<commit_before>package server

import (
	"encoding/json"
	"errors"
	"fmt"
	"path/filepath"
	"strings"
	"syscall"

	"github.com/Sirupsen/logrus"
	"github.com/docker/docker/pkg/stringid"
	"github.com/kubernetes-incubator/cri-o/oci"
	"github.com/kubernetes-incubator/cri-o/server/apparmor"
	"github.com/kubernetes-incubator/cri-o/server/seccomp"
	"github.com/opencontainers/image-spec/specs-go/v1"
	"github.com/opencontainers/runc/libcontainer/label"
	"github.com/opencontainers/runtime-tools/generate"
	"golang.org/x/net/context"
	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
)

const (
	seccompUnconfined      = "unconfined"
	seccompRuntimeDefault  = "runtime/default"
	seccompLocalhostPrefix = "localhost/"
)

func addOciBindMounts(sb *sandbox, containerConfig *pb.ContainerConfig, specgen *generate.Generator) error {
	mounts := containerConfig.GetMounts()
	for _, mount := range mounts {
		dest := mount.ContainerPath
		if dest == "" {
			return fmt.Errorf("Mount.ContainerPath is empty")
		}

		src := mount.HostPath
		if src == "" {
			return fmt.Errorf("Mount.HostPath is empty")
		}

		options := []string{"rw"}
		if mount.Readonly {
			options = []string{"ro"}
		}

		if mount.SelinuxRelabel {
			// Need a way in kubernetes to determine if the volume is shared or private
			if err := label.Relabel(src, sb.mountLabel, true); err != nil && err != syscall.ENOTSUP {
				return fmt.Errorf("relabel failed %s: %v", src, err)
			}
		}

		specgen.AddBindMount(src, dest, options)
	}

	return nil
}

// buildOCIProcessArgs build an OCI compatible process arguments slice.
func buildOCIProcessArgs(containerKubeConfig *pb.ContainerConfig, imageOCIConfig *v1.Image) ([]string, error) {
	processArgs := []string{}

	kubeCommands := containerKubeConfig.Command
	kubeArgs := containerKubeConfig.Args

	if imageOCIConfig == nil {
		// HACK We should error out here, not being able to get an Image config is fatal.
		// When https://github.com/kubernetes-incubator/cri-o/issues/395 is fixed
		// we'll remove that one and return an error here.
		if containerKubeConfig.Metadata != nil {
			logrus.Errorf("empty image config for %s", containerKubeConfig.Metadata.Name)

			// HACK until https://github.com/kubernetes-incubator/cri-o/issues/395 is fixed.
			// If the container is kubeadm's dummy, imageOCIConfig is nil, and both
			// kubeCommands and kubeArgs are empty. So we set processArgs to /pause as the
			// dummy container is just a pause one.
			// (See https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/master/templates.go)
			if containerKubeConfig.Metadata.Name == "dummy" {
				return []string{podInfraCommand}, nil
			}
		} else {
			logrus.Errorf("empty image config for %s", containerKubeConfig.Image.Image)
		}
	}

	// We got an OCI Image configuration.
	// We will only use it if the kubelet information is incomplete.
	if kubeCommands == nil {
		if imageOCIConfig != nil && imageOCIConfig.Config.Entrypoint != nil {
			processArgs = append(processArgs, imageOCIConfig.Config.Entrypoint...)
		}
	} else {
		processArgs = append(processArgs, kubeCommands...)
	}

	if kubeArgs == nil {
		// Our kubelet command arguments slice is empty.
		// We will use the OCI Image configuration only if we already
		// have found a process command, i.e. if processArgs is no
		// longer empty. No doing so will have us create a process
		// arguments slice starting with the OCI Image command arguments
		// as the entry point.
		if processArgs != nil &&
			imageOCIConfig != nil &&
			imageOCIConfig.Config.Entrypoint != nil && imageOCIConfig.Config.Cmd != nil {
			processArgs = append(processArgs, imageOCIConfig.Config.Cmd...)
		}
	} else {
		processArgs = append(processArgs, kubeArgs...)
	}

	if processArgs == nil {
		// Use a reasonable default if everything failed.
		processArgs = []string{"/bin/sh"}
	}

	logrus.Debugf("OCI process args %v", processArgs)
<commit_msg>server: Fix the OCI process arguments build routine<commit_after>package server

import (
	"encoding/json"
	"errors"
	"fmt"
	"path/filepath"
	"strings"
	"syscall"

	"github.com/Sirupsen/logrus"
	"github.com/docker/docker/pkg/stringid"
	"github.com/kubernetes-incubator/cri-o/oci"
	"github.com/kubernetes-incubator/cri-o/server/apparmor"
	"github.com/kubernetes-incubator/cri-o/server/seccomp"
	"github.com/opencontainers/image-spec/specs-go/v1"
	"github.com/opencontainers/runc/libcontainer/label"
	"github.com/opencontainers/runtime-tools/generate"
	"golang.org/x/net/context"
	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
)

const (
	seccompUnconfined      = "unconfined"
	seccompRuntimeDefault  = "runtime/default"
	seccompLocalhostPrefix = "localhost/"
)

func addOciBindMounts(sb *sandbox, containerConfig *pb.ContainerConfig, specgen *generate.Generator) error {
	mounts := containerConfig.GetMounts()
	for _, mount := range mounts {
		dest := mount.ContainerPath
		if dest == "" {
			return fmt.Errorf("Mount.ContainerPath is empty")
		}

		src := mount.HostPath
		if src == "" {
			return fmt.Errorf("Mount.HostPath is empty")
		}

		options := []string{"rw"}
		if mount.Readonly {
			options = []string{"ro"}
		}

		if mount.SelinuxRelabel {
			// Need a way in kubernetes to determine if the volume is shared or private
			if err := label.Relabel(src, sb.mountLabel, true); err != nil && err != syscall.ENOTSUP {
				return fmt.Errorf("relabel failed %s: %v", src, err)
			}
		}

		specgen.AddBindMount(src, dest, options)
	}

	return nil
}

// buildOCIProcessArgs build an OCI compatible process arguments slice.
func buildOCIProcessArgs(containerKubeConfig *pb.ContainerConfig, imageOCIConfig *v1.Image) ([]string, error) {
	processArgs := []string{}
	var processEntryPoint, processCmd []string

	kubeCommands := containerKubeConfig.Command
	kubeArgs := containerKubeConfig.Args

	if imageOCIConfig == nil {
		// HACK We should error out here, not being able to get an Image config is fatal.
		// When https://github.com/kubernetes-incubator/cri-o/issues/395 is fixed
		// we'll remove that one and return an error here.
		if containerKubeConfig.Metadata != nil {
			logrus.Errorf("empty image config for %s", containerKubeConfig.Metadata.Name)

			// HACK until https://github.com/kubernetes-incubator/cri-o/issues/395 is fixed.
			// If the container is kubeadm's dummy, imageOCIConfig is nil, and both
			// kubeCommands and kubeArgs are empty. So we set processArgs to /pause as the
			// dummy container is just a pause one.
			// (See https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/master/templates.go)
			if containerKubeConfig.Metadata.Name == "dummy" {
				return []string{podInfraCommand}, nil
			}
		} else {
			logrus.Errorf("empty image config for %s", containerKubeConfig.Image.Image)
		}
	}

	// We got an OCI Image configuration.
	// We will only use it if the kubelet information is incomplete.

	// First we set the process entry point.
	if kubeCommands != nil {
		// The kubelet command slice is prioritized.
		processEntryPoint = kubeCommands
	} else {
		// Here the kubelet command slice is empty.
		if imageOCIConfig != nil {
			// If the OCI image config has an ENTRYPOINT we
			// use it as our process command.
			// Otherwise we use the CMD slice if it's not
			// empty.
			if imageOCIConfig.Config.Entrypoint != nil {
				processEntryPoint = imageOCIConfig.Config.Entrypoint
			} else if imageOCIConfig.Config.Cmd != nil {
				processEntryPoint = imageOCIConfig.Config.Cmd
			}
		} else {
			// We neither have a kubelet command not an image OCI config.
			// Missing an image OCI config will no longer be supported after
			// https://github.com/kubernetes-incubator/cri-o/issues/395 is fixed.
			processEntryPoint = []string{"/bin/sh", "-c"}
		}
	}

	// Then we build the process command arguments
	if kubeArgs != nil {
		// The kubelet command arguments slice is prioritized.
		processCmd = kubeArgs
	} else {
		if kubeCommands != nil {
			// kubelet gave us a command slice but explicitely
			// left the arguments slice empty. We should keep
			// it that way.
			processCmd = []string{}
		} else {
			// Here kubelet kept both the command and arguments
			// slices empty. We should try building the process
			// arguments slice from the OCI image config.
			// If the OCI image config has an ENTRYPOINT slice,
			// we use the CMD slice as the process arguments.
			// Otherwise, we already picked CMD as our process
			// command and we must not add the CMD slice twice.
			if imageOCIConfig != nil {
				if imageOCIConfig.Config.Entrypoint != nil {
					processCmd = imageOCIConfig.Config.Cmd
				} else {
					processCmd = []string{}
				}
			} else {
				// Missing an image OCI config will no longer
				// be supported after https://github.com/kubernetes-incubator/cri-o/issues/395
				// is fixed.
				processCmd = []string{}
			}
		}
	}

	processArgs = append(processArgs, processEntryPoint...)
	processArgs = append(processArgs, processCmd...)

	logrus.Debugf("OCI process args %v", processArgs)

{'fraction_non_alphanumeric': 0.11397753808517735, 'fraction_numerical': 0.00311353274769265, 'mean_word_length': 3.510531594784353, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '784718', 'n_tokens_mistral': 3179, 'n_tokens_neox': 2868, 'n_words': 811}