C++ ContainerConfig类代码示例

Future<Option<ContainerLaunchInfo>> PosixFilesystemIsolatorProcess::prepare(
    const ContainerID& containerId,
    const ContainerConfig& containerConfig)
{
  if (infos.contains(containerId)) {
    return Failure("Container has already been prepared");
  }

  const ExecutorInfo& executorInfo = containerConfig.executor_info();

  if (executorInfo.has_container()) {
    CHECK_EQ(executorInfo.container().type(), ContainerInfo::MESOS);

    // Return failure if the container change the filesystem root
    // because the symlinks will become invalid in the new root.
    if (executorInfo.container().mesos().has_image()) {
      return Failure("Container root filesystems not supported");
    }

    if (executorInfo.container().volumes().size() > 0) {
      return Failure("Volumes in ContainerInfo is not supported");
    }
  }

  infos.put(containerId, Owned<Info>(new Info(containerConfig.directory())));

  return update(containerId, executorInfo.resources())
      .then([]() -> Future<Option<ContainerLaunchInfo>> { return None(); });
}

// static
int DbWrapper::copySecondary(DB_ENV *env,
			     const std::string &oldcname,
			     const std::string &newcname,
			     const std::string &prefix,
			     const std::string &dbname,
			     bool duplicates)
{
	int err;
	DbWrapper olddb(env, oldcname, prefix, dbname, DEFAULT_CONFIG);
	ContainerConfig config;
	config.setReadOnly(true);
	err = olddb.open(0, DB_BTREE, config);
	if (err) {
		// ignore ENOENT -- it's OK sometimes
		if (err == ENOENT)
			err = 0;
		return err;
	}
	config.setReadOnly(false);
	config.setPageSize(olddb.getPageSize());
	DbWrapper newdb(env, newcname, prefix, dbname,
			config);
	if (duplicates) {
		err = newdb.getDb()->set_flags(newdb.getDb(), DB_DUP|DB_DUPSORT);
		if (err)
			throw XmlException(err);
	}
	err = newdb.open(0, DB_BTREE, DB_CREATE|DB_EXCL);
	if (err == 0)
		err = newdb.copy(olddb, DB_KEYFIRST);
	return err;
}

TYPED_TEST(MemIsolatorTest, MemUsage)
{
  slave::Flags flags;

  Try<Isolator*> isolator = TypeParam::create(flags);
  CHECK_SOME(isolator);

  ExecutorInfo executorInfo;
  executorInfo.mutable_resources()->CopyFrom(
      Resources::parse("mem:1024").get());

  ContainerID containerId;
  containerId.set_value(UUID::random().toString());

  // Use a relative temporary directory so it gets cleaned up
  // automatically with the test.
  Try<string> dir = os::mkdtemp(path::join(os::getcwd(), "XXXXXX"));
  ASSERT_SOME(dir);

  ContainerConfig containerConfig;
  containerConfig.mutable_executor_info()->CopyFrom(executorInfo);
  containerConfig.set_directory(dir.get());

  AWAIT_READY(isolator.get()->prepare(
      containerId,
      containerConfig));

  MemoryTestHelper helper;
  ASSERT_SOME(helper.spawn());
  ASSERT_SOME(helper.pid());

  // Set up the reaper to wait on the subprocess.
  Future<Option<int>> status = process::reap(helper.pid().get());

  // Isolate the subprocess.
  AWAIT_READY(isolator.get()->isolate(containerId, helper.pid().get()));

  const Bytes allocation = Megabytes(128);
  EXPECT_SOME(helper.increaseRSS(allocation));

  Future<ResourceStatistics> usage = isolator.get()->usage(containerId);
  AWAIT_READY(usage);

  EXPECT_GE(usage.get().mem_rss_bytes(), allocation.bytes());

  // Ensure the process is killed.
  helper.cleanup();

  // Make sure the subprocess was reaped.
  AWAIT_READY(status);

  // Let the isolator clean up.
  AWAIT_READY(isolator.get()->cleanup(containerId));

  delete isolator.get();
}

StructuralStatsDatabase::StructuralStatsDatabase()
	: db_(0, "", "", "", DEFAULT_CONFIG),
	  inMemory_(true)
{
	ContainerConfig config;
	config.setAllowCreate(true);
	int err = db_.open(0, DB_BTREE, config);

	if (err != 0) throw XmlException(err);
}

ContainerConfig::ContainerConfig(const ContainerConfig &o)
: mode_(o.getMode()), dbOpenFlags_(o.getDbOpenFlags()), dbSetFlags_(o.getDbSetFlags()), 
	seqFlags_(o.getSeqFlags()), xmlFlags_(o.getXmlFlags()), 
	type_(o.getContainerType()), compressionName_(o.getCompressionName()), mgr_(0),
	  pageSize_(o.getPageSize()), sequenceIncr_(o.getSequenceIncrement()),
	  containerOwned_(false)
{}

Future<Option<ContainerLaunchInfo>> CgroupsNetClsIsolatorProcess::prepare(
    const ContainerID& containerId,
    const ContainerConfig& containerConfig)
{
  if (infos.contains(containerId)) {
    return Failure("Container has already been prepared");
  }

  // Use this info to create the cgroup, but do not insert it into
  // infos till the cgroup has been created successfully.
  Info info(path::join(flags.cgroups_root, containerId.value()));

  // Create a cgroup for this container.
  Try<bool> exists = cgroups::exists(hierarchy, info.cgroup);
  if (exists.isError()) {
    return Failure("Failed to check if the cgroup already exists: " +
                   exists.error());
  } else if (exists.get()) {
    return Failure("The cgroup already exists");
  }

  Try<Nothing> create = cgroups::create(hierarchy, info.cgroup);
  if (create.isError()) {
    return Failure("Failed to create the cgroup: " + create.error());
  }

  // 'chown' the cgroup so the executor can create nested cgroups. Do
  // not recurse so the control files are still owned by the slave
  // user and thus cannot be changed by the executor.
  if (containerConfig.has_user()) {
    Try<Nothing> chown = os::chown(
        containerConfig.user(),
        path::join(hierarchy, info.cgroup),
        false);

    if (chown.isError()) {
      return Failure("Failed to change ownership of cgroup hierarchy: " +
                     chown.error());
    }
  }

  infos.emplace(containerId, info);

  return update(containerId, containerConfig.executorinfo().resources())
    .then([]() -> Future<Option<ContainerLaunchInfo>> {
      return None();
    });
}

void ContainerConfig::setFlags(const ContainerConfig &flags)
{
	setTransactional(flags.getTransactional());
	setIndexNodes(flags.getIndexNodes());
	setEncrypted(flags.getEncrypted());
	setStatistics(flags.getStatistics());
	setAllowValidation(flags.getAllowValidation());
	setChecksum(flags.getChecksum());
	setDbOpenFlags(flags.getDbOpenFlags());
	setDbSetFlags(flags.getDbSetFlags());
	setSeqFlags(flags.getSeqFlags());
}

Future<Option<ContainerLaunchInfo>> LinuxFilesystemIsolatorProcess::prepare(
    const ContainerID& containerId,
    const ContainerConfig& containerConfig)
{
  const string& directory = containerConfig.directory();

  Option<string> user;
  if (containerConfig.has_user()) {
    user = containerConfig.user();
  }

  if (infos.contains(containerId)) {
    return Failure("Container has already been prepared");
  }

  Owned<Info> info(new Info(
      directory,
      containerConfig.executor_info()));

  infos.put(containerId, info);

  ContainerLaunchInfo launchInfo;
  launchInfo.set_namespaces(CLONE_NEWNS);

  // Prepare the commands that will be run in the container's mount
  // namespace right after forking the executor process. We use these
  // commands to mount those volumes specified in the container info
  // so that they don't pollute the host mount namespace.
  Try<string> _script = script(containerId, containerConfig);
  if (_script.isError()) {
    return Failure("Failed to generate isolation script: " + _script.error());
  }

  CommandInfo* command = launchInfo.add_commands();
  command->set_value(_script.get());

  return update(containerId, containerConfig.executor_info().resources())
    .then([launchInfo]() -> Future<Option<ContainerLaunchInfo>> {
      return launchInfo;
    });
}

DocumentDatabase::DocumentDatabase(DB_ENV *env, Transaction *txn,
				   const std::string &name,
				   const ContainerConfig &config,
				   XmlCompression *compression)
	: environment_(env),
	  name_(name),
	  type_(config.getContainerType()),
	  content_(env, name, "content_", document_name,
		   DEFAULT_CONFIG),
	  secondary_(env, name, document_name, DEFAULT_CONFIG),
	  compressor_(compression)
{
	open(txn, config);
}

DbWrapper::DbWrapper(DB_ENV *environment, const std::string &name,
		     const std::string &prefixName,
		     const std::string &databaseName,
		     const ContainerConfig &config)
	: flags_(0),
	  name_(name),
	  prefixName_(prefixName),
	  databaseName_(databaseName),
	  pageSize_(config.getPageSize()),
	  db_(0),
	  environment_(environment),
	  readCursor_(0),
	  writeCursor_(0)
{
	int ret = db_create(&db_, environment, 0);
	if (ret != 0)
		throw XmlException(ret);
	if (environment_)
		setFlags(environment_);
}

DictionaryDatabase::DictionaryDatabase(DB_ENV *env, Transaction *txn,
				       const std::string &name,
				       const ContainerConfig &config,
				       bool useMutex)
	: stringCache_(true),
	  environment_(env),
	  name_(name),
	  primary_(new PrimaryDatabase(env, name,
				       dictionary_name,
				       DEFAULT_CONFIG)),
	  secondary_(new SecondaryDatabase(env, name,
					   dictionary_name,
					   DEFAULT_CONFIG)),
	  nidName_(0),
	  nidRoot_(0),
	  usePreloads_(false),
	  isTransacted_(txn ? true : false),
	  mutex_(useMutex ? MutexLock::createMutex() : 0)
{
	cache_.setDictionaryDatabase(this);
	if (!isTransacted_ && env) {
		u_int32_t envFlags;
		env->get_flags(env, &envFlags);
		if (envFlags & DB_CDB_ALLDB)
			isTransacted_ = true;
	}
	int err = 0;
	try {
		// set cache sizes low if no DB_ENV -- this is the in-memory
		// dictionary for transient docs
		if (!env) {
			primary_->getDb()->set_cachesize(primary_->getDb(), 0, dictCacheBytes, 1);
			secondary_->getDb()->set_cachesize(secondary_->getDb(), 0, dictCacheBytes, 1);
		}

		// Open the Db objects
		err = primary_->open(txn, config);
		if (err == 0)
			err = secondary_->open(txn, /*duplicates*/true, config);

		if (err == 0) {
			// Lookup/Define the dbxml namespace names (but don't define
			// if this is a read-only container)
			bool rdonly = config.getReadOnly();
			preloadDictionary(txn, rdonly);
		}

	} catch (XmlException &) {
		secondary_->cleanup();
		primary_->cleanup();
		if (txn)
			txn->abort();
		throw;
	}
	if (err != 0) {
		secondary_->cleanup();
		primary_->cleanup();
		if (txn)
			txn->abort();
		string msg = name;
		if (err == EEXIST) {
			msg += ": container exists";
			throw XmlException(
				XmlException::CONTAINER_EXISTS, msg);
		} else if (err == ENOENT) {
			msg += ": container file not found, or not a container";
			throw XmlException(XmlException::CONTAINER_NOT_FOUND,
					   msg);
		}
		throw XmlException(err);
	}
}

// A test to verify the number of processes and threads in a
// container.
TEST_F(LimitedCpuIsolatorTest, ROOT_CGROUPS_Pids_and_Tids)
{
  slave::Flags flags;
  flags.cgroups_cpu_enable_pids_and_tids_count = true;

  Try<Isolator*> isolator = CgroupsCpushareIsolatorProcess::create(flags);
  CHECK_SOME(isolator);

  Try<Launcher*> launcher = LinuxLauncher::create(flags);
  CHECK_SOME(launcher);

  ExecutorInfo executorInfo;
  executorInfo.mutable_resources()->CopyFrom(
      Resources::parse("cpus:0.5;mem:512").get());

  ContainerID containerId;
  containerId.set_value(UUID::random().toString());

  // Use a relative temporary directory so it gets cleaned up
  // automatically with the test.
  Try<string> dir = os::mkdtemp(path::join(os::getcwd(), "XXXXXX"));
  ASSERT_SOME(dir);

  ContainerConfig containerConfig;
  containerConfig.mutable_executor_info()->CopyFrom(executorInfo);
  containerConfig.set_directory(dir.get());

  Future<Option<ContainerLaunchInfo>> prepare =
    isolator.get()->prepare(
        containerId,
        containerConfig);

  AWAIT_READY(prepare);

  // Right after the creation of the cgroup, which happens in
  // 'prepare', we check that it is empty.
  Future<ResourceStatistics> usage = isolator.get()->usage(containerId);
  AWAIT_READY(usage);
  EXPECT_EQ(0U, usage.get().processes());
  EXPECT_EQ(0U, usage.get().threads());

  int pipes[2];
  ASSERT_NE(-1, ::pipe(pipes));

  vector<string> argv(1);
  argv[0] = "cat";

  Try<pid_t> pid = launcher.get()->fork(
      containerId,
      "cat",
      argv,
      Subprocess::FD(STDIN_FILENO),
      Subprocess::FD(STDOUT_FILENO),
      Subprocess::FD(STDERR_FILENO),
      None(),
      None(),
      lambda::bind(&childSetup, pipes),
      prepare.get().isSome() ? prepare.get().get().namespaces() : 0);

  ASSERT_SOME(pid);

  // Reap the forked child.
  Future<Option<int>> status = process::reap(pid.get());

  // Continue in the parent.
  ASSERT_SOME(os::close(pipes[0]));

  // Before isolation, the cgroup is empty.
  usage = isolator.get()->usage(containerId);
  AWAIT_READY(usage);
  EXPECT_EQ(0U, usage.get().processes());
  EXPECT_EQ(0U, usage.get().threads());

  // Isolate the forked child.
  AWAIT_READY(isolator.get()->isolate(containerId, pid.get()));

  // After the isolation, the cgroup is not empty, even though the
  // process hasn't exec'd yet.
  usage = isolator.get()->usage(containerId);
  AWAIT_READY(usage);
  EXPECT_EQ(1U, usage.get().processes());
  EXPECT_EQ(1U, usage.get().threads());

  // Now signal the child to continue.
  char dummy;
  ASSERT_LT(0, ::write(pipes[1], &dummy, sizeof(dummy)));

  ASSERT_SOME(os::close(pipes[1]));

  // Process count should be 1 since 'sleep' is still sleeping.
  usage = isolator.get()->usage(containerId);
  AWAIT_READY(usage);
  EXPECT_EQ(1U, usage.get().processes());
  EXPECT_EQ(1U, usage.get().threads());

  // Ensure all processes are killed.
  AWAIT_READY(launcher.get()->destroy(containerId));

//.........这里部分代码省略.........

  Future<bool> launch(
      const ContainerID& containerId,
      const ContainerConfig& containerConfig,
      const map<string, string>& environment,
      const Option<string>& pidCheckpointPath)
  {
    CHECK(!terminatedContainers.contains(containerId))
      << "Failed to launch nested container " << containerId
      << " for executor '" << containerConfig.executor_info().executor_id()
      << "' of framework " << containerConfig.executor_info().framework_id()
      << " because this ContainerID is being re-used with"
      << " a previously terminated container";

    CHECK(!containers_.contains(containerId))
      << "Failed to launch container " << containerId
      << " for executor '" << containerConfig.executor_info().executor_id()
      << "' of framework " << containerConfig.executor_info().framework_id()
      << " because it is already launched";

    containers_[containerId] = Owned<ContainerData>(new ContainerData());

    if (containerId.has_parent()) {
      // Launching a nested container via the test containerizer is a
      // no-op for now.
      return true;
    }

    CHECK(executors.contains(containerConfig.executor_info().executor_id()))
      << "Failed to launch executor '"
      << containerConfig.executor_info().executor_id()
      << "' of framework " << containerConfig.executor_info().framework_id()
      << " because it is unknown to the containerizer";

    containers_.at(containerId)->executorId =
      containerConfig.executor_info().executor_id();

    containers_.at(containerId)->frameworkId =
      containerConfig.executor_info().framework_id();

    // We need to synchronize all reads and writes to the environment
    // as this is global state.
    //
    // TODO(jmlvanre): Even this is not sufficient, as other aspects
    // of the code may read an environment variable while we are
    // manipulating it. The better solution is to pass the environment
    // variables into the fork, or to set them on the command line.
    // See MESOS-3475.
    static std::mutex mutex;

    synchronized(mutex) {
      // Since the constructor for `MesosExecutorDriver` reads
      // environment variables to load flags, even it needs to
      // be within this synchronization section.
      //
      // Prepare additional environment variables for the executor.
      // TODO(benh): Need to get flags passed into the TestContainerizer
      // in order to properly use here.
      slave::Flags flags;
      flags.recovery_timeout = Duration::zero();

      // We need to save the original set of environment variables so we
      // can reset the environment after calling 'driver->start()' below.
      hashmap<string, string> original = os::environment();

      foreachpair (const string& name, const string& variable, environment) {
        os::setenv(name, variable);
      }

      // TODO(benh): Can this be removed and done exclusively in the
      // 'executorEnvironment()' function? There are other places in the
      // code where we do this as well and it's likely we can do this once
      // in 'executorEnvironment()'.
      foreach (const Environment::Variable& variable,
               containerConfig.executor_info()
                 .command().environment().variables()) {
        os::setenv(variable.name(), variable.value());
      }

      os::setenv("MESOS_LOCAL", "1");

      const Owned<ExecutorData>& executorData =
        executors.at(containerConfig.executor_info().executor_id());

      if (executorData->executor != nullptr) {
        executorData->driver = Owned<MesosExecutorDriver>(
            new MesosExecutorDriver(executorData->executor));
        executorData->driver->start();
      } else {
        shared_ptr<v1::MockHTTPExecutor> executor =
          executorData->v1ExecutorMock;
        executorData->v1Library = Owned<v1::executor::TestMesos>(
          new v1::executor::TestMesos(ContentType::PROTOBUF, executor));
      }

      os::unsetenv("MESOS_LOCAL");

      // Unset the environment variables we set by resetting them to their
      // original values and also removing any that were not part of the
      // original environment.
      foreachpair (const string& name, const string& value, original) {
//.........这里部分代码省略.........

// upgrade from 2.1 (version 4) to 2.2 (version 5)
// Modify keys for both document secondary and content (if wholedoc storage)
// secondary key: docId, nameId, type
// content key: docId
// for both:
// 1.  open old DB and create a new database
// 2.  for each record:
//    o unmarshal old format; marshal in new, and put into new DB
static int upgrade22(const std::string &name,
		     const std::string &tname, Manager &mgr)
{
	int err = 0;
	SecondaryDatabase secondary(mgr.getDB_ENV(), name,
				    document_name, DEFAULT_CONFIG);
	err = secondary.open(0, /*duplicates*/false, DEFAULT_CONFIG);
	ContainerConfig config;
	config.setPageSize(secondary.getPageSize());
	SecondaryDatabase newSec(mgr.getDB_ENV(), tname,
				 document_name, config);
	err = newSec.open(0, /*duplicates*/false, CREATE_CONFIG);
	// the key is: docId,nodeId,type
	DbXml::DbXmlDbt key;
	DbXml::DbXmlDbt data;
	Cursor curs(secondary, (Transaction*)0, DbXml::CURSOR_READ);
	int ret = 0;
	while ((err == 0) &&
	       (ret = curs.get(key, data, DB_NEXT)) == 0) {
		// decode key using pre-2.2 code
		DocID did;
		NameID nid;
		XmlValue::Type type;
		u_int32_t *p = (u_int32_t *)key.data;
		u_int32_t id1, id2;
		id1 = *p++;
		id2 = *p++;
		if (Manager::isBigendian()) {
			M_32_SWAP(id1);
			M_32_SWAP(id2);  
		}
		did = id1;            
		nid = id2;
		type = (XmlValue::Type) * ((unsigned char*)p);
		// encode using 2.2. code
		DbtOut newKey;
		MetaDatum::setKeyDbt(did, nid, type, newKey);
		err = newSec.put(0, &newKey, &data, 0);
	}
	curs.close();
	secondary.close(0);
	newSec.close(0);
	if (err == 0) {
		DbWrapper content(mgr.getDB_ENV(), name,
				  "content_",
				  document_name, DEFAULT_CONFIG);
		err = content.open(0, DB_BTREE, DEFAULT_CONFIG);
		if (err != 0) {
			// ignore ENOENT
			if (err == ENOENT)
				err = 0;
			return err;
		}
		config.setPageSize(content.getPageSize());
		DbWrapper newContent(mgr.getDB_ENV(), tname,
				     "content_", document_name,
				     config);
		err = newContent.open(0, DB_BTREE,
				      CREATE_CONFIG);
		if (err != 0)
			return err;
		// the key is: docId
		DbXml::DbXmlDbt key;
		DbXml::DbXmlDbt data;
		Cursor curs1(content, (Transaction*)0, DbXml::CURSOR_READ);
		int ret = 0;
		while ((err == 0) &&
		       (ret = curs1.get(key, data, DB_NEXT)) == 0) {
			// decode/encode key, rewrite
			u_int32_t *p = (u_int32_t *)key.data;
			u_int32_t id1;
			id1 = *p;
			if (Manager::isBigendian())
				M_32_SWAP(id1);
			DocID id(id1);
			DbtOut newKey;
			id.setDbtFromThis(newKey);
			err = newContent.put(0, &newKey, &data, 0);
		}
		curs1.close();
		content.close(0);
		newContent.close(0);
	}
	return err;
}

Try<string> LinuxFilesystemIsolatorProcess::script(
    const ContainerID& containerId,
    const ContainerConfig& containerConfig)
{
  ostringstream out;
  out << "#!/bin/sh\n";
  out << "set -x -e\n";

  // Make sure mounts in the container mount namespace do not
  // propagate back to the host mount namespace.
  // NOTE: We cannot simply run `mount --make-rslave /`, for more info
  // please refer to comments in mount.hpp.
  MesosContainerizerMount::Flags mountFlags;
  mountFlags.operation = MesosContainerizerMount::MAKE_RSLAVE;
  mountFlags.path = "/";
  out << path::join(flags.launcher_dir, "mesos-containerizer") << " "
      << MesosContainerizerMount::NAME << " "
      << stringify(mountFlags) << "\n";

  if (!containerConfig.executor_info().has_container()) {
    return out.str();
  }

  // Bind mount the sandbox if the container specifies a rootfs.
  if (containerConfig.has_rootfs()) {
    string sandbox = path::join(
        containerConfig.rootfs(),
        flags.sandbox_directory);

    Try<Nothing> mkdir = os::mkdir(sandbox);
    if (mkdir.isError()) {
      return Error(
          "Failed to create sandbox mount point at '" +
          sandbox + "': " + mkdir.error());
    }

    out << "mount -n --rbind '" << containerConfig.directory()
        << "' '" << sandbox << "'\n";
  }

  foreach (const Volume& volume,
           containerConfig.executor_info().container().volumes()) {
    // NOTE: Volumes with source will be handled by the corresponding
    // isolators (e.g., docker/volume).
    if (volume.has_source()) {
      VLOG(1) << "Ignored a volume with source for container '"
              << containerId << "'";
      continue;
    }

    if (!volume.has_host_path()) {
      return Error("A volume misses 'host_path'");
    }

    // If both 'host_path' and 'container_path' are relative paths,
    // return an error because the user can just directly access the
    // volume in the work directory.
    if (!strings::startsWith(volume.host_path(), "/") &&
        !strings::startsWith(volume.container_path(), "/")) {
      return Error(
          "Both 'host_path' and 'container_path' of a volume are relative");
    }

    // Determine the source of the mount.
    string source;

    if (strings::startsWith(volume.host_path(), "/")) {
      source = volume.host_path();

      // An absolute path must already exist.
      if (!os::exists(source)) {
        return Error("Absolute host path does not exist");
      }
    } else {
      // Path is interpreted as relative to the work directory.
      source = path::join(containerConfig.directory(), volume.host_path());

      // TODO(jieyu): We need to check that source resolves under the
      // work directory because a user can potentially use a container
      // path like '../../abc'.

      Try<Nothing> mkdir = os::mkdir(source);
      if (mkdir.isError()) {
        return Error(
            "Failed to create the source of the mount at '" +
            source + "': " + mkdir.error());
      }

      // TODO(idownes): Consider setting ownership and mode.
    }

    // Determine the target of the mount.
    string target;

    if (strings::startsWith(volume.container_path(), "/")) {
      if (containerConfig.has_rootfs()) {
        target = path::join(
            containerConfig.rootfs(),
            volume.container_path());

//.........这里部分代码省略.........