman/v5/libpod/define"
14
	"github.com/containers/podman/v5/pkg/specgen"
15
	"github.com/opencontainers/runtime-spec/specs-go"
16
	spec "github.com/opencontainers/runtime-spec/specs-go"
17
	"github.com/opencontainers/runtime-tools/generate"
18
)
19

20
// SpecGenToOCI returns the base configuration for the container.
21
func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) {
22
	var imageOs string
23
	if newImage != nil {
24
		inspectData, err := newImage.Inspect(ctx, nil)
25
		if err != nil {
26
			return nil, err
27
		}
28
		imageOs = inspectData.Os
29
	} else {
30
		imageOs = "freebsd"
31
	}
32

33
	if imageOs != "freebsd" && imageOs != "linux" {
34
		return nil, fmt.Errorf("unsupported image OS: %s", imageOs)
35
	}
36

37
	g, err := generate.New(imageOs)
38
	if err != nil {
39
		return nil, err
40
	}
41

42
	g.SetProcessCwd(s.WorkDir)
43

44
	g.SetProcessArgs(finalCmd)
45

46
	if s.Terminal != nil {
47
		g.SetProcessTerminal(*s.Terminal)
48
	}
49

50
	for key, val := range s.Annotations {
51
		g.AddAnnotation(key, val)
52
	}
53

54
	// Devices
55
	var userDevices []spec.LinuxDevice
56
	if !s.IsPrivileged() {
57
		// add default devices from containers.conf
58
		for _, device := range rtc.Containers.Devices.Get() {
59
			if err = DevicesFromPath(&g, device); err != nil {
60
				return nil, err
61
			}
62
		}
63
		if len(compatibleOptions.HostDeviceList) > 0 && len(s.Devices) == 0 {
64
			userDevices = compatibleOptions.HostDeviceList
65
		} else {
66
			userDevices = s.Devices
67
		}
68
		// add default devices specified by caller
69
		for _, device := range userDevices {
70
			if err = DevicesFromPath(&g, device.Path); err != nil {
71
				return nil, err
72
			}
73
		}
74
	}
75

76
	g.ClearProcessEnv()
77
	for name, val := range s.Env {
78
		g.AddProcessEnv(name, val)
79
	}
80

81
	addRlimits(s, &g)
82

83
	// NAMESPACES
84
	if err := specConfigureNamespaces(s, &g, rt, pod); err != nil {
85
		return nil, err
86
	}
87
	configSpec := g.Config
88

89
	if err := securityConfigureGenerator(s, &g, newImage, rtc); err != nil {
90
		return nil, err
91
	}
92

93
	// Linux emulatioon
94
	if imageOs == "linux" {
95
		var mounts []spec.Mount
96
		for _, m := range configSpec.Mounts {
97
			switch m.Destination {
98
			case "/proc":
99
				m.Type = "linprocfs"
100
				m.Options = []string{"nodev"}
101
				mounts = append(mounts, m)
102
				continue
103
			case "/sys":
104
				m.Type = "linsysfs"
105
				m.Options = []string{"nodev"}
106
				mounts = append(mounts, m)
107
				continue
108
			case "/dev", "/dev/pts", "/dev/shm", "/dev/mqueue":
109
				continue
110
			}
111
		}
112
		mounts = append(mounts,
113
			spec.Mount{
114
				Destination: "/dev",
115
				Type:        "devfs",
116
				Source:      "devfs",
117
				Options: []string{
118
					"ruleset=4",
119
					"rule=path shm unhide mode 1777",
120
				},
121
			},
122
			spec.Mount{
123
				Destination: "/dev/fd",
124
				Type:        "fdescfs",
125
				Source:      "fdesc",
126
				Options:     []string{},
127
			},
128
			spec.Mount{
129
				Destination: "/dev/shm",
130
				Type:        define.TypeTmpfs,
131
				Source:      "shm",
132
				Options:     []string{"notmpcopyup"},
133
			},
134
		)
135
		configSpec.Mounts = mounts
136
	}
137

138
	// BIND MOUNTS
139
	configSpec.Mounts = SupersedeUserMounts(mounts, configSpec.Mounts)
140
	// Process mounts to ensure correct options
141
	if err := InitFSMounts(configSpec.Mounts); err != nil {
142
		return nil, err
143
	}
144

145
	// Add annotations
146
	if configSpec.Annotations == nil {
147
		configSpec.Annotations = make(map[string]string)
148
	}
149

150
	if s.Remove != nil && *s.Remove {
151
		configSpec.Annotations[define.InspectAnnotationAutoremove] = define.InspectResponseTrue
152
	}
153

154
	if len(s.VolumesFrom) > 0 {
155
		configSpec.Annotations[define.VolumesFromAnnotation] = strings.Join(s.VolumesFrom, ";")
156
	}
157

158
	if s.IsPrivileged() {
159
		configSpec.Annotations[define.InspectAnnotationPrivileged] = define.InspectResponseTrue
160
	}
161

162
	if s.Init != nil && *s.Init {
163
		configSpec.Annotations[define.InspectAnnotationInit] = define.InspectResponseTrue
164
	}
165

166
	if s.OOMScoreAdj != nil {
167
		g.SetProcessOOMScoreAdj(*s.OOMScoreAdj)
168
	}
169

170
	return configSpec, nil
171
}
172

173
func WeightDevices(wtDevices map[string]spec.LinuxWeightDevice) ([]spec.LinuxWeightDevice, error) {
174
	devs := []spec.LinuxWeightDevice{}
175
	return devs, nil
176
}
177

178
func subNegativeOne(u specs.POSIXRlimit) specs.POSIXRlimit {
179
	return u
180
}
181