Codebase list golang-github-opencontainers-specs / 61bd050
Update upstream source from tag 'upstream/1.0.2.118.g5cfc4c3' Update to upstream version '1.0.2.118.g5cfc4c3' with Debian dir df2c42e584ead091ed782f637cf386047e9f9ca0 Faidon Liambotis 1 year, 3 months ago
11 changed file(s) with 58 addition(s) and 8 deletion(s). Raw diff Collapse all Expand all
+1
-1
CODEOWNERS less more
0 * @crosbymichael @cyphar @dqminh @giuseppe @hqhq @mrunalp @tianon @vbatts
0 * @AkihiroSuda @crosbymichael @cyphar @dqminh @giuseppe @hqhq @kolyshkin @mrunalp @thaJeztah @tianon @vbatts
+1
-1
GOVERNANCE.md less more
6666
6767 > [runtime-spec adopted]: Tag 0647920 as 1.0.0-rc (+6 -0 #3)
6868
69 [charter]: https://www.opencontainers.org/about/governance
69 [charter]: https://github.com/opencontainers/tob/blob/main/CHARTER.md
+3
-0
MAINTAINERS less more
55 Qiang Huang <h.huangqiang@huawei.com> (@hqhq)
66 Aleksa Sarai <asarai@suse.de> (@cyphar)
77 Giuseppe Scrivano <gscrivan@redhat.com> (@giuseppe)
8 Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (@AkihiroSuda)
9 Kir Kolyshkin <kolyshkin@gmail.com> (@kolyshkin)
10 Sebastiaan van Stijn <github@gone.nl> (@thaJeztah)
+1
-1
RELEASES.md less more
4747 For example if a breaking change is introduced in v1.0.0-rc2 then the series would end with v1.0.0-rc4 and v1.0.0.
4848 * Minor and patch releases SHOULD be made on an as-needed basis.
4949
50 [charter]: https://www.opencontainers.org/about/governance
50 [charter]: https://github.com/opencontainers/tob/blob/main/CHARTER.md
5151
5252 ## Checklist
5353
+10
-0
config-linux.md less more
335335 To disable it, specify a value of `true`.
336336 * **`useHierarchy`** *(bool, OPTIONAL)* - enables or disables hierarchical memory accounting.
337337 If enabled (`true`), child cgroups will share the memory limits of this cgroup.
338 * **`checkBeforeUpdate`** *(bool, OPTIONAL)* - enables container memory usage check before setting a new limit.
339 If enabled (`true`), runtime MAY check if a new memory limit is lower than the current usage, and MUST
340 reject the new limit. Practically, when cgroup v1 is used, the kernel rejects the limit lower than the
341 current usage, and when cgroup v2 is used, an OOM killer is invoked. This setting can be used on
342 cgroup v2 to mimic the cgroup v1 behavior.
338343
339344 #### Example
340345
359364
360365 * **`shares`** *(uint64, OPTIONAL)* - specifies a relative share of CPU time available to the tasks in a cgroup
361366 * **`quota`** *(int64, OPTIONAL)* - specifies the total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by **`period`** below)
367 If specified with any (valid) positive value, it MUST be no smaller than `burst` (runtimes MAY generate an error).
368 * **`burst`** *(uint64, OPTIONAL)* - specifies the maximum amount of accumulated time in microseconds for which all tasks in a cgroup can run additionally for burst during one period (as defined by **`period`** below)
369 If specified, this value MUST be no larger than any positive `quota` (runtimes MAY generate an error).
362370 * **`period`** *(uint64, OPTIONAL)* - specifies a period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated (CFS scheduler only)
363371 * **`realtimeRuntime`** *(int64, OPTIONAL)* - specifies a period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources
364372 * **`realtimePeriod`** *(uint64, OPTIONAL)* - same as **`period`** but applies to realtime scheduler only
372380 "cpu": {
373381 "shares": 1024,
374382 "quota": 1000000,
383 "burst": 1000000,
375384 "period": 500000,
376385 "realtimeRuntime": 950000,
377386 "realtimePeriod": 1000000,
700709 * `SECCOMP_FILTER_FLAG_TSYNC`
701710 * `SECCOMP_FILTER_FLAG_LOG`
702711 * `SECCOMP_FILTER_FLAG_SPEC_ALLOW`
712 * `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV`
703713
704714 * **`listenerPath`** *(string, OPTIONAL)* - specifies the path of UNIX domain socket over which the runtime will send the [container process state](#containerprocessstate) data structure when the `SCMP_ACT_NOTIFY` action is used.
705715 This socket MUST use `AF_UNIX` domain and `SOCK_STREAM` type.
+14
-3
config.md less more
352352
353353 ```json
354354 "hostname": "mrsdalloway"
355 ```
356
357 ## <a name="configDomainname" />Domainname
358
359 * **`domainname`** (string, OPTIONAL) specifies the container's domainname as seen by processes running inside the container.
360 On Linux, for example, this will change the domainname in the [container](glossary.md#container-namespace) [UTS namespace][uts-namespace.7].
361 Depending on your [namespace configuration](config-linux.md#namespaces), the container UTS namespace may be the [runtime](glossary.md#runtime-namespace) [UTS namespace][uts-namespace.7].
362
363 ### Example
364
365 ```json
366 "domainname": "foobarbaz.test"
355367 ```
356368
357369 ## <a name="configPlatformSpecificConfiguration" />Platform-specific configuration
429441
430442 ### <a name="configHooksPrestart" />Prestart
431443
432 The `prestart` hooks MUST be called after the [`start`](runtime.md#start) operation is called but [before the user-specified program command is executed](runtime.md#lifecycle).
444 The `prestart` hooks MUST be called as part of the [`create`](runtime.md#create) operation after the runtime environment has been created (according to the configuration in config.json) but before the `pivot_root` or any equivalent operation has been executed.
433445 On Linux, for example, they are called after the container namespaces are created, so they provide an opportunity to customize the container (e.g. the network namespace could be specified in this hook).
446 The `prestart` hooks MUST be called before the `createRuntime` hooks.
434447
435448 Note: `prestart` hooks were deprecated in favor of `createRuntime`, `createContainer` and `startContainer` hooks, which allow more granular hook control during the create and start phase.
436449
447460 On Linux, for example, they are called after the container namespaces are created, so they provide an opportunity to customize the container (e.g. the network namespace could be specified in this hook).
448461
449462 The definition of `createRuntime` hooks is currently underspecified and hooks authors, should only expect from the runtime that the mount namespace have been created and the mount operations performed. Other operations such as cgroups and SELinux/AppArmor labels might not have been performed by the runtime.
450
451 Note: `runc` originally implemented `prestart` hooks contrary to the spec, namely as part of the `create` operation (instead of during the `start` operation). This incorrect implementation actually corresponds to `createRuntime` hooks. For runtimes that implement the deprecated `prestart` hooks as `createRuntime` hooks, `createRuntime` hooks MUST be called after the `prestart` hooks.
452463
453464 ### <a name="configHooksCreateContainer" />CreateContainer Hooks
454465
+6
-0
schema/config-linux.json less more
108108 },
109109 "quota": {
110110 "$ref": "defs.json#/definitions/int64"
111 },
112 "burst": {
113 "$ref": "defs.json#/definitions/uint64"
111114 },
112115 "realtimePeriod": {
113116 "$ref": "defs.json#/definitions/uint64"
168171 },
169172 "useHierarchy": {
170173 "type": "boolean"
174 },
175 "checkBeforeUpdate": {
176 "type": "boolean"
171177 }
172178 }
173179 },
+3
-0
schema/config-schema.json less more
3232 "$ref": "defs.json#/definitions/annotations"
3333 },
3434 "hostname": {
35 "type": "string"
36 },
37 "domainname": {
3538 "type": "string"
3639 },
3740 "mounts": {
+2
-1
schema/defs-linux.json less more
6969 "enum": [
7070 "SECCOMP_FILTER_FLAG_TSYNC",
7171 "SECCOMP_FILTER_FLAG_LOG",
72 "SECCOMP_FILTER_FLAG_SPEC_ALLOW"
72 "SECCOMP_FILTER_FLAG_SPEC_ALLOW",
73 "SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"
7374 ]
7475 },
7576 "SeccompOperators": {
+4
-1
schema/test/config/good/spec-example.json less more
6262 "readonly": true
6363 },
6464 "hostname": "slartibartfast",
65 "domainname": "foobarbaz.test",
6566 "mounts": [
6667 {
6768 "destination": "/proc",
268269 "kernelTCP": -1,
269270 "swappiness": 0,
270271 "disableOOMKiller": false,
271 "useHierarchy": false
272 "useHierarchy": false,
273 "checkBeforeUpdate": false
272274 },
273275 "cpu": {
274276 "shares": 1024,
275277 "quota": 1000000,
278 "burst": 1000000,
276279 "period": 500000,
277280 "realtimeRuntime": 950000,
278281 "realtimePeriod": 1000000,
+13
-0
specs-go/config.go less more
1111 Root *Root `json:"root,omitempty"`
1212 // Hostname configures the container's hostname.
1313 Hostname string `json:"hostname,omitempty"`
14 // Domainname configures the container's domainname.
15 Domainname string `json:"domainname,omitempty"`
1416 // Mounts configures additional mounts (on top of Root).
1517 Mounts []Mount `json:"mounts,omitempty"`
1618 // Hooks configures callbacks for container lifecycle events.
316318 DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"`
317319 // Enables hierarchical memory accounting
318320 UseHierarchy *bool `json:"useHierarchy,omitempty"`
321 // CheckBeforeUpdate enables checking if a new memory limit is lower
322 // than the current usage during update, and if so, rejecting the new
323 // limit.
324 CheckBeforeUpdate *bool `json:"checkBeforeUpdate,omitempty"`
319325 }
320326
321327 // LinuxCPU for Linux cgroup 'cpu' resource management
324330 Shares *uint64 `json:"shares,omitempty"`
325331 // CPU hardcap limit (in usecs). Allowed cpu time in a given period.
326332 Quota *int64 `json:"quota,omitempty"`
333 // CPU hardcap burst limit (in usecs). Allowed accumulated cpu time additionally for burst in a
334 // given period.
335 Burst *uint64 `json:"burst,omitempty"`
327336 // CPU period to be used for hardcapping (in usecs).
328337 Period *uint64 `json:"period,omitempty"`
329338 // How much time realtime scheduling may use (in usecs).
642651 // LinuxSeccompFlagSpecAllow can be used to disable Speculative Store
643652 // Bypass mitigation. (since Linux 4.17)
644653 LinuxSeccompFlagSpecAllow LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_SPEC_ALLOW"
654
655 // LinuxSeccompFlagWaitKillableRecv can be used to switch to the wait
656 // killable semantics. (since Linux 5.19)
657 LinuxSeccompFlagWaitKillableRecv LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"
645658 )
646659
647660 // Additional architectures permitted to be used for system calls