Factor out setting of allowed devices so that we can update allowed devi...

[calfonso]

...ces

Co-Authored-By: Ian Main [email protected]
Docker-DCO-1.1-Signed-off-by: Chris Alfonso [email protected] (github: calfonso)

[vmarmol]

nit: createAndEnterCgroup()? Then call on the above function:

createAndEnterCgroup(...)
UpdateAllowedDevices(...)

[vmarmol]

LGTM

[vmarmol]

Overall this LGTM. This will be taken over by an Update() in the libcontainer API. For now we should be okay. Waiting on @crosbymichael to OK as well.

[calfonso]

Just to add some context of why we want to add a device at runtime...
Although this API is useful in general, it specifically gives us the ability to have OpenStack Nova APIs call the docker container hypervisor plugin to dynamically attach and detach a volume. In order for us to add the hypervisor plugin to OpenStack, the hypervisor plugin needs to implement certain features - including a runtime attaching/detaching of storage.

[vmarmol]

Ping @rjnagal @crosbymichael

[crosbymichael]

testing now

[timthelion]

This is also useful for subuser.org. While --device works fine for setting up sound and such, long running programs often need access to transient devices. For example, many people will launch skype when their computer starts but only plug in their web cams once they receive a call. This also raises the question: what happens when a device gets removed on the host and we have mknodded it within the container?

[calfonso]

Ping @rjnagal @crosbymichael

[crosbymichael]

This needs to support non systemd but it maybe better to wait on #143 so that you can easily get the existing cgroup paths for a container.

[calfonso]

@crosbymichael I think that the cgroup API implementation for non systemd should be part of a different patch and PR, this one is intended just to allow updating the devices on the already implemented systemd based managed cgroups impl. Thoughts?

[timthelion]

@calfonso is "UpdateAllowedDevices" systemd specific at all? It seems to me, that all it's doing is writting to the cgroups devices.allow file. The only difference in the implementation between systemd and fs should be the path.

[calfonso]

@timthelion Correct. There isn't anything specific to systemd in the update func, the only thing that is specific to systemd is the location of this implementation. I'm not completely sure about the details of the original implementation, I know the freezer subsystem isn't implemented at the kernel level to work on non-systems - not sure if that was the original impitus to split them out or not.

[calfonso]

I believe this is no longer needed now that joinDevices has been added upstream. We do need to capitalize the joinDevices method to make it accessable to docker though. Stay tuned fo that patch. Closing this PR.