E589 Merge pull request #35621 from kolyshkin/ipc-private · moby/moby@ca0b64e · GitHub
[go: up one dir, main page]
Skip to content

Commit ca0b64e

Browse files
thaJeztahthaJeztah
authored
Merge pull request #35621 from kolyshkin/ipc-private
daemon: use 'private' ipc mode by default
2 parents 5b67713 + 596ca14 commit ca0b64e

File tree

5 files changed

+39
-5
lines changed

5 files changed

+39
-5
lines changed

‎api/server/router/container/container_routes.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -474,11 +474,14 @@ func (s *containerRouter) postContainersCreate(ctx context.Context, w http.Respo
474474
}
475475
// Ignore KernelMemoryTCP because it was added in API 1.40.
476476
hostConfig.KernelMemoryTCP = 0
477-
}
478477

479-
// Ignore Capabilities because it was added in API 1.40.
480-
if hostConfig != nil && versions.LessThan(version, "1.40") {
478+
// Ignore Capabilities because it was added in API 1.40.
481479
hostConfig.Capabilities = nil
480+
481+
// Older clients (API < 1.40) expects the default to be shareable, make them happy
482+
if hostConfig.IpcMode.IsEmpty() {
483+
hostConfig.IpcMode = container.IpcMode("shareable")
484+
}
482485
}
483486

484487
ccr, err := s.backend.ContainerCreate(types.ContainerCreateConfig{

‎daemon/config/config_unix.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212

1313
const (
1414
// DefaultIpcMode is default for container's IpcMode, if not set otherwise
15-
DefaultIpcMode = "shareable" // TODO: change to private
15+
DefaultIpcMode = "private"
1616
)
1717

1818
// Config defines the configuration of a docker daemon.

‎daemon/container_operations_unix.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func (daemon *Daemon) getIpcContainer(id string) (*container.Container, error) {
7272
// Check the container ipc is shareable
7373
if st, err := os.Stat(container.ShmPath); err != nil || !st.IsDir() {
7474
if err == nil || os.IsNotExist(err) {
75-
return nil, errors.New(errMsg + ": non-shareable IPC")
75+
return nil, errors.New(errMsg + ": non-shareable IPC (hint: use IpcMode:shareable for the donor container)")
7676
}
7777
// stat() failed?
7878
return nil, errors.Wrap(err, errMsg+": unexpected error from stat "+container.ShmPath)

‎docs/api/version-history.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ keywords: "API, Docker, rcli, REST, documentation"
6161
* `POST /containers/create` now takes a `Capabilities` field to set the list of
6262
kernel capabilities to be available for the container (this overrides the default
6363
set).
64+
* `POST /containers/create` on Linux now creates a container with `HostConfig.IpcMode=private`
65+
by default, if IpcMode is not explicitly specified. The per-daemon default can be changed
66+
back to `shareable` by using `DefaultIpcMode` daemon configuration parameter.
6467
* `POST /containers/{id}/update` now accepts a `PidsLimit` field to tune a container's
6568
PID limit. Set `0` or `-1` for unlimited. Leave `null` to not change the current value.
6669

‎integration/container/ipcmode_linux_test.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,11 @@ import (
1111

1212
"github.com/docker/docker/api/types"
1313
containertypes "github.com/docker/docker/api/types/container"
14+
"github.com/docker/docker/api/types/versions"
15+
"github.com/docker/docker/client"
1416
"github.com/docker/docker/integration/internal/container"
1517
"github.com/docker/docker/internal/test/daemon"
18+
"github.com/docker/docker/internal/test/request"
1619
"gotest.tools/assert"
1720
is "gotest.tools/assert/cmp"
1821
"gotest.tools/fs"
@@ -292,3 +295,28 @@ func TestDaemonIpcModeShareableFromConfig(t *testing.T) {
292295

293296
testDaemonIpcFromConfig(t, "shareable", true)
294297
}
298+
299+
// TestIpcModeOlderClient checks that older client gets shareable IPC mode
300+
// by default, even when the daemon default is private.
301+
func TestIpcModeOlderClient(t *testing.T) {
302+
skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.40"), "requires a daemon with DefaultIpcMode: private")
303+
t.Parallel()
304+
305+
ctx := context.Background()
306+
307+
// pre-check: default ipc mode in daemon is private
308+
c := testEnv.APIClient()
309+
cID := container.Create(t, ctx, c, container.WithAutoRemove)
310+
311+
inspect, err := c.ContainerInspect(ctx, cID)
312+
assert.NilError(t, err)
313+
assert.Check(t, is.Equal(string(inspect.HostConfig.IpcMode), "private"))
314+
315+
// main check: using older client creates "shareable" container
316+
c = request.NewAPIClient(t, client.WithVersion("1.39"))
317+
cID = container.Create(t, ctx, c, container.WithAutoRemove)
318+
319+
inspect, err = c.ContainerInspect(ctx, cID)
320+
assert.NilError(t, err)
321+
assert.Check(t, is.Equal(string(inspect.HostConfig.IpcMode), "shareable"))
322+
}

0 commit comments

Comments
 (0)
0