create.go#Action（入口）

1、检查对应有一个参数，即容器名
2、读取当前目录下的config.json，JSON反序列化为spec对象
3、启动容器startContainer，传入操作类型为CREATE
4、根据startContainer的返回值，退出

Action: func(context *cli.Context) error {
        if err := checkArgs(context, 1, exactArgs); err != nil {
            return err
        }
        if err := revisePidFile(context); err != nil {
            return err
        }
        spec, err := setupSpec(context)
        if err != nil {
            return err
        }
        status, err := startContainer(context, spec, CT_ACT_CREATE, nil)
        if err != nil {
            return err
        }
        // exit with the container's exit status so any external supervisor is
        // notified of the exit with the correct exit status.
        os.Exit(status)
        return nil
    },

1) utils.go#setUpSpec（加载spec对象）

// setupSpec performs initial setup based on the cli.Context for the container
func setupSpec(context *cli.Context) (*specs.Spec, error) {
    bundle := context.String("bundle")
    if bundle != "" {
        if err := os.Chdir(bundle); err != nil {
            return nil, err
        }
    }
  // ********************************** NOTICE ********************************** //
    spec, err := loadSpec(specConfig)
  // ********************************** NOTICE ********************************** //
    if err != nil {
        return nil, err
    }
    return spec, nil
}

1.1) spec.go#loadSpec（加载config.json）

// loadSpec loads the specification from the provided path.
func loadSpec(cPath string) (spec *specs.Spec, err error) {
    cf, err := os.Open(cPath)
    if err != nil {
        if os.IsNotExist(err) {
            return nil, fmt.Errorf("JSON specification file %s not found", cPath)
        }
        return nil, err
    }
    defer cf.Close()
    if err = json.NewDecoder(cf).Decode(&spec); err != nil {
        return nil, err
    }
    return spec, validateProcessSpec(spec.Process)
}
func validateProcessSpec(spec *specs.Process) error {
    if spec.Cwd == "" {
        return fmt.Errorf("Cwd property must not be empty")
    }
    if !filepath.IsAbs(spec.Cwd) {
        return fmt.Errorf("Cwd must be an absolute path")
    }
    if len(spec.Args) == 0 {
        return fmt.Errorf("args must not be empty")
    }
    return nil
}

2) utils_linux.go#startContainer（create、run、restore入口）

1、检查容器id是否传入
2、调用createContainer方法创建一个容器
3、构造一个runner对象，并调用其run方法。

type CtAct uint8
const (
    CT_ACT_CREATE CtAct = iota + 1
    CT_ACT_RUN
    CT_ACT_RESTORE
)
func startContainer(context *cli.Context, spec *specs.Spec, action CtAct, criuOpts *libcontainer.CriuOpts) (int, error) {
    id := context.Args().First()
    if id == "" {
        return -1, errEmptyID
    }
    notifySocket := newNotifySocket(context, os.Getenv("NOTIFY_SOCKET"), id)
    if notifySocket != nil {
        notifySocket.setupSpec(context, spec)
    }
  // ********************************** NOTICE ********************************** //
    container, err := createContainer(context, id, spec)
  // ********************************** NOTICE ********************************** //
    if err != nil {
        return -1, err
    }
    if notifySocket != nil {
        err := notifySocket.setupSocket()
        if err != nil {
            return -1, err
        }
    }
    // Support on-demand socket activation by passing file descriptors into the container init process.
    listenFDs := []*os.File{}
    if os.Getenv("LISTEN_FDS") != "" {
        listenFDs = activation.Files(false)
    }
    r := &runner{
        enableSubreaper: !context.Bool("no-subreaper"),
        shouldDestroy:   true,
        container:       container,
        listenFDs:       listenFDs,
        notifySocket:    notifySocket,
        consoleSocket:   context.String("console-socket"),
        detach:          context.Bool("detach"),
        pidFile:         context.String("pid-file"),
        preserveFDs:     context.Int("preserve-fds"),
        action:          action,
        criuOpts:        criuOpts,
        init:            true,
    }
  // ********************************** NOTICE ********************************** //
    return r.run(spec.Process)
  // ********************************** NOTICE ********************************** //
}

2.1) utils_linux.go#createContainer

1、将spec对象转为config对象
2、获取container的工厂对象
3、调用工厂的create方法

func createContainer(context *cli.Context, id string, spec *specs.Spec) (libcontainer.Container, error) {
    rootlessCg, err := shouldUseRootlessCgroupManager(context)
    if err != nil {
        return nil, err
    }
  // ********************************** NOTICE ********************************** //
    config, err := specconv.CreateLibcontainerConfig(&specconv.CreateOpts{
        CgroupName:       id,
        UseSystemdCgroup: context.GlobalBool("systemd-cgroup"),
        NoPivotRoot:      context.Bool("no-pivot"),
        NoNewKeyring:     context.Bool("no-new-keyring"),
        Spec:             spec,
        RootlessEUID:     os.Geteuid() != 0,
        RootlessCgroups:  rootlessCg,
    })
  // ********************************** NOTICE ********************************** //
    if err != nil {
        return nil, err
    }
    // ********************************** NOTICE ********************************** //
    factory, err := loadFactory(context)
  // ********************************** NOTICE ********************************** //
    if err != nil {
        return nil, err
    }
  // ********************************** NOTICE ********************************** //
    return factory.Create(id, config)
  // ********************************** NOTICE ********************************** //
}

2.1.1) libcontainer/specconv/spec_linux.go#CreateLibcontainerConfig（spec转config）

spec

// Spec is the base configuration for the container.
type Spec struct {
    // Version of the Open Container Initiative Runtime Specification with which the bundle complies.
    Version string `json:"ociVersion"`
    // Process configures the container process.
    Process *Process `json:"process,omitempty"`
    // Root configures the container's root filesystem.
    Root *Root `json:"root,omitempty"`
    // Hostname configures the container's hostname.
    Hostname string `json:"hostname,omitempty"`
    // Mounts configures additional mounts (on top of Root).
    Mounts []Mount `json:"mounts,omitempty"`
    // Hooks configures callbacks for container lifecycle events.
    Hooks *Hooks `json:"hooks,omitempty" platform:"linux,solaris"`
    // Annotations contains arbitrary metadata for the container.
    Annotations map[string]string `json:"annotations,omitempty"`
    // Linux is platform-specific configuration for Linux based containers.
    Linux *Linux `json:"linux,omitempty" platform:"linux"`
    // Solaris is platform-specific configuration for Solaris based containers.
    Solaris *Solaris `json:"solaris,omitempty" platform:"solaris"`
    // Windows is platform-specific configuration for Windows based containers.
    Windows *Windows `json:"windows,omitempty" platform:"windows"`
    // VM specifies configuration for virtual-machine-based containers.
    VM *VM `json:"vm,omitempty" platform:"vm"`
}
// Process contains information to start a specific application inside the container.
type Process struct {
    // Terminal creates an interactive terminal for the container.
    Terminal bool `json:"terminal,omitempty"`
    // ConsoleSize specifies the size of the console.
    ConsoleSize *Box `json:"consoleSize,omitempty"`
    // User specifies user information for the process.
    User User `json:"user"`
    // Args specifies the binary and arguments for the application to execute.
    Args []string `json:"args"`
    // Env populates the process environment for the process.
    Env []string `json:"env,omitempty"`
    // Cwd is the current working directory for the process and must be
    // relative to the container's root.
    Cwd string `json:"cwd"`
    // Capabilities are Linux capabilities that are kept for the process.
    Capabilities *LinuxCapabilities `json:"capabilities,omitempty" platform:"linux"`
    // Rlimits specifies rlimit options to apply to the process.
    Rlimits []POSIXRlimit `json:"rlimits,omitempty" platform:"linux,solaris"`
    // NoNewPrivileges controls whether additional privileges could be gained by processes in the container.
    NoNewPrivileges bool `json:"noNewPrivileges,omitempty" platform:"linux"`
    // ApparmorProfile specifies the apparmor profile for the container.
    ApparmorProfile string `json:"apparmorProfile,omitempty" platform:"linux"`
    // Specify an oom_score_adj for the container.
    OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"`
    // SelinuxLabel specifies the selinux context that the container process is run as.
    SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
}
// Linux contains platform-specific configuration for Linux based containers.
type Linux struct {
    // UIDMapping specifies user mappings for supporting user namespaces.
    UIDMappings []LinuxIDMapping `json:"uidMappings,omitempty"`
    // GIDMapping specifies group mappings for supporting user namespaces.
    GIDMappings []LinuxIDMapping `json:"gidMappings,omitempty"`
    // Sysctl are a set of key value pairs that are set for the container on start
    Sysctl map[string]string `json:"sysctl,omitempty"`
    // Resources contain cgroup information for handling resource constraints
    // for the container
    Resources *LinuxResources `json:"resources,omitempty"`
    // CgroupsPath specifies the path to cgroups that are created and/or joined by the container.
    // The path is expected to be relative to the cgroups mountpoint.
    // If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
    CgroupsPath string `json:"cgroupsPath,omitempty"`
    // Namespaces contains the namespaces that are created and/or joined by the container
    Namespaces []LinuxNamespace `json:"namespaces,omitempty"`
    // Devices are a list of device nodes that are created for the container
    Devices []LinuxDevice `json:"devices,omitempty"`
    // Seccomp specifies the seccomp security settings for the container.
    Seccomp *LinuxSeccomp `json:"seccomp,omitempty"`
    // RootfsPropagation is the rootfs mount propagation mode for the container.
    RootfsPropagation string `json:"rootfsPropagation,omitempty"`
    // MaskedPaths masks over the provided paths inside the container.
    MaskedPaths []string `json:"maskedPaths,omitempty"`
    // ReadonlyPaths sets the provided paths as RO inside the container.
    ReadonlyPaths []string `json:"readonlyPaths,omitempty"`
    // MountLabel specifies the selinux context for the mounts in the container.
    MountLabel string `json:"mountLabel,omitempty"`
    // IntelRdt contains Intel Resource Director Technology (RDT) information for
    // handling resource constraints (e.g., L3 cache, memory bandwidth) for the container
    IntelRdt *LinuxIntelRdt `json:"intelRdt,omitempty"`
}

type CreateOpts struct {
    CgroupName       string
    UseSystemdCgroup bool
    NoPivotRoot      bool
    NoNewKeyring     bool
    Spec             *specs.Spec
    RootlessEUID     bool
    RootlessCgroups  bool
}
// CreateLibcontainerConfig creates a new libcontainer configuration from a
// given specification and a cgroup name
func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
    // runc's cwd will always be the bundle path
    rcwd, err := os.Getwd()
    if err != nil {
        return nil, err
    }
    cwd, err := filepath.Abs(rcwd)
    if err != nil {
        return nil, err
    }
    spec := opts.Spec
    if spec.Root == nil {
        return nil, fmt.Errorf("Root must be specified")
    }
    rootfsPath := spec.Root.Path
    if !filepath.IsAbs(rootfsPath) {
        rootfsPath = filepath.Join(cwd, rootfsPath)
    }
    labels := []string{}
    for k, v := range spec.Annotations {
        labels = append(labels, fmt.Sprintf("%s=%s", k, v))
    }
    config := &configs.Config{
        Rootfs:          rootfsPath,
        NoPivotRoot:     opts.NoPivotRoot,
        Readonlyfs:      spec.Root.Readonly,
        Hostname:        spec.Hostname,
        Labels:          append(labels, fmt.Sprintf("bundle=%s", cwd)),
        NoNewKeyring:    opts.NoNewKeyring,
        RootlessEUID:    opts.RootlessEUID,
        RootlessCgroups: opts.RootlessCgroups,
    }
    exists := false
    for _, m := range spec.Mounts {
    // ********************************** NOTICE ********************************** //
        config.Mounts = append(config.Mounts, createLibcontainerMount(cwd, m))
    // ********************************** NOTICE ********************************** //
    }
  // ********************************** NOTICE ********************************** //
    if err := createDevices(spec, config); err != nil {
    // ********************************** NOTICE ********************************** //
        return nil, err
    }
    // ********************************** NOTICE ********************************** //
    c, err := createCgroupConfig(opts)
  // ********************************** NOTICE ********************************** //
    if err != nil {
        return nil, err
    }
    config.Cgroups = c
    // set linux-specific config
    if spec.Linux != nil {
        if config.RootPropagation, exists = mountPropagationMapping[spec.Linux.RootfsPropagation]; !exists {
            return nil, fmt.Errorf("rootfsPropagation=%v is not supported", spec.Linux.RootfsPropagation)
        }
        if config.NoPivotRoot && (config.RootPropagation&unix.MS_PRIVATE != 0) {
            return nil, fmt.Errorf("rootfsPropagation of [r]private is not safe without pivot_root")
        }
        for _, ns := range spec.Linux.Namespaces {
            t, exists := namespaceMapping[ns.Type]
            if !exists {
                return nil, fmt.Errorf("namespace %q does not exist", ns)
            }
            if config.Namespaces.Contains(t) {
                return nil, fmt.Errorf("malformed spec file: duplicated ns %q", ns)
            }
            config.Namespaces.Add(t, ns.Path)
        }
        if config.Namespaces.Contains(configs.NEWNET) && config.Namespaces.PathOf(configs.NEWNET) == "" {
            config.Networks = []*configs.Network{
                {
                    Type: "loopback",
                },
            }
        }
        if config.Namespaces.Contains(configs.NEWUSER) {
            if err := setupUserNamespace(spec, config); err != nil {
                return nil, err
            }
        }
        config.MaskPaths = spec.Linux.MaskedPaths
        config.ReadonlyPaths = spec.Linux.ReadonlyPaths
        config.MountLabel = spec.Linux.MountLabel
        config.Sysctl = spec.Linux.Sysctl
        if spec.Linux.Seccomp != nil {
            seccomp, err := SetupSeccomp(spec.Linux.Seccomp)
            if err != nil {
                return nil, err
            }
            config.Seccomp = seccomp
        }
        if spec.Linux.IntelRdt != nil {
            config.IntelRdt = &configs.IntelRdt{}
            if spec.Linux.IntelRdt.L3CacheSchema != "" {
                config.IntelRdt.L3CacheSchema = spec.Linux.IntelRdt.L3CacheSchema
            }
            if spec.Linux.IntelRdt.MemBwSchema != "" {
                config.IntelRdt.MemBwSchema = spec.Linux.IntelRdt.MemBwSchema
            }
        }
    }
    if spec.Process != nil {
        config.OomScoreAdj = spec.Process.OOMScoreAdj
        if spec.Process.SelinuxLabel != "" {
            config.ProcessLabel = spec.Process.SelinuxLabel
        }
        if spec.Process.Capabilities != nil {
            config.Capabilities = &configs.Capabilities{
                Bounding:    spec.Process.Capabilities.Bounding,
                Effective:   spec.Process.Capabilities.Effective,
                Permitted:   spec.Process.Capabilities.Permitted,
                Inheritable: spec.Process.Capabilities.Inheritable,
                Ambient:     spec.Process.Capabilities.Ambient,
            }
        }
    }
    createHooks(spec, config)
    config.Version = specs.Version
    return config, nil
}

config

// Config defines configuration options for executing a process inside a contained environment.
type Config struct {
    // NoPivotRoot will use MS_MOVE and a chroot to jail the process into the container's rootfs
    // This is a common option when the container is running in ramdisk
    NoPivotRoot bool `json:"no_pivot_root"`
    // ParentDeathSignal specifies the signal that is sent to the container's process in the case
    // that the parent process dies.
    ParentDeathSignal int `json:"parent_death_signal"`
    // Path to a directory containing the container's root filesystem.
    Rootfs string `json:"rootfs"`
    // Readonlyfs will remount the container's rootfs as readonly where only externally mounted
    // bind mounts are writtable.
    Readonlyfs bool `json:"readonlyfs"`
    // Specifies the mount propagation flags to be applied to /.
    RootPropagation int `json:"rootPropagation"`
    // Mounts specify additional source and destination paths that will be mounted inside the container's
    // rootfs and mount namespace if specified
    Mounts []*Mount `json:"mounts"`
    // The device nodes that should be automatically created within the container upon container start.  Note, make sure that the node is marked as allowed in the cgroup as well!
    Devices []*Device `json:"devices"`
    MountLabel string `json:"mount_label"`
    // Hostname optionally sets the container's hostname if provided
    Hostname string `json:"hostname"`
    // Namespaces specifies the container's namespaces that it should setup when cloning the init process
    // If a namespace is not provided that namespace is shared from the container's parent process
    Namespaces Namespaces `json:"namespaces"`
    // Capabilities specify the capabilities to keep when executing the process inside the container
    // All capabilities not specified will be dropped from the processes capability mask
    Capabilities *Capabilities `json:"capabilities"`
    // Networks specifies the container's network setup to be created
    Networks []*Network `json:"networks"`
    // Routes can be specified to create entries in the route table as the container is started
    Routes []*Route `json:"routes"`
    // Cgroups specifies specific cgroup settings for the various subsystems that the container is
    // placed into to limit the resources the container has available
    Cgroups *Cgroup `json:"cgroups"`
    // AppArmorProfile specifies the profile to apply to the process running in the container and is
    // change at the time the process is execed
    AppArmorProfile string `json:"apparmor_profile,omitempty"`
    // ProcessLabel specifies the label to apply to the process running in the container.  It is
    // commonly used by selinux
    ProcessLabel string `json:"process_label,omitempty"`
    // Rlimits specifies the resource limits, such as max open files, to set in the container
    // If Rlimits are not set, the container will inherit rlimits from the parent process
    Rlimits []Rlimit `json:"rlimits,omitempty"`
    // OomScoreAdj specifies the adjustment to be made by the kernel when calculating oom scores
    // for a process. Valid values are between the range [-1000, '1000'], where processes with
    // higher scores are preferred for being killed. If it is unset then we don't touch the current
    // value.
    // More information about kernel oom score calculation here: https://lwn.net/Articles/317814/
    OomScoreAdj *int `json:"oom_score_adj,omitempty"`
    // UidMappings is an array of User ID mappings for User Namespaces
    UidMappings []IDMap `json:"uid_mappings"`
    // GidMappings is an array of Group ID mappings for User Namespaces
    GidMappings []IDMap `json:"gid_mappings"`
    // MaskPaths specifies paths within the container's rootfs to mask over with a bind
    // mount pointing to /dev/null as to prevent reads of the file.
    MaskPaths []string `json:"mask_paths"`
    // ReadonlyPaths specifies paths within the container's rootfs to remount as read-only
    // so that these files prevent any writes.
    ReadonlyPaths []string `json:"readonly_paths"`
    // Sysctl is a map of properties and their values. It is the equivalent of using
    // sysctl -w my.property.name value in Linux.
    Sysctl map[string]string `json:"sysctl"`
    // Seccomp allows actions to be taken whenever a syscall is made within the container.
    // A number of rules are given, each having an action to be taken if a syscall matches it.
    // A default action to be taken if no rules match is also given.
    Seccomp *Seccomp `json:"seccomp"`
    // NoNewPrivileges controls whether processes in the container can gain additional privileges.
    NoNewPrivileges bool `json:"no_new_privileges,omitempty"`
    // Hooks are a collection of actions to perform at various container lifecycle events.
    // CommandHooks are serialized to JSON, but other hooks are not.
    Hooks *Hooks
    // Version is the version of opencontainer specification that is supported.
    Version string `json:"version"`
    // Labels are user defined metadata that is stored in the config and populated on the state
    Labels []string `json:"labels"`
    // NoNewKeyring will not allocated a new session keyring for the container.  It will use the
    // callers keyring in this case.
    NoNewKeyring bool `json:"no_new_keyring"`
    // IntelRdt specifies settings for Intel RDT group that the container is placed into
    // to limit the resources (e.g., L3 cache, memory bandwidth) the container has available
    IntelRdt *IntelRdt `json:"intel_rdt,omitempty"`
    // RootlessEUID is set when the runc was launched with non-zero EUID.
    // Note that RootlessEUID is set to false when launched with EUID=0 in userns.
    // When RootlessEUID is set, runc creates a new userns for the container.
    // (config.json needs to contain userns settings)
    RootlessEUID bool `json:"rootless_euid,omitempty"`
    // RootlessCgroups is set when unlikely to have the full access to cgroups.
    // When RootlessCgroups is set, cgroups errors are ignored.
    RootlessCgroups bool `json:"rootless_cgroups,omitempty"`
}

2.1.1.1) libcontainer/specconv/spec_linux.go#createLibcontainerMount

func createLibcontainerMount(cwd string, m specs.Mount) *configs.Mount {
    flags, pgflags, data, ext := parseMountOptions(m.Options)
    source := m.Source
    device := m.Type
    if flags&unix.MS_BIND != 0 {
        if device == "" {
            device = "bind"
        }
        if !filepath.IsAbs(source) {
            source = filepath.Join(cwd, m.Source)
        }
    }
    return &configs.Mount{
        Device:           device,
        Source:           source,
        Destination:      m.Destination,
        Data:             data,
        Flags:            flags,
        PropagationFlags: pgflags,
        Extensions:       ext,
    }
}

2.1.1.2) libcontainer/specconv/spec_linux.go#createDevices

func createDevices(spec *specs.Spec, config *configs.Config) error {
    // add whitelisted devices
    config.Devices = []*configs.Device{
        {
            Type:     'c',
            Path:     "/dev/null",
            Major:    1,
            Minor:    3,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
        {
            Type:     'c',
            Path:     "/dev/random",
            Major:    1,
            Minor:    8,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
        {
            Type:     'c',
            Path:     "/dev/full",
            Major:    1,
            Minor:    7,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
        {
            Type:     'c',
            Path:     "/dev/tty",
            Major:    5,
            Minor:    0,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
        {
            Type:     'c',
            Path:     "/dev/zero",
            Major:    1,
            Minor:    5,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
        {
            Type:     'c',
            Path:     "/dev/urandom",
            Major:    1,
            Minor:    9,
            FileMode: 0666,
            Uid:      0,
            Gid:      0,
        },
    }
    // merge in additional devices from the spec
    if spec.Linux != nil {
        for _, d := range spec.Linux.Devices {
            var uid, gid uint32
            var filemode os.FileMode = 0666
            if d.UID != nil {
                uid = *d.UID
            }
            if d.GID != nil {
                gid = *d.GID
            }
            dt, err := stringToDeviceRune(d.Type)
            if err != nil {
                return err
            }
            if d.FileMode != nil {
                filemode = *d.FileMode
            }
            device := &configs.Device{
                Type:     dt,
                Path:     d.Path,
                Major:    d.Major,
                Minor:    d.Minor,
                FileMode: filemode,
                Uid:      uid,
                Gid:      gid,
            }
            config.Devices = append(config.Devices, device)
        }
    }
    return nil
}

2.1.1.3) libcontainer/specconv/spec_linux.go#createDevices

func createCgroupConfig(opts *CreateOpts) (*configs.Cgroup, error) {
    var (
        myCgroupPath string
        spec             = opts.Spec
        useSystemdCgroup = opts.UseSystemdCgroup
        name             = opts.CgroupName
    )
    c := &configs.Cgroup{
        Resources: &configs.Resources{},
    }
    if spec.Linux != nil && spec.Linux.CgroupsPath != "" {
        myCgroupPath = libcontainerUtils.CleanPath(spec.Linux.CgroupsPath)
        if useSystemdCgroup {
            myCgroupPath = spec.Linux.CgroupsPath
        }
    }
    if useSystemdCgroup {
        if myCgroupPath == "" {
            c.Parent = "system.slice"
            c.ScopePrefix = "runc"
            c.Name = name
        } else {
            // Parse the path from expected "slice:prefix:name"
            // for e.g. "system.slice:docker:1234"
            parts := strings.Split(myCgroupPath, ":")
            if len(parts) != 3 {
                return nil, fmt.Errorf("expected cgroupsPath to be of format \"slice:prefix:name\" for systemd cgroups")
            }
            c.Parent = parts[0]
            c.ScopePrefix = parts[1]
            c.Name = parts[2]
        }
    } else {
        if myCgroupPath == "" {
            c.Name = name
        }
        c.Path = myCgroupPath
    }
    // In rootless containers, any attempt to make cgroup changes is likely to fail.
    // libcontainer will validate this but ignores the error.
    c.Resources.AllowedDevices = allowedDevices
    if spec.Linux != nil {
        r := spec.Linux.Resources
        if r == nil {
            return c, nil
        }
        for i, d := range spec.Linux.Resources.Devices {
            var (
                t     = "a"
                major = int64(-1)
                minor = int64(-1)
            )
            if d.Type != "" {
                t = d.Type
            }
            if d.Major != nil {
                major = *d.Major
            }
            if d.Minor != nil {
                minor = *d.Minor
            }
            if d.Access == "" {
                return nil, fmt.Errorf("device access at %d field cannot be empty", i)
            }
            dt, err := stringToCgroupDeviceRune(t)
            if err != nil {
                return nil, err
            }
            dd := &configs.Device{
                Type:        dt,
                Major:       major,
                Minor:       minor,
                Permissions: d.Access,
                Allow:       d.Allow,
            }
            c.Resources.Devices = append(c.Resources.Devices, dd)
        }
        if r.Memory != nil {
            if r.Memory.Limit != nil {
                c.Resources.Memory = *r.Memory.Limit
            }
            if r.Memory.Reservation != nil {
                c.Resources.MemoryReservation = *r.Memory.Reservation
            }
            if r.Memory.Swap != nil {
                c.Resources.MemorySwap = *r.Memory.Swap
            }
            if r.Memory.Kernel != nil {
                c.Resources.KernelMemory = *r.Memory.Kernel
            }
            if r.Memory.KernelTCP != nil {
                c.Resources.KernelMemoryTCP = *r.Memory.KernelTCP
            }
            if r.Memory.Swappiness != nil {
                c.Resources.MemorySwappiness = r.Memory.Swappiness
            }
            if r.Memory.DisableOOMKiller != nil {
                c.Resources.OomKillDisable = *r.Memory.DisableOOMKiller
            }
        }
        if r.CPU != nil {
            if r.CPU.Shares != nil {
                c.Resources.CpuShares = *r.CPU.Shares
            }
            if r.CPU.Quota != nil {
                c.Resources.CpuQuota = *r.CPU.Quota
            }
            if r.CPU.Period != nil {
                c.Resources.CpuPeriod = *r.CPU.Period
            }
            if r.CPU.RealtimeRuntime != nil {
                c.Resources.CpuRtRuntime = *r.CPU.RealtimeRuntime
            }
            if r.CPU.RealtimePeriod != nil {
                c.Resources.CpuRtPeriod = *r.CPU.RealtimePeriod
            }
            if r.CPU.Cpus != "" {
                c.Resources.CpusetCpus = r.CPU.Cpus
            }
            if r.CPU.Mems != "" {
                c.Resources.CpusetMems = r.CPU.Mems
            }
        }
        if r.Pids != nil {
            c.Resources.PidsLimit = r.Pids.Limit
        }
        if r.BlockIO != nil {
            if r.BlockIO.Weight != nil {
                c.Resources.BlkioWeight = *r.BlockIO.Weight
            }
            if r.BlockIO.LeafWeight != nil {
                c.Resources.BlkioLeafWeight = *r.BlockIO.LeafWeight
            }
            if r.BlockIO.WeightDevice != nil {
                for _, wd := range r.BlockIO.WeightDevice {
                    var weight, leafWeight uint16
                    if wd.Weight != nil {
                        weight = *wd.Weight
                    }
                    if wd.LeafWeight != nil {
                        leafWeight = *wd.LeafWeight
                    }
                    weightDevice := configs.NewWeightDevice(wd.Major, wd.Minor, weight, leafWeight)
                    c.Resources.BlkioWeightDevice = append(c.Resources.BlkioWeightDevice, weightDevice)
                }
            }
            if r.BlockIO.ThrottleReadBpsDevice != nil {
                for _, td := range r.BlockIO.ThrottleReadBpsDevice {
                    rate := td.Rate
                    throttleDevice := configs.NewThrottleDevice(td.Major, td.Minor, rate)
                    c.Resources.BlkioThrottleReadBpsDevice = append(c.Resources.BlkioThrottleReadBpsDevice, throttleDevice)
                }
            }
            if r.BlockIO.ThrottleWriteBpsDevice != nil {
                for _, td := range r.BlockIO.ThrottleWriteBpsDevice {
                    rate := td.Rate
                    throttleDevice := configs.NewThrottleDevice(td.Major, td.Minor, rate)
                    c.Resources.BlkioThrottleWriteBpsDevice = append(c.Resources.BlkioThrottleWriteBpsDevice, throttleDevice)
                }
            }
            if r.BlockIO.ThrottleReadIOPSDevice != nil {
                for _, td := range r.BlockIO.ThrottleReadIOPSDevice {
                    rate := td.Rate
                    throttleDevice := configs.NewThrottleDevice(td.Major, td.Minor, rate)
                    c.Resources.BlkioThrottleReadIOPSDevice = append(c.Resources.BlkioThrottleReadIOPSDevice, throttleDevice)
                }
            }
            if r.BlockIO.ThrottleWriteIOPSDevice != nil {
                for _, td := range r.BlockIO.ThrottleWriteIOPSDevice {
                    rate := td.Rate
                    throttleDevice := configs.NewThrottleDevice(td.Major, td.Minor, rate)
                    c.Resources.BlkioThrottleWriteIOPSDevice = append(c.Resources.BlkioThrottleWriteIOPSDevice, throttleDevice)
                }
            }
        }
        for _, l := range r.HugepageLimits {
            c.Resources.HugetlbLimit = append(c.Resources.HugetlbLimit, &configs.HugepageLimit{
                Pagesize: l.Pagesize,
                Limit:    l.Limit,
            })
        }
        if r.Network != nil {
            if r.Network.ClassID != nil {
                c.Resources.NetClsClassid = *r.Network.ClassID
            }
            for _, m := range r.Network.Priorities {
                c.Resources.NetPrioIfpriomap = append(c.Resources.NetPrioIfpriomap, &configs.IfPrioMap{
                    Interface: m.Name,
                    Priority:  int64(m.Priority),
                })
            }
        }
    }
    // append the default allowed devices to the end of the list
    c.Resources.Devices = append(c.Resources.Devices, allowedDevices...)
    return c, nil
}
func stringToCgroupDeviceRune(s string) (rune, error) {
    switch s {
    case "a":
        return 'a', nil
    case "b":
        return 'b', nil
    case "c":
        return 'c', nil
    default:
        return 0, fmt.Errorf("invalid cgroup device type %q", s)
    }
}

2.1.1.4) libcontainer/specconv/spec_linux.go#setupUserNamespace

func setupUserNamespace(spec *specs.Spec, config *configs.Config) error {
    create := func(m specs.LinuxIDMapping) configs.IDMap {
        return configs.IDMap{
            HostID:      int(m.HostID),
            ContainerID: int(m.ContainerID),
            Size:        int(m.Size),
        }
    }
    if spec.Linux != nil {
        for _, m := range spec.Linux.UIDMappings {
            config.UidMappings = append(config.UidMappings, create(m))
        }
        for _, m := range spec.Linux.GIDMappings {
            config.GidMappings = append(config.GidMappings, create(m))
        }
    }
    rootUID, err := config.HostRootUID()
    if err != nil {
        return err
    }
    rootGID, err := config.HostRootGID()
    if err != nil {
        return err
    }
    for _, node := range config.Devices {
        node.Uid = uint32(rootUID)
        node.Gid = uint32(rootGID)
    }
    return nil
}

2.1.1.5) libcontainer/specconv/spec_linux.go#createHooks

func createHooks(rspec *specs.Spec, config *configs.Config) {
    config.Hooks = &configs.Hooks{}
    if rspec.Hooks != nil {
        for _, h := range rspec.Hooks.Prestart {
            cmd := createCommandHook(h)
            config.Hooks.Prestart = append(config.Hooks.Prestart, configs.NewCommandHook(cmd))
        }
        for _, h := range rspec.Hooks.Poststart {
            cmd := createCommandHook(h)
            config.Hooks.Poststart = append(config.Hooks.Poststart, configs.NewCommandHook(cmd))
        }
        for _, h := range rspec.Hooks.Poststop {
            cmd := createCommandHook(h)
            config.Hooks.Poststop = append(config.Hooks.Poststop, configs.NewCommandHook(cmd))
        }
    }
}

2.1.2) utils_linux.go#loadFactory

会根据context中的信息来确定使用哪些：

• cgroupManager
• intelRdtManager
• CriuPath
• NewuidmapPath
• NewgidmapPath ```go var errEmptyID = errors.New(“container id cannot be empty”)

// loadFactory returns the configured factory instance for execing containers. func loadFactory(context *cli.Context) (libcontainer.Factory, error) { root := context.GlobalString(“root”) abs, err := filepath.Abs(root) if err != nil { return nil, err }

// We default to cgroupfs, and can only use systemd if the system is a
// systemd box.
cgroupManager := libcontainer.Cgroupfs
rootlessCg, err := shouldUseRootlessCgroupManager(context)
if err != nil {
    return nil, err
}
if rootlessCg {
    cgroupManager = libcontainer.RootlessCgroupfs
}
if context.GlobalBool("systemd-cgroup") {
    if systemd.UseSystemd() {
        cgroupManager = libcontainer.SystemdCgroups
    } else {
        return nil, fmt.Errorf("systemd cgroup flag passed, but systemd support for managing cgroups is not available")
    }
}
intelRdtManager := libcontainer.IntelRdtFs
if !intelrdt.IsCatEnabled() && !intelrdt.IsMbaEnabled() {
    intelRdtManager = nil
}
// We resolve the paths for {newuidmap,newgidmap} from the context of runc,
// to avoid doing a path lookup in the nsexec context. TODO: The binary
// names are not currently configurable.
newuidmap, err := exec.LookPath("newuidmap")
if err != nil {
    newuidmap = ""
}
newgidmap, err := exec.LookPath("newgidmap")
if err != nil {
    newgidmap = ""
}

// ** NOTICE ** // return libcontainer.New(abs, cgroupManager, intelRdtManager, libcontainer.CriuPath(context.GlobalString(“criu”)), libcontainer.NewuidmapPath(newuidmap), libcontainer.NewgidmapPath(newgidmap)) // ** NOTICE ** // }

<a name="4b7269a2"></a>
#### 2.1.2.1) libcontainer/factory_linux.go#New
```go
// New returns a linux based container factory based in the root directory and
// configures the factory with the provided option funcs.
func New(root string, options ...func(*LinuxFactory) error) (Factory, error) {
    if root != "" {
        if err := os.MkdirAll(root, 0700); err != nil {
            return nil, newGenericError(err, SystemError)
        }
    }
    l := &LinuxFactory{
        Root:      root,
        InitPath:  "/proc/self/exe",
        InitArgs:  []string{os.Args[0], "init"},
        Validator: validate.New(),
        CriuPath:  "criu",
    }
    Cgroupfs(l)
    for _, opt := range options {
        if opt == nil {
            continue
        }
        if err := opt(l); err != nil {
            return nil, err
        }
    }
    return l, nil
}
// Cgroupfs is an options func to configure a LinuxFactory to return containers
// that use the native cgroups filesystem implementation to create and manage
// cgroups.
func Cgroupfs(l *LinuxFactory) error {
    l.NewCgroupsManager = func(config *configs.Cgroup, paths map[string]string) cgroups.Manager {
        return &fs.Manager{
            Cgroups: config,
            Paths:   paths,
        }
    }
    return nil
}

2.1.3) libcontainer/factory_linux.go#Create

func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, error) {
    if l.Root == "" {
        return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
    }
    if err := l.validateID(id); err != nil {
        return nil, err
    }
    if err := l.Validator.Validate(config); err != nil {
        return nil, newGenericError(err, ConfigInvalid)
    }
    containerRoot, err := securejoin.SecureJoin(l.Root, id)
    if err != nil {
        return nil, err
    }
    if _, err := os.Stat(containerRoot); err == nil {
        return nil, newGenericError(fmt.Errorf("container with id exists: %v", id), IdInUse)
    } else if !os.IsNotExist(err) {
        return nil, newGenericError(err, SystemError)
    }
    if err := os.MkdirAll(containerRoot, 0711); err != nil {
        return nil, newGenericError(err, SystemError)
    }
    if err := os.Chown(containerRoot, unix.Geteuid(), unix.Getegid()); err != nil {
        return nil, newGenericError(err, SystemError)
    }
    c := &linuxContainer{
        id:            id,
        root:          containerRoot,
        config:        config,
        initPath:      l.InitPath,
        initArgs:      l.InitArgs,
        criuPath:      l.CriuPath,
        newuidmapPath: l.NewuidmapPath,
        newgidmapPath: l.NewgidmapPath,
        cgroupManager: l.NewCgroupsManager(config.Cgroups, nil),
    }
    if intelrdt.IsCatEnabled() || intelrdt.IsMbaEnabled() {
        c.intelRdtManager = l.NewIntelRdtManager(config, id, "")
    }
    c.state = &stoppedState{c: c}
    return c, nil
}
// stoppedState represents a container is a stopped/destroyed state.
type stoppedState struct {
    c *linuxContainer
}