Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit68eb128

Browse files
wkingrh-atomic-bot
authored andcommitted
pkg/hooks: Version the hook structure and add 1.0.0 hooks
This shifts the matching logic out of libpod/container_internal andinto the hook package, where we can reuse it after vendoring intoCRI-O. It also adds unit tests with almost-complete coverage. Nowlibpod is even more isolated from the hook internals, which makes itfairly straightforward to bump the hook config file to 1.0.0. I'vedubbed the old format 0.1.0, although it doesn't specify an explicitversion. Motivation for some of my changes with 1.0.0:* Add an explicit version field. This will make any future JSON structure migrations more straightforward by avoiding the need for version-guessing heuristics.* Collect the matching properties in a new When sub-structure. This makes the root Hook structure easier to understand, because you don't have to read over all the matching properties when wrapping your head around Hook.* Replace the old 'hook' and 'arguments' with a direct embedding of the runtime-spec's hook structure. This provides access to additional upstream properties (args[0], env, and timeout) and avoids the complication of a CRI-O-specific analog structure.* Add a 'when.always' property. You can usually accomplish this effect in another way (e.g. when.commands = [".*"]), but having a boolean explicitly for this use-case makes for easier reading and writing.* Replace the previous annotations array with an annotations map. The 0.1.0 approach matched only the values regardless of key, and that seems unreliable.* Replace 'cmds' with 'when.commands', because while there are a few ways to abbreviate "commands", there's only one way to write it out in full ;). This gives folks one less thing to remember when writing hook JSON.* Replace the old "inject if any specified condition matches" with "inject if all specified conditions match". This allows for more precise targeting. Users that need more generous targeting can recover the previous behavior by creating a separate 1.0.0 hook file for each specified 0.1.0 condition.I've added doc-compat support for the various pluralizations of the0.1.0 properties. Previously, the docs and code were not inagreement. More on this particular facet in [1].I've updated the docs to point out that the annotations being matchedare the OCI config annotations. This differs from CRI-O, where theannotations used are the Kubernetes-supplied annotations [2,3]. Forexample, io.kubernetes.cri-o.Volumes [4] is part of CRI-O's runtimeconfig annotations [5], but not part of the Kubernetes-suppliedannotations CRI-O uses for matching hooks.The Monitor method supports the CRI-O use-case [6]. podman doesn'tneed it directly, but CRI-O will need it when we vendor this packagethere.I've used nvidia-container-runtime-hook for the annotation examplesbecause Dan mentioned the Nvidia folks as the motivation behindannotation matching. The environment variables are documented in [7].The 0.1.0 hook config, which does not allow for environment variables,only works because runc currently leaks the host environment into thehooks [8]. I haven't been able to find documentation for their usualannotation trigger or hook-install path, so I'm just guessing there.[1]:cri-o/cri-o#1235[2]:https://github.com/kubernetes-incubator/cri-o/blob/v1.10.0/server/container_create.go#L760[3]:https://github.com/kubernetes-incubator/cri-o/blob/v1.10.0/server/container_create.go#L772[4]:https://github.com/kubernetes-incubator/cri-o/blob/v1.10.0/pkg/annotations/annotations.go#L97-L98[5]:https://github.com/kubernetes-incubator/cri-o/blob/v1.10.0/server/container_create.go#L830-L834[6]:cri-o/cri-o#1345[7]:https://github.com/NVIDIA/nvidia-container-runtime/tree/v1.3.0-1#environment-variables-oci-spec[8]:opencontainers/runc#1738Signed-off-by: W. Trevor King <wking@tremily.us>Closes:#686Approved by: mheon
1 parent9657cd6 commit68eb128

File tree

19 files changed

+1822
-255
lines changed

19 files changed

+1822
-255
lines changed

‎README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ The plan is to use OCI projects and best of breed libraries for different aspect
3737
**[Installation notes](/install.md)**
3838
Information on how to install Podman in your environment.
3939

40-
**[OCI Hooks Support](/hooks.md)**
41-
Information on how Podman configures OCI Hooks to run when launching a container.
40+
**[OCI Hooks Support](pkg/hooks/README.md)**
41+
Information on how Podman configures[OCI Hooks][spec-hooks] to run when launching a container.
4242

4343
**[Podman Commands](/commands.md)**
4444
A list of the Podman commands with links to their man pages and in many cases videos
@@ -64,3 +64,5 @@ Information about contributing to this project.
6464
1. Pod commands for Podman
6565
1. Rootless containers
6666
1. Support for cleaning up containers via post-run hooks
67+
68+
[spec-hooks]:https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks

‎cmd/podman/main.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"github.com/containers/storage/pkg/reexec"
99
"github.com/pkg/errors"
1010
"github.com/projectatomic/libpod/pkg/hooks"
11+
_"github.com/projectatomic/libpod/pkg/hooks/0.1.0"
1112
"github.com/projectatomic/libpod/version"
1213
"github.com/sirupsen/logrus"
1314
"github.com/urfave/cli"
@@ -136,7 +137,7 @@ func main() {
136137
cli.StringFlag{
137138
Name:"hooks-dir-path",
138139
Usage:"set the OCI hooks directory path",
139-
Value:hooks.DefaultHooksDir,
140+
Value:hooks.DefaultDir,
140141
Hidden:true,
141142
},
142143
cli.StringFlag{

‎hooks.md‎

Lines changed: 0 additions & 91 deletions
This file was deleted.

‎libpod/container_internal.go‎

Lines changed: 9 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ import (
99
"os"
1010
"path"
1111
"path/filepath"
12-
"regexp"
1312
"strings"
1413
"syscall"
1514
"time"
@@ -1064,7 +1063,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
10641063
}
10651064
}
10661065

1067-
iferr:=c.setupOCIHooks(&g);err!=nil {
1066+
iferr:=c.setupOCIHooks(ctx,&g);err!=nil {
10681067
returnnil,errors.Wrapf(err,"error setting up OCI Hooks")
10691068
}
10701069
// Bind builtin image volumes
@@ -1283,58 +1282,15 @@ func (c *Container) saveSpec(spec *spec.Spec) error {
12831282
returnnil
12841283
}
12851284

1286-
// Add OCI hooks to a container's spec
1287-
func (c*Container)setupOCIHooks(g*generate.Generator)error {
1288-
addedHooks:=map[string]struct{}{}
1289-
ocihooks,err:=hooks.SetupHooks(c.runtime.config.HooksDir)
1290-
iferr!=nil {
1291-
returnerr
1292-
}
1293-
addHook:=func(hook hooks.HookParams)error {
1294-
// Only add a hook once
1295-
if_,ok:=addedHooks[hook.Hook];!ok {
1296-
iferr:=hooks.AddOCIHook(g,hook);err!=nil {
1297-
returnerr
1298-
}
1299-
addedHooks[hook.Hook]=struct{}{}
1300-
}
1285+
func (c*Container)setupOCIHooks(ctx context.Context,g*generate.Generator)error {
1286+
ifc.runtime.config.HooksDir=="" {
13011287
returnnil
13021288
}
1303-
for_,hook:=rangeocihooks {
1304-
logrus.Debugf("SetupOCIHooks",hook)
1305-
ifhook.HasBindMounts&&len(c.config.UserVolumes)>0 {
1306-
iferr:=addHook(hook);err!=nil {
1307-
returnerr
1308-
}
1309-
continue
1310-
}
1311-
for_,cmd:=rangehook.Cmds {
1312-
match,err:=regexp.MatchString(cmd,c.config.Spec.Process.Args[0])
1313-
iferr!=nil {
1314-
logrus.Errorf("Invalid regex %q:%q",cmd,err)
1315-
continue
1316-
}
1317-
ifmatch {
1318-
iferr:=addHook(hook);err!=nil {
1319-
returnerr
1320-
}
1321-
}
1322-
}
1323-
annotations:=c.Spec().Annotations
1324-
for_,annotationRegex:=rangehook.Annotations {
1325-
for_,annotation:=rangeannotations {
1326-
match,err:=regexp.MatchString(annotationRegex,annotation)
1327-
iferr!=nil {
1328-
logrus.Errorf("Invalid regex %q:%q",annotationRegex,err)
1329-
continue
1330-
}
1331-
ifmatch {
1332-
iferr:=addHook(hook);err!=nil {
1333-
returnerr
1334-
}
1335-
}
1336-
}
1337-
}
1289+
1290+
manager,err:=hooks.New(ctx, []string{c.runtime.config.HooksDir})
1291+
iferr!=nil {
1292+
returnerr
13381293
}
1339-
returnnil
1294+
1295+
returnmanager.Hooks(g.Spec(),c.Spec().Annotations,len(c.config.UserVolumes)>0)
13401296
}

‎libpod/runtime.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ var (
159159
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
160160
},
161161
CgroupManager:CgroupfsCgroupsManager,
162-
HooksDir:hooks.DefaultHooksDir,
162+
HooksDir:hooks.DefaultDir,
163163
StaticDir:filepath.Join(storage.DefaultStoreOptions.GraphRoot,"libpod"),
164164
TmpDir:"/var/run/libpod",
165165
MaxLogSize:-1,

‎pkg/hooks/0.1.0/hook.go‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Package hook is the 0.1.0 hook configuration structure.
2+
package hook
3+
4+
import (
5+
"encoding/json"
6+
"errors"
7+
"strings"
8+
9+
rspec"github.com/opencontainers/runtime-spec/specs-go"
10+
hooks"github.com/projectatomic/libpod/pkg/hooks"
11+
current"github.com/projectatomic/libpod/pkg/hooks/1.0.0"
12+
)
13+
14+
// Version is the hook configuration version defined in this package.
15+
constVersion="0.1.0"
16+
17+
// Hook is the hook configuration structure.
18+
typeHookstruct {
19+
Hook*string`json:"hook"`
20+
Arguments []string`json:"arguments,omitempty"`
21+
22+
// https://github.com/kubernetes-incubator/cri-o/pull/1235
23+
Stages []string`json:"stages"`
24+
Stage []string`json:"stage"`
25+
26+
Cmds []string`json:"cmds,omitempty"`
27+
Cmd []string`json:"cmd,omitempty"`
28+
29+
Annotations []string`json:"annotations,omitempty"`
30+
Annotation []string`json:"annotation,omitempty"`
31+
32+
HasBindMounts*bool`json:"hasbindmounts,omitempty"`
33+
}
34+
35+
funcread(content []byte) (hook*current.Hook,errerror) {
36+
varrawHook
37+
iferr=json.Unmarshal(content,&raw);err!=nil {
38+
returnnil,err
39+
}
40+
41+
ifraw.Hook==nil {
42+
returnnil,errors.New("missing required property: hook")
43+
}
44+
45+
ifraw.Stages==nil {
46+
raw.Stages=raw.Stage
47+
}elseifraw.Stage!=nil {
48+
returnnil,errors.New("cannot set both 'stage' and 'stages'")
49+
}
50+
ifraw.Stages==nil {
51+
returnnil,errors.New("missing required property: stages")
52+
}
53+
54+
ifraw.Cmds==nil {
55+
raw.Cmds=raw.Cmd
56+
}elseifraw.Cmd!=nil {
57+
returnnil,errors.New("cannot set both 'cmd' and 'cmds'")
58+
}
59+
60+
ifraw.Annotations==nil {
61+
raw.Annotations=raw.Annotation
62+
}elseifraw.Annotation!=nil {
63+
returnnil,errors.New("cannot set both 'annotation' and 'annotations'")
64+
}
65+
66+
hook=&current.Hook{
67+
Version:current.Version,
68+
Hook: rspec.Hook{
69+
Path:*raw.Hook,
70+
},
71+
When: current.When{
72+
Commands:raw.Cmds,
73+
HasBindMounts:raw.HasBindMounts,
74+
Or:true,
75+
},
76+
Stages:raw.Stages,
77+
}
78+
ifraw.Arguments!=nil {
79+
hook.Hook.Args=append([]string{*raw.Hook},raw.Arguments...)
80+
}
81+
ifraw.Annotations!=nil {
82+
hook.When.Annotations=map[string]string{
83+
".*":strings.Join(raw.Annotations,"|"),
84+
}
85+
}
86+
87+
returnhook,nil
88+
}
89+
90+
funcinit() {
91+
hooks.Readers[""]=read
92+
hooks.Readers[Version]=read
93+
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp