runc spec command源码分析

runc是OCI的参考实现，当运行runc spec时会产生config.json.

这篇分析其源码如何实现的，在注释里说明代码逻辑。

runc的命令行框架使用的urfave-cli , 用法非常简单。

基础知识

1. 容器组成

OCI将镜像定义为一个bundle, bundle由config.json和rootfs文件系统组成。

config.json定义了容器配置; rootfs是类似linux /路径下的文件结构，包含/proc,/var之类的。

2. runc spec命令

// 在当前目录下生成容器配置文件config.json
runc spec
// 在指定路径下生成config.json
runc spec --bundle /path/to/bundle
// rootless容器，即在非root权限下运行的容器
runc spec --rootless

code

var specCommand = cli.Command{
   Name:      "spec",    // runc子命令spec，用法runc spec
   Usage:     "create a new specification file",  
   ArgsUsage: "",
   Description: `The spec command creates the new specification file named "` + specConfig + `" for
the bundle.

The spec generated is just a starter file. Editing of the spec is required to
achieve desired results. For example, the newly generated spec includes an args
parameter that is initially set to call the "sh" command when the container is
started. Calling "sh" may work for an ubuntu container or busybox, but will not
work for containers that do not include the "sh" program.

EXAMPLE:
  To run docker's hello-world container one needs to set the args parameter
in the spec to call hello. This can be done using the sed command or a text
editor. The following commands create a bundle for hello-world, change the
default args parameter in the spec from "sh" to "/hello", then run the hello
command in a new hello-world container named container1:

    mkdir hello
    cd hello
    docker pull hello-world
    docker export $(docker create hello-world) > hello-world.tar
    mkdir rootfs
    tar -C rootfs -xf hello-world.tar
    runc spec
    sed -i 's;"sh";"/hello";' ` + specConfig + `
    runc run container1

In the run command above, "container1" is the name for the instance of the
container that you are starting. The name you provide for the container instance
must be unique on your host.

An alternative for generating a customized spec config is to use "oci-runtime-tool", the
sub-command "oci-runtime-tool generate" has lots of options that can be used to do any
customizations as you want, see runtime-tools (https://github.com/opencontainers/runtime-tools)
to get more information.

When starting a container through runc, runc needs root privilege. If not
already running as root, you can use sudo to give runc root privilege. For
example: "sudo runc start container1" will give runc root privilege to start the
container on your host.

Alternatively, you can start a rootless container, which has the ability to run
without root privileges. For this to work, the specification file needs to be
adjusted accordingly. You can pass the parameter --rootless to this command to
generate a proper rootless spec file.

Note that --rootless is not needed when you execute runc as the root in a user namespace
created by an unprivileged user.
`,
   Flags: []cli.Flag{
      // runc spec的参数列表
      cli.StringFlag{
         Name:  "bundle, b",  // runc spec -b 或者runc spec --bundle指定config.json的生成位置
         Value: "",
         Usage: "path to the root of the bundle directory",
      },
      cli.BoolFlag{
         Name:  "rootless",  // runc spec --root-less指定生成rootless容器
         Usage: "generate a configuration for a rootless container",
      },
   },
   Action: func(context *cli.Context) error {
      // context包含命令行解析参数的上下文
      if err := checkArgs(context, 0, exactArgs); err != nil {
         return err
      }
      // config.json是一个结构体对象specs.Spec，这个方法可以获取带有默认值的结构体对象。
      spec := specconv.Example()

      // 参数--rootless是否指定，即是否命令是 runc spec --rootless
      rootless := context.Bool("rootless")
      if rootless {
         // 将容器设置为rootless模式
         specconv.ToRootless(spec)
      }
      // 函数类型变量，检查config.json不存在，存在则报错
      checkNoFile := func(name string) error {
         _, err := os.Stat(name)
         if err == nil {
            return fmt.Errorf("File %s exists. Remove it first", name)
         }
         if !os.IsNotExist(err) {
            return err
         }
         return nil
      }
      // 获取bundle参数的值
      bundle := context.String("bundle")
      if bundle != "" {
         // 如果bundle路径不存在则报错
         if err := os.Chdir(bundle); err != nil {
            return err
         }
      }
      // 检测config.json不存在
      if err := checkNoFile(specConfig); err != nil {
         return err
      }
      // 将结构体编码为json字节数组
      data, err := json.MarshalIndent(spec, "", "\t")
      if err != nil {
         return err
      }
      // 将json字节数组写入config.json
      return os.WriteFile(specConfig, data, 0o666)
   },
}