| 669 | |
| 670 | |
| 671 | Future<Option<ContainerLaunchInfo>> LinuxFilesystemIsolatorProcess::prepare( |
| 672 | const ContainerID& containerId, |
| 673 | const ContainerConfig& containerConfig) |
| 674 | { |
| 675 | // If we are a nested container in the `DEBUG` class, then we only |
| 676 | // use this isolator to indicate that we should enter our parent's |
| 677 | // MOUNT namespace. We don't want to clone a new MOUNT namespace or |
| 678 | // run any new pre-exec commands in it. For now, we also don't |
| 679 | // support provisioning a new filesystem or setting a `rootfs` for |
| 680 | // the container. We also don't support mounting any volumes. |
| 681 | if (containerId.has_parent() && |
| 682 | containerConfig.has_container_class() && |
| 683 | containerConfig.container_class() == ContainerClass::DEBUG) { |
| 684 | if (containerConfig.has_rootfs()) { |
| 685 | return Failure("A 'rootfs' cannot be set for DEBUG containers"); |
| 686 | } |
| 687 | |
| 688 | if (containerConfig.has_container_info() && |
| 689 | containerConfig.container_info().volumes().size() > 0) { |
| 690 | return Failure("Volumes not supported for DEBUG containers"); |
| 691 | } |
| 692 | |
| 693 | ContainerLaunchInfo launchInfo; |
| 694 | launchInfo.add_enter_namespaces(CLONE_NEWNS); |
| 695 | return launchInfo; |
| 696 | } |
| 697 | |
| 698 | // Currently, we do not support persistent volumes for standalone |
| 699 | // containers. Therefore, we perform the check here to reject the |
| 700 | // standalone container launch if persistent volumes are specified. |
| 701 | const bool isStandaloneContainer = |
| 702 | containerizer::paths::isStandaloneContainer(flags.runtime_dir, containerId); |
| 703 | |
| 704 | if (isStandaloneContainer && |
| 705 | !Resources(containerConfig.resources()).persistentVolumes().empty()) { |
| 706 | return Failure( |
| 707 | "Persistent volumes are not supported for standalone containers"); |
| 708 | } |
| 709 | |
| 710 | if (infos.contains(containerId)) { |
| 711 | return Failure("Container has already been prepared"); |
| 712 | } |
| 713 | |
| 714 | const string& directory = containerConfig.directory(); |
| 715 | |
| 716 | Option<ExecutorInfo> executorInfo; |
| 717 | if (containerConfig.has_executor_info()) { |
| 718 | executorInfo = containerConfig.executor_info(); |
| 719 | } |
| 720 | |
| 721 | infos.put(containerId, Owned<Info>(new Info( |
| 722 | directory, |
| 723 | executorInfo))); |
| 724 | |
| 725 | ContainerLaunchInfo launchInfo; |
| 726 | launchInfo.add_clone_namespaces(CLONE_NEWNS); |
| 727 | |
| 728 | if (containerConfig.has_rootfs()) { |
nothing calls this directly
no test coverage detected