mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
f22ce921cd
Adjusts Docker capabilities per OS, and checks for runtime on Windows. --------- Co-authored-by: Tim Gross <tgross@hashicorp.com>
34 lines
1.1 KiB
Go
34 lines
1.1 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build windows
|
|
|
|
package docker
|
|
|
|
import (
|
|
"errors"
|
|
|
|
docker "github.com/fsouza/go-dockerclient"
|
|
)
|
|
|
|
// Currently Windows containers don't support host ip in port binding.
|
|
func getPortBinding(ip string, port string) docker.PortBinding {
|
|
return docker.PortBinding{HostIP: "", HostPort: port}
|
|
}
|
|
|
|
var containerAdminErrMsg = "running container as ContainerAdmin is unsafe; change the container user, set task configuration to privileged or enable windows_allow_insecure_container_admin to disable this check"
|
|
|
|
func validateImageUser(user, taskUser string, taskDriverConfig *TaskConfig, driverConfig *DriverConfig) error {
|
|
// we're only interested in the case where isolation is set to "process"
|
|
// (it's also the default) and when windows_allow_insecure_container_admin
|
|
// is explicitly set to true in the config
|
|
if driverConfig.WindowsAllowInsecureContainerAdmin || taskDriverConfig.Isolation == "hyper-v" {
|
|
return nil
|
|
}
|
|
|
|
if user == "ContainerAdmin" && (taskUser == "ContainerAdmin" || taskUser == "") && !taskDriverConfig.Privileged {
|
|
return errors.New(containerAdminErrMsg)
|
|
}
|
|
return nil
|
|
}
|