acl-repro.go

package main

import (
	"encoding/json"
	"fmt"
	"io/ioutil"
	"log"
	"os"
	"path/filepath"
	"time"

	"github.com/Microsoft/hcsshim"
)

func main() {
	rootfsPath, present := os.LookupEnv("ROOTFS_PATH")
	if !present {
		log.Fatal("Must set ROOTFS_PATH env var")
	}
	networkName, present := os.LookupEnv("NETWORK_NAME")
	if !present {
		log.Fatal("Must set NETWORK_NAME env var")
	}
	containerId := fmt.Sprintf("%d", time.Now().UnixNano())

	fmt.Printf("Container ID: %s\n", containerId)

	parentLayerChain, err := ioutil.ReadFile(filepath.Join(rootfsPath, "layerchain.json"))
	if err != nil {
		log.Fatal(err)
	}

	var parentLayers []string
	if err := json.Unmarshal(parentLayerChain, &parentLayers); err != nil {
		log.Fatal(err)
	}
	sandboxLayers := append([]string{rootfsPath}, parentLayers...)

	imageStore := `C:\windows\temp\image-store`
	driverInfo := hcsshim.DriverInfo{
		HomeDir: imageStore,
		Flavour: 1,
	}

	if err := hcsshim.CreateSandboxLayer(driverInfo, containerId, "", sandboxLayers); err != nil {
		log.Fatal(err)
	}

	if err := hcsshim.ActivateLayer(driverInfo, containerId); err != nil {
		log.Fatal(err)
	}

	if err := hcsshim.PrepareLayer(driverInfo, containerId, sandboxLayers); err != nil {
		log.Fatal(err)
	}

	volumePath, err := hcsshim.GetLayerMountPath(driverInfo, containerId)
	if err != nil {
		log.Fatal(err)
	}

	var layerInfos []hcsshim.Layer
	for _, layerPath := range sandboxLayers {
		layerId := filepath.Base(layerPath)
		layerGuid, err := hcsshim.NameToGuid(layerId)
		if err != nil {
			log.Fatal(err)
		}

		layerInfos = append(layerInfos, hcsshim.Layer{
			ID:   layerGuid.ToString(),
			Path: layerPath,
		})
	}

	containerConfig := hcsshim.ContainerConfig{
		SystemType:      "Container",
		Name:            containerId,
		VolumePath:      volumePath,
		Owner:           "acl-repro",
		LayerFolderPath: "ignored",
		Layers:          layerInfos,
	}

	container, err := hcsshim.CreateContainer(containerId, &containerConfig)
	if err != nil {
		log.Fatal(err)
	}
	defer container.Close()

	if err := container.Start(); err != nil {
		log.Fatal(err)
	}

	network, err := hcsshim.GetHNSNetworkByName(networkName)
	if err != nil {
		log.Fatal(err)
	}

	endpoint := &hcsshim.HNSEndpoint{
		VirtualNetwork: network.Id,
		Name:           containerId,
	}

	createdEndpoint, err := endpoint.Create()
	if err != nil {
		log.Fatal(err)
	}

	if err := hcsshim.HotAttachEndpoint(containerId, createdEndpoint.Id); err != nil {
		log.Fatal(err)
	}

	attachedEndpoint, err := hcsshim.GetHNSEndpointByName(containerId)
	if err != nil {
		log.Fatal(err)
	}

	acl, err := json.Marshal(hcsshim.ACLPolicy{
		Type:      hcsshim.ACL,
		Direction: hcsshim.Out,
		Action:    hcsshim.Allow,
		Protocol:  6,
	})

	if err != nil {
		log.Fatal(err)
	}

	attachedEndpoint.Policies = append(attachedEndpoint.Policies, acl)

	_, err = attachedEndpoint.Update()
	if err != nil {
		log.Fatal(err)
	}

	fmt.Println("added acl to the endpoint")
}