agent/app/agent_capability.go
func (agent *ecsAgent) capabilities() ([]*ecs.Attribute, error) {
	var capabilities []*ecs.Attribute

	if !agent.cfg.PrivilegedDisabled {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"privileged-container")
	}

	supportedVersions := make(map[dockerclient.DockerVersion]bool)
	// Determine API versions to report as supported. Supported versions are also used for capability-enablement, except
	// logging drivers.
	for _, version := range agent.dockerClient.SupportedVersions() {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"docker-remote-api."+string(version))
		supportedVersions[version] = true
	}

	capabilities = agent.appendLoggingDriverCapabilities(capabilities)

	if agent.cfg.SELinuxCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"selinux")
	}
	if agent.cfg.AppArmorCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"apparmor")
	}

	capabilities = agent.appendTaskIamRoleCapabilities(capabilities, supportedVersions)

	capabilities, err := agent.appendTaskCPUMemLimitCapabilities(capabilities, supportedVersions)
	if err != nil {
		return nil, err
	}

	capabilities = agent.appendTaskENICapabilities(capabilities)
	capabilities = agent.appendDockerDependentCapabilities(capabilities, supportedVersions)

	// TODO: gate this on docker api version when ecs supported docker includes
	// credentials endpoint feature from upstream docker
	if agent.cfg.OverrideAWSLogsExecutionRole {
		capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+"execution-role-awslogs")
	}

	capabilities = agent.appendVolumeDriverCapabilities(capabilities)

	// ecs agent version 1.19.0 supports private registry authentication using
	// aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityPrivateRegistryAuthASM)

	// ecs agent version 1.22.0 supports ecs secrets integrating with aws systems manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvSSM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverSSM)

	// ecs agent version 1.22.0 supports sharing PID namespaces and IPC resource namespaces
	// with host EC2 instance and among containers within the task
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabiltyPIDAndIPCNamespaceSharing)

	if agent.cfg.GPUSupportEnabled {
		capabilities = agent.appendNvidiaDriverVersionAttribute(capabilities)
	}
	// support ecr endpoint override
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityECREndpoint)

	// ecs agent version 1.23.0 supports ecs secrets integrating with aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvASM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverASM)

	// ecs agent version 1.26.0 supports aws-appmesh cni plugin
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+appMeshAttributeSuffix)

	// support elastic inference in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+taskEIAAttributeSuffix)

	// support container ordering in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityContainerOrdering)

	return capabilities, nil
}
func (agent *ecsAgent) capabilities() ([]*ecs.Attribute, error) {
	var capabilities []*ecs.Attribute

	if !agent.cfg.PrivilegedDisabled {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"privileged-container")
	}

	supportedVersions := make(map[dockerclient.DockerVersion]bool)
	// Determine API versions to report as supported. Supported versions are also used for capability-enablement, except
	// logging drivers.
	for _, version := range agent.dockerClient.SupportedVersions() {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"docker-remote-api."+string(version))
		supportedVersions[version] = true
	}

	capabilities = agent.appendLoggingDriverCapabilities(capabilities)

	if agent.cfg.SELinuxCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"selinux")
	}
	if agent.cfg.AppArmorCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"apparmor")
	}

	capabilities = agent.appendTaskIamRoleCapabilities(capabilities, supportedVersions)

	capabilities, err := agent.appendTaskCPUMemLimitCapabilities(capabilities, supportedVersions)
	if err != nil {
		return nil, err
	}

	capabilities = agent.appendTaskENICapabilities(capabilities)
	capabilities = agent.appendDockerDependentCapabilities(capabilities, supportedVersions)

	// TODO: gate this on docker api version when ecs supported docker includes
	// credentials endpoint feature from upstream docker
	if agent.cfg.OverrideAWSLogsExecutionRole {
		capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+"execution-role-awslogs")
	}

	capabilities = agent.appendVolumeDriverCapabilities(capabilities)

	// ecs agent version 1.19.0 supports private registry authentication using
	// aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityPrivateRegistryAuthASM)

	// ecs agent version 1.22.0 supports ecs secrets integrating with aws systems manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvSSM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverSSM)

	// ecs agent version 1.22.0 supports sharing PID namespaces and IPC resource namespaces
	// with host EC2 instance and among containers within the task
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabiltyPIDAndIPCNamespaceSharing)

	if agent.cfg.GPUSupportEnabled {
		capabilities = agent.appendNvidiaDriverVersionAttribute(capabilities)
	}
	// support ecr endpoint override
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityECREndpoint)

	// ecs agent version 1.23.0 supports ecs secrets integrating with aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvASM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverASM)

	// ecs agent version 1.26.0 supports aws-appmesh cni plugin
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+appMeshAttributeSuffix)

	// support elastic inference in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+taskEIAAttributeSuffix)

	// support container ordering in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityContainerOrdering)

	return capabilities, nil
}
func ( agent * ecsAgent ) capabilities ( ) ( [ ] * ecs . Attribute , error ) { var capabilities [ ] * ecs . Attribute if ! agent . cfg . PrivilegedDisabled { capabilities = appendNameOnlyAttribute ( capabilities , capabilityPrefix + " " ) } supportedVersions := make ( map [ dockerclient . DockerVersion ] bool ) // Determine API versions to report as supported. Supported versions are also used for capability-enablement, except // logging drivers. for _ , version := range agent . dockerClient . SupportedVersions ( ) { capabilities = appendNameOnlyAttribute ( capabilities , capabilityPrefix + " " + string ( version ) ) supportedVersions [ version ] = true } capabilities = agent . appendLoggingDriverCapabilities ( capabilities ) if agent . cfg . SELinuxCapable { capabilities = appendNameOnlyAttribute ( capabilities , capabilityPrefix + " " ) } if agent . cfg . AppArmorCapable { capabilities = appendNameOnlyAttribute ( capabilities , capabilityPrefix + " " ) } capabilities = agent . appendTaskIamRoleCapabilities ( capabilities , supportedVersions ) capabilities , err := agent . appendTaskCPUMemLimitCapabilities ( capabilities , supportedVersions ) if err != nil { return nil , err } capabilities = agent . appendTaskENICapabilities ( capabilities ) capabilities = agent . appendDockerDependentCapabilities ( capabilities , supportedVersions ) // TODO: gate this on docker api version when ecs supported docker includes // credentials endpoint feature from upstream docker if agent . cfg . OverrideAWSLogsExecutionRole { capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + " " ) } capabilities = agent . appendVolumeDriverCapabilities ( capabilities ) // ecs agent version 1.19.0 supports private registry authentication using // aws secrets manager capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilityPrivateRegistryAuthASM ) // ecs agent version 1.22.0 supports ecs secrets integrating with aws systems manager capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilitySecretEnvSSM ) // ecs agent version 1.27.0 supports ecs secrets for logging drivers capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilitySecretLogDriverSSM ) // ecs agent version 1.22.0 supports sharing PID namespaces and IPC resource namespaces // with host EC2 instance and among containers within the task capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabiltyPIDAndIPCNamespaceSharing ) if agent . cfg . GPUSupportEnabled { capabilities = agent . appendNvidiaDriverVersionAttribute ( capabilities ) } // support ecr endpoint override capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilityECREndpoint ) // ecs agent version 1.23.0 supports ecs secrets integrating with aws secrets manager capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilitySecretEnvASM ) // ecs agent version 1.27.0 supports ecs secrets for logging drivers capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilitySecretLogDriverASM ) // ecs agent version 1.26.0 supports aws-appmesh cni plugin capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + appMeshAttributeSuffix ) // support elastic inference in agent capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + taskEIAAttributeSuffix ) // support container ordering in agent capabilities = appendNameOnlyAttribute ( capabilities , attributePrefix + capabilityContainerOrdering ) return capabilities , nil }
// capabilities returns the supported capabilities of this agent / docker-client pair.
// Currently, the following capabilities are possible:
//
//    com.amazonaws.ecs.capability.privileged-container
//    com.amazonaws.ecs.capability.docker-remote-api.1.17
//    com.amazonaws.ecs.capability.docker-remote-api.1.18
//    com.amazonaws.ecs.capability.docker-remote-api.1.19
//    com.amazonaws.ecs.capability.docker-remote-api.1.20
//    com.amazonaws.ecs.capability.logging-driver.json-file
//    com.amazonaws.ecs.capability.logging-driver.syslog
//    com.amazonaws.ecs.capability.logging-driver.fluentd
//    com.amazonaws.ecs.capability.logging-driver.journald
//    com.amazonaws.ecs.capability.logging-driver.gelf
//    com.amazonaws.ecs.capability.logging-driver.none
//    com.amazonaws.ecs.capability.selinux
//    com.amazonaws.ecs.capability.apparmor
//    com.amazonaws.ecs.capability.ecr-auth
//    com.amazonaws.ecs.capability.task-iam-role
//    com.amazonaws.ecs.capability.task-iam-role-network-host
//    ecs.capability.docker-volume-driver.${driverName}
//    ecs.capability.task-eni
//    ecs.capability.task-eni-block-instance-metadata
//    ecs.capability.execution-role-ecr-pull
//    ecs.capability.execution-role-awslogs
//    ecs.capability.container-health-check
//    ecs.capability.private-registry-authentication.secretsmanager
//    ecs.capability.secrets.ssm.environment-variables
//    ecs.capability.secrets.ssm.bootstrap.log-driver
//    ecs.capability.pid-ipc-namespace-sharing
//    ecs.capability.ecr-endpoint
//    ecs.capability.secrets.asm.environment-variables
//    ecs.capability.secrets.asm.bootstrap.log-driver
//    ecs.capability.aws-appmesh
//    ecs.capability.task-eia
capabilities returns the supported capabilities of this agent / docker - client pair . Currently the following capabilities are possible : com . amazonaws . ecs . capability . privileged - container com . amazonaws . ecs . capability . docker - remote - api . 1 . 17 com . amazonaws . ecs . capability . docker - remote - api . 1 . 18 com . amazonaws . ecs . capability . docker - remote - api . 1 . 19 com . amazonaws . ecs . capability . docker - remote - api . 1 . 20 com . amazonaws . ecs . capability . logging - driver . json - file com . amazonaws . ecs . capability . logging - driver . syslog com . amazonaws . ecs . capability . logging - driver . fluentd com . amazonaws . ecs . capability . logging - driver . journald com . amazonaws . ecs . capability . logging - driver . gelf com . amazonaws . ecs . capability . logging - driver . none com . amazonaws . ecs . capability . selinux com . amazonaws . ecs . capability . apparmor com . amazonaws . ecs . capability . ecr - auth com . amazonaws . ecs . capability . task - iam - role com . amazonaws . ecs . capability . task - iam - role - network - host ecs . capability . docker - volume - driver . $ { driverName } ecs . capability . task - eni ecs . capability . task - eni - block - instance - metadata ecs . capability . execution - role - ecr - pull ecs . capability . execution - role - awslogs ecs . capability . container - health - check ecs . capability . private - registry - authentication . secretsmanager ecs . capability . secrets . ssm . environment - variables ecs . capability . secrets . ssm . bootstrap . log - driver ecs . capability . pid - ipc - namespace - sharing ecs . capability . ecr - endpoint ecs . capability . secrets . asm . environment - variables ecs . capability . secrets . asm . bootstrap . log - driver ecs . capability . aws - appmesh ecs . capability . task - eia