Docker plugin add host devices property

Docker 1.2.0 and docker-py 0.6.0 support the device parameter when
starting containers(docker run --device[]).

Using --device you can add a host device to the container without the
--privileged flag.(e.g. --device=/dev/sdc:/dev/xvdc:rwm)
Note:":" is used to split the full device path.

Reference: (parse_devices function)
https://github.com/docker/docker-py/blob/master/docker/utils/utils.py#L259

Change-Id: I7735a8b769062f442cc8f1810dbdecdc6324509e
Closes-bug: #1434427
This commit is contained in:
LiangChen 2015-03-28 16:19:08 +08:00
parent e53b3ff73b
commit 3c4ecc24c5
2 changed files with 144 additions and 3 deletions

View File

@ -31,7 +31,9 @@ from heat.engine import support
LOG = logging.getLogger(__name__)
DOCKER_INSTALLED = False
MIN_API_VERSION_MAP = {'read_only': '1.17', 'cpu_shares': '1.8'}
MIN_API_VERSION_MAP = {'read_only': '1.17', 'cpu_shares': '1.8',
'devices': '1.14'}
DEVICE_PATH_REGEX = r"^/dev/[/_\-a-zA-Z0-9]+$"
# conditionally import so tests can work without having the dependency
# satisfied
try:
@ -47,12 +49,13 @@ class DockerContainer(resource.Resource):
DOCKER_ENDPOINT, HOSTNAME, USER, MEMORY, PORT_SPECS,
PRIVILEGED, TTY, OPEN_STDIN, STDIN_ONCE, ENV, CMD, DNS,
IMAGE, VOLUMES, VOLUMES_FROM, PORT_BINDINGS, LINKS, NAME,
RESTART_POLICY, CAP_ADD, CAP_DROP, READ_ONLY, CPU_SHARES,
RESTART_POLICY, CAP_ADD, CAP_DROP, READ_ONLY, CPU_SHARES, DEVICES,
) = (
'docker_endpoint', 'hostname', 'user', 'memory', 'port_specs',
'privileged', 'tty', 'open_stdin', 'stdin_once', 'env', 'cmd', 'dns',
'image', 'volumes', 'volumes_from', 'port_bindings', 'links', 'name',
'restart_policy', 'cap_add', 'cap_drop', 'read_only', 'cpu_shares',
'devices'
)
ATTRIBUTES = (
@ -71,6 +74,12 @@ class DockerContainer(resource.Resource):
'Name', 'MaximumRetryCount',
)
_DEVICES_KEYS = (
PATH_ON_HOST, PATH_IN_CONTAINER, PERMISSIONS
) = (
'path_on_host', 'path_in_container', 'permissions'
)
_CAPABILITIES = ['SETPCAP', 'SYS_MODULE', 'SYS_RAWIO', 'SYS_PACCT',
'SYS_ADMIN', 'SYS_NICE', 'SYS_RESOURCE', 'SYS_TIME',
'SYS_TTY_CONFIG', 'MKNOD', 'AUDIT_WRITE',
@ -234,8 +243,49 @@ class DockerContainer(resource.Resource):
MIN_API_VERSION_MAP['cpu_shares'],
default=0,
support_status=support.SupportStatus(version='2015.2'),
),
DEVICES: properties.Schema(
properties.Schema.LIST,
_('Device mappings (only supported for API version >= %s).') %
MIN_API_VERSION_MAP['devices'],
schema=properties.Schema(
properties.Schema.MAP,
schema={
PATH_ON_HOST: properties.Schema(
properties.Schema.STRING,
_('The device path on the host.'),
constraints=[
constraints.Length(max=255),
constraints.AllowedPattern(DEVICE_PATH_REGEX),
],
required=True
),
PATH_IN_CONTAINER: properties.Schema(
properties.Schema.STRING,
_('The device path of the container'
' mappings to the host.'),
constraints=[
constraints.Length(max=255),
constraints.AllowedPattern(DEVICE_PATH_REGEX),
],
),
PERMISSIONS: properties.Schema(
properties.Schema.STRING,
_('The permissions of the container to'
' read/write/create the devices.'),
constraints=[
constraints.AllowedValues(['r', 'w', 'm',
'rw', 'rm', 'wm',
'rwm']),
],
default='rwm'
)
}
),
default=[],
support_status=support.SupportStatus(version='2015.2'),
),
}
attributes_schema = {
INFO: attributes.Schema(
@ -380,10 +430,29 @@ class DockerContainer(resource.Resource):
start_args['cap_drop'] = self.properties[self.CAP_DROP]
if self.properties[self.READ_ONLY]:
start_args[self.READ_ONLY] = True
if (self.properties[self.DEVICES] and
not self.properties[self.PRIVILEGED]):
start_args['devices'] = self._get_mapping_devices(
self.properties[self.DEVICES])
client.start(container_id, **start_args)
return container_id
def _get_mapping_devices(self, devices):
actual_devices = []
for device in devices:
if device[self.PATH_IN_CONTAINER]:
actual_devices.append(':'.join(
[device[self.PATH_ON_HOST],
device[self.PATH_IN_CONTAINER],
device[self.PERMISSIONS]]))
else:
actual_devices.append(':'.join(
[device[self.PATH_ON_HOST],
device[self.PATH_ON_HOST],
device[self.PERMISSIONS]]))
return actual_devices
def _get_container_status(self, container_id):
client = self.get_client()
info = client.inspect_container(container_id)

View File

@ -360,3 +360,75 @@ class DockerContainerTest(common.HeatTestCase):
def test_create_with_cpu_shares_for_low_api_version(self):
self.arg_for_low_api_version('cpu_shares', 512, '1.7')
def test_start_with_mapping_devices(self):
t = template_format.parse(template)
stack = utils.parse_stack(t)
definition = stack.t.resource_definitions(stack)['Blog']
definition['Properties']['devices'] = (
[{'path_on_host': '/dev/sda',
'path_in_container': '/dev/xvdc',
'permissions': 'r'},
{'path_on_host': '/dev/mapper/a_bc-d',
'path_in_container': '/dev/xvdd',
'permissions': 'rw'}])
my_resource = docker_container.DockerContainer(
'Blog', definition, stack)
get_client_mock = self.patchobject(my_resource, 'get_client')
get_client_mock.return_value = fakeclient.FakeDockerClient()
self.assertIsNone(my_resource.validate())
scheduler.TaskRunner(my_resource.create)()
self.assertEqual((my_resource.CREATE, my_resource.COMPLETE),
my_resource.state)
client = my_resource.get_client()
self.assertEqual(['samalba/wordpress'], client.pulled_images)
self.assertEqual(['/dev/sda:/dev/xvdc:r',
'/dev/mapper/a_bc-d:/dev/xvdd:rw'],
client.container_start[0]['devices'])
def test_start_with_mapping_devices_also_with_privileged(self):
t = template_format.parse(template)
stack = utils.parse_stack(t)
definition = stack.t.resource_definitions(stack)['Blog']
definition['Properties']['devices'] = (
[{'path_on_host': '/dev/sdb',
'path_in_container': '/dev/xvdc',
'permissions': 'r'}])
definition['Properties']['privileged'] = True
my_resource = docker_container.DockerContainer(
'Blog', definition, stack)
get_client_mock = self.patchobject(my_resource, 'get_client')
get_client_mock.return_value = fakeclient.FakeDockerClient()
self.assertIsNone(my_resource.validate())
scheduler.TaskRunner(my_resource.create)()
self.assertEqual((my_resource.CREATE, my_resource.COMPLETE),
my_resource.state)
client = my_resource.get_client()
self.assertEqual(['samalba/wordpress'], client.pulled_images)
self.assertNotIn('devices', client.container_start[0])
def test_start_with_mapping_devices_for_low_api_version(self):
value = ([{'path_on_host': '/dev/sda',
'path_in_container': '/dev/xvdc',
'permissions': 'rwm'}])
self.arg_for_low_api_version('devices', value, '1.13')
def test_start_with_mapping_devices_not_set_path_in_container(self):
t = template_format.parse(template)
stack = utils.parse_stack(t)
definition = stack.t.resource_definitions(stack)['Blog']
definition['Properties']['devices'] = (
[{'path_on_host': '/dev/sda',
'permissions': 'rwm'}])
my_resource = docker_container.DockerContainer(
'Blog', definition, stack)
get_client_mock = self.patchobject(my_resource, 'get_client')
get_client_mock.return_value = fakeclient.FakeDockerClient()
self.assertIsNone(my_resource.validate())
scheduler.TaskRunner(my_resource.create)()
self.assertEqual((my_resource.CREATE, my_resource.COMPLETE),
my_resource.state)
client = my_resource.get_client()
self.assertEqual(['samalba/wordpress'], client.pulled_images)
self.assertEqual(['/dev/sda:/dev/sda:rwm'],
client.container_start[0]['devices'])