docker run: specify cgroup namespace mode with --cgroupns by rgulewich · Pull Request #2024 · docker/cli

rgulewich · 2019-07-30T04:47:48Z

- What I did

This adds the --cgroupns=host|private option to docker run to allow setting the cgroup namespace mode. Fixes#1988

- How I did it

Largely by copying the code for userns and ipc modes.

- How to verify it

docker run --cgroupns=private against a daemon that's running with --default-cgroupns-mode=host.

- Description for the changelog

docker run: allow specifying cgroup namespace mode with --cgroupns

- A picture of a cute animal (not mandatory but encouraged)

AkihiroSuda · 2019-07-30T04:56:13Z

Looks good, but CI failing

GordonTheTurtle · 2019-07-30T16:50:45Z

Please sign your commits following these rules:
https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:

$ git clone -b "1988-run-cgroupns-mode" git@github.com:rgulewich/cli.git somewhere
$ cd somewhere
$ git rebase -i HEAD~842358791888editor openschange each 'pick' to 'edit'save the file and quit
$ git commit --amend -s --no-edit
$ git rebase --continue # and repeat the amend for each commit
$ git push -f

Amending updates the existing PR. You DO NOT need to open a new one.

codecov-io · 2019-07-30T17:10:28Z

Codecov Report

❗ No coverage uploaded for pull request base (master@2079e74). Click here to learn what that means.
The diff coverage is 80%.

@@ Coverage Diff @@## master #2024 +/- ##
=========================================
Coverage ? 56.79% =========================================
Files ? 311 Lines ? 21849 Branches ? 0 =========================================
Hits ? 12410 Misses ? 8523 Partials ? 916

rgulewich · 2019-07-30T17:42:15Z

Looks good, but CI failing

@AkihiroSuda - Fixed CI failures related to my changes - TestSigProxyWithTTY() is failling, but as far as I can tell, the failure is unrelated.

kolyshkin · 2019-07-31T01:13:46Z

TestSigProxyWithTTY() is failling

@rgulewich might be fixed by #2016, could you please rebase?

rgulewich · 2019-07-31T16:59:42Z

@kolyshkin - That did it, thanks!

kolyshkin · 2019-07-31T17:22:18Z

+	environment.SkipIfCgroupNamespacesNotSupported(t)
+
+	result := icmd.RunCommand("docker", "run", "--cgroupns=private", "--rm", fixtures.AlpineImage,
+ "sh", "-c", "[[ $(cat /proc/1/cgroup | grep memory | cut -d: -f 3) == '/' ]]")


Perhaps rewrite this to not depend on bash? Also, looks like a single grep is sufficient, e.g.
grep -q ':memory:/$' /proc/1/cgroup

@rgulewich ^^

Updated - PTAL.

@kolyshkin ^^

thaJeztah

Thanks! left some comments inline

thaJeztah · 2019-08-06T11:48:50Z

 --cap-add value Add Linux capabilities (default [])
 --cap-drop value Drop Linux capabilities (default [])
+ --cgroupns string Cgroup namespace to use
+ 'host': Run the container in the Docker host's cgroup namespace


Might be slightly easier to read if the descriptions are aligned;
--cgroupns string Cgroup namespace to use 'host': Run the container in the Docker host's cgroup namespace 'private': Run the container in its own private cgroup namespace '': Use the default Docker daemon cgroup namespace specified by the "--default-cgroupns-mode" option (default)

thaJeztah · 2019-08-06T11:50:12Z


+**--default-cgroupns-mode**="**host**|**private**"
+ Set the default cgroup namespace mode for newly created containers. The argument
+ can either be **host** or **private**.


Should we describe the default here as well?

thaJeztah · 2019-08-06T11:56:48Z

 	}

+	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
+	if !cgroupnsMode.Valid() {


Thinking about this; I'm a bit on the fence if we should validate this on the client side, or just leave it to the daemon to return an error if an invalid value was provided. OTOH, these values likely won't change in future, so perhaps it's ok
@kolyshkin wdyt?

I think it's ok for now, given that it likely won't change in future, but I'll open a follow-up issue after this is merged to discuss this

albers

bash completion LGTM, thanks.

AkihiroSuda · 2019-08-16T19:41:47Z

needs rebase

thaJeztah

thanks for updating! (and sorry for the delay 😞) I left one comment about the docker-compose schema version (hoping #2073 will be merged soon), and a suggestion for the flag description output for --help.

Otherwise looks good to me!

thaJeztah · 2019-08-30T09:45:33Z

 	}

+	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
+	if !cgroupnsMode.Valid() {


I think it's ok for now, given that it likely won't change in future, but I'll open a follow-up issue after this is merged to discuss this

rgulewich · 2019-09-10T04:18:45Z

@thaJeztah - Updated with your changes. Mind taking a look?

rgulewich · 2019-09-30T20:56:16Z

@thaJeztah / @kolyshkin - Mind taking a look? Thanks!

AkihiroSuda · 2019-10-25T08:30:54Z

@thaJeztah PTAL?

AkihiroSuda · 2019-10-25T08:30:59Z

needs rebase

rgulewich · 2019-10-25T18:43:55Z

Rebased. @thaJeztah, mind taking a look?

AkihiroSuda · 2020-01-15T03:45:24Z

ping @thaJeztah

thaJeztah

LGTM

silvin-lubecki

Looks Good To Me 🐯

Signed-off-by: Rob Gulewich <rgulewich@netflix.com>

AkihiroSuda · 2020-02-10T14:39:06Z

CI failure seems unrelated


=== Failed
=== FAIL: e2e/image TestPushWithContentTrustUnreachableServer (0.37s)
push_test.go:323: assertion failed: Command: docker tag registry:5000/alpine:3.6 registry:5000/trust-push-unreachable:latest
ExitCode: 1
Error: exit status 1
Stdout: Stderr: error during connect: Post http://docker/v1.40/images/registry:5000/alpine:3.6/tag?repo=registry%3A5000%2Ftrust-push-unreachable&tag=latest: command [ssh -o ControlMaster=auto -o ControlPath=/root/.docker/%r@%h:%p -l penguin 172.20.0.2 -- docker system dial-stdio] has exited with exit status 255, please make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=
Failures:
ExitCode was 1 expected 0
Expected no error

AkihiroSuda · 2020-02-11T08:43:58Z

CI green

thaJeztah · 2020-02-11T10:16:00Z

Whoop! Let's merge!

@AkihiroSuda if you're able to assist with #2303 (that's related to CI being really flaky currently)

rgulewich requested review from albers and thaJeztah as code owners July 30, 2019 04:47

GordonTheTurtle added the status/0-triage label Jul 30, 2019

rgulewich mentioned this pull request Jul 30, 2019
docker run flag for overriding daemon default-cgroupns-mode #1988
Closed

AkihiroSuda approved these changes Jul 30, 2019
View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from f39912d to b560da6Compare July 30, 2019 16:50

GordonTheTurtle added the dco/no label Jul 30, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from b560da6 to bd828fdCompare July 30, 2019 17:10

GordonTheTurtle removed the dco/no label Jul 30, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from bd828fd to 0883b2aCompare July 30, 2019 17:27

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 0883b2a to 4c4bb53Compare July 31, 2019 02:44

kolyshkin reviewed Jul 31, 2019
View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 4c4bb53 to b6efc48Compare August 2, 2019 18:11

thaJeztah added impact/changelog impact/documentation status/2-code-review and removed status/0-triage labels Aug 6, 2019

thaJeztah requested changes Aug 6, 2019
View reviewed changes

thaJeztah reviewed Aug 6, 2019
View reviewed changes

albers approved these changes Aug 6, 2019
View reviewed changes

GordonTheTurtle added the dco/no label Aug 7, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 2ea22b0 to 602452fCompare August 23, 2019 20:42

GordonTheTurtle removed the dco/no label Aug 23, 2019

thaJeztah requested changes Aug 30, 2019
View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 602452f to fdeb2fdCompare September 10, 2019 04:15

rgulewich force-pushed the 1988-run-cgroupns-mode branch 2 times, most recently from 977f2ad to 88aba22Compare September 16, 2019 19:00

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 88aba22 to 306338fCompare September 30, 2019 20:54

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 306338f to 298d9cdCompare October 25, 2019 18:42

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 298d9cd to 15c01bbCompare November 11, 2019 22:29

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 15c01bb to 5afc093Compare December 18, 2019 22:25

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 5afc093 to e0d3e04Compare January 15, 2020 21:01

thaJeztah approved these changes Jan 16, 2020
View reviewed changes

thaJeztah added status/4-merge and removed status/2-code-review labels Jan 16, 2020

silvin-lubecki approved these changes Jan 17, 2020
View reviewed changes

docker run: specify cgroup namespace mode with --cgroupns
5ad1d4d
Signed-off-by: Rob Gulewich <rgulewich@netflix.com>

rgulewich force-pushed the 1988-run-cgroupns-mode branch from e0d3e04 to 5ad1d4dCompare January 29, 2020 22:51

thaJeztah merged commit 8ef8547 into docker:masterFeb 11, 2020

thaJeztah added this to the 20.03.0 milestone Feb 19, 2020

hendrikmaus mentioned this pull request Jul 7, 2022
docs: fix default value for dockerd --default-cgroupns to private#3699
Open

crazy-max mentioned this pull request Dec 18, 2022
cmd: set double quotes as code delimiter #3924
Merged

LewisGaul mentioned this pull request Jan 18, 2023
Add support for the --cgroupns arg gabrieldemarmiesse/python-on-whales#400
Merged

BenTheElder mentioned this pull request Apr 6, 2023
Cannot start kind with userns remap kubernetes-sigs/kind#3043
Open

Uh oh!

Conversation

rgulewich commented Jul 30, 2019

Uh oh!

AkihiroSuda commented Jul 30, 2019

Uh oh!

GordonTheTurtle commented Jul 30, 2019

Uh oh!

codecov-io commented Jul 30, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rgulewich commented Jul 30, 2019

Uh oh!

kolyshkin commented Jul 31, 2019

Uh oh!

rgulewich commented Jul 31, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

albers left a comment

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda commented Aug 16, 2019

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rgulewich commented Sep 10, 2019

Uh oh!

rgulewich commented Sep 30, 2019

Uh oh!

AkihiroSuda commented Oct 25, 2019

Uh oh!

AkihiroSuda commented Oct 25, 2019

Uh oh!

rgulewich commented Oct 25, 2019

Uh oh!

AkihiroSuda commented Jan 15, 2020

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

silvin-lubecki left a comment

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda commented Feb 10, 2020

Uh oh!

AkihiroSuda commented Feb 11, 2020

Uh oh!

thaJeztah commented Feb 11, 2020

Uh oh!

Reviewers

Assignees

Labels

codecov-io commented Jul 30, 2019•
edited
Loading