Merge pull request #222 from laijs/event-hanghup

change policy for event hangup

.gitignore

@@ -7,6 +7,8 @@
 .#*
 .git
 .deps
+TAGS
+tags
 init
 build/hyper_daemon
 build/hyper-initrd.img
@@ -14,6 +16,7 @@ build/cbfs.rom
 build/root/*
 build/*iso
 build/daemon
+build/kernel_config.old
 build/.*
 src/.*
 Makefile

.travis.yml

@@ -0,0 +1,24 @@
+sudo: required
+dist: trusty
+
+language: c
+
+matrix:
+  include:
+    - go: 1.7
+
+before_install:
+  - sudo apt-get update -qq
+  - sudo apt-get install -y autoconf automake pkg-config libdevmapper-dev libsqlite3-dev libvirt-dev qemu libvirt-bin -qq
+  - cd `mktemp -d`
+  - wget https://git.fedorahosted.org/cgit/lvm2.git/snapshot/lvm2-2_02_131.tar.xz
+  - tar xf lvm2-2_02_131.tar.xz
+  - cd lvm2-2_02_131
+  - ./configure && make device-mapper && sudo make install
+
+script:
+  - cd ${TRAVIS_BUILD_DIR}
+  - ./autogen.sh
+  - ./configure
+  - make
+  - hack/test-cmd.sh

Makefile.am

@@ -4,3 +4,5 @@ initrd-local:
 	@echo finish make initrd
 cbfs-local:
 	@echo finish make cbfs
+kernel-local:
+	@echo finish make kernel

README.md

@@ -1,6 +1,6 @@
-# The init Task for Hyper
+# The init Task for HyperContainer
 
-You can get the binary installer of Hyper and HyperStart through [The Hyper Page](https://github.com/hyperhq/hyper)
+You can get the binary installer of HyperContainer and HyperStart through [The Hyper Page](https://github.com/hyperhq/hyperd)
 
 ## Build from source 
 
@@ -12,6 +12,11 @@ clone this repo, and make sure you have build-essentials installed. Go into the
 
 Then you can find `hyper-initrd.img` in the build directory, together with a pre-built kernel.
 
+If you want to run hyperstart with 64-bit ARM architecture, please reconfigure with flag --with-aarch64,
+
+    > ./configure --with-aarch64
+    > make
+
 If you want to get the boot disk file for VirtualBox, please reconfigure with flag --with-vbox,
 
     > ./configure --with-vbox

autogen.sh

@@ -8,34 +8,34 @@ DIE=0
 
 test -f src/init.c || {
 	echo
-	echo "You must run this script in the top-level hyperint drectory."
+	echo "You must run this script in the top-level hyperstart drectory."
 	echo
 	DIE=1
 }
 
 (autoconf --version) < /dev/null > /dev/null 2>&1 || {
 	echo
-	echo "You must have autoconf installed to generate the hyperinit."
+	echo "You must have autoconf installed to generate the hyperstart."
 	echo
 	DIE=1
 }
 
 (autoheader --version) < /dev/null > /dev/null 2>&1 || {
 	echo
-	echo "You must have autoheader installed to generate the hypernit."
+	echo "You must have autoheader installed to generate the hyperstart."
 	echo
 	DIE=1
 }
 
 (automake --version) < /dev/null > /dev/null 2>&1 || {
 	echo
-	echo "You must have automake installed to generate the hypernit."
+	echo "You must have automake installed to generate the hyperstart."
 	echo
 	DIE=1
 }
 (autoreconf --version) < /dev/null > /dev/null 2>&1 || {
 	echo
-	echo "You must have autoreconf installed to generate the hypernit."
+	echo "You must have autoreconf installed to generate the hyperstart."
 	echo
 	DIE=1
 }

build/Dockerfile

@@ -0,0 +1,29 @@
+FROM centos:7
+MAINTAINER Hyper Developers <dev@hyper.sh>
+
+RUN yum install -y patch gcc ncurses-devel make openssl-devel bc
+
+ENV KERNEL_VERSION 4.4.12
+ENV LOCALVERSION -hyper
+ENV KERNEL_RELEASE ${KERNEL_VERSION}${LOCALVERSION}
+
+ENV KBUILD_BUILD_USER    dev
+ENV KBUILD_BUILD_HOST    hyper.sh
+ENV KBUILD_BUILD_VERSION 1
+
+RUN mkdir /root/build/ && mkdir /root/build/result/
+RUN curl -fSL https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VERSION}.tar.gz | tar -zx -C /root/build
+
+COPY kernel_config /root/build/linux-${KERNEL_VERSION}/.config
+COPY kernel_patch/ /root/build/kernel_patch/
+
+RUN cd /root/build/linux-${KERNEL_VERSION}/ && for patch in /root/build/kernel_patch/*.patch; do patch -p1 <$patch || exit 1; done
+RUN cd /root/build/linux-${KERNEL_VERSION}/ && make silentoldconfig && make -j 8
+
+# install to /root/build/result/ so that we can get them from it
+RUN cp /root/build/linux-${KERNEL_VERSION}/arch/x86_64/boot/bzImage /root/build/result/kernel
+RUN mkdir /root/build/result/modules &&\
+    cd /root/build/linux-${KERNEL_VERSION}/ && make modules_install INSTALL_MOD_PATH="/root/build/result/modules" &&\
+    cd /root/build/result/modules/lib/modules/ && rm -f ${KERNEL_RELEASE}/{build,source} &&\
+    tar -cf /root/build/result/modules.tar ${KERNEL_RELEASE}/ && rm -rf /root/build/result/modules
+RUN cp /root/build/linux-${KERNEL_VERSION}/.config /root/build/result/kernel_config

build/Makefile.am

@@ -4,9 +4,21 @@ if WITH_VBOX
 initrd-local:
 	bash ./make-initrd.sh vbox
 else
+if WITH_AARCH64
+initrd-local:
+	bash ./make-initrd.sh aarch64
+else
 initrd-local:
 	bash ./make-initrd.sh
 endif
+endif
 
 cbfs-local:
 	bash ./make-initrd.sh cbfs
+
+kernel-local:
+	hyperctl build -t hyperstart-dev:latest .
+	hyperctl run --rm hyperstart-dev:latest cat /root/build/result/kernel >kernel.new && mv -f kernel.new kernel
+	hyperctl run --rm hyperstart-dev:latest cat /root/build/result/modules.tar >modules.tar
+	mv kernel_config kernel_config.old
+	hyperctl run --rm hyperstart-dev:latest cat /root/build/result/kernel_config >kernel_config

build/kernel_patch/0001-HACK-9P-always-use-cached-inode-to-fill-in-v9fs_vfs_.patch

@@ -0,0 +1,43 @@
+From 084b4a5aa4b90975f7ac6b4714a6b449430ef4c4 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Wed, 4 May 2016 12:01:22 +0800
+Subject: [PATCH] HACK: 9P: always use cached inode to fill in v9fs_vfs_getattr
+
+So that if in cache=none mode, we don't have to lookup server that
+might not support open-unlink-fstat operation.
+
+Signed-off-by: Peng Tao <bergwolf@gmail.com>
+---
+ fs/9p/vfs_inode.c      | 2 +-
+ fs/9p/vfs_inode_dotl.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 5110785..43ebb31 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -1059,7 +1059,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ 
+ 	p9_debug(P9_DEBUG_VFS, "dentry: %p\n", dentry);
+ 	v9ses = v9fs_dentry2v9ses(dentry);
+-	if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) {
++	if (!d_really_is_negative(dentry) || v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) {
+ 		generic_fillattr(d_inode(dentry), stat);
+ 		return 0;
+ 	}
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index cb899af..b1e4205 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -479,7 +479,7 @@ v9fs_vfs_getattr_dotl(struct vfsmount *mnt, struct dentry *dentry,
+ 
+ 	p9_debug(P9_DEBUG_VFS, "dentry: %p\n", dentry);
+ 	v9ses = v9fs_dentry2v9ses(dentry);
+-	if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) {
++	if (!d_really_is_negative(dentry) || v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) {
+ 		generic_fillattr(d_inode(dentry), stat);
+ 		return 0;
+ 	}
+-- 
+2.5.0
+

build/kernel_version

@@ -1,2 +0,0 @@
-# v4.4
-afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc

build/make-initrd.sh

@@ -1,18 +1,50 @@
 #!/bin/bash
 
-rm -rf root
+rm -rf /tmp/hyperstart-rootfs
-mkdir root
+mkdir -p /tmp/hyperstart-rootfs/lib \
+	  /tmp/hyperstart-rootfs/lib64 \
+	  /tmp/hyperstart-rootfs/lib/modules
 
-cp ../src/init ./root
+mkdir -m 0755 -p /tmp/hyperstart-rootfs/dev \
+	  /tmp/hyperstart-rootfs/sys \
+	  /tmp/hyperstart-rootfs/sbin \
+	  /tmp/hyperstart-rootfs/bin \
+	  /tmp/hyperstart-rootfs/proc
 
-ldd ./root/init | while read line
+cp ../src/init /tmp/hyperstart-rootfs
+cp busybox /tmp/hyperstart-rootfs
+cp iptables /tmp/hyperstart-rootfs
+cp libm.so.6 /tmp/hyperstart-rootfs/lib64/
+
+if [ "$1"x = "aarch64"x ]; then
+	echo "build hyperstart for aarch64"
+	tar -xf modules_aarch64.tar -C /tmp/hyperstart-rootfs/lib/modules
+else
+	tar -xf modules.tar -C /tmp/hyperstart-rootfs/lib/modules
+fi
+
+# create symlinks to busybox and iptables
+BUSYBOX_BINARIES=(/bin/sh /bin/tar /bin/hwclock /sbin/modprobe /sbin/depmod)
+for bin in ${BUSYBOX_BINARIES[@]}
+do
+	mkdir -p /tmp/hyperstart-rootfs/`dirname ${bin}`
+	ln -sf /busybox /tmp/hyperstart-rootfs/${bin}
+done
+IPTABLES_BINARIES=(/sbin/iptables /sbin/iptables-restore /sbin/iptables-save)
+for bin in ${IPTABLES_BINARIES[@]}
+do
+	mkdir -p /tmp/hyperstart-rootfs/`dirname ${bin}`
+	ln -sf /iptables /tmp/hyperstart-rootfs/${bin}
+done
+
+ldd /tmp/hyperstart-rootfs/init | while read line
 do
 	arr=(${line// / })
 
 	for lib in ${arr[@]}
 	do
 		if [ "${lib:0:1}" = "/" ]; then
-			dir=root`dirname $lib`
+			dir=/tmp/hyperstart-rootfs`dirname $lib`
 			mkdir -p "${dir}"
 			cp -f $lib $dir
 		fi
@@ -21,13 +53,12 @@ done
 
 if [ "$1"x = "vbox"x ]; then
 	echo "build initrd for vbox"
-	cp ./vbox/driver/* ./root
+	cp ./vbox/driver/* /tmp/hyperstart-rootfs
 fi
 
-cd ./root && find . | cpio -H newc -o | gzip -9 > ../hyper-initrd.img
+( cd /tmp/hyperstart-rootfs && find . | cpio -H newc -o | gzip -9 ) > ./hyper-initrd.img
 
-cd ../
+rm -rf /tmp/hyperstart-rootfs
-rm -rf ./root
 
 if [ "$1"x = "cbfs"x ]; then
 	echo "build cbfs"

configure.ac

@@ -2,9 +2,9 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.69])
-AC_INIT([hyperstart], [0.5.0], [www.hyper.sh])
+AC_INIT([hyperstart], [0.6.2], [www.hyper.sh])
 AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects])
-AM_EXTRA_RECURSIVE_TARGETS([initrd cbfs])
+AM_EXTRA_RECURSIVE_TARGETS([initrd cbfs kernel])
 AC_CONFIG_SRCDIR([src/init.c])
 AC_CONFIG_HEADERS([config.h])
 
@@ -38,6 +38,17 @@ if test "$fail" = "1" ; then
     AC_MSG_ERROR(Unable to find necessary functions)
 fi
 
+AC_ARG_WITH([aarch64],
+            [AS_HELP_STRING([--with-aarch64],
+                            [run hyperstart with 64-bit ARM architecture])],
+            [],[with_aarch64=no])
+
+if test "x$with_aarch64" != "xno" ; then
+    AC_DEFINE_UNQUOTED([WITH_AARCH64], 1, [run hyperstart with 64-bit ARM architecture])
+fi
+
+AM_CONDITIONAL([WITH_AARCH64], [test "x$with_aarch64" != "xno"])
+
 AC_ARG_WITH([vbox],
             [AS_HELP_STRING([--with-vbox],
                             [run hyperstart on Virtualbox])],
@@ -61,6 +72,7 @@ AC_MSG_RESULT([
 	prefix:		${prefix}
 
 	with-vbox:	${with_vbox}
+	with-aarch64:	${with_aarch64}
 
 	compiler:          ${CC}
 	cflags:            ${CFLAGS}

hack/test-cmd.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+###########################
+# test hyperstart from hyper
+
+export HYPER_RUNTIME=/var/lib/hyper
+sudo mkdir -p ${HYPER_RUNTIME}
+sudo cp build/kernel ${HYPER_RUNTIME}/kernel
+sudo cp build/hyper-initrd.img ${HYPER_RUNTIME}/hyper-initrd.img
+
+mkdir -p ${GOPATH}/src/github.com/hyperhq
+git clone https://github.com/hyperhq/hyperd.git ${GOPATH}/src/github.com/hyperhq/hyperd
+cd ${GOPATH}/src/github.com/hyperhq/hyperd
+./autogen.sh
+./configure
+make
+hack/test-cmd.sh
+

src/Makefile.am

@@ -1,3 +1,3 @@
-AM_CFLAGS = -Wall
+AM_CFLAGS = -Wall -Werror
 bin_PROGRAMS=init
-init_SOURCES=init.c jsmn.c net.c util.c parse.c container.c exec.c event.c
+init_SOURCES=init.c jsmn.c net.c util.c parse.c parson.c container.c exec.c event.c portmapping.c

src/api.h

@@ -0,0 +1,51 @@
+#ifndef _HYPERSTART_API_H_
+#define _HYPERSTART_API_H_
+
+#define APIVERSION 4242
+
+// control command id
+enum {
+	GETVERSION,
+	STARTPOD,
+	GETPOD,
+	STOPPOD_DEPRECATED,
+	DESTROYPOD,
+	RESTARTCONTAINER,
+	EXECCMD,
+	CMDFINISHED,
+	READY,
+	ACK,
+	ERROR,
+	WINSIZE,
+	PING,
+	PODFINISHED,
+	NEXT,
+	WRITEFILE,
+	READFILE,
+	NEWCONTAINER,
+	KILLCONTAINER,
+	ONLINECPUMEM,
+	SETUPINTERFACE,
+	SETUPROUTE,
+	REMOVECONTAINER,
+};
+
+/*
+ * control message format
+ * | ctrl id | length  | payload (length-8)      |
+ * | . . . . | . . . . | . . . . . . . . . . . . |
+ * 0         4         8                         length
+ */
+#define CONTROL_HEADER_SIZE		8
+#define CONTROL_HEADER_LENGTH_OFFSET	4
+
+/*
+ * stream message format
+ * | stream sequence | length  | payload (length-12)     |
+ * | . . . . . . . . | . . . . | . . . . . . . . . . . . |
+ * 0                 8         12                        length
+ */
+#define STREAM_HEADER_SIZE		12
+#define STREAM_HEADER_LENGTH_OFFSET	8
+
+#endif /* _HYPERSTART_API_H_ */

src/container.c

@@ -7,6 +7,7 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/utsname.h>
 #include <unistd.h>
 #include <mntent.h>
 #include <signal.h>
@@ -19,6 +20,79 @@
 #include "parse.h"
 #include "syscall.h"
 
+static int container_populate_volume(char *src, char *dest)
+{
+	struct stat st;
+
+	fprintf(stdout, "populate volumes from %s to %s\n", src, dest);
+	/* FIXME: check if has data in volume, (except lost+found) */
+
+	if (stat(dest, &st) == 0) {
+		if (!S_ISDIR(st.st_mode)) {
+			fprintf(stderr, "the _data in volume %s is not directory\n", dest);
+			return -1;
+		}
+
+		return 0;
+	}
+
+	if (errno != ENOENT) {
+		perror("access to volume failed\n");
+		return -1;
+	}
+
+	if (hyper_mkdir(dest, 0777) < 0) {
+		fprintf(stderr, "fail to create directory %s\n", dest);
+		return -1;
+	}
+
+	return hyper_copy_dir(src, dest);
+}
+
+const char *INIT_VOLUME_FILENAME = ".hyper_file_volume_data_do_not_create_on_your_own";
+
+static int container_check_file_volume(char *hyper_path, const char **filename)
+{
+	struct dirent **list;
+	struct stat stbuf;
+	int i, num, found = 0;
+	char path[PATH_MAX];
+
+	*filename = NULL;
+	num = scandir(hyper_path, &list, NULL, NULL);
+	if (num < 0) {
+		/* No data in the volume yet, treat as non-file-volume */
+		if (errno == ENOENT) {
+			return 0;
+		}
+		perror("scan path failed");
+		return -1;
+	} else if (num != 3) {
+		fprintf(stdout, "%s has %d files/dirs\n", hyper_path, num - 2);
+		for (i = 0; i < num; i++) {
+			free(list[i]);
+		}
+		free(list);
+		return 0;
+	}
+
+	sprintf(path, "%s/%s", hyper_path, INIT_VOLUME_FILENAME);
+	for (i = 0; i < num; i++) {
+		if (strcmp(list[i]->d_name, ".") != 0 &&
+		    strcmp(list[i]->d_name, "..") != 0 &&
+		    strcmp(list[i]->d_name, INIT_VOLUME_FILENAME) == 0 &&
+		    stat(path, &stbuf) == 0 && S_ISREG(stbuf.st_mode)) {
+			found++;
+		}
+		free(list[i]);
+	}
+	free(list);
+
+	fprintf(stdout, "%s %s a file volume\n", hyper_path, found > 0?"is":"is not");
+	*filename = found > 0 ? INIT_VOLUME_FILENAME : NULL;
+	return 0;
+}
+
 static int container_setup_volume(struct hyper_container *container)
 {
 	int i;
@@ -26,140 +100,113 @@ static int container_setup_volume(struct hyper_container *container)
 	struct volume *vol;
 
 	for (i = 0; i < container->vols_num; i++) {
+		char volume[512];
+		char mountpoint[512];
+		char *options = NULL;
+		const char *filevolume = NULL;
 		vol = &container->vols[i];
 
 		if (vol->scsiaddr)
-			hyper_find_sd("/.oldroot", vol->scsiaddr, &vol->device);
+			hyper_find_sd(vol->scsiaddr, &vol->device);
 
-		sprintf(dev, "/.oldroot/dev/%s", vol->device);
+		sprintf(dev, "/dev/%s", vol->device);
 		sprintf(path, "/tmp/%s", vol->mountpoint);
+		sprintf(mountpoint, "./%s", vol->mountpoint);
+
 		fprintf(stdout, "mount %s to %s, tmp path %s\n",
 			dev, vol->mountpoint, path);
 
-		if (hyper_mkdir(path) < 0 || hyper_mkdir(vol->mountpoint) < 0) {
+		if (hyper_mkdir(path, 0755) < 0) {
 			perror("create volume dir failed");
 			return -1;
 		}
 
-		if (mount(dev, path, vol->fstype, 0, NULL) < 0) {
+		if (!strncmp(vol->fstype, "xfs", strlen("xfs")))
-			perror("mount volume device faled");
+			options = "nouuid";
+
+		if (mount(dev, path, vol->fstype, 0, options) < 0) {
+			perror("mount volume device failed");
 			return -1;
 		}
 
-		if (mount(path, vol->mountpoint, NULL, MS_BIND, NULL) < 0) {
+		sprintf(volume, "/%s/_data", path);
-			perror("mount volume device faled");
+		if (container_check_file_volume(volume, &filevolume) < 0)
+			return -1;
+
+		if (filevolume == NULL) {
+			if (hyper_mkdir(mountpoint, 0755) < 0) {
+				perror("create volume dir failed");
+				return -1;
+			}
+			if (vol->docker) {
+				if (container->initialize &&
+				    (container_populate_volume(mountpoint, volume) < 0)) {
+					fprintf(stderr, "fail to populate volume %s\n", mountpoint);
+					return -1;
+				}
+			} else if (hyper_mkdir(volume, 0777) < 0) {
+				/* First time mounting an empty volume */
+				perror("create _data dir failed");
+				return -1;
+			}
+		} else {
+			hyper_filize(mountpoint);
+			if (hyper_create_file(mountpoint) < 0) {
+				perror("create volume file failed");
+				return -1;
+			}
+			sprintf(volume, "/%s/_data/%s", path, filevolume);
+			/* 0777 so that any user can read/write the new file volume */
+			if (chmod(volume, 0777) < 0) {
+				fprintf(stderr, "fail to chmod directory %s\n", volume);
+				return -1;
+			}
+		}
+
+		if (mount(volume, mountpoint, NULL, MS_BIND, NULL) < 0) {
+			perror("mount volume device failed");
 			return -1;
 		}
 
 		if (vol->readonly &&
-		    mount(path, vol->mountpoint, NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL) < 0) {
+		    mount(volume, mountpoint, NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL) < 0) {
-			perror("mount fsmap faled");
+			perror("mount fsmap failed");
 			return -1;
 		}
 
 		umount(path);
 	}
 
-	return 0;
-}
-
-static void container_unmount_oldroot(char *path)
-{
-	FILE *mtab;
-	struct mntent *mnt;
-	char *mntlist[128];
-	int i;
-	int n = 0;
-	char *filesys;
-
-	mtab = setmntent("/proc/mounts", "r");
-	if (mtab == NULL) {
-		fprintf(stderr, "cannot open /proc/mount");
-		return;
-	}
-
-	while (n < 128 && (mnt = getmntent(mtab))) {
-		if (strncmp(mnt->mnt_dir, path, strlen(path)))
-			continue;
-		mntlist[n++] = strdup(mnt->mnt_dir);
-	}
-
-	endmntent(mtab);
-
-	for (i = n - 1; i >= 0; i--) {
-		filesys = mntlist[i];
-		fprintf(stdout, "umount %s\n", filesys);
-		if (umount(mntlist[i]) < 0 && umount2(mntlist[i],
-			   MNT_DETACH) < 0) {
-			fprintf(stdout, "umount %s: %s failed\n",
-				filesys, strerror(errno));
-		}
-	}
-}
-
-static int container_setup_mount(struct hyper_container *container)
-{
-	int i, fd;
-	char src[512];
-	struct fsmap *map;
-
-	hyper_mkdir("/proc");
-	hyper_mkdir("/sys");
-	hyper_mkdir("/dev");
-
-	if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
-	    mount("sysfs", "/sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
-	    mount("devtmpfs", "/dev", "devtmpfs", MS_NOSUID, NULL) < 0) {
-		perror("mount basic filesystem for container failed");
-		return -1;
-	}
-
-	if (hyper_mkdir("/dev/shm") < 0) {
-		fprintf(stderr, "create /dev/shm failed\n");
-		return -1;
-	}
-
-	if (mount("tmpfs", "/dev/shm/", "tmpfs", MS_NOSUID| MS_NODEV, NULL) < 0) {
-		perror("mount shm failed");
-		return -1;
-	}
-
-	if (hyper_mkdir("/dev/pts") < 0) {
-		fprintf(stderr, "create /dev/pts failed\n");
-		return -1;
-	}
-
-	if (sprintf(src, "/.oldroot/tmp/hyper/%s/devpts", container->id) < 0) {
-		fprintf(stderr, "get container devpts failed\n");
-		return -1;
-	}
-
-	if (mount(src, "/dev/pts/", NULL, MS_BIND, NULL) < 0) {
-		perror("move pts to /dev/pts failed");
-		return -1;
-	}
-
-	if (unlink("/dev/ptmx") < 0)
-		perror("remove /dev/ptmx failed");
-	if (symlink("/dev/pts/ptmx", "/dev/ptmx") < 0)
-		perror("link /dev/pts/ptmx to /dev/ptmx failed");
-
 	for (i = 0; i < container->maps_num; i++) {
 		struct stat st;
+		char *src, path[512], volume[512];
+		struct fsmap *map = &container->maps[i];
+		char mountpoint[512];
 
-		map = &container->maps[i];
+		sprintf(path, "%s/%s", SHARED_DIR, map->source);
-
+		sprintf(mountpoint, "./%s", map->path);
-		sprintf(src, "/.oldroot/tmp/hyper/shared/%s", map->source);
+		fprintf(stdout, "mount %s to %s\n", path, mountpoint);
-		fprintf(stdout, "mount %s to %s\n", src, map->path);
 
+		src = path;
 		stat(src, &st);
+
 		if (st.st_mode & S_IFDIR) {
-			if (hyper_mkdir(map->path) < 0) {
+			if (hyper_mkdir(mountpoint, 0755) < 0) {
 				perror("create map dir failed");
 				continue;
 			}
+			if (map->docker) {
+				/* converted from volume */
+				sprintf(volume, "%s/_data", path);
+				src = volume;
+				if (container->initialize &&
+				    (container_populate_volume(mountpoint, volume) < 0)) {
+					fprintf(stderr, "fail to populate volume %s\n", mountpoint);
+					continue;
+				}
+			}
 		} else {
-			fd = open(map->path, O_CREAT|O_WRONLY, 0755);
+			int fd = open(mountpoint, O_CREAT|O_WRONLY, 0755);
 			if (fd < 0) {
 				perror("create map file failed");
 				continue;
@@ -167,65 +214,209 @@ static int container_setup_mount(struct hyper_container *container)
 			close(fd);
 		}
 
-		if (mount(src, map->path, NULL, MS_BIND, NULL) < 0) {
+		if (mount(src, mountpoint, NULL, MS_BIND, NULL) < 0) {
-			perror("mount fsmap faled");
+			perror("mount fsmap failed");
 			continue;
 		}
 
 		if (map->readonly == 0)
 			continue;
 
-		if (mount(src, map->path, NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL) < 0)
+		if (mount(src, mountpoint, NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL) < 0)
-			perror("mount fsmap faled");
+			perror("mount fsmap failed");
 	}
 
 	return 0;
 }
 
+static int container_setup_modules(struct hyper_container *container)
+{
+	struct stat st;
+	struct utsname uts;
+	char src[512], dst[512];
+
+	if (uname(&uts) < 0) {
+		perror("fail to call uname");
+		return -1;
+	}
+
+	sprintf(src, "/lib/modules/%s", uts.release);
+	sprintf(dst, "./%s", src);
+
+	if (stat(dst, &st) == 0) {
+		struct dirent **list;
+		int num;
+
+		if (!S_ISDIR(st.st_mode)) {
+			return -1;
+		}
+
+		num = scandir(dst, &list, NULL, NULL);
+		if (num > 2) {
+			fprintf(stdout, "%s is not null, %d", dst, num);
+			return 0;
+		}
+	} else if (errno == ENOENT) {
+		if (hyper_mkdir(dst, 0755) < 0)
+			return -1;
+	} else {
+		return -1;
+	}
+
+	if (mount(src, dst, NULL, MS_BIND, NULL) < 0) {
+		perror("mount bind modules failed");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int container_setup_mount(struct hyper_container *container)
+{
+	char src[512];
+
+	// current dir is container rootfs, the operations on "./PATH" are the operations on container's "/PATH"
+	hyper_mkdir("./proc", 0755);
+	hyper_mkdir("./sys", 0755);
+	hyper_mkdir("./dev", 0755);
+	hyper_mkdir("./lib/modules", 0755);
+
+	if (mount("proc", "./proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
+	    mount("sysfs", "./sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
+	    mount("devtmpfs", "./dev", "devtmpfs", MS_NOSUID, NULL) < 0) {
+		perror("mount basic filesystem for container failed");
+		return -1;
+	}
+
+	if (hyper_mkdir("./dev/shm", 0755) < 0) {
+		fprintf(stderr, "create /dev/shm failed\n");
+		return -1;
+	}
+
+	if (mount("tmpfs", "./dev/shm/", "tmpfs", MS_NOSUID| MS_NODEV, NULL) < 0) {
+		perror("mount shm failed");
+		return -1;
+	}
+
+	if (hyper_mkdir("./dev/pts", 0755) < 0) {
+		fprintf(stderr, "create /dev/pts failed\n");
+		return -1;
+	}
+
+	if (sprintf(src, "/tmp/hyper/%s/devpts", container->id) < 0) {
+		fprintf(stderr, "get container devpts failed\n");
+		return -1;
+	}
+
+	if (mount(src, "./dev/pts/", NULL, MS_BIND, NULL) < 0) {
+		perror("move pts to /dev/pts failed");
+		return -1;
+	}
+
+	if (unlink("./dev/ptmx") < 0) {
+		perror("remove /dev/ptmx failed");
+		return -1;
+	}
+	if (symlink("/dev/pts/ptmx", "./dev/ptmx") < 0) {
+		perror("link /dev/pts/ptmx to /dev/ptmx failed");
+		return -1;
+	}
+
+	/* all containers share the same devtmpfs, so we need to ignore the errno EEXIST */
+	if ((symlink("/proc/self/fd", "./dev/fd") < 0 && errno != EEXIST) ||
+	    (symlink("/proc/self/fd/0", "./dev/stdin") < 0 && errno != EEXIST) ||
+	    (symlink("/proc/self/fd/1", "./dev/stdout") < 0 && errno != EEXIST) ||
+	    (symlink("/proc/self/fd/2", "./dev/stderr") < 0 && errno != EEXIST)) {
+		perror("failed to symlink for /dev/fd, /dev/stdin, /dev/stdout or /dev/stderr");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int container_recreate_file(char *filename)
+{
+	struct stat stbuf;
+
+	fprintf(stdout, "recreate file %s\n", filename);
+	if (stat(filename, &stbuf) < 0) {
+		if (errno != ENOENT) {
+			fprintf(stderr, "failed to stat %s: %d\n", filename, errno);
+			return -1;
+		}
+		return hyper_create(filename);
+	}
+	if (stbuf.st_mode & S_IFREG && stbuf.st_size == 0)
+		return 0;
+
+	hyper_unlink(filename);
+	return hyper_create(filename);
+}
+
+static int container_recreate_symlink(char *oldpath, char *newpath)
+{
+	fprintf(stdout, "recreate symlink %s to %s\n", newpath, oldpath);
+	hyper_unlink(newpath);
+	return hyper_symlink(oldpath, newpath);
+}
+
+/*
+ * Docker uses the init layer to protect against unwanted side effects on
+ * the rw layer. We recreate the same files here to have similar effect.
+ * Docker also creates directories like /dev/pts, /dev/shm, /proc, /sys,
+ * which we have over ridden in container_setup_mount, so no need to create
+ * them here.
+ */
+static int container_setup_init_layer(struct hyper_container *container,
+				      int setup_dns)
+{
+	if (!container->initialize)
+		return 0;
+
+	hyper_mkdir("./etc/", 0755);
+
+	if (setup_dns && container_recreate_file("./etc/resolv.conf") < 0)
+		return -1;
+
+	if (container_recreate_file("./etc/hosts") < 0)
+		return -1;
+
+	if (container_recreate_file("./etc/hostname") < 0)
+		return -1;
+
+	if (container_recreate_symlink("/proc/mounts", "./etc/mtab") < 0)
+		return -1;
+
+	return 0;
+}
+
 static int container_setup_sysctl(struct hyper_container *container)
 {
-	int i, size, len, l, fd;
+	int i;
 	struct sysctl *sys;
 
 	for (i = 0; i < container->sys_num; i++) {
 		char path[256];
 
-		len = 0;
 		sys = &container->sys[i];
-		size = strlen(sys->value);
 
 		sprintf(path, "/proc/sys/%s", sys->path);
 		fprintf(stdout, "sysctl %s value %s\n", sys->path, sys->value);
 
-		fd = open(path, O_WRONLY);
+		if (hyper_write_file(path, sys->value, strlen(sys->value)) < 0) {
-		if (fd < 0) {
+			fprintf(stderr, "sysctl: write %s to %s failed\n", sys->value, path);
-			perror("open file failed");
+			return -1;
-			goto out;
 		}
-
-		while (len < size) {
-			l = write(fd, sys->value + len, size - len);
-			if (l < 0) {
-				perror("fail to write sysctl");
-				close(fd);
-				goto out;
-			}
-			len += l;
-		}
-
-		close(fd);
 	}
 
 	return 0;
-out:
-	return -1;
 }
 
 static int container_setup_dns(struct hyper_container *container)
 {
 	int fd;
 	struct stat st;
-	char *src = "/.oldroot/tmp/hyper/resolv.conf";
+	char *src = "/tmp/hyper/resolv.conf";
 
 	if (stat(src, &st) < 0) {
 		if (errno == ENOENT) {
@@ -237,16 +428,16 @@ static int container_setup_dns(struct hyper_container *container)
 		return -1;
 	}
 
-	hyper_mkdir("/etc");
+	hyper_mkdir("./etc", 0755);
 
-	fd = open("/etc/resolv.conf", O_CREAT| O_WRONLY, 0644);
+	fd = open("./etc/resolv.conf", O_CREAT| O_WRONLY, 0644);
 	if (fd < 0) {
 		perror("create /etc/resolv.conf failed");
 		return -1;
 	}
 	close(fd);
 
-	if (mount(src, "/etc/resolv.conf", NULL, MS_BIND, NULL) < 0) {
+	if (mount(src, "./etc/resolv.conf", NULL, MS_BIND, NULL) < 0) {
 		perror("bind to /etc/resolv.conf failed");
 		return -1;
 	}
@@ -256,19 +447,14 @@ static int container_setup_dns(struct hyper_container *container)
 
 static int container_setup_workdir(struct hyper_container *container)
 {
-	if (container->workdir && chdir(container->workdir) < 0) {
+	if (container->initialize) {
-		perror("change work directory failed");
+		// create workdir
-		return -1;
+		return hyper_mkdir(container->exec.workdir, 0755);
 	}
 
 	return 0;
 }
 
-static int container_setup_tty(int fd, struct hyper_container *container)
-{
-	return hyper_dup_exec_tty(fd, &container->exec);
-}
-
 static int hyper_rescan_scsi(void)
 {
 	struct dirent **list;
@@ -278,7 +464,7 @@ static int hyper_rescan_scsi(void)
 
 	num = scandir("/sys/class/scsi_host/", &list, NULL, NULL);
 	if (num < 0) {
-		perror("scan /sys/calss/virtio-ports/ failed");
+		perror("scan /sys/class/scsi_host/ failed");
 		return -1;
 	}
 
@@ -316,43 +502,38 @@ static int hyper_rescan_scsi(void)
 
 struct hyper_container_arg {
 	struct hyper_container	*c;
-	int			ipcns;
+	struct hyper_pod	*pod;
-	int			utsns;
 	int			pipe[2];
+	int			pipens[2];
 };
 
-static int hyper_container_init(void *data)
+static int hyper_setup_container_rootfs(void *data)
 {
 	struct hyper_container_arg *arg = data;
 	struct hyper_container *container = arg->c;
-	char root[512], oldroot[512];
+	char root[512], rootfs[512];
+	int setup_dns;
+	uint32_t type;
 
-	fprintf(stdout, "%s in\n", __func__);
+	/* wait for ns-opened ready message */
-	if (container->exec.argv == NULL) {
+	if (hyper_get_type(arg->pipens[0], &type) < 0 || type != READY) {
-		fprintf(stdout, "no cmd!\n");
+		fprintf(stderr, "wait for /proc/self/ns/mnt opened failed\n");
 		goto fail;
 	}
 
-	if (setns(arg->ipcns, CLONE_NEWIPC) < 0) {
+	if (hyper_enter_sandbox(arg->pod, -1) < 0) {
-		perror("setns to ipcns of pod init faild");
+		perror("enter sandbox failed");
 		goto fail;
 	}
 
-	if (setns(arg->utsns, CLONE_NEWUTS) < 0) {
+	/* To create files/directories accessible for all users. */
-		perror("setns to ipcns of pod init faild");
+	umask(0);
-		goto fail;
-	}
 
-	if (hyper_rescan_scsi() < 0) {
+	if (container->fstype && hyper_rescan_scsi() < 0) {
 		fprintf(stdout, "rescan scsi failed\n");
 		goto fail;
 	}
 
-	if (hyper_setup_env(container->envs, container->envs_num) < 0) {
-		fprintf(stdout, "setup env failed\n");
-		goto fail;
-	}
-
 	if (mount("", "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
 		perror("mount SLAVE failed");
 		goto fail;
@@ -364,8 +545,8 @@ static int hyper_container_init(void *data)
 	}
 
 	sprintf(root, "/tmp/hyper/%s/root/", container->id);
-	if (hyper_mkdir(root) < 0) {
+	if (hyper_mkdir(root, 0755) < 0) {
-		perror("make root directroy failed");
+		perror("make root directory failed");
 		goto fail;
 	}
 
@@ -373,21 +554,28 @@ static int hyper_container_init(void *data)
 
 	if (container->fstype) {
 		char dev[128];
+		char *options = NULL;
 
-		if (container->scsiaddr)
+		if (container->scsiaddr) {
-			hyper_find_sd("", container->scsiaddr, &container->image);
+			free(container->image);
+			container->image = NULL;
+			hyper_find_sd(container->scsiaddr, &container->image);
+		}
 
 		sprintf(dev, "/dev/%s", container->image);
 		fprintf(stdout, "device %s\n", dev);
 
-		if (mount(dev, root, container->fstype, 0, NULL) < 0) {
+		if (!strncmp(container->fstype, "xfs", strlen("xfs")))
+			options = "nouuid";
+
+		if (mount(dev, root, container->fstype, 0, options) < 0) {
 			perror("mount device failed");
 			goto fail;
 		}
 	} else {
 		char path[512];
 
-		sprintf(path, "/tmp/hyper/shared/%s/", container->image);
+		sprintf(path, "%s/%s/", SHARED_DIR, container->image);
 		fprintf(stdout, "src directory %s\n", path);
 
 		if (mount(path, root, NULL, MS_BIND, NULL) < 0) {
@@ -399,26 +587,23 @@ static int hyper_container_init(void *data)
 	fprintf(stdout, "root directory for container is %s/%s, init task %s\n",
 		root, container->rootfs, container->exec.argv[0]);
 
-	sprintf(oldroot, "%s/%s/.oldroot", root, container->rootfs);
+	sprintf(rootfs, "%s/%s/", root, container->rootfs);
-	if (hyper_mkdir(oldroot) < 0) {
+	if (mount(rootfs, rootfs, NULL, MS_BIND|MS_REC, NULL) < 0) {
-		perror("make oldroot directroy failed");
+		perror("failed to bind rootfs");
+		goto fail;
+	}
+	if (chdir(rootfs) < 0) {
+		perror("failed to change the root to path of the container root(before manipulating)");
 		goto fail;
 	}
 
-	if (mount("/", oldroot, NULL, MS_BIND|MS_REC, NULL) < 0) {
+	/*
-		perror("bind oldroot failed");
+	 * Recreate dns resolver iif configured by pod spec. Other cases
-		goto fail;
+	 * are handled by hyperd instead.
-	}
+	 */
-	/* reuse oldroot array */
+	setup_dns = arg->pod->dns != NULL && arg->pod->d_num > 0;
-	sprintf(oldroot, "%s/%s/", root, container->rootfs);
+	if (container_setup_init_layer(container, setup_dns) < 0) {
-	/* pivot_root won't work, see
+		fprintf(stderr, "container sets up init layer failed\n");
-	 * Documention/filesystem/ramfs-rootfs-initramfs.txt */
-	chroot(oldroot);
-
-	chdir("/");
-
-	if (container_setup_volume(container) < 0) {
-		fprintf(stderr, "container sets up voulme failed\n");
 		goto fail;
 	}
 
@@ -427,8 +612,11 @@ static int hyper_container_init(void *data)
 		goto fail;
 	}
 
-	if (container_setup_sysctl(container) < 0) {
+	// ignore error of setup modules
-		fprintf(stderr, "container sets up sysctl failed\n");
+	container_setup_modules(container);
+
+	if (container_setup_volume(container) < 0) {
+		fprintf(stderr, "container sets up voulme failed\n");
 		goto fail;
 	}
 
@@ -437,33 +625,40 @@ static int hyper_container_init(void *data)
 		goto fail;
 	}
 
+	// manipulate the rootfs of the container/namespace: move the prepared path @rootfs to /
+	if (mount(rootfs, "/", NULL, MS_MOVE, NULL) < 0) {
+		perror("failed to move rootfs");
+		goto fail;
+	}
+	/* pivot_root won't work, see
+	 * Documention/filesystem/ramfs-rootfs-initramfs.txt */
+	if (chroot(".") < 0) {
+		perror("failed to setup the root for the mount namepsace");
+		goto fail;
+	}
+
+	if (chdir("/") < 0) {
+		perror("failed chdir to the new root");
+		goto fail;
+	}
+
+	if (container_setup_sysctl(container) < 0) {
+		fprintf(stderr, "container sets up sysctl failed\n");
+		goto fail;
+	}
+
 	if (container_setup_workdir(container) < 0) {
 		fprintf(stderr, "container sets up work directory failed\n");
 		goto fail;
 	}
 
-	container_unmount_oldroot("/.oldroot");
+	hyper_send_type(arg->pipe[1], READY);
-
+	fflush(NULL);
-	fflush(stdout);
+	_exit(0);
-
-	if (container_setup_tty(arg->pipe[1], container) < 0) {
-		fprintf(stdout, "setup tty failed\n");
-		goto fail;
-	}
-
-	symlink("/proc/self/fd", "/dev/fd");
-	symlink("/proc/self/fd/0", "/dev/stdin");
-	symlink("/proc/self/fd/1", "/dev/stdout");
-	symlink("/proc/self/fd/2", "/dev/stderr");
-
-	execvp(container->exec.argv[0], container->exec.argv);
-	perror("exec container command failed");
-
-	_exit(-1);
 
 fail:
 	hyper_send_type(arg->pipe[1], ERROR);
-	_exit(-1);
+	_exit(125);
 }
 
 static int hyper_setup_pty(struct hyper_container *c)
@@ -472,8 +667,8 @@ static int hyper_setup_pty(struct hyper_container *c)
 
 	sprintf(root, "/tmp/hyper/%s/devpts/", c->id);
 
-	if (hyper_mkdir(root) < 0) {
+	if (hyper_mkdir(root, 0755) < 0) {
-		perror("make container pts directroy failed");
+		perror("make container pts directory failed");
 		return -1;
 	}
 
@@ -483,33 +678,33 @@ static int hyper_setup_pty(struct hyper_container *c)
 		return -1;
 	}
 
-	if (hyper_setup_exec_tty(&c->exec) < 0) {
-		fprintf(stderr, "setup container pts failed\n");
-		return -1;
-	}
-
 	return 0;
 }
 
-int hyper_start_container(struct hyper_container *container,
+int hyper_setup_container(struct hyper_container *container, struct hyper_pod *pod)
-			  int utsns, int ipcns, struct hyper_pod *pod)
 {
-	int stacksize = getpagesize() * 4;
+	int stacksize = getpagesize() * 42;
 	struct hyper_container_arg arg = {
 		.c	= container,
-		.utsns	= utsns,
+		.pod	= pod,
-		.ipcns	= ipcns,
 		.pipe	= {-1, -1},
+		.pipens = {-1, -1},
 	};
 	int flags = CLONE_NEWNS | SIGCHLD;
 	char path[128];
-	uint32_t type;
 	void *stack;
+	uint32_t type;
 	int pid;
 
-	if (container->image == NULL || container->exec.argv == NULL) {
+	container->exec.pod = pod;
-		fprintf(stdout, "container root image %s, argv %p\n",
+
-			container->image, container->exec.argv);
+	if (pipe2(arg.pipe, O_CLOEXEC) < 0 || pipe2(arg.pipens, O_CLOEXEC) < 0) {
+		perror("create pipe between pod init execcmd failed");
+		goto fail;
+	}
+
+	if (hyper_setup_container_portmapping(container, pod) < 0) {
+		perror("fail to setup port mapping for container");
 		goto fail;
 	}
 
@@ -518,66 +713,49 @@ int hyper_start_container(struct hyper_container *container,
 		goto fail;
 	}
 
-	if (pipe2(arg.pipe, O_CLOEXEC) < 0) {
-		perror("create pipe between pod init execcmd failed");
-		goto fail;
-	}
-
-	if (hyper_watch_exec_pty(&container->exec, pod) < 0) {
-		fprintf(stderr, "faile to watch container pty\n");
-		goto fail;
-	}
-
 	stack = malloc(stacksize);
 	if (stack == NULL) {
 		perror("fail to allocate stack for container init");
 		goto fail;
 	}
 
-	pid = clone(hyper_container_init, stack + stacksize, flags, &arg);
+	pid = clone(hyper_setup_container_rootfs, stack + stacksize, flags, &arg);
 	free(stack);
 	if (pid < 0) {
 		perror("create child process failed");
 		goto fail;
 	}
-	sprintf(path, "/proc/%d/ns/mnt", pid);
 
+	sprintf(path, "/proc/%d/ns/mnt", pid);
 	container->ns = open(path, O_RDONLY | O_CLOEXEC);
 	if (container->ns < 0) {
 		perror("open container mount ns failed");
 		goto fail;
 	}
+	hyper_send_type(arg.pipens[1], READY);
 
 	/* wait for ready message */
 	if (hyper_get_type(arg.pipe[0], &type) < 0 || type != READY) {
-		fprintf(stderr, "wait for container started failed\n");
+		fprintf(stderr, "wait for setup container rootfs failed\n");
 		goto fail;
 	}
 
-	container->exec.pid = pid;
-	list_add_tail(&container->exec.list, &pod->exec_head);
-	container->exec.ref++;
-
 	close(arg.pipe[0]);
 	close(arg.pipe[1]);
-
+	close(arg.pipens[0]);
-	fprintf(stdout, "container %s,init pid %d,ref %d\n", container->id, pid, container->exec.ref);
+	close(arg.pipens[1]);
 	return 0;
 fail:
+	close(container->ns);
+	container->ns = -1;
 	close(arg.pipe[0]);
 	close(arg.pipe[1]);
-	close(container->ns);
+	close(arg.pipens[0]);
-	hyper_reset_event(&container->exec.e);
+	close(arg.pipens[1]);
-	hyper_reset_event(&container->exec.errev);
-	container->ns = -1;
-	fprintf(stdout, "container %s init exit code %d\n", container->id, -1);
-	container->exec.code = -1;
-	container->exec.seq = 0;
-	container->exec.ref = 0;
 	return -1;
 }
 
-struct hyper_container *hyper_find_container(struct hyper_pod *pod, char *id)
+struct hyper_container *hyper_find_container(struct hyper_pod *pod, const char *id)
 {
 	struct hyper_container *c;
 
@@ -594,7 +772,7 @@ struct hyper_container *hyper_find_container(struct hyper_pod *pod, char *id)
 	return NULL;
 }
 
-void hyper_cleanup_container(struct hyper_container *c)
+void hyper_cleanup_container(struct hyper_container *c, struct hyper_pod *pod)
 {
 	char root[512];
 
@@ -603,6 +781,7 @@ void hyper_cleanup_container(struct hyper_container *c)
 		perror("umount devpts failed");
 
 	close(c->ns);
+	hyper_cleanup_container_portmapping(c, pod);
 	hyper_free_container(c);
 }
 
@@ -611,7 +790,7 @@ void hyper_cleanup_containers(struct hyper_pod *pod)
 	struct hyper_container *c, *n;
 
 	list_for_each_entry_safe(c, n, &pod->containers, list)
-		hyper_cleanup_container(c);
+		hyper_cleanup_container(c, pod);
 
 	pod->remains = 0;
 }

src/container.h

@@ -3,23 +3,20 @@
 
 #include "exec.h"
 
-struct env {
-	char	*env;
-	char	*value;
-};
-
 struct volume {
 	char	*device;
 	char	*scsiaddr;
 	char	*mountpoint;
 	char	*fstype;
 	int	readonly;
+	int	docker;
 };
 
 struct fsmap {
 	char	*source;
 	char	*path;
 	int	readonly;
+	int	docker;
 };
 
 struct sysctl {
@@ -27,33 +24,40 @@ struct sysctl {
 	char	*value;
 };
 
+struct port {
+	int  host_port;
+	int  container_port;
+	char *protocol;
+};
+
 struct hyper_container {
+	struct list_head	list;
+	struct hyper_exec	exec;
+	int			ns;
+	uint32_t		code;
+
+	// configs
 	char			*id;
 	char			*rootfs;
 	char			*image;
 	char			*scsiaddr;
-	char			*workdir;
 	char			*fstype;
 	struct volume		*vols;
-	struct env		*envs;
 	struct fsmap		*maps;
 	struct sysctl		*sys;
+	struct port		*ports;
 	int			vols_num;
-	int			envs_num;
 	int			maps_num;
 	int			sys_num;
-	int			ns;
+	int			ports_num;
-	uint32_t		code;
+	int			initialize;
-	struct list_head	list;
-	struct hyper_exec	exec;
 };
 
 struct hyper_pod;
 
-int hyper_start_container(struct hyper_container *container,
+int hyper_setup_container(struct hyper_container *container, struct hyper_pod *pod);
-			  int utsns, int ipcns, struct hyper_pod *pod);
+struct hyper_container *hyper_find_container(struct hyper_pod *pod, const char *id);
-struct hyper_container *hyper_find_container(struct hyper_pod *pod, char *id);
+void hyper_cleanup_container(struct hyper_container *container, struct hyper_pod *pod);
-void hyper_cleanup_container(struct hyper_container *container);
 void hyper_cleanup_containers(struct hyper_pod *pod);
 void hyper_free_container(struct hyper_container *c);
 

src/event.c

@@ -10,25 +10,25 @@
 #include "hyper.h"
 #include "event.h"
 
-void hyper_reset_event(struct hyper_event *de)
+void hyper_reset_event(struct hyper_event *he)
 {
-	free(de->rbuf.data);
+	free(he->rbuf.data);
-	free(de->wbuf.data);
+	free(he->wbuf.data);
-	close(de->fd);
+	close(he->fd);
-	memset(de, 0, sizeof(*de));
+	memset(he, 0, sizeof(*he));
-	de->fd = -1;
+	he->fd = -1;
 }
 
-int hyper_init_event(struct hyper_event *de, struct hyper_event_ops *ops, void *arg)
+int hyper_init_event(struct hyper_event *he, struct hyper_event_ops *ops, void *arg)
 {
-	struct hyper_buf *rbuf = &de->rbuf;
+	struct hyper_buf *rbuf = &he->rbuf;
-	struct hyper_buf *wbuf = &de->wbuf;
+	struct hyper_buf *wbuf = &he->wbuf;
 
 	memset(rbuf, 0, sizeof(*rbuf));
 	memset(wbuf, 0, sizeof(*wbuf));
 
-	de->ops		= ops;
+	he->ops		= ops;
-	de->ptr		= arg;
+	he->ptr		= arg;
 	rbuf->size	= ops->rbuf_size;
 	wbuf->size	= ops->wbuf_size;
 
@@ -51,22 +51,22 @@ int hyper_init_event(struct hyper_event *de, struct hyper_event_ops *ops, void *
 	return 0;
 }
 
-int hyper_add_event(int efd, struct hyper_event *de, int flag)
+int hyper_add_event(int efd, struct hyper_event *he, int flag)
 {
 	struct epoll_event event = {
 		.events		= flag,
-		.data.ptr	= de,
+		.data.ptr	= he,
 	};
 
-	de->flag = flag;
+	he->flag = flag;
-	if (hyper_setfd_nonblock(de->fd) < 0) {
+	if (hyper_setfd_nonblock(he->fd) < 0) {
 		perror("set fd nonblock failed");
 		return -1;
 	}
 
-	fprintf(stdout, "%s add event fd %d, %p\n", __func__, de->fd, de->ops);
+	fprintf(stdout, "%s add event fd %d, %p\n", __func__, he->fd, he->ops);
 
-	if (epoll_ctl(efd, EPOLL_CTL_ADD, de->fd, &event) < 0) {
+	if (epoll_ctl(efd, EPOLL_CTL_ADD, he->fd, &event) < 0) {
 		perror("epoll_ctl fd failed");
 		return -1;
 	}
@@ -74,21 +74,21 @@ int hyper_add_event(int efd, struct hyper_event *de, int flag)
 	return 0;
 }
 
-int hyper_modify_event(int efd, struct hyper_event *de, int flag)
+int hyper_modify_event(int efd, struct hyper_event *he, int flag)
 {
 	struct epoll_event event = {
 		.events		= flag,
-		.data.ptr	= de,
+		.data.ptr	= he,
 	};
 
-	if (de->flag == flag)
+	if (he->flag == flag)
 		return 0;
 
-	de->flag = flag;
+	he->flag = flag;
 	fprintf(stdout, "%s modify event fd %d, %p, event %d\n",
-			__func__, de->fd, de, flag);
+			__func__, he->fd, he, flag);
 
-	if (epoll_ctl(efd, EPOLL_CTL_MOD, de->fd, &event) < 0) {
+	if (epoll_ctl(efd, EPOLL_CTL_MOD, he->fd, &event) < 0) {
 		perror("epoll_ctl fd failed");
 		return -1;
 	}
@@ -96,106 +96,34 @@ int hyper_modify_event(int efd, struct hyper_event *de, int flag)
 	return 0;
 }
 
-static int hyper_getmsg_len(struct hyper_event *de, uint32_t *len)
+int hyper_requeue_event(int efd, struct hyper_event *ev)
 {
-	struct hyper_buf *buf = &de->rbuf;
+	struct epoll_event event = {
+		.events		= ev->flag,
+		.data.ptr	= ev,
+	};
 
-	if (buf->get < de->ops->len_offset + 4)
+	if (epoll_ctl(efd, EPOLL_CTL_DEL, ev->fd, NULL) < 0) {
+		perror("epoll_ctl del fd failed");
 		return -1;
+	}
+
+	if (epoll_ctl(efd, EPOLL_CTL_ADD, ev->fd, &event) < 0) {
+		perror("epoll_ctl add fd failed");
+		return -1;
+	}
 
-	*len = hyper_get_be32(buf->data + de->ops->len_offset);
 	return 0;
 }
 
-int hyper_event_read(struct hyper_event *de)
+int hyper_event_write(struct hyper_event *he, int efd)
 {
-	struct hyper_buf *buf = &de->rbuf;
+	struct hyper_buf *buf = &he->wbuf;
-	uint32_t len = 4;
-	uint8_t data[4];
-	int offset = de->ops->len_offset;
-	int end = offset + 4;
-	int size;
-
-	fprintf(stdout, "%s\n", __func__);
-
-	while (hyper_getmsg_len(de, &len) < 0) {
-		size = read(de->fd, buf->data + buf->get, end - buf->get);
-		if (size > 0) {
-			buf->get += size;
-			fprintf(stdout, "already read %" PRIu32 " bytes data\n",
-				buf->get);
-
-			if (de->ops->ack) {
-				/* control channel, need ack */
-				hyper_set_be32(data, size);
-				hyper_send_msg(de->fd, NEXT, 4, data);
-			}
-			continue;
-		}
-
-		if (errno == EINTR)
-			continue;
-
-		if (errno != EAGAIN && size != 0) {
-			perror("fail to read");
-			return -1;
-		}
-
-		return 0;
-	}
-
-	fprintf(stdout, "get length %" PRIu32"\n", len);
-	if (len > buf->size) {
-		fprintf(stderr, "get length %" PRIu32", too long\n", len);
-		return -1;
-	}
-
-	while (buf->get < len) {
-		size = read(de->fd, buf->data + buf->get, len - buf->get);
-		if (size > 0) {
-			buf->get += size;
-			fprintf(stdout, "read %d bytes data, total data %" PRIu32 "\n",
-				size, buf->get);
-			if (de->ops->ack) {
-				/* control channel, need ack */
-				hyper_set_be32(data, size);
-				hyper_send_msg(de->fd, NEXT, 4, data);
-			}
-
-			continue;
-		}
-
-		if (errno == EINTR)
-			continue;
-
-		if (errno != EAGAIN && size != 0) {
-			perror("fail to read");
-			return -1;
-		}
-
-		/* size == 0 : No one connect to qemu socket */
-		return 0;
-	}
-
-	/* get the whole data */
-	if (de->ops->handle(de, len) != 0)
-		return -1;
-
-	/* len: length of the already get new data */
-	buf->get -= len;
-	memmove(buf->data, buf->data + len, buf->get);
-
-	return 0;
-}
-
-int hyper_event_write(struct hyper_event *de)
-{
-	struct hyper_buf *buf = &de->wbuf;
 	uint32_t len = 0;
 	int size = 0;
 
 	while (len < buf->get) {
-		size = write(de->fd, buf->data + len, buf->get - len);
+		size = write(he->fd, buf->data + len, buf->get - len);
 		if (size <= 0) {
 			if (errno == EINTR)
 				continue;
@@ -210,49 +138,42 @@ int hyper_event_write(struct hyper_event *de)
 	memmove(buf->data, buf->data + len, buf->get);
 
 	if (buf->get == 0) {
-		hyper_modify_event(ctl.efd, de, EPOLLIN);
+		hyper_modify_event(ctl.efd, he, he->flag & ~EPOLLOUT);
 	}
 
 	return 0;
 }
 
-void hyper_event_hup(struct hyper_event *de, int efd)
+void hyper_event_hup(struct hyper_event *he, int efd)
 {
-	if (epoll_ctl(efd, EPOLL_CTL_DEL, de->fd, NULL) < 0)
+	if (epoll_ctl(efd, EPOLL_CTL_DEL, he->fd, NULL) < 0)
 		perror("epoll_ctl del epoll event failed");
-	hyper_reset_event(de);
+	hyper_reset_event(he);
 }
 
 int hyper_handle_event(int efd, struct epoll_event *event)
 {
-	struct hyper_event *de = event->data.ptr;
+	struct hyper_event *he = event->data.ptr;
-	fprintf(stdout, "%s get event %d, de %p, fd %d. ops %p\n",
+	fprintf(stdout, "%s get event %d, he %p, fd %d. ops %p\n",
-			__func__, event->events, de, de->fd, de->ops);
+			__func__, event->events, he, he->fd, he->ops);
 
-	/* do not handle hup event if have in event */
+	/* do not handle hup event if have in/out event */
-	if (event->events & EPOLLIN) {
+	if ((event->events & EPOLLIN) && he->ops->read) {
-		fprintf(stdout, "%s event EPOLLIN, de %p, fd %d, %p\n",
+		fprintf(stdout, "%s event EPOLLIN, he %p, fd %d, %p\n",
-			__func__, de, de->fd, de->ops);
+			__func__, he, he->fd, he->ops);
-		if (de->ops->read(de) < 0)
+		return he->ops->read(he, efd);
-			return -1;
+	}
-	} else if (event->events & EPOLLHUP) {
+	if ((event->events & EPOLLOUT) && he->ops->write) {
-		fprintf(stdout, "%s event EPOLLHUP, de %p, fd %d, %p\n",
+		fprintf(stdout, "%s event EPOLLOUT, he %p, fd %d, %p\n",
-			__func__, de, de->fd, de->ops);
+			__func__, he, he->fd, he->ops);
-		if (de->ops->hup)
+		return he->ops->write(he, efd);
-			de->ops->hup(de, efd);
-		return 0;
 	}
 
-	if (event->events & EPOLLOUT) {
+	if ((event->events & EPOLLHUP) || (event->events & EPOLLERR)) {
-		fprintf(stdout, "%s event EPOLLOUT, de %p, fd %d, %p\n",
+		fprintf(stdout, "%s event EPOLLHUP or EPOLLERR, he %p, fd %d, %x\n",
-			__func__, de, de->fd, de->ops);
+			__func__, he, he->fd, event->events);
-		if (de->ops->write && de->ops->write(de) < 0)
+		if (he->ops->hup)
-			return -1;
+			he->ops->hup(he, efd);
-	}
-
-	if (event->events & EPOLLERR) {
-		fprintf(stderr, "get epoll err of not epool in event\n");
-		return -1;
 	}
 
 	return 0;

src/event.h

@@ -7,14 +7,11 @@
 struct hyper_event;
 
 struct hyper_event_ops {
-	int		(*read)(struct hyper_event *e);
+	int		(*read)(struct hyper_event *e, int efd);
-	int		(*write)(struct hyper_event *e);
+	int		(*write)(struct hyper_event *e, int efd);
-	int		(*handle)(struct hyper_event *e, uint32_t len);
 	void		(*hup)(struct hyper_event *e, int efd);
 	int		rbuf_size;
 	int		wbuf_size;
-	int		len_offset;
-	int		ack;
 };
 
 struct hyper_buf {
@@ -32,13 +29,16 @@ struct hyper_event {
 	void			*ptr;
 };
 
+#define FULL(buf) \
+	(buf->size - buf->get <= 12)
+
 int hyper_add_event(int efd, struct hyper_event *de, int flag);
 int hyper_modify_event(int efd, struct hyper_event *de, int flag);
+int hyper_requeue_event(int efd, struct hyper_event *ev);
 int hyper_init_event(struct hyper_event *de, struct hyper_event_ops *ops,
 		     void *arg);
 int hyper_handle_event(int efd, struct epoll_event *event);
 void hyper_reset_event(struct hyper_event *de);
 void hyper_event_hup(struct hyper_event *de, int efd);
-int hyper_event_read(struct hyper_event *de);
+int hyper_event_write(struct hyper_event *de, int efd);
-int hyper_event_write(struct hyper_event *de);
 #endif

src/exec.h

@@ -4,37 +4,49 @@
 #include "list.h"
 #include "event.h"
 
+struct env {
+	char	*env;
+	char	*value;
+};
+
 struct hyper_exec {
 	struct list_head	list;
-	struct hyper_event	e;
+	struct hyper_pod	*pod;
-	struct hyper_event	errev;
+
-	char			*id;
+	struct hyper_event	stdinev;
-	char			**argv;
+	struct hyper_event	stdoutev;
-	int			argc;
+	struct hyper_event	stderrev;
-	uint64_t		seq;
-	uint64_t		errseq;
 	int			pid;
 	int			ptyno;
 	int			init;
 	int			ptyfd;
-	int			errfd;
+	uint8_t			close_stdin_request;
 	uint8_t			code;
 	uint8_t			exit;
 	uint8_t			ref;
+
+	// configs
+	char			*container_id;
+	char			*user;
+	char			*group;
+	char			**additional_groups;
+	int			nr_additional_groups;
+	struct env		*envs;
+	int			envs_num;
+	char			**argv;
+	int			argc;
+	int			tty; // use tty or not
+	uint64_t		seq;
+	uint64_t		errseq;
+	char			*workdir;
 };
 
 struct hyper_pod;
 
 int hyper_exec_cmd(char *json, int length);
-int hyper_release_exec(struct hyper_exec *, struct hyper_pod *);
+int hyper_run_process(struct hyper_exec *e);
-int hyper_container_execcmd(struct hyper_pod *pod);
-int hyper_setup_exec_tty(struct hyper_exec *e);
-int hyper_dup_exec_tty(int fd, struct hyper_exec *e);
 struct hyper_exec *hyper_find_exec_by_pid(struct list_head *head, int pid);
 struct hyper_exec *hyper_find_exec_by_seq(struct hyper_pod *pod, uint64_t seq);
 int hyper_handle_exec_exit(struct hyper_pod *pod, int pid, uint8_t code);
-int hyper_watch_exec_pty(struct hyper_exec *exec, struct hyper_pod *pod);
-void hyper_cleanup_exec(struct hyper_pod *pod);
 
-extern struct hyper_event_ops pts_ops;
 #endif

src/hyper.h

@@ -2,45 +2,26 @@
 #define _HYPER_H_
 
 #include <stdint.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 
+#include "api.h"
 #include "net.h"
 #include "list.h"
 #include "exec.h"
 #include "event.h"
 #include "container.h"
+#include "portmapping.h"
 
-enum {
+/* Path to rootfs shared directory */
-	RESERVED,
+#define SHARED_DIR "/tmp/hyper/shared"
-	STARTPOD,
-	GETPOD,
-	STOPPOD,
-	DESTROYPOD,
-	RESTARTCONTAINER,
-	EXECCMD,
-	CMDFINISHED,
-	READY,
-	ACK,
-	ERROR,
-	WINSIZE,
-	PING,
-	PODFINISHED,
-	NEXT,
-	WRITEFILE,
-	READFILE,
-	NEWCONTAINER,
-	KILLCONTAINER,
-};
-
-enum {
-	POLICY_NEVER,
-	POLICY_ALWAYS,
-	POLICY_ONFAILURE,
-};
 
 struct hyper_pod {
-	struct hyper_container	*c;
 	struct hyper_interface	*iface;
 	struct hyper_route	*rt;
+	struct portmapping_white_list	*portmap_white_lists;
 	char			**dns;
 	struct list_head	containers;
 	struct list_head	exec_head;
@@ -49,54 +30,63 @@ struct hyper_pod {
 	int			init_pid;
 	uint32_t		i_num;
 	uint32_t		r_num;
-	uint32_t		e_num;
 	uint32_t		d_num;
-	uint32_t		type;
 	/* how many containers are running */
 	uint32_t		remains;
-	uint8_t			policy;
+	int			req_destroy;
 	int			efd;
-	struct hyper_event	sig;
+};
+
+struct portmapping_white_list {
+	char **internal_networks;
+	char **external_networks;
+	uint32_t i_num;
+	uint32_t e_num;
 };
 
 struct hyper_win_size {
-	char		*tty;
 	int		row;
 	int		column;
 	uint64_t	seq;
 };
 
-struct hyper_killer {
+struct file_command {
-	char		*id;
-	int		signal;
-};
-
-struct hyper_reader {
 	char		*id;
 	char		*file;
 };
 
-struct hyper_writter {
-	char		*id;
-	char		*file;
-	uint8_t		*data;
-	int		len;
-};
-
 struct hyper_ctl {
 	int			efd;
-	struct hyper_event	sig;
 	struct hyper_event	tty;
 	struct hyper_event	chan;
 };
 
-int hyper_mkdir(char *hyper_path);
+static inline int hyper_symlink(char *oldpath, char *newpath)
+{
+	return symlink(oldpath, newpath);
+}
+
+static inline int hyper_unlink(char *hyper_path)
+{
+	return unlink(hyper_path);
+}
+
+static inline int hyper_create(char *hyper_path)
+{
+	int fd = creat(hyper_path, 0755);
+	if (fd < 0)
+		return -1;
+
+	close(fd);
+	return 0;
+}
+
 int hyper_open_serial(char *tty);
-struct hyper_container *hyper_find_container(struct hyper_pod *pod, char *id);
-int hyper_start_containers(struct hyper_pod *pod);
 void hyper_cleanup_pod(struct hyper_pod *pod);
+int hyper_enter_sandbox(struct hyper_pod *pod, int pidpipe);
+void hyper_pod_destroyed(int failed);
 
 extern struct hyper_pod global_pod;
 extern struct hyper_ctl ctl;
-extern struct hyper_exec *global_exec;
+extern sigset_t orig_mask;
 #endif

src/net.c

@@ -11,6 +11,7 @@
 
 #include "hyper.h"
 #include "util.h"
+#include "parse.h"
 #include "../config.h"
 
 void hyper_set_be32(uint8_t *buf, uint32_t val)
@@ -47,7 +48,6 @@ int hyper_send_data(int fd, uint8_t *data, uint32_t len)
 
 	while (length < len) {
 		size = write(fd, data + length, len - length);
-
 		if (size <= 0) {
 			if (errno == EINTR)
 				continue;
@@ -98,7 +98,6 @@ int hyper_get_type(int fd, uint32_t *type)
 
 	while (len < 8) {
 		size = read(fd, buf + len, 8 - len);
-
 		if (size <= 0) {
 			if (errno == EINTR)
 				continue;
@@ -178,7 +177,7 @@ static int addattr_l(struct nlmsghdr *n, int maxlen, int type, void *data, int a
 static int hyper_get_ifindex(char *nic)
 {
 	int fd, ifindex = -1;
-	char path[512], buf[4];
+	char path[512], buf[8];
 
 	fprintf(stdout, "net device %s\n", nic);
 	sprintf(path, "/sys/class/net/%s/ifindex", nic);
@@ -191,7 +190,7 @@ static int hyper_get_ifindex(char *nic)
 	}
 
 	memset(buf, 0, sizeof(buf));
-	if (read(fd, buf, sizeof(buf)) <= 0) {
+	if (read(fd, buf, sizeof(buf) - 1) <= 0) {
 		perror("can read open file");
 		goto out;
 	}
@@ -429,8 +428,13 @@ static int hyper_setup_route(struct rtnl_handle *rth,
 	}
 
 	if (rt->device) {
-		rt->ifindex = hyper_get_ifindex(rt->device);
+		int ifindex = hyper_get_ifindex(rt->device);
-		if (addattr_l(&req.n, sizeof(req), RTA_OIF, &rt->ifindex, 4)) {
+		if (ifindex < 0) {
+			fprintf(stderr, "failed to get the ifindix of %s\n", rt->device);
+			return -1;
+		}
+
+		if (addattr_l(&req.n, sizeof(req), RTA_OIF, &ifindex, 4)) {
 			fprintf(stderr, "setup oif attr failed\n");
 			return -1;
 		}
@@ -512,7 +516,13 @@ static int hyper_cleanup_route(struct rtnl_handle *rth, struct hyper_route *rt)
 	}
 
 	if (rt->device) {
-		if (addattr_l(&req.n, sizeof(req), RTA_OIF, &rt->ifindex, 4)) {
+		int ifindex = hyper_get_ifindex(rt->device);
+		if (ifindex < 0) {
+			fprintf(stderr, "failed to get the ifindix of %s\n", rt->device);
+			return -1;
+		}
+
+		if (addattr_l(&req.n, sizeof(req), RTA_OIF, &ifindex, 4)) {
 			fprintf(stderr, "setup oif attr failed\n");
 			return -1;
 		}
@@ -555,6 +565,44 @@ static int hyper_cleanup_route(struct rtnl_handle *rth, struct hyper_route *rt)
 	return 0;
 }
 
+static int hyper_set_interface_name(struct rtnl_handle *rth,
+				int ifindex,
+				char *new_device_name)
+{
+	struct {
+                struct nlmsghdr n;
+                struct ifinfomsg i;
+                char buf[1024];
+        } req;
+
+	if (ifindex < 0 || !new_device_name) {
+		return -1;
+	}
+
+	memset(&req, 0, sizeof(req));
+	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
+	req.n.nlmsg_flags = NLM_F_REQUEST;
+	req.n.nlmsg_type = RTM_SETLINK;
+
+	req.i.ifi_family = AF_UNSPEC;
+	req.i.ifi_change = 0xFFFFFFFF;
+	req.i.ifi_index = ifindex;
+
+	if (addattr_l(&req.n, sizeof(req), IFLA_IFNAME, 
+			new_device_name,
+			strlen(new_device_name) + 1)) {
+                fprintf(stderr, "setup attr failed\n");
+                return -1;
+        }
+
+	if (rtnl_talk(rth, &req.n, 0, 0, NULL) < 0) {
+		perror("rtnl_talk failed");
+		return -1;
+	}
+
+	return 0;
+}
+
 static int hyper_setup_interface(struct rtnl_handle *rth,
 			       struct hyper_interface *iface)
 {
@@ -565,6 +613,7 @@ static int hyper_setup_interface(struct rtnl_handle *rth,
 		struct ifaddrmsg ifa;
 		char buf[256];
 	} req;
+	int ifindex;
 
 	if (!(iface->device && iface->ipaddr && iface->mask)) {
 		fprintf(stderr, "interface information incorrect\n");
@@ -577,8 +626,13 @@ static int hyper_setup_interface(struct rtnl_handle *rth,
 	req.n.nlmsg_type = RTM_NEWADDR;
 	req.ifa.ifa_family = AF_INET;
 
-	iface->ifindex = hyper_get_ifindex(iface->device);
+	ifindex = hyper_get_ifindex(iface->device);
-	req.ifa.ifa_index = iface->ifindex;
+	if (ifindex < 0) {
+		fprintf(stderr, "failed to get the ifindix of %s\n", iface->device);
+		return -1;
+	}
+
+	req.ifa.ifa_index = ifindex;
 	req.ifa.ifa_scope = 0;
 
 	if (get_addr_ipv4((uint8_t *)&data, iface->ipaddr) <= 0) {
@@ -603,8 +657,13 @@ static int hyper_setup_interface(struct rtnl_handle *rth,
 		return -1;
 	}
 
-	if (hyper_up_nic(rth, iface->ifindex) < 0) {
+	if (iface->new_device_name && strcmp(iface->new_device_name, iface->device)) {
-		fprintf(stderr, "up device %d failed\n", iface->ifindex);
+		fprintf(stdout, "Setting interface name to %s\n", iface->new_device_name);
+		hyper_set_interface_name(rth, ifindex, iface->new_device_name);
+	}
+
+	if (hyper_up_nic(rth, ifindex) < 0) {
+		fprintf(stderr, "up device %d failed\n", ifindex);
 		return -1;
 	}
 
@@ -621,6 +680,7 @@ static int hyper_cleanup_interface(struct rtnl_handle *rth,
 		struct ifaddrmsg ifa;
 		char buf[256];
 	} req;
+	int ifindex;
 
 	if (!(iface->device && iface->ipaddr && iface->mask)) {
 		fprintf(stderr, "interface information incorrect\n");
@@ -633,7 +693,13 @@ static int hyper_cleanup_interface(struct rtnl_handle *rth,
 	req.n.nlmsg_type = RTM_DELADDR;
 	req.ifa.ifa_family = AF_INET;
 
-	req.ifa.ifa_index = iface->ifindex;
+	ifindex = hyper_get_ifindex(iface->device);
+	if (ifindex < 0) {
+		fprintf(stderr, "failed to get the ifindix of %s\n", iface->device);
+		return -1;
+	}
+
+	req.ifa.ifa_index = ifindex;
 	req.ifa.ifa_scope = 0;
 
 	if (get_addr_ipv4((uint8_t *)&data, iface->ipaddr) <= 0) {
@@ -663,8 +729,8 @@ static int hyper_cleanup_interface(struct rtnl_handle *rth,
 		return 0;
 	}
 
-	if (hyper_down_nic(rth, iface->ifindex) < 0) {
+	if (hyper_down_nic(rth, ifindex) < 0) {
-		fprintf(stderr, "up device %d failed\n", iface->ifindex);
+		fprintf(stderr, "up device %d failed\n", ifindex);
 		return -1;
 	}
 
@@ -783,6 +849,69 @@ void hyper_cleanup_network(struct hyper_pod *pod)
 	netlink_close(&rth);
 }
 
+int hyper_cmd_setup_interface(char *json, int length)
+{
+	int ret = -1;
+	struct hyper_interface *iface;
+	struct rtnl_handle rth;
+
+	if (hyper_rescan() < 0)
+		return -1;
+
+	if (netlink_open(&rth) < 0)
+		return -1;
+
+
+	iface = hyper_parse_setup_interface(json, length);
+	if (iface == NULL) {
+		fprintf(stderr, "parse interface failed\n");
+		goto out;
+	}
+	ret = hyper_setup_interface(&rth, iface);
+	if (ret < 0) {
+		fprintf(stderr, "link up device %s failed\n", iface->device);
+		goto out1;
+	}
+	ret = 0;
+out1:
+	free(iface->device);
+	free(iface->ipaddr);
+	free(iface->mask);
+	free(iface);
+out:
+	netlink_close(&rth);
+	return ret;
+}
+
+int hyper_cmd_setup_route(char *json, int length) {
+	struct hyper_route *rts = NULL;
+	int i, ret = -1;
+	uint32_t r_num;
+	struct rtnl_handle rth;
+
+	if (netlink_open(&rth) < 0)
+		return -1;
+
+	if (hyper_parse_setup_routes(&rts, &r_num, json, length) < 0) {
+		fprintf(stderr, "parse route failed\n");
+		goto out;
+	}
+
+	for (i = 0; i < r_num; i++) {
+		ret = hyper_setup_route(&rth, &rts[i]);
+		if (ret < 0) {
+			fprintf(stderr, "setup route failed\n");
+			goto out;
+		}
+	}
+
+	ret = 0;
+out:
+	netlink_close(&rth);
+	free(rts);
+	return ret;
+}
+
 int hyper_setup_dns(struct hyper_pod *pod)
 {
 	int i, fd, ret = -1;
@@ -827,6 +956,9 @@ void hyper_cleanup_dns(struct hyper_pod *pod)
 {
 	int fd, i;
 
+	if (pod->dns == NULL)
+		return;
+
 	for (i = 0; i < pod->d_num; i++) {
 		free(pod->dns[i]);
 	}

src/net.h

@@ -18,26 +18,17 @@ struct rtnl_handle {
 	__u32 dump;
 };
 
-typedef struct {
-	__u8 family;
-	__u8 bytelen;
-	__s16 bitlen;
-	__u32 flags;
-	__u32 data[8];
-} inet_prefix;
-
 struct hyper_interface {
 	char		*device;
-	int		ifindex;
 	char		*ipaddr;
 	char		*mask;
+	char            *new_device_name;
 };
 
 struct hyper_route {
 	char		*dst;
 	char		*gw;
 	char		*device;
-	int		ifindex;
 };
 
 struct hyper_pod;
@@ -47,6 +38,8 @@ uint32_t hyper_get_be32(uint8_t *buf);
 void hyper_set_be64(uint8_t *buf, uint64_t val);
 uint64_t hyper_get_be64(uint8_t *buf);
 int hyper_setup_network(struct hyper_pod *pod);
+int hyper_cmd_setup_interface(char *json, int length);
+int hyper_cmd_setup_route(char *json, int length);
 void hyper_cleanup_network(struct hyper_pod *pod);
 int hyper_setup_dns(struct hyper_pod *pod);
 void hyper_cleanup_dns(struct hyper_pod *pod);

src/parse.h

@@ -3,16 +3,18 @@
 
 #include "hyper.h"
 #include "jsmn.h"
+#include "parson.h"
 
 int hyper_parse_pod(struct hyper_pod *pod, char *json, int length);
 struct hyper_exec *hyper_parse_execcmd(char *json, int length);
 char *json_token_str(char *js, jsmntok_t *t);
 int json_token_streq(char *js, jsmntok_t *t, char *s);
 int hyper_parse_winsize(struct hyper_win_size *ws, char *json, int length);
-int hyper_parse_kill_container(struct hyper_killer *killer, char *json, int length);
+int hyper_parse_file_command(struct file_command *cmd, char *json, int length);
-int hyper_parse_write_file(struct hyper_writter *writter, char *json, int length);
-int hyper_parse_read_file(struct hyper_reader *reader, char *json, int length);
 struct hyper_container *hyper_parse_new_container(struct hyper_pod *pod, char *json, int length);
 void hyper_free_container(struct hyper_container *c);
+struct hyper_interface *hyper_parse_setup_interface(char *json, int length);
+int hyper_parse_setup_routes(struct hyper_route **routes, uint32_t *r_num, char *json, int length);
+JSON_Value *hyper_json_parse(char *json, int length);
 
 #endif

src/parson.h

@@ -0,0 +1,223 @@
+/*
+ Parson ( http://kgabis.github.com/parson/ )
+ Copyright (c) 2012 - 2016 Krzysztof Gabis
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+*/
+
+#ifndef parson_parson_h
+#define parson_parson_h
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include <stddef.h>   /* size_t */
+
+/* Types and enums */
+typedef struct json_object_t JSON_Object;
+typedef struct json_array_t  JSON_Array;
+typedef struct json_value_t  JSON_Value;
+
+enum json_value_type {
+    JSONError   = -1,
+    JSONNull    = 1,
+    JSONString  = 2,
+    JSONNumber  = 3,
+    JSONObject  = 4,
+    JSONArray   = 5,
+    JSONBoolean = 6
+};
+typedef int JSON_Value_Type;
+
+enum json_result_t {
+    JSONSuccess = 0,
+    JSONFailure = -1
+};
+typedef int JSON_Status;
+
+typedef void * (*JSON_Malloc_Function)(size_t);
+typedef void   (*JSON_Free_Function)(void *);
+
+/* Call only once, before calling any other function from parson API. If not called, malloc and free
+   from stdlib will be used for all allocations */
+void json_set_allocation_functions(JSON_Malloc_Function malloc_fun, JSON_Free_Function free_fun);
+
+/* Parses first JSON value in a file, returns NULL in case of error */
+JSON_Value * json_parse_file(const char *filename);
+
+/* Parses first JSON value in a file and ignores comments (/ * * / and //),
+   returns NULL in case of error */
+JSON_Value * json_parse_file_with_comments(const char *filename);
+
+/*  Parses first JSON value in a string, returns NULL in case of error */
+JSON_Value * json_parse_string(const char *string);
+
+/*  Parses first JSON value in a string and ignores comments (/ * * / and //),
+    returns NULL in case of error */
+JSON_Value * json_parse_string_with_comments(const char *string);
+
+/* Serialization */
+size_t      json_serialization_size(const JSON_Value *value); /* returns 0 on fail */
+JSON_Status json_serialize_to_buffer(const JSON_Value *value, char *buf, size_t buf_size_in_bytes);
+JSON_Status json_serialize_to_file(const JSON_Value *value, const char *filename);
+char *      json_serialize_to_string(const JSON_Value *value);
+
+/* Pretty serialization */
+size_t      json_serialization_size_pretty(const JSON_Value *value); /* returns 0 on fail */
+JSON_Status json_serialize_to_buffer_pretty(const JSON_Value *value, char *buf, size_t buf_size_in_bytes);
+JSON_Status json_serialize_to_file_pretty(const JSON_Value *value, const char *filename);
+char *      json_serialize_to_string_pretty(const JSON_Value *value);
+
+void        json_free_serialized_string(char *string); /* frees string from json_serialize_to_string and json_serialize_to_string_pretty */
+
+/* Comparing */
+int  json_value_equals(const JSON_Value *a, const JSON_Value *b);
+
+/* Validation
+   This is *NOT* JSON Schema. It validates json by checking if object have identically
+   named fields with matching types.
+   For example schema {"name":"", "age":0} will validate
+   {"name":"Joe", "age":25} and {"name":"Joe", "age":25, "gender":"m"},
+   but not {"name":"Joe"} or {"name":"Joe", "age":"Cucumber"}.
+   In case of arrays, only first value in schema is checked against all values in tested array.
+   Empty objects ({}) validate all objects, empty arrays ([]) validate all arrays,
+   null validates values of every type.
+ */
+JSON_Status json_validate(const JSON_Value *schema, const JSON_Value *value);
+
+/*
+ * JSON Object
+ */
+JSON_Value  * json_object_get_value  (const JSON_Object *object, const char *name);
+const char  * json_object_get_string (const JSON_Object *object, const char *name);
+JSON_Object * json_object_get_object (const JSON_Object *object, const char *name);
+JSON_Array  * json_object_get_array  (const JSON_Object *object, const char *name);
+double        json_object_get_number (const JSON_Object *object, const char *name); /* returns 0 on fail */
+int           json_object_get_boolean(const JSON_Object *object, const char *name); /* returns -1 on fail */
+
+/* dotget functions enable addressing values with dot notation in nested objects,
+ just like in structs or c++/java/c# objects (e.g. objectA.objectB.value).
+ Because valid names in JSON can contain dots, some values may be inaccessible
+ this way. */
+JSON_Value  * json_object_dotget_value  (const JSON_Object *object, const char *name);
+const char  * json_object_dotget_string (const JSON_Object *object, const char *name);
+JSON_Object * json_object_dotget_object (const JSON_Object *object, const char *name);
+JSON_Array  * json_object_dotget_array  (const JSON_Object *object, const char *name);
+double        json_object_dotget_number (const JSON_Object *object, const char *name); /* returns 0 on fail */
+int           json_object_dotget_boolean(const JSON_Object *object, const char *name); /* returns -1 on fail */
+
+/* Functions to get available names */
+size_t        json_object_get_count   (const JSON_Object *object);
+const char  * json_object_get_name    (const JSON_Object *object, size_t index);
+JSON_Value  * json_object_get_value_at(const JSON_Object *object, size_t index);
+
+/* Creates new name-value pair or frees and replaces old value with a new one.
+ * json_object_set_value does not copy passed value so it shouldn't be freed afterwards. */
+JSON_Status json_object_set_value(JSON_Object *object, const char *name, JSON_Value *value);
+JSON_Status json_object_set_string(JSON_Object *object, const char *name, const char *string);
+JSON_Status json_object_set_number(JSON_Object *object, const char *name, double number);
+JSON_Status json_object_set_boolean(JSON_Object *object, const char *name, int boolean);
+JSON_Status json_object_set_null(JSON_Object *object, const char *name);
+
+/* Works like dotget functions, but creates whole hierarchy if necessary.
+ * json_object_dotset_value does not copy passed value so it shouldn't be freed afterwards. */
+JSON_Status json_object_dotset_value(JSON_Object *object, const char *name, JSON_Value *value);
+JSON_Status json_object_dotset_string(JSON_Object *object, const char *name, const char *string);
+JSON_Status json_object_dotset_number(JSON_Object *object, const char *name, double number);
+JSON_Status json_object_dotset_boolean(JSON_Object *object, const char *name, int boolean);
+JSON_Status json_object_dotset_null(JSON_Object *object, const char *name);
+
+/* Frees and removes name-value pair */
+JSON_Status json_object_remove(JSON_Object *object, const char *name);
+
+/* Works like dotget function, but removes name-value pair only on exact match. */
+JSON_Status json_object_dotremove(JSON_Object *object, const char *key);
+
+/* Removes all name-value pairs in object */
+JSON_Status json_object_clear(JSON_Object *object);
+
+/*
+ *JSON Array
+ */
+JSON_Value  * json_array_get_value  (const JSON_Array *array, size_t index);
+const char  * json_array_get_string (const JSON_Array *array, size_t index);
+JSON_Object * json_array_get_object (const JSON_Array *array, size_t index);
+JSON_Array  * json_array_get_array  (const JSON_Array *array, size_t index);
+double        json_array_get_number (const JSON_Array *array, size_t index); /* returns 0 on fail */
+int           json_array_get_boolean(const JSON_Array *array, size_t index); /* returns -1 on fail */
+size_t        json_array_get_count  (const JSON_Array *array);
+
+/* Frees and removes value at given index, does nothing and returns JSONFailure if index doesn't exist.
+ * Order of values in array may change during execution.  */
+JSON_Status json_array_remove(JSON_Array *array, size_t i);
+
+/* Frees and removes from array value at given index and replaces it with given one.
+ * Does nothing and returns JSONFailure if index doesn't exist.
+ * json_array_replace_value does not copy passed value so it shouldn't be freed afterwards. */
+JSON_Status json_array_replace_value(JSON_Array *array, size_t i, JSON_Value *value);
+JSON_Status json_array_replace_string(JSON_Array *array, size_t i, const char* string);
+JSON_Status json_array_replace_number(JSON_Array *array, size_t i, double number);
+JSON_Status json_array_replace_boolean(JSON_Array *array, size_t i, int boolean);
+JSON_Status json_array_replace_null(JSON_Array *array, size_t i);
+
+/* Frees and removes all values from array */
+JSON_Status json_array_clear(JSON_Array *array);
+
+/* Appends new value at the end of array.
+ * json_array_append_value does not copy passed value so it shouldn't be freed afterwards. */
+JSON_Status json_array_append_value(JSON_Array *array, JSON_Value *value);
+JSON_Status json_array_append_string(JSON_Array *array, const char *string);
+JSON_Status json_array_append_number(JSON_Array *array, double number);
+JSON_Status json_array_append_boolean(JSON_Array *array, int boolean);
+JSON_Status json_array_append_null(JSON_Array *array);
+
+/*
+ *JSON Value
+ */
+JSON_Value * json_value_init_object (void);
+JSON_Value * json_value_init_array  (void);
+JSON_Value * json_value_init_string (const char *string); /* copies passed string */
+JSON_Value * json_value_init_number (double number);
+JSON_Value * json_value_init_boolean(int boolean);
+JSON_Value * json_value_init_null   (void);
+JSON_Value * json_value_deep_copy   (const JSON_Value *value);
+void         json_value_free        (JSON_Value *value);
+
+JSON_Value_Type json_value_get_type   (const JSON_Value *value);
+JSON_Object *   json_value_get_object (const JSON_Value *value);
+JSON_Array  *   json_value_get_array  (const JSON_Value *value);
+const char  *   json_value_get_string (const JSON_Value *value);
+double          json_value_get_number (const JSON_Value *value);
+int             json_value_get_boolean(const JSON_Value *value);
+
+/* Same as above, but shorter */
+JSON_Value_Type json_type   (const JSON_Value *value);
+JSON_Object *   json_object (const JSON_Value *value);
+JSON_Array  *   json_array  (const JSON_Value *value);
+const char  *   json_string (const JSON_Value *value);
+double          json_number (const JSON_Value *value);
+int             json_boolean(const JSON_Value *value);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/portmapping.c

@@ -0,0 +1,417 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <limits.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/wait.h>
+#include <sys/utsname.h>
+#include <arpa/inet.h>
+#include <fcntl.h>
+
+#include "hyper.h"
+#include "util.h"
+#include "../config.h"
+
+int hyper_init_modules() 
+{
+	int status = hyper_cmd("depmod");
+	if (status != 0) {
+		fprintf(stderr, "depmod failed, status: %d\n", status);
+		return -1;
+	}
+
+	return 0;
+}
+
+int hyper_setup_iptables_rule(struct ipt_rule rule)
+{
+	char check_cmd[512] = {0};
+	char cmd[512] = {0};
+	int check = -1;
+
+	if (rule.rule != NULL) {
+		sprintf(check_cmd, "iptables -t %s -C %s %s", rule.table, rule.chain, rule.rule);
+		sprintf(cmd, "iptables -t %s %s %s %s", rule.table, rule.op, rule.chain, rule.rule);
+	} else {
+		sprintf(cmd, "iptables -t %s %s %s", rule.table, rule.op, rule.chain);
+	}
+
+	if (strlen(check_cmd) > 0) {
+		check = hyper_cmd(check_cmd);
+		fprintf(stdout, "check iptables '%s', ret: %d\n", check_cmd, check);
+	}
+
+	if (check == 0) {
+		// iptables rule already exist, do not insert it again
+		if (!strncmp(rule.op, "-A", strlen("-A")) ||
+			!strncmp(rule.op, "-I", strlen("-I")) ||
+			!strncmp(rule.op, "-N", strlen("-N"))) {
+			fprintf(stdout, "iptables rule '%s' already exist\n", rule.rule);
+			return 0;
+		}
+	}
+
+	int status = hyper_cmd(cmd);
+	fprintf(stdout, "insert iptables '%s', ret: %d\n", cmd, status);
+	if (status != 0) {
+		fprintf(stderr, "insert iptables rule failed, ret: %d\n", status);
+		return -1;
+	}
+
+	return 0;
+}
+
+// initialize modules and iptables chains
+int hyper_setup_portmapping(struct hyper_pod *pod)
+{
+	const char *connmax = "10485760";
+	const char *timeout = "300";
+
+	if (pod->portmap_white_lists == NULL || (pod->portmap_white_lists->i_num == 0 &&
+			pod->portmap_white_lists->e_num == 0)) {
+		return 0;
+	}
+
+	if (hyper_init_modules() < 0) {
+		return -1;
+	}
+
+	// iptables -t filter -N hyperstart-INPUT
+	// iptables -t nat -N hyperstart-PREROUTING
+	// iptables -t filter -I INPUT -j hyperstart-INPUT
+	// iptables -t nat -I PREROUTING -j hyperstart-PREROUTING
+	// iptables -t filter -A hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -p icmp -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -i lo -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -j DROP
+	// iptables -t nat -A hyperstart-PREROUTING -j RETURN
+	const struct ipt_rule rules[] = {
+		{
+			.table = "filter",
+			.op = "-N",
+			.chain = "hyperstart-INPUT",
+			.rule = NULL,
+		},
+		{
+			.table = "nat",
+			.op = "-N",
+			.chain = "hyperstart-PREROUTING",
+			.rule = NULL,
+		},
+		{
+			.table = "filter",
+			.op = "-I",
+			.chain = "INPUT",
+			.rule = "-j hyperstart-INPUT",
+		},
+		{
+			.table = "nat",
+			.op = "-I",
+			.chain = "PREROUTING",
+			.rule = "-j hyperstart-PREROUTING",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-p icmp -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-i lo -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-j DROP",
+		},
+		{
+			.table = "nat",
+			.op = "-A",
+			.chain = "hyperstart-PREROUTING",
+			.rule = "-j RETURN",
+		},
+	};
+
+	int i = 0;
+	for(i=0; i< sizeof(rules)/sizeof(struct ipt_rule); i++) {
+		if (hyper_setup_iptables_rule(rules[i])<0) {
+			return -1;
+		}
+	}
+
+	/* portmapping enables nf_conntrack by default, should blow up nf_conntack_max to make sure
+	 * nf_conntrack is available for connections. */
+	if (hyper_write_file("/proc/sys/net/nf_conntrack_max", connmax, strlen(connmax)) < 0) {
+		fprintf(stderr, "sysctl: setup default nf_conntrack_max(%s) failed\n", connmax);
+	}
+
+	if (hyper_write_file("/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established", timeout, strlen(timeout)) < 0) {
+		fprintf(stderr, "sysctl: setup default nf_conntrack_tcp_timeout_established(%s) failed\n", timeout);
+	}
+
+	return 0;
+}
+
+void hyper_cleanup_portmapping(struct hyper_pod *pod)
+{
+	if (pod->portmap_white_lists == NULL || (pod->portmap_white_lists->i_num == 0 &&
+			pod->portmap_white_lists->e_num == 0)) {
+		return;
+	}
+
+	// iptables -t filter -D hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -p icmp -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -i lo -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -j DROP
+	// iptables -t filter -D INPUT -j hyperstart-DNPUT
+	// iptables -t nat -D hyperstart-PREROUTING -j RETURN
+	// iptables -t nat -D PREROUTING -j hyperstart-PREROUTING
+	// iptables -t filter -F hyperstart-INPUT
+	// iptables -t nat -F hyperstart-PREROUTING
+	// iptables -t filter -X hyperstart-INPUT
+	// iptables -t nat -X hyperstart-PREROUTING
+	const struct ipt_rule rules[] = {
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-p icmp -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-i lo -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-j DROP",
+		},
+		{
+			.table = "nat",
+			.op = "-D",
+			.chain = "hyperstart-PREROUTING",
+			.rule = "-j RETURN",
+		},
+		{
+			.table = "nat",
+			.op = "-D",
+			.chain = "PREROUTING",
+			.rule = "-j hyperstart-PREROUTING",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "INPUT",
+			.rule = "-j hyperstart-INPUT",
+		},
+		{
+			.table = "nat",
+			.op = "-F",
+			.chain = "hyperstart-PREROUTING",
+			.rule = NULL,
+		},
+		{
+			.table = "nat",
+			.op = "-X",
+			.chain = "hyperstart-PREROUTING",
+			.rule = NULL,
+		},
+		{
+			.table = "filter",
+			.op = "-F",
+			.chain = "hyperstart-INPUT",
+			.rule = NULL,
+		},
+		{
+			.table = "filter",
+			.op = "-X",
+			.chain = "hyperstart-INPUT",
+			.rule = NULL,
+		},
+	};
+
+	int i = 0;
+	for(i=0; i< sizeof(rules)/sizeof(struct ipt_rule); i++) {
+		if (hyper_setup_iptables_rule(rules[i])<0) {
+			return;
+		}
+	}
+
+	free(pod->portmap_white_lists->internal_networks);
+	free(pod->portmap_white_lists->external_networks);
+	free(pod->portmap_white_lists);
+	pod->portmap_white_lists = NULL;
+}
+
+int hyper_setup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod)
+{
+	if (pod->portmap_white_lists == NULL || (pod->portmap_white_lists->i_num == 0 &&
+			pod->portmap_white_lists->e_num == 0)) {
+		return 0;
+	}
+
+	// only allow network request from internal white list
+	int i = 0, j = 0;
+	char rule[128] = {0};
+	for (j=0; j<pod->portmap_white_lists->i_num; j++) {
+		sprintf(rule, "-s %s -j ACCEPT",
+			pod->portmap_white_lists->internal_networks[j]);
+		struct ipt_rule accept_rule = {
+			.table = "filter",
+			.op = "-I",
+			.chain = "hyperstart-INPUT",
+			.rule = rule,
+		};
+		if (hyper_setup_iptables_rule(accept_rule)<0) {
+			fprintf(stderr, "setup accept_rule '%s' failed\n", rule);
+			return -1;
+		}
+	}
+
+	if (c->ports_num == 0) {
+		return 0;
+	}
+
+	char *network = NULL;
+	for (i=0; i<c->ports_num; i++) {
+		// setup port mapping only if host_port is set
+		if (c->ports[i].host_port > 0) {
+			for (j=0; j<pod->portmap_white_lists->e_num; j++) {
+				network = pod->portmap_white_lists->external_networks[j];
+
+				// redirect host_port to container_port
+				if (c->ports[i].host_port != c->ports[i].container_port) {
+					sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
+						network,
+						c->ports[i].protocol,
+						c->ports[i].protocol,
+						c->ports[i].host_port,
+						c->ports[i].container_port);
+					struct ipt_rule redirect_rule = {
+						.table = "nat",
+						.op = "-I",
+						.chain = "hyperstart-PREROUTING",
+						.rule = rule,
+					};
+					if (hyper_setup_iptables_rule(redirect_rule)<0) {
+						fprintf(stderr, "setup redirect_rule '%s' failed\n", rule);
+						return -1;
+					}
+				}
+
+				// open container_port to external network
+				sprintf(rule, "-s %s -p %s -m %s --dport %d -j ACCEPT",
+					network,
+					c->ports[i].protocol,
+					c->ports[i].protocol,
+					c->ports[i].container_port);
+				struct ipt_rule accept_rule = {
+					.table = "filter",
+					.op = "-I",
+					.chain = "hyperstart-INPUT",
+					.rule = rule,
+				};
+				if (hyper_setup_iptables_rule(accept_rule)<0) {
+					fprintf(stderr, "setup accept_rule '%s' failed\n", rule);
+					return -1;
+				}
+			}
+		}
+	}
+
+	return 0;
+}
+
+void hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod)
+{
+	if (pod->portmap_white_lists == NULL || (pod->portmap_white_lists->i_num == 0 &&
+			pod->portmap_white_lists->e_num == 0)) {
+		return;
+	}
+
+	int i = 0, j = 0;
+	char rule[128] = {0};
+	for (j=0; j<pod->portmap_white_lists->i_num; j++) {
+		sprintf(rule, "-s %s -j ACCEPT",
+			pod->portmap_white_lists->internal_networks[j]);
+		struct ipt_rule accept_rule = {
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = rule,
+		};
+		if (hyper_setup_iptables_rule(accept_rule)<0) {
+			fprintf(stderr, "cleanup accept_rule '%s' failed\n", rule);
+		}
+	}
+
+	if (c->ports_num == 0) {
+		return;
+	}
+
+	char *network = NULL;
+	for (i=0; i<c->ports_num; i++) {
+		// clean up port mapping only if host_port is set
+		if (c->ports[i].host_port > 0) {
+			for (j=0; j<pod->portmap_white_lists->e_num; j++) {
+				network = pod->portmap_white_lists->external_networks[j];
+
+				//  delete rules redirecting host_port to container_port
+				if (c->ports[i].host_port != c->ports[i].container_port) {
+					sprintf(rule, "-s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d",
+						network,
+						c->ports[i].protocol,
+						c->ports[i].protocol,
+						c->ports[i].host_port,
+						c->ports[i].container_port);
+					struct ipt_rule redirect_rule = {
+						.table = "nat",
+						.op = "-D",
+						.chain = "hyperstart-PREROUTING",
+						.rule = rule,
+					};
+					if (hyper_setup_iptables_rule(redirect_rule)<0) {
+						fprintf(stderr, "cleanup redirect '%s' failed\n", rule);
+					}
+				}
+
+				// open container_port to external network
+				sprintf(rule, "-s %s -p %s -m %s --dport %d -j ACCEPT",
+					network,
+					c->ports[i].protocol,
+					c->ports[i].protocol,
+					c->ports[i].container_port);
+				struct ipt_rule accept_rule = {
+					.table = "filter",
+					.op = "-D",
+					.chain = "hyperstart-INPUT",
+					.rule = rule,
+				};
+				if (hyper_setup_iptables_rule(accept_rule)<0) {
+					fprintf(stderr, "cleanup accept_rule '%s' failed\n", rule);
+				}
+			}
+		}
+	}
+}

src/portmapping.h

@@ -0,0 +1,23 @@
+#ifndef _PORT_MAPPING_H_
+#define _PORT_MAPPING_H_
+
+#include <stdio.h>
+#include <ctype.h>
+#include <stdint.h>
+#include <sys/types.h>
+
+struct ipt_rule {
+	char *table;
+	char *op;
+	char *chain;
+	char *rule;
+};
+
+struct hyper_pod;
+struct hyper_container;
+int hyper_setup_portmapping(struct hyper_pod *pod);
+void hyper_cleanup_portmapping(struct hyper_pod *pod);
+int hyper_setup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod);
+void hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod);
+
+#endif

src/util.c

@@ -9,11 +9,15 @@
 #include <errno.h>
 #include <signal.h>
 #include <ctype.h>
+#include <unistd.h>
 #include <mntent.h>
+#include <sys/wait.h>
 #include <sys/mount.h>
 #include <sys/socket.h>
 #include <sys/reboot.h>
 #include <linux/reboot.h>
+#include <grp.h>
+#include <pwd.h>
 
 #include "util.h"
 #include "hyper.h"
@@ -64,13 +68,34 @@ int hyper_list_dir(char *path)
 	return 0;
 }
 
-int hyper_find_sd(char *prefix, char *addr, char **dev) {
+int hyper_copy_dir(char *src, char *dest)
+{
+	char cmd[512];
+	snprintf(cmd, sizeof(cmd), "tar cf - -C %s . | tar fx - -C %s", src, dest);
+
+	return hyper_cmd(cmd);
+}
+
+void hyper_sync_time_hctosys() {
+	int pid;
+	pid = fork();
+	if (pid < 0) {
+		perror("fail to fork to copy directory");
+	} else if (pid == 0) {
+		execlp("hwclock", "hwclock", "-s", NULL);
+		perror("exec hwclock -s command failed");
+		exit(-1);
+	}
+}
+
+int hyper_find_sd(char *addr, char **dev)
+{
 	struct dirent **list;
 	struct dirent *dir;
 	char path[512];
 	int i, num;
 
-	sprintf(path, "%s/sys/class/scsi_disk/0:0:%s/device/block/", prefix, addr);
+	sprintf(path, "/sys/class/scsi_disk/0:0:%s/device/block/", addr);
 	fprintf(stdout, "orig dev %s, scan path %s\n", *dev, path);
 
 	num = scandir(path, &list, NULL, NULL);
@@ -86,7 +111,6 @@ int hyper_find_sd(char *prefix, char *addr, char **dev) {
 		}
 
 		fprintf(stdout, "%s get %s\n", path, dir->d_name);
-		free(*dev);
 		*dev = strdup(dir->d_name);
 		break;
 	}
@@ -98,46 +122,218 @@ int hyper_find_sd(char *prefix, char *addr, char **dev) {
 	return 0;
 }
 
-int hyper_mkdir(char *hyper_path)
+static unsigned long id_or_max(const char *name)
+{
+	char *ptr;
+	long id = strtol(name, &ptr, 10);
+	if (name == ptr || id < 0 || (errno != 0 && id == 0) || *ptr != '\0')
+		return ~0UL;
+	return id;
+}
+
+// the same as getpwnam(), but it only parses /etc/passwd and allows name to be id string
+struct passwd *hyper_getpwnam(const char *name)
+{
+	uid_t uid = (uid_t)id_or_max(name);
+	FILE *file = fopen("/etc/passwd", "r");
+	if (!file) {
+		perror("faile to open /etc/passwd");
+		return NULL;
+	}
+	for (;;) {
+		struct passwd *pwd = fgetpwent(file);
+		if (!pwd)
+			break;
+		if (!strcmp(pwd->pw_name, name) || pwd->pw_uid == uid) {
+			fclose(file);
+			return pwd;
+		}
+	}
+	fclose(file);
+	return NULL;
+}
+
+// the same as getgrnam(), but it only parses /etc/group and allows the name to be id string
+struct group *hyper_getgrnam(const char *name)
+{
+	gid_t gid = (gid_t)id_or_max(name);
+	FILE *file = fopen("/etc/group", "r");
+	if (!file) {
+		perror("faile to open /etc/group");
+		return NULL;
+	}
+	for (;;) {
+		struct group *gr = fgetgrent(file);
+		if (!gr)
+			break;
+		if (!strcmp(gr->gr_name, name) || gr->gr_gid == gid) {
+			fclose(file);
+			return gr;
+		}
+	}
+	fclose(file);
+	return NULL;
+}
+
+// the same as getgrouplist(), but it only parses /etc/group
+int hyper_getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups)
+{
+	int nr = 0, ret;
+	FILE *file = fopen("/etc/group", "r");
+	if (!file) {
+		perror("faile to open /etc/group");
+		return -1;
+	}
+	for (;;) {
+		struct group *gr = fgetgrent(file);
+		if (!gr)
+			break;
+		int j;
+		for (j = 0; gr->gr_mem && gr->gr_mem[j]; j++) {
+			if (!strcmp(gr->gr_mem[j], user)) {
+				if (nr + 1 < *ngroups)
+					groups[nr] = gr->gr_gid;
+				nr++;
+			}
+		}
+	}
+	fclose(file);
+	if (nr == 0) {
+		if (nr + 1 < *ngroups)
+			groups[nr] = group;
+		nr++;
+	}
+	ret = nr <= *ngroups ? nr : -1;
+	*ngroups = nr;
+	return ret;
+}
+
+int hyper_write_file(const char *path, const char *value, size_t len)
+{
+	size_t size = 0, l;
+	int fd = open(path, O_WRONLY);
+	if (fd < 0) {
+		perror("open file failed");
+		return -1;
+	}
+
+	while (size < len) {
+		l = write(fd, value + size, len - size);
+		if (l < 0) {
+			perror("fail to write to file");
+			close(fd);
+			return -1;
+		}
+		size += l;
+	}
+
+	close(fd);
+	return 0;
+}
+
+/* Trim all trailing '/' of a hyper_path except for the prefix one. */
+void hyper_filize(char *hyper_path)
+{
+	char *p;
+
+	if (strlen(hyper_path) == 0)
+		return;
+
+	p = &hyper_path[strlen(hyper_path) - 1];
+
+	for (; *p == '/' && p != hyper_path; p--) {
+		*p = '\0';
+	}
+}
+
+static int hyper_create_parent_dir(const char *hyper_path)
+{
+	char *p, *path = strdup(hyper_path);
+	int ret = 0;
+
+	if (path == NULL)
+		return -1;
+	p = strrchr(path, '/');
+	if (p != NULL && p != path) {
+		*p = '\0';
+		ret = hyper_mkdir(path, 0777);
+	}
+	free(path);
+
+	return ret;
+}
+
+/* hyper_path must point to a file rather than a directory, e.g., having trailing '/' */
+int hyper_create_file(const char *hyper_path)
+{
+	int fd;
+	struct stat stbuf;
+
+	if (stat(hyper_path, &stbuf) >= 0) {
+		if (S_ISREG(stbuf.st_mode))
+			return 0;
+		errno = S_ISDIR(stbuf.st_mode) ? EISDIR : EINVAL;
+		return -1;
+	}
+
+	if (hyper_create_parent_dir(hyper_path) < 0)
+		return -1;
+
+	fd = open(hyper_path, O_CREAT|O_WRONLY, 0666);
+	if (fd < 0)
+		return -1;
+	close(fd);
+	fprintf(stdout, "created file %s\n", hyper_path);
+	return 0;
+}
+
+int hyper_mkdir(char *hyper_path, mode_t mode)
 {
 	struct stat st;
 	char *p, *path = strdup(hyper_path);
 
 	if (path == NULL) {
 		errno = ENOMEM;
-		return -1;
+		goto fail;
 	}
 
-	fprintf(stdout, "create directory %s\n", path);
 	if (stat(path, &st) >= 0) {
 		if (S_ISDIR(st.st_mode))
-			return 0;
+			goto out;
 		errno = ENOTDIR;
-		return -1;
+		goto fail;
 	}
 
 	if (errno != ENOENT)
-		return -1;
+		goto fail;
 
 	p = strrchr(path, '/');
 	if (p == NULL) {
 		errno = EINVAL;
-		return -1;
+		goto fail;
 	}
 
 	if (p != path) {
 		*p = '\0';
 
-		if (hyper_mkdir(path) < 0)
+		if (hyper_mkdir(path, mode) < 0)
-			return -1;
+			goto fail;
 
 		*p = '/';
 	}
 
-	if (mkdir(path, 0755) < 0 && errno != EEXIST)
+	fprintf(stdout, "create directory %s\n", path);
-		return -1;
+	if (mkdir(path, mode) < 0 && errno != EEXIST) {
-
+		perror("failed to create directory");
+		goto fail;
+	}
+out:
+	free(path);
 	return 0;
+
+fail:
+	free(path);
+	return -1;
 }
 
 void online_cpu(void)
@@ -219,13 +415,12 @@ int hyper_open_channel(char *channel, int mode)
 {
 	struct termios term;
 	int fd = open(channel, O_RDWR | O_CLOEXEC | mode);
-	fprintf(stdout, "open %s get %d\n", channel, fd);
-
 	if (fd < 0) {
 		perror("fail to open channel device");
 		return -1;
 	}
 
+	fprintf(stdout, "open %s get %d\n", channel, fd);
 	bzero(&term, sizeof(term));
 
 	cfmakeraw(&term);
@@ -316,7 +511,7 @@ int hyper_open_channel(char *channel, int mode)
 
 	num = scandir("/sys/class/virtio-ports/", &list, NULL, NULL);
 	if (num < 0) {
-		perror("scan /sys/calss/virtio-ports/ failed");
+		perror("scan /sys/class/virtio-ports/ failed");
 		return -1;
 	}
 
@@ -342,7 +537,6 @@ int hyper_open_channel(char *channel, int mode)
 		fd = -1;
 
 		if (strncmp(name, channel, strlen(channel))) {
-			fprintf(stderr, "channel %s, directory %s\n", channel, name);
 			continue;
 		}
 
@@ -369,16 +563,6 @@ int hyper_insmod(char *module)
 }
 #endif
 
-int hyper_open_serial_dev(char *tty)
-{
-	int fd = open(tty, O_RDWR | O_CLOEXEC | O_NOCTTY);
-
-	if (fd < 0)
-		perror("fail to open tty device");
-
-	return fd;
-}
-
 int hyper_setfd_cloexec(int fd)
 {
 	int flags = fcntl(fd, F_GETFD);
@@ -430,21 +614,6 @@ int hyper_setfd_nonblock(int fd)
 	return flags;
 }
 
-int hyper_socketpair(int domain, int type, int protocol, int sv[2])
-{
-	if (socketpair(domain, type, protocol, sv) < 0) {
-		perror("socketpair failed");
-		return -1;
-	}
-
-	if (hyper_setfd_cloexec(sv[0]) < 0 ||
-	    hyper_setfd_cloexec(sv[1]) < 0) {
-		return -1;
-	}
-
-	return 0;
-}
-
 static void hyper_unmount_all(void)
 {
 	FILE *mtab;
@@ -485,6 +654,8 @@ static void hyper_unmount_all(void)
 			fprintf(stdout, ("umount %s: %s failed\n"),
 				filesys, strerror(errno));
 		}
+		free(filesys);
+		mntlist[i] = NULL;
 	}
 
 	sync();
@@ -492,7 +663,58 @@ static void hyper_unmount_all(void)
 
 void hyper_shutdown()
 {
-	hyper_send_msg_block(ctl.chan.fd, ACK, 0, NULL);
 	hyper_unmount_all();
 	reboot(LINUX_REBOOT_CMD_POWER_OFF);
 }
+
+int hyper_cmd(char *cmd)
+{
+	int pid, status;
+
+	pid = fork();
+	if (pid < 0) {
+		perror("fail to fork");
+		return -1;
+	} else if (pid > 0) {
+		if (waitpid(pid, &status, 0) <= 0) {
+			perror("waiting fork cmd failed");
+			return -1;
+		}
+		if (WIFEXITED(status)) {
+			int ret = WEXITSTATUS(status);
+			fprintf(stdout, "%s cmd exit normally, status %" PRIu8 "\n", cmd, ret);
+			if (ret == 0)
+				return 0;
+		}
+
+		fprintf(stdout, "cmd %s exit unexpectedly, status %" PRIu8 "\n", cmd, status);
+		return -1;
+	} else {
+		fprintf(stdout, "executing cmd %s\n", cmd);
+		execlp("sh", "sh", "-c", cmd, NULL);
+	}
+
+	return -1;
+}
+
+ssize_t nonblock_read(int fd, void *buf, size_t count)
+{
+	ssize_t len = 0, ret = 0;
+
+	while (len < count) {
+		ret = read(fd, buf + len, count - len);
+		if (ret <= 0) {
+			if (errno == EINTR) {
+				continue;
+			}
+			if (errno == EAGAIN) {
+				ret = 0;
+			}
+			break;
+		}
+
+		len += ret;
+	}
+
+	return len > 0 ? len : ret;
+}

src/util.h

@@ -2,6 +2,8 @@
 #define _UTIL_H_
 
 #include <stdio.h>
+#include <grp.h>
+#include <pwd.h>
 #include "../config.h"
 
 struct hyper_pod;
@@ -9,24 +11,33 @@ struct env;
 
 #ifdef WITH_DEBUG
 #define dprintf(fmt, ...) \
-	fprintf(stdout, fmt, ##_VA_ARGS__)
+	fprintf(stdout, fmt, ##__VA_ARGS__)
 #else
 #define dprintf(fmr, ...)
 #endif
 
 char *read_cmdline(void);
 int hyper_setup_env(struct env *envs, int num);
-int hyper_find_sd(char *prefix, char *addr, char **dev);
+int hyper_find_sd(char *addr, char **dev);
 int hyper_list_dir(char *path);
+int hyper_copy_dir(char *src, char *dst);
+void hyper_sync_time_hctosys();
 void online_cpu(void);
 void online_memory(void);
-int hyper_mkdir(char *path);
+int hyper_cmd(char *cmd);
+int hyper_create_file(const char *hyper_path);
+void hyper_filize(char *hyper_path);
+int hyper_mkdir(char *path, mode_t mode);
+int hyper_write_file(const char *path, const char *value, size_t len);
 int hyper_open_channel(char *channel, int mode);
-int hyper_open_serial_dev(char *tty);
 int hyper_setfd_cloexec(int fd);
 int hyper_setfd_block(int fd);
 int hyper_setfd_nonblock(int fd);
 int hyper_socketpair(int domain, int type, int protocol, int sv[2]);
-void hyper_shutdown(void);
+void hyper_shutdown();
 int hyper_insmod(char *module);
+struct passwd *hyper_getpwnam(const char *name);
+struct group *hyper_getgrnam(const char *name);
+int hyper_getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups);
+ssize_t nonblock_read(int fd, void *buf, size_t count);
 #endif