add device-remove-all option

Signed-off-by: zhouhao <[email protected]>

Author: zhouhao

cmd/oci-runtime-tool/generate.go

@@ -28,6 +28,7 @@ var generateFlags = []cli.Flag{
 	cli.StringFlag{Name: "cwd", Value: "/", Usage: "current working directory for the process"},
 	cli.StringSliceFlag{Name: "device-add", Usage: "add a device which must be made available in the container"},
 	cli.StringSliceFlag{Name: "device-remove", Usage: "remove a device which must be made available in the container"},
+	cli.BoolFlag{Name: "device-remove-all", Usage: "remove all devices which must be made available in the container"},
 	cli.BoolFlag{Name: "disable-oom-kill", Usage: "disable OOM Killer"},
 	cli.StringSliceFlag{Name: "env", Usage: "add environment variable e.g. key=value"},
 	cli.StringSliceFlag{Name: "env-file", Usage: "read in a file of environment variables"},
@@ -524,6 +525,10 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
 		}
 	}
 
+	if context.Bool("device-remove-all") {
+		g.ClearLinuxDevices()
+	}
+
 	err := addSeccomp(context, g)
 	return err
 }
@@ -655,7 +660,7 @@ var deviceType = map[string]bool{
 	"p": true, // a FIFO
 }
 
-// parseDevice takes the raw string passed with the --device flag
+// parseDevice takes the raw string passed with the --device-add flag
 func parseDevice(device string, g *generate.Generator) (rspec.Device, error) {
 	dev := rspec.Device{}
 

completions/bash/oci-runtime-tool

@@ -364,6 +364,7 @@ _oci-runtime-tool_generate() {
 	"
 
 	local boolean_options="
+		--device-remove-all
 		--disable-oom-kill
 		--linux-namespace-remove-all
 		--no-new-privileges

generate/generate.go

@@ -932,7 +932,7 @@ func (g *Generator) AddDevice(device rspec.Device) {
 }
 
 //RemoveDevice remove a device from g.spec.Linux.Devices
-func(g *Generator) RemoveDevice(path string) error {
+func (g *Generator) RemoveDevice(path string) error {
 	if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Devices == nil {
 		return nil
 	}
@@ -946,6 +946,13 @@ func(g *Generator) RemoveDevice(path string) error {
 	return nil
 }
 
+func (g *Generator) ClearLinuxDevices() {
+	if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Devices == nil {
+		return
+	}
+
+	g.spec.Linux.Devices = []rspec.Device{}
+}
 
 // strPtr returns the pointer pointing to the string s.
 func strPtr(s string) *string { return &s }

man/oci-runtime-tool-generate.1.md

@@ -66,6 +66,9 @@ read the configuration from `config.json`.
   Remove a device file in container.
   This option can be specified multiple times.
 
+**--device-remove-all**=true|false
+  Remove all devices for linux inside the container. The default is *false*.
+
 **--disable-oom-kill**=true|false
   Whether to disable OOM Killer for the container or not.