Skip to content

Commit c76c2e4

Browse files
ecrupperecrupper
authored
feat(runtime/docker): add drop kernel capabilities option to runtime flags (#454)
* capabilities * docker compose revert + opencontainers version * revert lots of go mod stuff * fix copy pasta and add a test in opts
1 parent 41812a9 commit c76c2e4

File tree

12 files changed

+104
-8
lines changed

12 files changed

+104
-8
lines changed

‎cmd/vela-worker/exec.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ func (w *Worker) exec(index int) error {
7474
PodsTemplateName: w.Config.Runtime.PodsTemplateName,
7575
PodsTemplateFile: w.Config.Runtime.PodsTemplateFile,
7676
PrivilegedImages: w.Config.Runtime.PrivilegedImages,
77+
DropCapabilities: w.Config.Runtime.DropCapabilities,
7778
})
7879
if err != nil {
7980
return err

‎cmd/vela-worker/run.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ func run(c *cli.Context) error {
112112
PodsTemplateFile: c.Path("runtime.pods-template-file"),
113113
HostVolumes: c.StringSlice("runtime.volumes"),
114114
PrivilegedImages: c.StringSlice("runtime.privileged-images"),
115+
DropCapabilities: c.StringSlice("runtime.drop-capabilities"),
115116
},
116117
// queue configuration
117118
Queue: &queue.Setup{

‎go.mod‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@ require (
9797
github.com/spf13/afero v1.9.4 // indirect
9898
github.com/spf13/cast v1.3.1 // indirect
9999
github.com/spf13/pflag v1.0.5 // indirect
100+
github.com/stretchr/testify v1.8.2 // indirect
101+
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
100102
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
101103
github.com/ugorji/go/codec v1.2.9 // indirect
102104
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
@@ -106,7 +108,7 @@ require (
106108
golang.org/x/crypto v0.6.0 // indirect
107109
golang.org/x/net v0.7.0 // indirect
108110
golang.org/x/oauth2 v0.5.0 // indirect
109-
golang.org/x/sys v0.5.0 // indirect
111+
golang.org/x/sys v0.6.0 // indirect
110112
golang.org/x/term v0.5.0 // indirect
111113
golang.org/x/text v0.7.0 // indirect
112114
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect

‎go.sum‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -397,8 +397,11 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
397397
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
398398
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
399399
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
400-
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
401400
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
401+
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
402+
github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
403+
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
404+
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
402405
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
403406
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
404407
github.com/ugorji/go/codec v1.2.9 h1:rmenucSohSTiyL09Y+l2OCk+FrMxGMzho2+tjr5ticU=
@@ -589,8 +592,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
589592
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
590593
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
591594
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
592-
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
593-
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
595+
golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
596+
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
594597
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
595598
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
596599
golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

‎runtime/docker/container.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func (c *client) RunContainer(ctx context.Context, ctn *pipeline.Container, b *p
9595
// allocate new container config from pipeline container
9696
containerConf := ctnConfig(ctn)
9797
// allocate new host config with volume data
98-
hostConf := hostConfig(c.Logger, b.ID, ctn.Ulimits, c.config.Volumes)
98+
hostConf := hostConfig(c.Logger, b.ID, ctn.Ulimits, c.config.Volumes, c.config.DropCapabilities)
9999
// allocate new network config with container name
100100
networkConf := netConfig(b.ID, ctn.Name)
101101

‎runtime/docker/docker.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ type config struct {
3131
Images []string
3232
// specifies a list of host volumes to use for the Docker client
3333
Volumes []string
34+
// specifies a list of kernel capabilities to drop for each Docker container
35+
DropCapabilities []string
3436
}
3537

3638
type client struct {

‎runtime/docker/opts.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,15 @@ func WithPrivilegedImages(images []string) ClientOpt {
4949
return nil
5050
}
5151
}
52+
53+
// WithDropCapabilities sets the kernel capabilities to drop from each container in the runtime client for Docker.
54+
func WithDropCapabilities(caps []string) ClientOpt {
55+
return func(c *client) error {
56+
c.Logger.Trace("configuring dropped capabilities in docker runtime client")
57+
58+
// set the runtime dropped kernel capabilities in the docker client
59+
c.config.DropCapabilities = caps
60+
61+
return nil
62+
}
63+
}

‎runtime/docker/opts_test.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,3 +133,40 @@ func TestDocker_ClientOpt_WithLogger(t *testing.T) {
133133
})
134134
}
135135
}
136+
137+
func TestDocker_ClientOpt_WithDropCapabilities(t *testing.T) {
138+
// setup tests
139+
tests := []struct {
140+
name string
141+
caps []string
142+
want []string
143+
}{
144+
{
145+
name: "defined",
146+
caps: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE"},
147+
want: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE"},
148+
},
149+
{
150+
name: "empty",
151+
caps: []string{},
152+
want: []string{},
153+
},
154+
}
155+
156+
// run tests
157+
for _, test := range tests {
158+
t.Run(test.name, func(t *testing.T) {
159+
_service, err := New(
160+
WithDropCapabilities(test.caps),
161+
)
162+
163+
if err != nil {
164+
t.Errorf("WithDropCapabilities returned err: %v", err)
165+
}
166+
167+
if !reflect.DeepEqual(_service.config.DropCapabilities, test.want) {
168+
t.Errorf("WithDropCapabilities is %v, want %v", _service.config.DropCapabilities, test.want)
169+
}
170+
})
171+
}
172+
}

‎runtime/docker/volume.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func (c *client) RemoveVolume(ctx context.Context, b *pipeline.Build) error {
9090

9191
// hostConfig is a helper function to generate the host config
9292
// with Ulimit and volume specifications for a container.
93-
func hostConfig(logger *logrus.Entry, id string, ulimits pipeline.UlimitSlice, volumes []string) *container.HostConfig {
93+
func hostConfig(logger *logrus.Entry, id string, ulimits pipeline.UlimitSlice, volumes []string, dropCaps []string) *container.HostConfig {
9494
logger.Tracef("creating mount for default volume %s", id)
9595

9696
// create default mount for pipeline volume
@@ -146,5 +146,6 @@ func hostConfig(logger *logrus.Entry, id string, ulimits pipeline.UlimitSlice, v
146146
Mounts: mounts,
147147
// https://pkg.go.dev/github.com/docker/docker/api/types/container#Resources.Ulimits
148148
Resources: resources,
149+
CapDrop: dropCaps,
149150
}
150151
}

‎runtime/flags.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,4 +60,10 @@ var Flags = []cli.Flag{
6060
Name: "runtime.volumes",
6161
Usage: "list of host volumes to mount for the runtime",
6262
},
63+
&cli.StringSliceFlag{
64+
EnvVars: []string{"VELA_RUNTIME_DROP_CAPABILITIES", "RUNTIME_DROP_CAPABILITIES"},
65+
FilePath: "/vela/runtime/drop_capabilities",
66+
Name: "runtime.drop-capabilities",
67+
Usage: "list of kernel capabilities to drop from container privileges (only used by Docker)",
68+
},
6369
}

0 commit comments

Comments
 (0)