update documentation

This commit is contained in:
criyle 2019-08-04 18:29:25 -07:00
parent 00d5f0d2a1
commit ae552994b2
3 changed files with 56 additions and 2 deletions

View File

@ -71,3 +71,4 @@ It seems unshare net or ipc takes time, maybe limits action by seccomp instead.
TODO:
1. Add ability to pre-fork container deamons
2. Add fork-exec with execve memfd (execveat), sethostname, setdomainname, prepare devices (mknod)

52
deamon/deamon.go Normal file
View File

@ -0,0 +1,52 @@
// Package deamon provides pre-forked container to reduce the container
// create / destroy costs (about 160ms). It creates deamon within unshared
// container and communicate with original process using unix socket with
// oob for fd / pid and structs are encoded in gob format.
package deamon
/*
Protocol between client and deamon (not thread safe):
- copyin (copy file into container):
send: path, perm, <input fd>
reply: "finished" (after copy finished) / "error"
- open (open file inside container):
send: path, flags, perm
reply: "success", <file fd> / "error"
- delete (unlik file / rmdir dir inside container):
send: path
reply: "finished" / "error"
- reset (clean up container for later use (clear workdir / tmp)):
send:
reply: "success"
- execve: (execute file inside container):
send: argv, envv, fd map, rlimits, <fds>
reply:
- success: "success", <pid>
- failed: "failed"
send (success): "init_finished" (as cmd)
- reply: "finished" / send: "kill" (as cmd)
- send: "kill" (as cmd) / reply: "finished"
Any socket related error will cause the deamon exit (with all process inside container)
*/
import (
"github.com/criyle/go-judger/types/rlimit"
)
// Cmd is the control message send into deamon
type Cmd struct {
Cmd string // type of the cmd
Path string // path
Perm int // write perm / open perm
Flags int // open flags
Argv []string // execve argv
Envv []string // execve envv
FdMap []int // execvc fd map
RLmits []rlimit.RLimit // execve posix rlimit
}
// Reply is the reply message send back to controller
type Reply struct {
Error string // empty if no error
}

View File

@ -30,7 +30,7 @@ type Msg struct {
}
// NewSocket creates Socket conn struct using existing unix socket fd
// creates by socketpair or net.DialUnix
// creates by socketpair or net.DialUnix and mark it as close_on_exec (avoid fd leak)
// it need SOCK_SEQPACKET socket for reliable transfer
// it will need SO_PASSCRED to pass unix credential, Notice: in the documentation,
// if cred is not specified, self information will be sent
@ -40,6 +40,7 @@ func NewSocket(fd int) (*Socket, error) {
return nil, fmt.Errorf("NewSocket: fd(%d) is not a valid fd", fd)
}
defer file.Close()
syscall.CloseOnExec(int(file.Fd()))
conn, err := net.FileConn(file)
if err != nil {
return nil, err