Skip to content

Commit 207e26c

Browse files
author
Mrunal Patel
authored
Merge pull request opencontainers#178 from wking/generate-namespace-optimize-fix-manpage
[1.0.0.rc1] generate: optimize namespace setup log and fix manpage
2 parents 217ce82 + ed659ab commit 207e26c

File tree

2 files changed

+42
-48
lines changed

2 files changed

+42
-48
lines changed

‎cmd/ocitools/generate.go‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -241,13 +241,7 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
241241
needsNewUser = true
242242
}
243243

244-
nsMaps := map[string]string{}
245-
for _, nsName := range generate.Namespaces {
246-
if context.IsSet(nsName) {
247-
nsMaps[nsName] = context.String(nsName)
248-
}
249-
}
250-
setupLinuxNamespaces(g, needsNewUser, nsMaps)
244+
setupLinuxNamespaces(context, g, needsNewUser)
251245

252246
if context.IsSet("tmpfs") {
253247
tmpfsSlice := context.StringSlice("tmpfs")
@@ -386,19 +380,12 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
386380
return nil
387381
}
388382

389-
func checkNs(nsMaps map[string]string, nsName string) bool {
390-
if _, ok := nsMaps[nsName]; !ok {
391-
return false
392-
}
393-
return true
394-
}
395-
396-
func setupLinuxNamespaces(g *generate.Generator, needsNewUser bool, nsMaps map[string]string) {
383+
func setupLinuxNamespaces(context *cli.Context, g *generate.Generator, needsNewUser bool) {
397384
for _, nsName := range generate.Namespaces {
398-
if !checkNs(nsMaps, nsName) && !(needsNewUser && nsName == "user") {
385+
if !context.IsSet(nsName) && !(needsNewUser && nsName == "user") {
399386
continue
400387
}
401-
nsPath := nsMaps[nsName]
388+
nsPath := context.String(nsName)
402389
if nsPath == "host" {
403390
g.RemoveLinuxNamespace(nsName)
404391
continue

‎man/ocitools-generate.1.md‎

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ read the configuration from `config.json`.
2929

3030
--args "/usr/bin/httpd" --args "-D" --args "FOREGROUND"
3131

32-
**--bind**=*[[HOST-DIR:CONTAINER-DIR][:OPTIONS]]*
32+
**--bind**=*[[HOST-DIR:CONTAINER-DIR][:OPTIONS]]*
3333
Bind mount directories src:dest:(rw,ro) If you specify, ` --bind
3434
/HOST-DIR:/CONTAINER-DIR`, runc bind mounts `/HOST-DIR` in the host
3535
to `/CONTAINER-DIR` in the OCI container. The `OPTIONS` are a comma
@@ -45,10 +45,11 @@ read the configuration from `config.json`.
4545
**--cap-drop**=[]
4646
Drop Linux capabilities
4747

48-
**--cgroup**=[*PATH*]
49-
Use a Cgroup namespace. If *PATH* is set, join that namespace. If it
50-
is unset, create a new namespace. The special *PATH* `host` removes
51-
any existing Cgroup namespace from the configuration.
48+
**--cgroup**=*PATH*
49+
Use a Cgroup namespace where *PATH* is an existing Cgroup namespace file
50+
to join. The special *PATH* empty-string creates a new namespace.
51+
The special *PATH* `host` removes any existing Cgroup namespace from
52+
the configuration.
5253

5354
**--cgroups-path**=""
5455
Specifies the path to the cgroups relative to the cgroups mount point.
@@ -77,15 +78,17 @@ inside of the container.
7778
**--hostname**=""
7879
Set the container host name that is available inside the container.
7980

80-
**--ipc**=[*PATH*]
81-
Use an IPC namespace. If *PATH* is set, join that namespace. If it
82-
is unset, create a new namespace. The special *PATH* `host` removes
83-
any existing IPC namespace from the configuration.
81+
**--ipc**=*PATH*
82+
Use an IPC namespace where *PATH* is an existing IPC namespace file
83+
to join. The special *PATH* empty-string creates a new namespace.
84+
The special *PATH* `host` removes any existing IPC namespace from the
85+
configuration.
8486

85-
**--mount**=[*PATH*]
86-
Use a mount namespace. If *PATH* is set, join that namespace. If
87-
it is unset, create a new namespace. The special *PATH* `host`
88-
removes any existing mount namespace from the configuration.
87+
**--mount**=*PATH*
88+
Use a mount namespace where *PATH* is an existing mount namespace file
89+
to join. The special *PATH* empty-string creates a new namespace.
90+
The special *PATH* `host` removes any existing mount namespace from the
91+
configuration.
8992

9093
**--mount-cgroups**=[rw|ro|no]
9194
Mount cgroups. The default is `no`.
@@ -102,10 +105,11 @@ inside of the container.
102105
"system_u:object_r:usr_t:s0" might be a good label for a readonly container,
103106
"system_u:system_r:svirt_sandbox_file_t:s0:c1,c2" for a read/write container.
104107

105-
**--network**=[*PATH*]
106-
Use a network namespace. If *PATH* is set, join that namespace. If
107-
it is unset, create a new namespace. The special *PATH* `host`
108-
removes any existing network namespace from the configuration.
108+
**--network**=*PATH*
109+
Use a network namespace where *PATH* is an existing network namespace file
110+
to join. The special *PATH* empty-string creates a new namespace.
111+
The special *PATH* `host` removes any existing network namespace from the
112+
configuration.
109113

110114
**--no-new-privileges**
111115
Set no new privileges bit for the container process. Setting this flag
@@ -121,10 +125,11 @@ inside of the container.
121125
**--os**=OS
122126
Operating system used within the container
123127

124-
**--pid**=[*PATH*]
125-
Use a PID namespace. If *PATH* is set, join that namespace. If it
126-
is unset, create a new namespace. The special *PATH* `host` removes
127-
any existing PID namespace from the configuration.
128+
**--pid**=*PATH*
129+
Use a PID namespace where *PATH* is an existing PID namespace file
130+
to join. The special *PATH* empty-string creates a new namespace.
131+
The special *PATH* `host` removes any existing PID namespace from
132+
the configuration.
128133

129134
**--poststart**=CMD
130135
Path to command to run in poststart hooks. This command will be run before
@@ -143,7 +148,7 @@ inside of the container.
143148
Give extended privileges to this container. The default is *false*.
144149

145150
By default, OCI containers are
146-
“unprivileged” (=false) and cannot do some of the things a normal root process can do.
151+
“unprivileged” (=false) and cannot do some of the things a normal root process can do.
147152

148153
When the operator executes **ocitools generate --privileged**, OCI will enable access to all devices on the host as well as disable some of the confinement mechanisms like AppArmor, SELinux, and seccomp from blocking access to privileged processes. This gives the container processes nearly all the same access to the host as processes generating outside of a container on the host.
149154

@@ -214,15 +219,17 @@ inside of the container.
214219
**--uidmappings**
215220
Add UIDMappings e.g HostUID:ContainerID:Size. Implies **--user=**.
216221

217-
**--user**=[*PATH*]
218-
Use a user namespace. If *PATH* is set, join that namespace. If it
219-
is unset, create a new namespace. The special *PATH* `host` removes
220-
any existing user namespace from the configuration.
221-
222-
**--uts**=[*PATH*]
223-
Use a UTS namespace. If *PATH* is set, join that namespace. If it
224-
is unset, create a new namespace. The special *PATH* `host` removes
225-
any existing UTS namespace from the configuration.
222+
**--user**=*PATH*
223+
Use a user namespace where *PATH* is an existing user namespace file
224+
to join. The special *PATH* empty-string creates a new namespace.
225+
The special *PATH* `host` removes any existing user namespace from
226+
the configuration.
227+
228+
**--uts**=*PATH*
229+
Use a UTS namespace where *PATH* is an existing UTS namespace file
230+
to join. The special *PATH* empty-string creates a new namespace.
231+
The special *PATH* `host` removes any existing UTS namespace from
232+
the configuration.
226233

227234
# EXAMPLES
228235

0 commit comments

Comments
 (0)