| 3333 | |
| 3334 | template <authorization::Action action> |
| 3335 | Future<Response> Http::_launchContainer( |
| 3336 | const ContainerID& containerId, |
| 3337 | const CommandInfo& commandInfo, |
| 3338 | const Option<Resources>& resourceRequests, |
| 3339 | const Option<google::protobuf::Map<string, Value::Scalar>>& resourceLimits, |
| 3340 | const Option<ContainerInfo>& containerInfo, |
| 3341 | const Option<ContainerClass>& containerClass, |
| 3342 | ContentType, |
| 3343 | const Owned<ObjectApprovers>& approvers) const |
| 3344 | { |
| 3345 | // Attempt to get the executor associated with this ContainerID. |
| 3346 | // We only expect to get the executor when launching a nested container |
| 3347 | // under a container launched via a scheduler. In other cases, we are |
| 3348 | // launching a standalone container (possibly nested). |
| 3349 | Executor* executor = slave->getExecutor(containerId); |
| 3350 | if (executor == nullptr) { |
| 3351 | if (!approvers->approved<action>(containerId)) { |
| 3352 | return Forbidden(); |
| 3353 | } |
| 3354 | } else { |
| 3355 | Framework* framework = slave->getFramework(executor->frameworkId); |
| 3356 | CHECK_NOTNULL(framework); |
| 3357 | |
| 3358 | if (!approvers->approved<action>( |
| 3359 | executor->info, framework->info, commandInfo, containerId)) { |
| 3360 | return Forbidden(); |
| 3361 | } |
| 3362 | } |
| 3363 | |
| 3364 | ContainerConfig containerConfig; |
| 3365 | containerConfig.mutable_command_info()->CopyFrom(commandInfo); |
| 3366 | |
| 3367 | #ifndef __WINDOWS__ |
| 3368 | if (slave->flags.switch_user && commandInfo.has_user()) { |
| 3369 | containerConfig.set_user(commandInfo.user()); |
| 3370 | } |
| 3371 | #endif // __WINDOWS__ |
| 3372 | |
| 3373 | if (resourceRequests.isSome()) { |
| 3374 | containerConfig.mutable_resources()->CopyFrom(resourceRequests.get()); |
| 3375 | } |
| 3376 | |
| 3377 | if (resourceLimits.isSome()) { |
| 3378 | *containerConfig.mutable_limits() = resourceLimits.get(); |
| 3379 | } |
| 3380 | |
| 3381 | if (containerInfo.isSome()) { |
| 3382 | containerConfig.mutable_container_info()->CopyFrom(containerInfo.get()); |
| 3383 | } |
| 3384 | |
| 3385 | if (containerClass.isSome()) { |
| 3386 | containerConfig.set_container_class(containerClass.get()); |
| 3387 | } |
| 3388 | |
| 3389 | // For standalone top-level containers, supply a sandbox directory. |
| 3390 | if (!containerId.has_parent()) { |
| 3391 | const string directory = |
| 3392 | slave::paths::getContainerPath(slave->flags.work_dir, containerId); |
nothing calls this directly
no test coverage detected