burble/nomad-driver-containerd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Change filesystem isolation to FSIsolationImage.

Browse Source 
Signed-off-by: Shishir Mahajan <smahajan@roblox.com>
This commit is contained in:
Shishir Mahajan 2021-01-12 10:00:22 -08:00
parent 6416bf6c17
commit 2e0a50bde1
No known key found for this signature in database
GPG Key ID: D41782E7688DEC4A
2 changed files with 24 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
containerd/containerd.go
View File

@ -36,9 +36,12 @@ type ContainerConfig struct {
ContainerName string ContainerName string
ContainerSnapshotName string ContainerSnapshotName string
NetworkNamespacePath string NetworkNamespacePath string
SecretsDir string SecretsDirSrc string
TaskDir string TaskDirSrc string
AllocDir string AllocDirSrc string
SecretsDirDest string
TaskDirDest string
AllocDirDest string
Env []string Env []string
MemoryLimit int64 MemoryLimit int64
CPUShares int64 CPUShares int64
@ -165,20 +168,20 @@ func (d *Driver) createContainer(containerConfig *ContainerConfig, config *TaskC
} }
// Setup "/secrets" (NOMAD_SECRETS_DIR) in the container. // Setup "/secrets" (NOMAD_SECRETS_DIR) in the container.
if containerConfig.SecretsDir != "" { if containerConfig.SecretsDirSrc != "" && containerConfig.SecretsDirDest != "" {
secretsMount := buildMountpoint("bind", "/secrets", containerConfig.SecretsDir, []string{"rbind", "ro"}) secretsMount := buildMountpoint("bind", containerConfig.SecretsDirDest, containerConfig.SecretsDirSrc, []string{"rbind", "rw"})
mounts = append(mounts, secretsMount) mounts = append(mounts, secretsMount)
} }
// Setup "/local" (NOMAD_TASK_DIR) in the container. // Setup "/local" (NOMAD_TASK_DIR) in the container.
if containerConfig.TaskDir != "" { if containerConfig.TaskDirSrc != "" && containerConfig.TaskDirDest != "" {
taskMount := buildMountpoint("bind", "/local", containerConfig.TaskDir, []string{"rbind", "ro"}) taskMount := buildMountpoint("bind", containerConfig.TaskDirDest, containerConfig.TaskDirSrc, []string{"rbind", "rw"})
mounts = append(mounts, taskMount) mounts = append(mounts, taskMount)
} }
// Setup "/alloc" (NOMAD_ALLOC_DIR) in the container. // Setup "/alloc" (NOMAD_ALLOC_DIR) in the container.
if containerConfig.AllocDir != "" { if containerConfig.AllocDirSrc != "" && containerConfig.AllocDirDest != "" {
allocMount := buildMountpoint("bind", "/alloc", containerConfig.AllocDir, []string{"rbind", "ro"}) allocMount := buildMountpoint("bind", containerConfig.AllocDirDest, containerConfig.AllocDirSrc, []string{"rbind", "rw"})
mounts = append(mounts, allocMount) mounts = append(mounts, allocMount)
} }

22
containerd/driver.go
View File

@ -29,6 +29,7 @@ import (
"github.com/hashicorp/go-hclog" "github.com/hashicorp/go-hclog"
log "github.com/hashicorp/go-hclog" log "github.com/hashicorp/go-hclog"
"github.com/hashicorp/nomad/client/stats" "github.com/hashicorp/nomad/client/stats"
"github.com/hashicorp/nomad/client/taskenv"
"github.com/hashicorp/nomad/drivers/shared/eventer" "github.com/hashicorp/nomad/drivers/shared/eventer"
"github.com/hashicorp/nomad/plugins/base" "github.com/hashicorp/nomad/plugins/base"
"github.com/hashicorp/nomad/plugins/drivers" "github.com/hashicorp/nomad/plugins/drivers"
@ -118,7 +119,7 @@ var (
capabilities = &drivers.Capabilities{ capabilities = &drivers.Capabilities{
SendSignals: true, SendSignals: true,
Exec: true, Exec: true,
FSIsolation: drivers.FSIsolationNone, FSIsolation: drivers.FSIsolationImage,
NetIsolationModes: []drivers.NetIsolationMode{drivers.NetIsolationModeGroup, drivers.NetIsolationModeTask}, NetIsolationModes: []drivers.NetIsolationMode{drivers.NetIsolationModeGroup, drivers.NetIsolationModeTask},
} }
) )
@ -385,18 +386,19 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive
if skipOverride(key) { if skipOverride(key) {
continue continue
} }
if key == "NOMAD_SECRETS_DIR" {
containerConfig.SecretsDir = val
}
if key == "NOMAD_TASK_DIR" {
containerConfig.TaskDir = val
}
if key == "NOMAD_ALLOC_DIR" {
containerConfig.AllocDir = val
}
containerConfig.Env = append(containerConfig.Env, fmt.Sprintf("%s=%s", key, val)) containerConfig.Env = append(containerConfig.Env, fmt.Sprintf("%s=%s", key, val))
} }
// Setup source paths for secrets, task and alloc directories.
containerConfig.SecretsDirSrc = cfg.TaskDir().SecretsDir
containerConfig.TaskDirSrc = cfg.TaskDir().LocalDir
containerConfig.AllocDirSrc = cfg.TaskDir().SharedAllocDir
// Setup destination paths for secrets, task and alloc directories.
containerConfig.SecretsDirDest = cfg.Env[taskenv.SecretsDir]
containerConfig.TaskDirDest = cfg.Env[taskenv.TaskLocalDir]
containerConfig.AllocDirDest = cfg.Env[taskenv.AllocDir]
containerConfig.ContainerSnapshotName = fmt.Sprintf("%s-snapshot", containerName) containerConfig.ContainerSnapshotName = fmt.Sprintf("%s-snapshot", containerName)
if cfg.NetworkIsolation != nil && cfg.NetworkIsolation.Path != "" { if cfg.NetworkIsolation != nil && cfg.NetworkIsolation.Path != "" {
containerConfig.NetworkNamespacePath = cfg.NetworkIsolation.Path containerConfig.NetworkNamespacePath = cfg.NetworkIsolation.Path