Repository: google/gvisor
File: runsc/specutils/specutils.go (Go)

Code before:
	//	"dev.gvisor.flag.debug": "true"
	//
	// Note: Only some flags can be overridden, unless `--allow-flag-override` is set. See
	// `config.overrideAllowlist` for the list of allowed flags.
	annotationFlagPrefix = "dev.gvisor.flag."

	annotationContainerName = "io.kubernetes.cri.container-name"

	// annotationContainerNameRemap allows the container name to be changed. This is useful during
	// restore when container name has changed after it has been saved.
	//
	// Usage:
	//	Remapping container name from "cont-123" (current) to "cont" (saved):
	//	"dev.gvisor.container-name-remap.<any-unique-id>": "<from>=<to>"
	//	"dev.gvisor.container-name-remap.1": "cont-123=cont"
	annotationContainerNameRemap = "dev.gvisor.container-name-remap."

	// annotationRootfsUpperTar allows the rootfs upper layer tar path to be specified.
	annotationRootfsUpperTar = "dev.gvisor.tar.rootfs.upper"
	// annotationRootfsUpperTarContainer allows the container name to be appended to the
	// rootfs upper layer tar annotation to select a specific container in a pod.
	//
	// Usage:
	//	"dev.gvisor.tar.rootfs.upper.<container-name>": "<path>"
	//	"dev.gvisor.tar.rootfs.upper.my-container": "/tmp/my-container.tar"
	annotationRootfsUpperTarContainer = annotationRootfsUpperTar + "."

	// annotationSeccomp indicates what seccomp rules was set to a given container.
	//
	// Usage:
	//	"dev.gvisor.internal.seccomp.<container-name>": "<value>"
	//	"dev.gvisor.internal.seccomp.cont": "RuntimeDefault"
	annotationSeccomp               = "dev.gvisor.internal.seccomp."
	annotationSeccompRuntimeDefault = "RuntimeDefault"

	// AnnotationTPU is the annotation used to enable TPU proxy on a pod.
	AnnotationTPU = "dev.gvisor.internal.tpuproxy"

	// AnnotationCPUFeatures is the annotation used to control cpu features
	// that exposed to user apps.
	AnnotationCPUFeatures = "dev.gvisor.internal.cpufeatures"
)

// ExePath must point to runsc binary, which is normally the same binary. It's
// changed in tests that aren't linked in the same binary.
var ExePath = "/proc/self/exe"

// Version is the supported spec version.
var Version = specs.Version

// LogSpecDebug writes the spec in a human-friendly format to the debug log.

Review comment (refactor):
nit: This is actually a prefix and should named as such (like `annotationRootfsUpperTarContainerPrefix` but that's too long). I think it would also be clean enough to not define this constant separately. Move the docstring to `annotationRootfsUpperTar` and have the callers append the "." when joining a container name.

Code after:
	//	"dev.gvisor.flag.debug": "true"
	//
	// Note: Only some flags can be overridden, unless `--allow-flag-override` is set. See
	// `config.overrideAllowlist` for the list of allowed flags.
	annotationFlagPrefix = "dev.gvisor.flag."

	// annotationContainerNameRemap allows the container name to be changed. This is useful during
	// restore when container name has changed after it has been saved.
	//
	// Usage:
	//	Remapping container name from "cont-123" (current) to "cont" (saved):
	//	"dev.gvisor.container-name-remap.<any-unique-id>": "<from>=<to>"
	//	"dev.gvisor.container-name-remap.1": "cont-123=cont"
	annotationContainerNameRemap = "dev.gvisor.container-name-remap."

	// AnnotationRootfsUpperTar specifies the rootfs upper layer tar path.
	// In multi-container pods, append the container name to select a specific
	// container:
	//
	// Usage:
	//	"dev.gvisor.tar.rootfs.upper": "<path>"
	//	"dev.gvisor.tar.rootfs.upper.<container-name>": "<path>"
	AnnotationRootfsUpperTar = "dev.gvisor.tar.rootfs.upper"

	// annotationSeccomp indicates what seccomp rules was set to a given container.
	//
	// Usage:
	//	"dev.gvisor.internal.seccomp.<container-name>": "<value>"
	//	"dev.gvisor.internal.seccomp.cont": "RuntimeDefault"
	annotationSeccomp               = "dev.gvisor.internal.seccomp."
	annotationSeccompRuntimeDefault = "RuntimeDefault"

	// AnnotationTPU is the annotation used to enable TPU proxy on a pod.
	AnnotationTPU = "dev.gvisor.internal.tpuproxy"

	// AnnotationCPUFeatures is the annotation used to control cpu features
	// that exposed to user apps.
	AnnotationCPUFeatures = "dev.gvisor.internal.cpufeatures"
)

// ExePath must point to runsc binary, which is normally the same binary. It's
// changed in tests that aren't linked in the same binary.
var ExePath = "/proc/self/exe"

// Version is the supported spec version.
var Version = specs.Version

// LogSpecDebug writes the spec in a human-friendly format to the debug log.
func LogSpecDebug(orig *specs.Spec, logSeccomp bool) {
	if log.IsLogging(log.Debug) {
		LogSpecCustomLogger(orig, logSeccomp, log.Debugf)