diff --git a/README.md b/README.md index 23183b5..e9aa824 100644 --- a/README.md +++ b/README.md @@ -95,7 +95,7 @@ type Runner interface { 1. Pre-fork container to run programs inside 2. Unix socket to pass fd inside / outside -Container / Master Communication Protocol (single thread): +Container / Host Communication Protocol (single thread): - ping (alive check): - reply: pong diff --git a/container/container_exec.go b/container/container_exec.go index 544a5eb..ea109a2 100644 --- a/container/container_exec.go +++ b/container/container_exec.go @@ -45,11 +45,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error }, } if err := c.sendReply(&reply{}, msg); err != nil { - return fmt.Errorf("syncFunc: sendReply %w", err) + return fmt.Errorf("syncFunc: sendReply %v", err) } cmd, _, err := c.recvCmd() if err != nil { - return fmt.Errorf("syncFunc: recvCmd %w", err) + return fmt.Errorf("syncFunc: recvCmd %v", err) } if cmd.Cmd == cmdKill { return fmt.Errorf("syncFunc: received kill") diff --git a/container/container_init.go b/container/container_init.go index fba979b..e226d4d 100644 --- a/container/container_init.go +++ b/container/container_init.go @@ -49,7 +49,7 @@ func Init() (err error) { const defaultFd = 3 soc, err := unixsocket.NewSocket(defaultFd) if err != nil { - return fmt.Errorf("container_init: failed to new socket %w", err) + return fmt.Errorf("container_init: failed to new socket %v", err) } // serve forever @@ -61,10 +61,10 @@ func (c *containerServer) serve() error { for { cmd, msg, err := c.recvCmd() if err != nil { - return fmt.Errorf("serve: recvCmd %w", err) + return fmt.Errorf("serve: recvCmd %v", err) } if err := c.handleCmd(cmd, msg); err != nil { - return fmt.Errorf("serve: failed to execute cmd %w", err) + return fmt.Errorf("serve: failed to execute cmd %v", err) } } } diff --git a/container/environment.go b/container/environment.go index e6de43d..adef2be 100644 --- a/container/environment.go +++ b/container/environment.go @@ -76,7 +76,7 @@ func (b *Builder) Build() (Environment, error) { WithTmpfs("w", ""). // work dir WithTmpfs("tmp", ""). // tmp Build(true); err != nil { - return nil, fmt.Errorf("container: failed to build rootfs mount %w", err) + return nil, fmt.Errorf("container: failed to build rootfs mount %v", err) } } @@ -84,14 +84,14 @@ func (b *Builder) Build() (Environment, error) { root := b.Root if root == "" { if root, err = os.Getwd(); err != nil { - return nil, fmt.Errorf("container: failed to get work directory %w", err) + return nil, fmt.Errorf("container: failed to get work directory %v", err) } } // prepare stdin / stdout / stderr devNull, err := os.OpenFile(os.DevNull, os.O_RDWR, os.ModePerm) if err != nil { - return nil, fmt.Errorf("container: failed to open devNull %w", err) + return nil, fmt.Errorf("container: failed to open devNull %v", err) } defer devNull.Close() @@ -106,21 +106,21 @@ func (b *Builder) Build() (Environment, error) { // prepare container exec file execFile, err := b.exec() if err != nil { - return nil, fmt.Errorf("container: prepare exec %w", err) + return nil, fmt.Errorf("container: prepare exec %v", err) } defer execFile.Close() // prepare host <-> container unix socket ins, outs, err := newPassCredSocketPair() if err != nil { - return nil, fmt.Errorf("container: failed to create socket: %w", err) + return nil, fmt.Errorf("container: failed to create socket: %v", err) } defer outs.Close() outf, err := outs.File() if err != nil { ins.Close() - return nil, fmt.Errorf("container: failed to dup container socket fd %w", err) + return nil, fmt.Errorf("container: failed to dup container socket fd %v", err) } defer outf.Close() @@ -149,7 +149,7 @@ func (b *Builder) Build() (Environment, error) { pid, err := r.Start() if err != nil { ins.Close() - return nil, fmt.Errorf("container: failed to start container %w", err) + return nil, fmt.Errorf("container: failed to start container %v", err) } c := &container{ diff --git a/container/socket.go b/container/socket.go index 4e8e006..4f218bb 100644 --- a/container/socket.go +++ b/container/socket.go @@ -32,7 +32,7 @@ func (s *socket) RecvMsg(e interface{}) (*unixsocket.Msg, error) { } if err := gob.NewDecoder(bytes.NewReader(buff[:n])).Decode(e); err != nil { - return nil, fmt.Errorf("RecvMsg: failed to decode %w", err) + return nil, fmt.Errorf("RecvMsg: failed to decode %v", err) } return msg, nil } @@ -46,11 +46,11 @@ func (s *socket) SendMsg(e interface{}, msg *unixsocket.Msg) error { // use buf pool to reduce allocation buff := bytes.NewBuffer(buf[:0]) if err := gob.NewEncoder(buff).Encode(e); err != nil { - return fmt.Errorf("SendMsg: failed to encode %w", err) + return fmt.Errorf("SendMsg: failed to encode %v", err) } if err := soc.SendMsg(buff.Bytes(), msg); err != nil { - return fmt.Errorf("SendMsg: failed to SendMsg %w", err) + return fmt.Errorf("SendMsg: failed to SendMsg %v", err) } return nil } diff --git a/go.mod b/go.mod index acc55cb..ae74fb3 100644 --- a/go.mod +++ b/go.mod @@ -4,5 +4,5 @@ go 1.13 require ( github.com/seccomp/libseccomp-golang v0.9.1 - golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 + golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c ) diff --git a/go.sum b/go.sum index 1cb83cb..63ba5f4 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo= github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo= -golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 h1:LfCXLvNmTYH9kEmVgqbnsWfruoXZIrh4YBgqVHtDvw0= -golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c h1:jceGD5YNJGgGMkJz79agzOln1K9TaZUjv5ird16qniQ= +golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= diff --git a/pkg/cgroup/cgroup.go b/pkg/cgroup/cgroup.go index b67bf4c..18d59d6 100644 --- a/pkg/cgroup/cgroup.go +++ b/pkg/cgroup/cgroup.go @@ -1,10 +1,3 @@ -// Package cgroup provices basic resource control over cgroups -// it measure -// cpu: cpuacct.usage (ns) -// memory: memory.max_usage_in_bytes -// it limits: -// memory: memory.limit_in_bytes -// # of tasks: pids.max package cgroup import "os" diff --git a/pkg/memfd/memfd_linux.go b/pkg/memfd/memfd_linux.go index 8b74826..0db88e4 100644 --- a/pkg/memfd/memfd_linux.go +++ b/pkg/memfd/memfd_linux.go @@ -17,7 +17,7 @@ const roSeal = unix.F_SEAL_SEAL | unix.F_SEAL_SHRINK | unix.F_SEAL_GROW | unix.F func New(name string) (*os.File, error) { fd, err := unix.MemfdCreate(name, createFlag) if err != nil { - return nil, fmt.Errorf("memfd: memfd_create failed %w", err) + return nil, fmt.Errorf("memfd: memfd_create failed %v", err) } file := os.NewFile(uintptr(fd), name) if file == nil { @@ -31,21 +31,21 @@ func New(name string) (*os.File, error) { func DupToMemfd(name string, reader io.Reader) (*os.File, error) { file, err := New(name) if err != nil { - return nil, fmt.Errorf("DupToMemfd: %w", err) + return nil, fmt.Errorf("DupToMemfd: %v", err) } // linux syscall sendfile might be more efficient here if reader is a file if _, err = io.Copy(file, reader); err != nil { file.Close() - return nil, fmt.Errorf("DupToMemfd: io.Copy %w", err) + return nil, fmt.Errorf("DupToMemfd: io.Copy %v", err) } // make memfd readonly if _, err = unix.FcntlInt(file.Fd(), unix.F_ADD_SEALS, roSeal); err != nil { file.Close() - return nil, fmt.Errorf("DupToMemfd: memfd seal %w", err) + return nil, fmt.Errorf("DupToMemfd: memfd seal %v", err) } if _, err := file.Seek(0, 0); err != nil { file.Close() - return nil, fmt.Errorf("DupToMemfd: file seek %w", err) + return nil, fmt.Errorf("DupToMemfd: file seek %v", err) } return file, nil } diff --git a/pkg/unixsocket/socket.go b/pkg/unixsocket/socket.go index d7424ad..854aaba 100644 --- a/pkg/unixsocket/socket.go +++ b/pkg/unixsocket/socket.go @@ -60,21 +60,21 @@ func NewSocket(fd int) (*Socket, error) { func NewSocketPair() (*Socket, *Socket, error) { fd, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0) if err != nil { - return nil, nil, fmt.Errorf("NewSocketPair: failed to call socketpair %w", err) + return nil, nil, fmt.Errorf("NewSocketPair: failed to call socketpair %v", err) } ins, err := NewSocket(fd[0]) if err != nil { syscall.Close(fd[0]) syscall.Close(fd[1]) - return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket on sender %w", err) + return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket on sender %v", err) } outs, err := NewSocket(fd[1]) if err != nil { ins.Close() syscall.Close(fd[1]) - return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket receiver %w", err) + return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket receiver %v", err) } return ins, outs, nil