Skip to content

Commit 7c9daeb

Browse files
author
Abhijeeth Nuthan
committed
Introducing Solaris in OCI
Signed-off-by: Abhijeeth Nuthan <[email protected]>
1 parent e5e603f commit 7c9daeb

File tree

7 files changed

+251
-2
lines changed

7 files changed

+251
-2
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ DOC_FILES := \
1414
runtime-linux.md \
1515
config.md \
1616
config-linux.md \
17+
config-solaris.md \
1718
glossary.md
1819
EPOCH_TEST_COMMIT := 78e6667ae2d67aad100b28ee9580b41b7a24e667
1920

‎config-solaris.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Solaris Application Container Configuration
2+
3+
Solaris application containers can be configured using the following properties, all of the below properties have mappings to properties specified under zonecfg(1M) man page, except milestone.
4+
The Solaris specification is entirely optional.
5+
6+
## milestone
7+
The SMF(Service Management Facility) FMRI which should go to "online" state before we start the desired process within the container.
8+
9+
**`milestone`** *(string, optional)*
10+
11+
### Example
12+
```json
13+
"milestone": "svc:/milestone/container:default"
14+
```
15+
16+
## limitpriv
17+
The maximum set of privileges any process in this container can obtain.
18+
The property should consist of a comma-separated privilege set specification as described in priv_str_to_set(3C) man page for the respective release of Solaris.
19+
20+
**`limitpriv`** *(string, optional)*
21+
22+
### Example
23+
```json
24+
"limitpriv": "default"
25+
```
26+
27+
## maxShmMemory
28+
The maximum amount of shared memory allowed for this application container.
29+
A scale (K, M, G, T) can be applied to the value for each of these numbers (for example, 1M is one megabyte).
30+
Mapped to max-shm-memory in zonecfg(1M) man page.
31+
32+
**`maxShmMemory`** *(string, optional)*
33+
34+
### Example
35+
```json
36+
"maxShmMemory": "512m"
37+
```
38+
39+
## cappedCPU
40+
Sets a limit on the amount of CPU time that can be used by a container.
41+
The unit used translates to the percentage of a single CPU that can be used by all user threads in a container, expressed as a fraction (for example, .75) or a mixed number (whole number and fraction, for example, 1.25).
42+
An ncpu value of 1 means 100% of a CPU, a value of 1.25 means 125%, .75 mean 75%, and so forth.
43+
When projects within a capped container have their own caps, the minimum value takes precedence.
44+
cappedCPU is mapped to capped-cpu in zonecfg(1M) man page.
45+
46+
* **`ncpus`** *(string, optional)*
47+
48+
### Example
49+
```json
50+
"cappedCPU": {
51+
"ncpus": "8"
52+
}
53+
```
54+
55+
## cappedMemory
56+
The physical and swap caps on the memory that can be used by this application container.
57+
A scale (K, M, G, T) can be applied to the value for each of these numbers (for example, 1M is one megabyte).
58+
cappedMemory is mapped to capped-memory in zonecfg(1M) man page.
59+
60+
* **`physical`** *(string, optional)*
61+
* **`swap`** *(string, optional)*
62+
63+
### Example
64+
```json
65+
"cappedMemory": {
66+
"physical": "512m",
67+
"swap": "512m"
68+
}
69+
```
70+
71+
## Network
72+
73+
### Automatic Network (anet)
74+
anet is specified as an array that is used to setup networking for Solaris application containers.
75+
The anet resource represents the automatic creation of a network resource for an application container.
76+
The zones administration daemon, zoneadmd, is the primary process for managing the container's virtual platform.
77+
One of the daemons is responsibilities is creation and teardown of the networks for the container.
78+
For more information on the daemon check the zoneadmd(1M) man page.
79+
When such a container is started, a temporary VNIC(Virtual NIC) is automatically created for the container.
80+
The VNIC is deleted when the container is torn down.
81+
The following properties can be used to setup automatic networks.
82+
For additional information on properties check zonecfg(1M) man page for the respective release of Solaris.
83+
84+
* **`linkname`** *(string, optional)* Specify a name for the automatically created VNIC datalink.
85+
* **`lowerLink`** *(string, optional)* Specify the link over which the VNIC will be created.
86+
Mapped to lower-link in the zonecfg(1M) man page.
87+
* **`allowedAddress`** *(string, optional)* The set of IP addresses that the container can use might be constrained by specifying the allowedAddress property.
88+
If allowedAddress has not been specified, then they can use any IP address on the associated physical interface for the network resource.
89+
Otherwise, when allowedAddress is specified, the container cannot use IP addresses that are not in the allowedAddress list for the physical address.
90+
Mapped to allowed-address in the zonecfg(1M) man page.
91+
* **`configureAllowedAddress`** *(string, optional)* If configureAllowedAddress is set to true, the addresses specified by allowedAddress are automatically configured on the interface each time the container starts.
92+
When it is set to false, the allowedAddress will not be configured on container start.
93+
Mapped to configure-allowed-address in the zonecfg(1M) man page.
94+
* **`defrouter`** *(string, optional)* The value for the optional default router.
95+
* **`macAddress`** *(string, optional)* Set the VNIC's MAC addresses based on the specified value or keyword.
96+
If not a keyword, it is interpreted as a unicast MAC address.
97+
For a list of the supported keywords please refer to the zonecfg(1M) man page of the respective Solaris release.
98+
Mapped to mac-address in the zonecfg(1M) man page.
99+
* **`linkProtection`** *(string, optional)* Enables one or more types of link protection using comma-separated values.
100+
See the protection property in dladm(8) for supported values in respective release of Solaris.
101+
Mapped to link-protection in the zonecfg(1M) man page.
102+
103+
#### Example
104+
```json
105+
"anet": [
106+
{
107+
"allowedAddress": "172.17.0.2/16",
108+
"configureAllowedAddress": "true",
109+
"defrouter": "172.17.0.1/16",
110+
"linkProtection": "mac-nospoof, ip-nospoof",
111+
"linkname": "net0",
112+
"lowerLink": "net2",
113+
"macAddress": "02:42:f8:52:c7:16"
114+
}
115+
]
116+
```

‎config.md‎

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,16 +108,18 @@ For more information about SELinux, see [Selinux documentation](http://selinuxp
108108

109109
The user for the process is a platform-specific structure that allows specific control over which user the process runs as.
110110

111-
#### Linux User
111+
#### Linux and Solaris User
112112

113-
For Linux-based systems the user structure has the following fields:
113+
For Linux and Solaris based systems the user structure has the following fields:
114114

115115
* **`uid`** (int, required) specifies the user id.
116116
* **`gid`** (int, required) specifies the group id.
117117
* **`additionalGids`** (array of ints, optional) specifies additional group ids to be added to the process.
118118

119119
_Note: symbolic name for uid and gid, such as uname and gname respectively, are left to upper levels to derive (i.e. `/etc/passwd` parsing, NSS, etc)_
120120

121+
_Note: For Solaris, uid and gid specify the uid and gid of the process inside the container and need not be same as in the host._
122+
121123
### Example (Linux)
122124

123125
```json
@@ -153,6 +155,26 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
153155
]
154156
}
155157
```
158+
### Example (Solaris)
159+
160+
```json
161+
"process": {
162+
"terminal": true,
163+
"user": {
164+
"uid": 1,
165+
"gid": 1,
166+
"additionalGids": [2, 8]
167+
},
168+
"env": [
169+
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
170+
"TERM=xterm"
171+
],
172+
"cwd": "/root",
173+
"args": [
174+
"/usr/bin/bash"
175+
],
176+
}
177+
```
156178

157179

158180
## Hostname
@@ -608,6 +630,29 @@ Here is a full example `config.json` for reference.
608630
],
609631
"mountLabel": "system_u:object_r:svirt_sandbox_file_t:s0:c715,c811"
610632
},
633+
"solaris": {
634+
"anet": [
635+
{
636+
"allowedAddress": "172.17.0.2/16",
637+
"configureAllowedAddress": "true",
638+
"defrouter": "172.17.0.1/16",
639+
"linkProtection": "mac-nospoof, ip-nospoof",
640+
"linkname": "net0",
641+
"lowerLink": "net2",
642+
"macAddress": "02:42:f8:52:c7:16"
643+
}
644+
],
645+
"cappedCPU": {
646+
"ncpus": "0.8"
647+
},
648+
"cappedMemory": {
649+
"physical": "1G",
650+
"swap": "512m"
651+
},
652+
"maxShmMemory": "256m",
653+
"limitpriv": "default",
654+
"milestone": "svc:/milestone/container:default"
655+
},
611656
"annotations": {
612657
"key1": "value1",
613658
"key2": "value2"

‎schema/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ validating the `config.json` of this container runtime specification.
88
The layout of the files is as follows:
99
* [schema.json](schema.json) - the primary entrypoint for the whole schema document
1010
* [schema-linux.json](schema-linux.json) - this schema is for the Linux-specific sub-structure
11+
* [schema-solaris.json](schema-solaris.json) - this schema is for the Solaris-specific sub-structure
1112
* [defs.json](defs.json) - definitions for general types
1213
* [defs-linux.json](defs-linux.json) - definitions for Linux-specific types
1314
* [validate.go](validate.go) - validation utility source code

‎schema/schema-solaris.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"solaris": {
3+
"description": "Solaris platform-specific configurations",
4+
"id": "https://opencontainers.org/schema/bundle/solaris",
5+
"type": "object",
6+
"properties": {
7+
"milestone": {
8+
"id": "https://opencontainers.org/schema/bundle/solaris/milestone",
9+
"type": "string"
10+
},
11+
"limitpriv": {
12+
"id": "https://opencontainers.org/schema/bundle/solaris/limitpriv",
13+
"type": "string"
14+
},
15+
"maxShmMemory": {
16+
"id": "https://opencontainers.org/schema/bundle/solaris/maxShmMemory",
17+
"type": "string"
18+
},
19+
"cappedCPU": {
20+
"id": "https://opencontainers.org/schema/bundle/solaris/cappedCPU",
21+
"$ref": "defs.json#/definitions/mapStringString"
22+
},
23+
"cappedMemory": {
24+
"id": "https://opencontainers.org/schema/bundle/solaris/cappedMemory",
25+
"$ref": "defs.json#/definitions/mapStringString"
26+
},
27+
"anet": {
28+
"id": "https://opencontainers.org/schema/bundle/solaris/anet",
29+
"type": "array",
30+
"items": {
31+
"$ref": "defs.json#/definitions/mapStringString"
32+
}
33+
}
34+
}
35+
}
36+
}

‎schema/schema.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,9 @@
167167
},
168168
"linux": {
169169
"$ref": "schema-linux.json#/linux"
170+
},
171+
"solaris": {
172+
"$ref": "schema-solaris.json#/solaris"
170173
}
171174
},
172175
"required": [

‎specs-go/config.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ type Spec struct {
2525

2626
// Linux is platform specific configuration for Linux based containers.
2727
Linux Linux `json:"linux" platform:"linux"`
28+
// Solaris is platform specific configuration for Solaris containers.
29+
Solaris Solaris `json:"solaris" platform:"solaris"`
2830
}
2931

3032
// Process contains information to start a specific application inside the container.
@@ -358,6 +360,51 @@ type Seccomp struct {
358360
Syscalls []Syscall `json:"syscalls,omitempty"`
359361
}
360362

363+
// Solaris contains platform specific configuration for Solaris application containers.
364+
type Solaris struct {
365+
// SMF FMRI which should go "online" before we start the container process.
366+
Milestone string `json:"milestone,omitempty"`
367+
// Maximum set of privileges any process in this container can obtain.
368+
LimitPriv string `json:"limitpriv,omitempty"`
369+
// The maximum amount of shared memory allowed for this container.
370+
MaxShmMemory string `json:"maxShmMemory,omitempty"`
371+
// Specification for automatic creation of network resources for this container.
372+
Anet []Anet `json:"anet,omitempty"`
373+
// Set limit on the amount of CPU time that can be used by container.
374+
CappedCPU CappedCPU `json:"cappedCPU,omitempty"`
375+
// The physical and swap caps on the memory that can be used by this container.
376+
CappedMemory CappedMemory `json:"cappedMemory,omitempty"`
377+
}
378+
379+
// CappedCPU allows users to set limit on the amount of CPU time that can be used by container.
380+
type CappedCPU struct {
381+
Ncpus string `json:"ncpus,omitempty"`
382+
}
383+
384+
// CappedMemory allows users to set the physical and swap caps on the memory that can be used by this container.
385+
type CappedMemory struct {
386+
Physical string `json:"physical,omitempty"`
387+
Swap string `json:"swap,omitempty"`
388+
}
389+
390+
// Anet provides the specification for automatic creation of network resources for this container.
391+
type Anet struct {
392+
// Specify a name for the automatically created VNIC datalink.
393+
Linkname string `json:"linkname,omitempty"`
394+
// Specify the link over which the VNIC will be created.
395+
Lowerlink string `json:"lowerLink,omitempty"`
396+
// The set of IP addresses that the container can use.
397+
Allowedaddr string `json:"allowedAddress,omitempty"`
398+
// Specifies whether allowedAddress limitation is to be applied to the VNIC.
399+
Configallowedaddr string `json:"configureAllowedAddress,omitempty"`
400+
// The value of the optional default router.
401+
Defrouter string `json:"defrouter,omitempty"`
402+
// Enable one or more types of link protection.
403+
Linkprotection string `json:"linkProtection,omitempty"`
404+
// Set the VNIC's macAddress
405+
Macaddress string `json:"macAddress,omitempty"`
406+
}
407+
361408
// Arch used for additional architectures
362409
type Arch string
363410

0 commit comments

Comments
 (0)