mirror of
https://github.com/moby/moby.git
synced 2026-08-09 01:21:37 +00:00
a8a1cfd111
Run containerd inside dockerd when the experimental `embedded-containerd` feature is enabled through `--feature` or the daemon configuration. Serve containerd's gRPC API on a Unix socket, or a named pipe on Windows, for the plugin executor and external tools. Use an in-memory listener for dockerd's own containerd client. Serve TTRPC on a platform endpoint so task shims can publish events. Register only the containerd plugins dockerd needs. Leave CRI, sandbox, streaming, transfer, NRI, and the restart monitor out of the embedded server. Reject `--cri-containerd` when embedded mode is enabled instead of silently ignoring the requested CRI support. Check the feature before `ContainerdAddr` so it can override the default containerd socket supplied by packaged service units. Continue to use the configured external containerd when the feature is disabled. Derive the Windows named-pipe address from the daemon state directory so multiple daemons can run on the same host. Restrict the pipes to the built-in Administrators group and LocalSystem with the same protected DACL as dockerd's API pipe, as the default security descriptor depends on the process token and can expose the containerd endpoints more broadly than intended. Treat embedded mode as a containerd runtime in the Windows test environment. Add the `no_embedded_containerd` build tag so distributors can omit the embedded plugin graph and its dependencies. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
70 lines
2.2 KiB
Go
70 lines
2.2 KiB
Go
//go:build windows
|
|
|
|
// Code generated by 'go generate' using "github.com/Microsoft/go-winio/tools/mkwinsyscall"; DO NOT EDIT.
|
|
|
|
package security
|
|
|
|
import (
|
|
"syscall"
|
|
"unsafe"
|
|
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
var _ unsafe.Pointer
|
|
|
|
// Do the interface allocations only once for common
|
|
// Errno values.
|
|
const (
|
|
errnoERROR_IO_PENDING = 997
|
|
)
|
|
|
|
var (
|
|
errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
|
|
errERROR_EINVAL error = syscall.EINVAL
|
|
)
|
|
|
|
// errnoErr returns common boxed Errno values, to prevent
|
|
// allocations at runtime.
|
|
func errnoErr(e syscall.Errno) error {
|
|
switch e {
|
|
case 0:
|
|
return errERROR_EINVAL
|
|
case errnoERROR_IO_PENDING:
|
|
return errERROR_IO_PENDING
|
|
}
|
|
return e
|
|
}
|
|
|
|
var (
|
|
modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
|
|
|
|
procGetSecurityInfo = modadvapi32.NewProc("GetSecurityInfo")
|
|
procSetEntriesInAclW = modadvapi32.NewProc("SetEntriesInAclW")
|
|
procSetSecurityInfo = modadvapi32.NewProc("SetSecurityInfo")
|
|
)
|
|
|
|
func getSecurityInfo(handle windows.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) {
|
|
r0, _, _ := syscall.SyscallN(procGetSecurityInfo.Addr(), uintptr(handle), uintptr(objectType), uintptr(si), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)))
|
|
if r0 != 0 {
|
|
win32err = syscall.Errno(r0)
|
|
}
|
|
return
|
|
}
|
|
|
|
func setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (win32err error) {
|
|
r0, _, _ := syscall.SyscallN(procSetEntriesInAclW.Addr(), uintptr(count), uintptr(pListOfEEs), uintptr(oldAcl), uintptr(unsafe.Pointer(newAcl)))
|
|
if r0 != 0 {
|
|
win32err = syscall.Errno(r0)
|
|
}
|
|
return
|
|
}
|
|
|
|
func setSecurityInfo(handle windows.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) {
|
|
r0, _, _ := syscall.SyscallN(procSetSecurityInfo.Addr(), uintptr(handle), uintptr(objectType), uintptr(si), uintptr(psidOwner), uintptr(psidGroup), uintptr(pDacl), uintptr(pSacl))
|
|
if r0 != 0 {
|
|
win32err = syscall.Errno(r0)
|
|
}
|
|
return
|
|
}
|