Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

This updates runc and libcontainer to handle rlimits per process and set
them correctly for the container.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

nsexec: don't use CLONE_PARENT and CLONE_NEWPID together

The rhel6 kernel returns EINVAL in this case

Known issue:
* CT with userns doesn't work

This is a copy of
https://github.com/avagin/runc/commit/d31e97fa28345375b3f76bff64d12cdb07e03ba0
to address https://github.com/opencontainers/runc/issues/613



Signed-off-by: Andrey Vagin <avagin@virtuozzo.com>
Signed-off-by: Andrew Fernandes <andrew@fernandes.org>

Improve error handling in runc

Create pid file when not exist

The error handling on the runc cli is currenly pretty messy because
messages to the user are split between regular stderr format and logrus
message format.  This changes all the error reporting to the cli to only
output on stderr and exit(1) for consumers of the api.

By default logrus logs to /dev/null so that it is not seen by the user.
If the user wants extra and/or structured loggging/errors from runc they
can use the `--log` flag to provide a path to the file where they want
this information.  This allows a consistent behavior on the cli but
extra power and information when debugging with logs.

This also includes a change to enable the same logging information
inside the container's init by adding an init cli command that can share
the existing flags for all other runc commands.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

Handling error condition in loadspec

Add man pages

Remove duplicated included head file

Serialize CommandHooks to state so that PostStop hooks execute during 'runc delete'

Add the most basic sniff tests of runc

Cleanup systemd apply

just so that we're not merging code into master w/o any tests at all.
I expect this to be removed once we have a real testing infrastructure.

Signed-off-by: Doug Davis <dug@us.ibm.com>

Signed-off-by: Rajasekaran <rajasec79@gmail.com>

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

This is copied from docker

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Remove no longer used uid/gid mapping functions

Properly setuid/setgid after entering userns

Now that all the user namespace code is moved into C, these routines are
no longer used.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

The re-work of namespace entering lost the setuid/setgid that was part
of the Go-routine based process exec in the prior code. A side issue was
found with setting oom_score_adj before execve() in a userns that is
also solved here.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

Stub RunningInUserNS for non-Linux

Update specs dep and runc functionality

Add a stub for non-Linux that always returns false

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

This commit adds support to libcontainer to allow caps, no new privs,
apparmor, and selinux process label to the process struct so that it can
be used together of override the base settings on the container config
per individual process.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

This bump of the spec includes a change to the deivce type to be a
string so that it is more readable in the json serialization.

It also includes the change were caps, no new privs, and process
labeling features are moved from the container config onto the process.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

This is needed to make 'runc delete' correctly run the post-stop hooks.

Signed-off-by: Julian Friedman <julz.friedman@uk.ibm.com>
Signed-off-by: Ed King <eking@pivotal.io>

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>

Eliminating checkpoint state in container

Fix build error on centos6

Fix handling of unsupported namespaces

Signed-off-by: Rajasekaran <rajasec79@gmail.com>

currentState() always adds all possible namespaces to the state,
regardless of whether they are supported.
If orderNamespacePaths detects an unsupported namespace, an error is
returned that results in initialization failure.

Fix this by only adding paths of supported namespaces to the state.

Signed-off-by: Ido Yariv <ido@wizery.com>

Signed-off-by: Ye Yin <eyniy@qq.com>

adds the spec required state command

Signed-off-by: Mike Brown <brownwm@us.ibm.com>