Skip to content

Commit 2d83782

Browse files
wkingwking
committed
config-linux: Convert linux.namespaces from an array to an object
Namespaces do not need repeated entries and the ordering is handled by the runtime regardless of the spec ordering (e.g. in runC [1]). Using an object leans on the new wording from eeaccfa (glossary: Make objects explicitly unordered and forbid duplicate names, 2016-09-27, #584) to make both of those points explicit. [1]: opencontainers/runc#977 Subject: nsenter: guarantee correct user namespace ordering Signed-off-by: W. Trevor King <wking@tremily.us>
1 parent 81888fe commit 2d83782

5 files changed

Lines changed: 50 additions & 78 deletions

File tree

‎config-linux.md‎

Lines changed: 14 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,9 @@ A namespace wraps a global system resource in an abstraction that makes it appea
2323
Changes to the global resource are visible to other processes that are members of the namespace, but are invisible to other processes.
2424
For more information, see [the man page](http://man7.org/linux/man-pages/man7/namespaces.7.html).
2525

26-
Namespaces are specified as an array of entries inside the `namespaces` root field.
27-
The following parameters can be specified to setup namespaces:
26+
* **`namespaces`** (object, OPTIONAL) specifies the container namespaces.
27+
Valid keys are:
2828

29-
* **`type`** *(string, REQUIRED)* - namespace type. The following namespaces types are supported:
3029
* **`pid`** processes inside the container will only be able to see other processes inside the same container.
3130
* **`network`** the container will have its own network stack.
3231
* **`mount`** the container will have an isolated mount table.
@@ -35,39 +34,29 @@ The following parameters can be specified to setup namespaces:
3534
* **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container.
3635
* **`cgroup`** the container will have an isolated view of the cgroup hierarchy.
3736

38-
* **`path`** *(string, OPTIONAL)* - path to namespace file in the [runtime mount namespace](glossary.md#runtime-namespace)
37+
Values have the following properties:
38+
39+
* **`path`** *(string, OPTIONAL)* - path to namespace file in the [runtime mount namespace](glossary.md#runtime-namespace)
3940

4041
If a path is specified, that particular file is used to join that type of namespace.
41-
If a namespace type is not specified in the `namespaces` array, the container MUST inherit the [runtime namespace](glossary.md#runtime-namespace) of that type.
42+
If a namespace type is not specified in the `namespaces` object, the container MUST inherit the [runtime namespace](glossary.md#runtime-namespace) of that type.
4243
If a new namespace is not created (because the namespace type is not listed, or because it is listed with a `path`), runtimes MUST assume that the setup for that namespace has already been done and error out if the config specifies anything else related to that namespace.
4344

4445
###### Example
4546

4647
```json
47-
"namespaces": [
48-
{
49-
"type": "pid",
48+
"namespaces": {
49+
"pid": {
5050
"path": "/proc/1234/ns/pid"
5151
},
52-
{
53-
"type": "network",
52+
"network": {
5453
"path": "/var/run/netns/neta"
5554
},
56-
{
57-
"type": "mount"
58-
},
59-
{
60-
"type": "ipc"
61-
},
62-
{
63-
"type": "uts"
64-
},
65-
{
66-
"type": "user"
67-
},
68-
{
69-
"type": "cgroup"
70-
}
55+
"mount": {},
56+
"ipc": {},
57+
"uts": {},
58+
"user": {},
59+
"cgroup": {}
7160
]
7261
```
7362

‎config.md‎

Lines changed: 11 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -279,11 +279,9 @@ For Windows based systems the user structure has the following fields:
279279
"arch": "amd64"
280280
},
281281
"linux": {
282-
"namespaces": [
283-
{
284-
"type": "pid"
285-
}
286-
]
282+
"namespaces": {
283+
"pid": {}
284+
}
287285
}
288286
}
289287
```
@@ -691,28 +689,14 @@ Here is a full example `config.json` for reference.
691689
}
692690
]
693691
},
694-
"namespaces": [
695-
{
696-
"type": "pid"
697-
},
698-
{
699-
"type": "network"
700-
},
701-
{
702-
"type": "ipc"
703-
},
704-
{
705-
"type": "uts"
706-
},
707-
{
708-
"type": "mount"
709-
},
710-
{
711-
"type": "user"
712-
},
713-
{
714-
"type": "cgroup"
715-
}
692+
"namespaces": {
693+
"pid": {},
694+
"network": {},
695+
"ipc": {},
696+
"uts": {},
697+
"mount": {},
698+
"user": {},
699+
"cgroup": {}
716700
],
717701
"maskedPaths": [
718702
"/proc/kcore",

‎schema/config-linux.json‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,13 +48,29 @@
4848
},
4949
"namespaces": {
5050
"id": "https://opencontainers.org/schema/bundle/linux/namespaces",
51-
"type": "array",
52-
"items": {
53-
"anyOf": [
54-
{
55-
"$ref": "defs-linux.json#/definitions/NamespaceReference"
56-
}
57-
]
51+
"type": "object",
52+
"properties": {
53+
"cgroup": {
54+
"$ref": "defs-linux.json#/definitions/Namespace"
55+
},
56+
"ipc": {
57+
"$ref": "defs-linux.json#/definitions/Namespace"
58+
},
59+
"mount": {
60+
"$ref": "defs-linux.json#/definitions/Namespace"
61+
},
62+
"network": {
63+
"$ref": "defs-linux.json#/definitions/Namespace"
64+
},
65+
"pid": {
66+
"$ref": "defs-linux.json#/definitions/Namespace"
67+
},
68+
"user": {
69+
"$ref": "defs-linux.json#/definitions/Namespace"
70+
},
71+
"uts": {
72+
"$ref": "defs-linux.json#/definitions/Namespace"
73+
}
5874
}
5975
},
6076
"resources": {

‎schema/defs-linux.json‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -262,24 +262,9 @@
262262
}
263263
}
264264
},
265-
"NamespaceType": {
266-
"type": "string",
267-
"enum": [
268-
"mount",
269-
"pid",
270-
"network",
271-
"uts",
272-
"ipc",
273-
"user",
274-
"cgroup"
275-
]
276-
},
277-
"NamespaceReference": {
265+
"Namespace": {
278266
"type": "object",
279267
"properties": {
280-
"type": {
281-
"$ref": "#/definitions/NamespaceType"
282-
},
283268
"path": {
284269
"$ref": "defs.json#/definitions/FilePath"
285270
}

‎specs-go/config.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ type Linux struct {
141141
// If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
142142
CgroupsPath *string `json:"cgroupsPath,omitempty"`
143143
// Namespaces contains the namespaces that are created and/or joined by the container
144-
Namespaces []LinuxNamespace `json:"namespaces,omitempty"`
144+
Namespaces map[LinuxNamespaceType]LinuxNamespace `json:"namespaces,omitempty"`
145145
// Devices are a list of device nodes that are created for the container
146146
Devices []LinuxDevice `json:"devices,omitempty"`
147147
// Seccomp specifies the seccomp security settings for the container.
@@ -158,8 +158,6 @@ type Linux struct {
158158

159159
// LinuxNamespace is the configuration for a Linux namespace
160160
type LinuxNamespace struct {
161-
// Type is the type of Linux namespace
162-
Type LinuxNamespaceType `json:"type"`
163161
// Path is a path to an existing namespace persisted on disk that can be joined
164162
// and is of the same type
165163
Path string `json:"path,omitempty"`

0 commit comments

Comments
 (0)