Skip to content

Commit 3b63cac

Browse files
AkihiroSudaAkihiroSuda
authored
Merge pull request #184 from jsturtevant/windows-part1
Windows part 1
2 parents 177d7fc + ffd9d45 commit 3b63cac

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1164
-417
lines changed

‎Makefile

+9-3
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,10 @@
1919
# -----------------------------------------------------------------------------
2020

2121
GO ?= go
22-
22+
GOOS ?= $(shell go env GOOS)
23+
ifeq ($(GOOS),windows)
24+
BIN_EXT := .exe
25+
endif
2326

2427
PACKAGE := github.com/containerd/nerdctl
2528
BINDIR ?= /usr/local/bin
@@ -28,7 +31,7 @@ VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
2831
VERSION_TRIMMED := $(VERSION:v%=%)
2932
REVISION=$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
3033

31-
export GO_BUILD=GO111MODULE=on CGO_ENABLED=0 $(GO) build -ldflags "-s -w -X $(PACKAGE)/pkg/version.Version=$(VERSION) -X $(PACKAGE)/pkg/version.Revision=$(REVISION)"
34+
export GO_BUILD=GO111MODULE=on CGO_ENABLED=0 GOOS=$(GOOS) $(GO) build -ldflags "-s -w -X $(PACKAGE)/pkg/version.Version=$(VERSION) -X $(PACKAGE)/pkg/version.Revision=$(REVISION)"
3235

3336
all: binaries
3437

@@ -40,7 +43,7 @@ help:
4043
@echo " * 'clean' - Clean artifacts."
4144

4245
nerdctl:
43-
$(GO_BUILD) -o $(CURDIR)/_output/nerdctl $(PACKAGE)
46+
$(GO_BUILD) -o $(CURDIR)/_output/nerdctl$(BIN_EXT) $(PACKAGE)
4447

4548
clean:
4649
find . -name \*~ -delete
@@ -72,6 +75,9 @@ artifacts: clean
7275
GOOS=linux GOARCH=s390x make -C $(CURDIR) binaries
7376
tar $(TAR_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-linux-s390x.tar.gz _output/nerdctl extras/rootless/*
7477

78+
GOOS=windows GOARCH=amd64 make -C $(CURDIR) binaries
79+
tar $(TAR_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-windows-amd64.tar.gz _output/nerdctl
80+
7581
rm -f $(CURDIR)/_output/nerdctl
7682

7783
DOCKER_BUILDKIT=1 docker build --output type=tar,dest=$(CURDIR)/_output/nerdctl-full-$(VERSION_TRIMMED)-linux-amd64.tar --target out-full $(CURDIR)

‎client.go

+7-12
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,15 @@ import (
2020
"context"
2121
"os"
2222
"path/filepath"
23+
"runtime"
2324
"strings"
2425

26+
"github.com/pkg/errors"
27+
2528
"github.com/containerd/containerd"
2629
"github.com/containerd/containerd/namespaces"
2730
"github.com/opencontainers/go-digest"
28-
"github.com/pkg/errors"
2931
"github.com/urfave/cli/v2"
30-
"golang.org/x/sys/unix"
3132
)
3233

3334
func newClient(clicontext *cli.Context) (*containerd.Client, context.Context, context.CancelFunc, error) {
@@ -54,15 +55,6 @@ func newClient(clicontext *cli.Context) (*containerd.Client, context.Context, co
5455
return client, ctx, cancel, nil
5556
}
5657

57-
func isSocketAccessible(s string) error {
58-
abs, err := filepath.Abs(s)
59-
if err != nil {
60-
return err
61-
}
62-
// set AT_EACCESS to allow running nerdctl as a setuid binary
63-
return unix.Faccessat(-1, abs, unix.R_OK|unix.W_OK, unix.AT_EACCESS)
64-
}
65-
6658
// getDataStore returns a string like "/var/lib/nerdctl/1935db59".
6759
// "1935db9" is from `$(echo -n "/run/containerd/containerd.sock" | sha256sum | cut -c1-8)``
6860
func getDataStore(clicontext *cli.Context) (string, error) {
@@ -84,7 +76,10 @@ func getDataStore(clicontext *cli.Context) (string, error) {
8476
func getAddrHash(addr string) (string, error) {
8577
const addrHashLen = 8
8678

87-
addr = strings.TrimPrefix(addr, "unix://")
79+
if runtime.GOOS != "windows" {
80+
addr = strings.TrimPrefix(addr, "unix://")
81+
}
82+
8883
var err error
8984
addr, err = filepath.EvalSymlinks(addr)
9085
if err != nil {

‎client_linux.go

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"path/filepath"
21+
22+
"golang.org/x/sys/unix"
23+
)
24+
25+
func isSocketAccessible(s string) error {
26+
abs, err := filepath.Abs(s)
27+
if err != nil {
28+
return err
29+
}
30+
// set AT_EACCESS to allow running nerdctl as a setuid binary
31+
return unix.Faccessat(-1, abs, unix.R_OK|unix.W_OK, unix.AT_EACCESS)
32+
}

‎client_windows.go

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"time"
21+
22+
"github.com/Microsoft/go-winio"
23+
)
24+
25+
func isSocketAccessible(s string) error {
26+
// test if we can access the pipe
27+
timeout := 2 * time.Second
28+
_, err := winio.DialPipe(s, &timeout)
29+
return err
30+
}

‎exec.go

+1-13
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import (
2626
"github.com/containerd/containerd/cio"
2727
"github.com/containerd/containerd/cmd/ctr/commands"
2828
"github.com/containerd/containerd/cmd/ctr/commands/tasks"
29-
"github.com/containerd/containerd/pkg/cap"
3029
"github.com/containerd/nerdctl/pkg/idgen"
3130
"github.com/containerd/nerdctl/pkg/idutil/containerwalker"
3231
"github.com/containerd/nerdctl/pkg/strutil"
@@ -224,21 +223,10 @@ func generateExecProcessSpec(ctx context.Context, clicontext *cli.Context, conta
224223
}
225224

226225
if clicontext.Bool("privileged") {
227-
if pspec.Capabilities == nil {
228-
pspec.Capabilities = &specs.LinuxCapabilities{}
229-
}
230-
allCaps, err := cap.Current()
226+
err = setExecCapabilities(pspec)
231227
if err != nil {
232228
return nil, err
233229
}
234-
pspec.Capabilities.Bounding = allCaps
235-
pspec.Capabilities.Permitted = pspec.Capabilities.Bounding
236-
pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding
237-
pspec.Capabilities.Effective = pspec.Capabilities.Bounding
238-
239-
// https://github.com/moby/moby/pull/36466/files
240-
// > `docker exec --privileged` does not currently disable AppArmor
241-
// > profiles. Privileged configuration of the container is inherited
242230
}
243231

244232
return pspec, nil

‎exec_linux.go

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"github.com/containerd/containerd/pkg/cap"
21+
"github.com/opencontainers/runtime-spec/specs-go"
22+
)
23+
24+
func setExecCapabilities(pspec *specs.Process) error {
25+
if pspec.Capabilities == nil {
26+
pspec.Capabilities = &specs.LinuxCapabilities{}
27+
}
28+
allCaps, err := cap.Current()
29+
if err != nil {
30+
return err
31+
}
32+
pspec.Capabilities.Bounding = allCaps
33+
pspec.Capabilities.Permitted = pspec.Capabilities.Bounding
34+
pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding
35+
pspec.Capabilities.Effective = pspec.Capabilities.Bounding
36+
37+
// https://github.com/moby/moby/pull/36466/files
38+
// > `docker exec --privileged` does not currently disable AppArmor
39+
// > profiles. Privileged configuration of the container is inherited
40+
return nil
41+
}

‎exec_windows.go

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"github.com/opencontainers/runtime-spec/specs-go"
21+
)
22+
23+
func setExecCapabilities(pspec *specs.Process) error {
24+
//no op windows
25+
return nil
26+
}

‎go.mod

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module github.com/containerd/nerdctl
33
go 1.16
44

55
require (
6+
github.com/Microsoft/go-winio v0.4.17
67
github.com/compose-spec/compose-go v0.0.0-20210420125800-01e9e6b4c64c
78
github.com/containerd/cgroups v1.0.0
89
github.com/containerd/console v1.0.2

‎login.go

+3-17
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,8 @@ import (
2020
"context"
2121
"fmt"
2222
"io/ioutil"
23-
"os"
2423
"runtime"
2524
"strings"
26-
"syscall"
2725

2826
"github.com/containerd/nerdctl/pkg/version"
2927
dockercliconfig "github.com/docker/cli/cli/config"
@@ -35,7 +33,6 @@ import (
3533
"github.com/pkg/errors"
3634
"github.com/sirupsen/logrus"
3735
"github.com/urfave/cli/v2"
38-
"golang.org/x/term"
3936
)
4037

4138
type loginOptions struct {
@@ -210,22 +207,11 @@ func ConfigureAuthentification(clicontext *cli.Context, authConfig *types.AuthCo
210207
if options.password == "" {
211208

212209
fmt.Print("Enter Password: ")
213-
var fd int
214-
if term.IsTerminal(syscall.Stdin) {
215-
fd = syscall.Stdin
216-
} else {
217-
tty, err := os.Open("/dev/tty")
218-
if err != nil {
219-
return errors.Wrap(err, "error allocating terminal")
220-
}
221-
defer tty.Close()
222-
fd = int(tty.Fd())
223-
}
224-
bytePassword, err := term.ReadPassword(fd)
210+
pwd, err := readPassword()
225211
if err != nil {
226-
return errors.Wrap(err, "error reading password")
212+
return err
227213
}
228-
options.password = string(bytePassword)
214+
options.password = pwd
229215
}
230216

231217
if options.password == "" {

‎login_linux.go

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"os"
21+
"syscall"
22+
23+
"github.com/pkg/errors"
24+
"golang.org/x/term"
25+
)
26+
27+
func readPassword() (string, error) {
28+
var fd int
29+
if term.IsTerminal(syscall.Stdin) {
30+
fd = syscall.Stdin
31+
} else {
32+
tty, err := os.Open("/dev/tty")
33+
if err != nil {
34+
return "", errors.Wrap(err, "error allocating terminal")
35+
}
36+
defer tty.Close()
37+
fd = int(tty.Fd())
38+
}
39+
bytePassword, err := term.ReadPassword(fd)
40+
if err != nil {
41+
return "", errors.Wrap(err, "error reading password")
42+
}
43+
44+
return string(bytePassword), nil
45+
}

‎login_windows.go

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"fmt"
21+
"syscall"
22+
23+
"github.com/pkg/errors"
24+
"golang.org/x/term"
25+
)
26+
27+
func readPassword() (string, error) {
28+
var fd int
29+
if term.IsTerminal(int(syscall.Stdin)) {
30+
fd = int(syscall.Stdin)
31+
} else {
32+
return "", fmt.Errorf("error allocating terminal")
33+
}
34+
bytePassword, err := term.ReadPassword(fd)
35+
if err != nil {
36+
return "", errors.Wrap(err, "error reading password")
37+
}
38+
39+
return string(bytePassword), nil
40+
}

0 commit comments

Comments
 (0)