Add support for devices

agent/exec/dockerapi/container.go

@@ -459,6 +459,15 @@ func (c *containerConfig) resources() enginecontainer.Resources {
 		}
 	}
 
+	resources.Devices = make([]enginecontainer.DeviceMapping, len(c.spec().Devices))
+	for i, device := range c.spec().Devices {
+		resources.Devices[i] = enginecontainer.DeviceMapping{
+			PathOnHost:        device.PathOnHost,
+			PathInContainer:   device.PathInContainer,
+			CgroupPermissions: device.CgroupPermissions,
+		}
+	}
+
 	// If no limits are specified let the engine use its defaults.
 	//
 	// TODO(aluzzardi): We might want to set some limits anyway otherwise

agent/exec/dockerapi/container_test.go

@@ -330,3 +330,35 @@ func TestUlimits(t *testing.T) {
 		t.Fatalf("expected %v, got %v", expected, actual)
 	}
 }
+
+func TestDevices(t *testing.T) {
+	c := containerConfig{
+		task: &api.Task{
+			Spec: api.TaskSpec{
+				Runtime: &api.TaskSpec_Container{
+					Container: &api.ContainerSpec{
+						Devices: []*api.ContainerSpec_DeviceMapping{
+							{
+								PathOnHost:        "/dev/dri/card0",
+								PathInContainer:   "/dev/card0",
+								CgroupPermissions: "ro",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	expected := []enginecontainer.DeviceMapping{
+		{
+			PathOnHost:        "/dev/dri/card0",
+			PathInContainer:   "/dev/card0",
+			CgroupPermissions: "ro",
+		},
+	}
+	actual := c.resources().Devices
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("expected %v, got %v", expected, actual)
+	}
+}

api/api.pb.txt

@@ -2735,8 +2735,8 @@ file {
         label: LABEL_OPTIONAL
         type: TYPE_UINT32
         options {
-          65001: 0
           65003: "os.FileMode"
+          65001: 0
         }
         json_name: "mode"
       }
@@ -2904,8 +2904,8 @@ file {
       type: TYPE_MESSAGE
       type_name: ".google.protobuf.Duration"
       options {
-        65001: 0
         65011: 1
+        65001: 0
       }
       json_name: "delay"
     }
@@ -3348,8 +3348,8 @@ file {
         }
       }
       options {
-        62001: 0
         62023: "PublishMode"
+        62001: 0
       }
     }
   }
@@ -4055,8 +4055,8 @@ file {
       label: LABEL_OPTIONAL
       type: TYPE_UINT32
       options {
-        65001: 0
         65003: "os.FileMode"
+        65001: 0
       }
       json_name: "mode"
     }
@@ -5052,8 +5052,8 @@ file {
       }
     }
     options {
-      62001: 0
       62023: "NodeRole"
+      62001: 0
     }
   }
   syntax: "proto3"
@@ -5677,6 +5677,14 @@ file {
       type_name: ".docker.swarmkit.v1.ContainerSpec.Ulimit"
       json_name: "ulimits"
     }
+    field {
+      name: "Devices"
+      number: 30
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".docker.swarmkit.v1.ContainerSpec.DeviceMapping"
+      json_name: "Devices"
+    }
     nested_type {
       name: "LabelsEntry"
       field {
@@ -5775,6 +5783,30 @@ file {
         json_name: "hard"
       }
     }
+    nested_type {
+      name: "DeviceMapping"
+      field {
+        name: "pathOnHost"
+        number: 1
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "pathOnHost"
+      }
+      field {
+        name: "pathInContainer"
+        number: 2
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "pathInContainer"
+      }
+      field {
+        name: "cgroupPermissions"
+        number: 3
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "cgroupPermissions"
+      }
+    }
     enum_type {
       name: "Isolation"
       value {
@@ -9739,8 +9771,8 @@ file {
       type: TYPE_MESSAGE
       type_name: ".google.protobuf.Duration"
       options {
-        65001: 0
         65011: 1
+        65001: 0
       }
       json_name: "period"
     }
@@ -10958,14 +10990,14 @@ file {
     }
   }
   options {
-    63001: 0
-    63002: 0
     63017: 1
-    63018: 1
     63020: 1
+    63018: 1
+    63001: 0
+    63002: 0
+    63035: 0
     63026: 0
     63034: 0
-    63035: 0
   }
 }
 file {

api/specs.proto

@@ -370,6 +370,14 @@ message ContainerSpec {
 	// Ulimits defines the list of ulimits to set in the container. This option
 	// is equivalent to passing --ulimit to docker run.
 	repeated Ulimit ulimits = 29;
+
+	message DeviceMapping {
+		string pathOnHost = 1;
+		string pathInContainer = 2;
+		string cgroupPermissions = 3;
+	}
+
+	repeated DeviceMapping Devices = 30;
 }
 
 // EndpointSpec defines the properties that can be configured to

cmd/swarmctl/service/flagparser/device.go

@@ -0,0 +1,49 @@
+package flagparser
+
+import (
+	"strings"
+
+	"github.com/moby/swarmkit/v2/api"
+	"github.com/pkg/errors"
+	"github.com/spf13/pflag"
+)
+
+func parseDevice(flags *pflag.FlagSet, spec *api.ServiceSpec) error {
+	if flags.Changed("device") {
+		container := spec.Task.GetContainer()
+		if container == nil {
+			return nil
+		}
+
+		devices, err := flags.GetStringSlice("device")
+		if err != nil {
+			return err
+		}
+
+		container.Devices = make([]*api.ContainerSpec_DeviceMapping, len(devices))
+
+		for i, device := range devices {
+			parts := strings.Split(device, ":")
+			if len(parts) < 1 || len(parts) > 3 {
+				return errors.Wrap(err, "failed to parse device")
+			}
+
+			mapping := &api.ContainerSpec_DeviceMapping{
+				PathOnHost:      parts[0],
+				PathInContainer: parts[0],
+			}
+
+			if len(parts) > 1 {
+				mapping.PathInContainer = parts[1]
+			}
+
+			if len(parts) == 3 {
+				mapping.CgroupPermissions = parts[2]
+			}
+
+			container.Devices[i] = mapping
+		}
+	}
+
+	return nil
+}

cmd/swarmctl/service/flagparser/flags.go

@@ -58,6 +58,7 @@ func AddServiceFlags(flags *pflag.FlagSet) {
 	flags.StringSlice("volume", nil, "define a volume mount")
 	flags.StringSlice("tmpfs", nil, "define a tmpfs mount")
 	flags.StringSlice("npipe", nil, "define a npipe mount")
+	flags.StringSlice("device", nil, "device options")
 
 	flags.String("log-driver", "", "specify a log driver")
 	flags.StringSlice("log-opt", nil, "log driver options, as key value pairs")
@@ -150,6 +151,10 @@ func Merge(cmd *cobra.Command, spec *api.ServiceSpec, c api.ControlClient) error
 		return err
 	}
 
+	if err := parseDevice(flags, spec); err != nil {
+		return err
+	}
+
 	driver, err := common.ParseLogDriverFlags(flags)
 	if err != nil {
 		return err