Repository: moby/moby
File: daemon/config/config_linux.go (Go)

Code before:
	}
	if err := verifyUserlandProxyConfig(conf); err != nil {
		return err
	}
	if err := verifyDefaultIpcMode(conf.IpcMode); err != nil {
		return err
	}

	if err := bridge.ValidateFixedCIDRV6(conf.FixedCIDRv6); err != nil {
		return errors.Wrap(err, "invalid fixed-cidr-v6")
	}

	return verifyDefaultCgroupNsMode(conf.CgroupNamespaceMode)
}

// verifyExecOptions checks if the configured exec-opts are valid for the platform.
// It returns an error if the exec-options are formatted incorrectly, or when
// options are used that are not supported on this platform.
func verifyExecOptions(execOptions []string) error {
	for _, opt := range execOptions {
		k, v, ok := strings.Cut(opt, "=")
		k = strings.ToLower(strings.TrimSpace(k))
		v = strings.TrimSpace(v)
		if !ok || k == "" || v == "" {
			return fmt.Errorf("invalid exec-opt (%s): must be formatted 'opt=value'", opt)
		}
		switch k {
		case "isolation":
			return fmt.Errorf("invalid exec-opt (%s): '%s' option is only supported on windows", opt, k)
		case "native.cgroupdriver":
			// TODO(thaJeztah): add validation that's currently in daemon.verifyCgroupDriver
			continue
		default:
			return fmt.Errorf("invalid exec-opt (%s): unknown option: '%s'", opt, k)
		}
	}
	return nil
}

// verifyUserlandProxyConfig verifies if a valid userland-proxy path
// is configured if userland-proxy is enabled.
func verifyUserlandProxyConfig(conf *Config) error {
	if !conf.EnableUserlandProxy {
		return nil
	}
	if conf.UserlandProxyPath == "" {
		return errors.New("invalid userland-proxy-path: userland-proxy is enabled, but userland-proxy-path is not set")
	}
	if !filepath.IsAbs(conf.UserlandProxyPath) {
		return errors.New("invalid userland-proxy-path: must be an absolute path: " + conf.UserlandProxyPath)
	}

Review comment (refactor):
Looks like this part is duplicated in all platform specific `verifyExecOptions` implementations.

I think we can keep the loop separate and only make a platform-specific `func validateExecOption(key, value string) error` function that validates a single option.

Code after:
	}
	if err := verifyDefaultIpcMode(conf.IpcMode); err != nil {
		return err
	}

	if err := bridge.ValidateFixedCIDRV6(conf.FixedCIDRv6); err != nil {
		return errors.Wrap(err, "invalid fixed-cidr-v6")
	}

	return verifyDefaultCgroupNsMode(conf.CgroupNamespaceMode)
}

// validatePlatformExecOpt validates if the given exec-opt and value are valid
// for the current platform.
func validatePlatformExecOpt(opt, value string) error {
	switch opt {
	case "isolation":
		return fmt.Errorf("option '%s' is only supported on windows", opt)
	case "native.cgroupdriver":
		// TODO(thaJeztah): add validation that's currently in daemon.verifyCgroupDriver
		return nil
	default:
		return fmt.Errorf("unknown option: '%s'", opt)
	}
}

// verifyUserlandProxyConfig verifies if a valid userland-proxy path
// is configured if userland-proxy is enabled.
func verifyUserlandProxyConfig(conf *Config) error {
	if !conf.EnableUserlandProxy {
		return nil
	}
	if conf.UserlandProxyPath == "" {
		return errors.New("invalid userland-proxy-path: userland-proxy is enabled, but userland-proxy-path is not set")
	}
	if !filepath.IsAbs(conf.UserlandProxyPath) {
		return errors.New("invalid userland-proxy-path: must be an absolute path: " + conf.UserlandProxyPath)
	}
	// Using exec.LookPath here, because it also produces an error if the
	// given path is not a valid executable or a directory.
	if _, err := exec.LookPath(conf.UserlandProxyPath); err != nil {
		return errors.Wrap(err, "invalid userland-proxy-path")
	}

	return nil
}

func verifyDefaultIpcMode(mode string) error {
	const hint = `use "shareable" or "private"`

	dm := container.IpcMode(mode)