7868: Allow admin to add arguments to "docker run" commands.

diff --git a/sdk/cli/bin/crunch-job b/sdk/cli/bin/crunch-job
index fca124726a45a33945914536db4d68adc8639a8c..b9365fe93c5b29632f705cbbc7c3a425eb67e538 100755 (executable)
--- a/sdk/cli/bin/crunch-job
+++ b/sdk/cli/bin/crunch-job
@@ -127,6 +127,7 @@ my $job_api_token;
 my $no_clear_tmp;
 my $resume_stash;
 my $docker_bin = "docker.io";
 my $no_clear_tmp;
 my $resume_stash;
 my $docker_bin = "docker.io";

+my $docker_run_args = "";

 GetOptions('force-unlock' => \$force_unlock,
            'git-dir=s' => \$git_dir,
            'job=s' => \$jobspec,
 GetOptions('force-unlock' => \$force_unlock,
            'git-dir=s' => \$git_dir,
            'job=s' => \$jobspec,


@@ -134,6 +135,7 @@ GetOptions('force-unlock' => \$force_unlock,
            'no-clear-tmp' => \$no_clear_tmp,
            'resume-stash=s' => \$resume_stash,
            'docker-bin=s' => \$docker_bin,
            'no-clear-tmp' => \$no_clear_tmp,
            'resume-stash=s' => \$resume_stash,
            'docker-bin=s' => \$docker_bin,

+           'docker-run-args=s' => \$docker_run_args,

     );
 
 if (defined $job_api_token) {
     );
 
 if (defined $job_api_token) {


@@ -467,7 +469,7 @@ fi
     }
     srun(["srun", "--nodelist=" . $node[0]],
          ["/bin/sh", "-ec",
     }
     srun(["srun", "--nodelist=" . $node[0]],
          ["/bin/sh", "-ec",

-          "a=`$docker_bin run $try_user_arg $docker_hash id --user` && " .
+          "a=`$docker_bin run $docker_run_args $try_user_arg $docker_hash id --user` && " .

           " test \$a -ne 0"],
          {fork => 1});
     if ($? == 0) {
           " test \$a -ne 0"],
          {fork => 1});
     if ($? == 0) {


@@ -907,7 +909,7 @@ for (my $todo_ptr = 0; $todo_ptr <= $#jobstep_todo; $todo_ptr ++)
       my $containername = "$Jobstep->{arvados_task}->{uuid}-$Jobstep->{failures}";
       my $cidfile = "$ENV{CRUNCH_TMP}/$containername.cid";
       $command .= "crunchstat -cgroup-root=/sys/fs/cgroup -cgroup-parent=docker -cgroup-cid=$cidfile -poll=10000 ";
       my $containername = "$Jobstep->{arvados_task}->{uuid}-$Jobstep->{failures}";
       my $cidfile = "$ENV{CRUNCH_TMP}/$containername.cid";
       $command .= "crunchstat -cgroup-root=/sys/fs/cgroup -cgroup-parent=docker -cgroup-cid=$cidfile -poll=10000 ";

-      $command .= "$docker_bin run --name=$containername --attach=stdout --attach=stderr --attach=stdin -i \Q$dockeruserarg\E --cidfile=$cidfile --sig-proxy ";
+      $command .= "$docker_bin run $docker_run_args --name=$containername --attach=stdout --attach=stderr --attach=stdin -i \Q$dockeruserarg\E --cidfile=$cidfile --sig-proxy ";

       # We only set memory limits if Docker lets us limit both memory and swap.
       # Memory limits alone have been supported longer, but subprocesses tend
       # to get SIGKILL if they exceed that without any swap limit set.
       # We only set memory limits if Docker lets us limit both memory and swap.
       # Memory limits alone have been supported longer, but subprocesses tend
       # to get SIGKILL if they exceed that without any swap limit set.

diff --git a/services/api/lib/crunch_dispatch.rb b/services/api/lib/crunch_dispatch.rb
index 858bb67753b9ab072e27bb4616e4bfc7830f9d8e..5d598d48eaade381820af9629135a9ce7d88a170 100644 (file)
--- a/services/api/lib/crunch_dispatch.rb
+++ b/services/api/lib/crunch_dispatch.rb
@@ -22,6 +22,7 @@ class CrunchDispatch
     end
 
     @docker_bin = ENV['CRUNCH_JOB_DOCKER_BIN']
     end
 
     @docker_bin = ENV['CRUNCH_JOB_DOCKER_BIN']

+    @docker_run_args = ENV['CRUNCH_JOB_DOCKER_RUN_ARGS']

 
     @arvados_internal = Rails.configuration.git_internal_dir
     if not File.exists? @arvados_internal
 
     @arvados_internal = Rails.configuration.git_internal_dir
     if not File.exists? @arvados_internal


@@ -395,6 +396,10 @@ class CrunchDispatch
         cmd_args += ['--docker-bin', @docker_bin]
       end
 
         cmd_args += ['--docker-bin', @docker_bin]
       end
 

+      if @docker_run_args
+        cmd_args += ['--docker-run-args', @docker_run_args]
+      end
+

       if have_job_lock?(job)
         cmd_args << "--force-unlock"
       end
       if have_job_lock?(job)
         cmd_args << "--force-unlock"
       end