dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-06 21:37:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
12,537 Commits 31 Branches 333 Tags
6a99fcc88cdf94de44bc690dee6eaeb61b6e94b0
Commit Graph
101 Commits
Author SHA1 Message Date
Sebastiaan van Stijn 9251072f78 remove github.com/opencontainers/runc dependency 
This migrates uses of github.com/opencontainers/runc/libcontainer/user
to the new github.com/moby/sys/user module, which was extracted from
runc at commit [opencontainers/runc@a3a0ec48c4].

This is the initial release of the module, which is a straight copy, but
some changes may be made in the next release (such as fixing camel-casing
in some fields and functions (Uid -> UID).

[opencontainers/runc@a3a0ec48c4]: https://github.com/opencontainers/runc/commit/a3a0ec48c464fe6458d2ba067f6707c027e5384e

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 4b1bb1293e)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-01-05 14:21:49 +01:00
Sebastiaan van Stijn 4e67213d4f vendor: github.com/cncf-tags/container-device-interface v0.6.1 
Removes uses of the github.com/opencontainers/runc/libcontainer/devices
package.

full diff: https://github.com/cncf-tags/container-device-interface/compare/v0.6.0...v0.6.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 05093d7c07)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-01-05 14:18:57 +01:00
Akihiro Suda e0ee0be0df go.mod: github.com/opencontainers/runtime-spec v1.1.0 
https://github.com/opencontainers/runtime-spec/compare/v1.1.0-rc.2...v1.1.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 235a4452df)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-01-05 14:17:19 +01:00
Akihiro Suda 91f953bb47 go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.2 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 5e054ee631)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-01-05 14:15:29 +01:00
Sebastiaan van Stijn 1ece0cb50f go.mod: remove replace for github.com/opencontainers/runtime-tools 
The replace rule was actually downgrading the package by one commit;
https://github.com/opencontainers/runtime-tools/compare/946c877fa809...2e043c6bd626

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit ec9e74ed92)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-15 13:09:57 +02:00
Akihiro Suda 2b4f830ede go.mod: github.com/opencontainers/selinux v1.11.0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-03-07 22:06:39 +09:00
Akihiro Suda 6bfc82dafe go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.1 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-03-07 22:06:39 +09:00
Krisztian Litkey 43704ca888 nri: add experimental NRI plugin. 
Add a common NRI 'service' plugin. It takes care of relaying
requests and respones to and from NRI (external NRI plugins)
and the high-level containerd namespace-independent logic of
applying NRI container adjustments and updates to actual CRI
and other containers.

The namespace-dependent details of the necessary container
manipulation operations are to be implemented by namespace-
specific adaptations. This NRI plugin defines the API which
such adaptations need to implement.

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2022-11-28 21:51:06 +02:00
Kevin Parsons e6b5311508 Merge pull request #7483 from jterry75/jterry75/update_image_config_argsescaped 
Updates oci image config to support upstream ArgsEscaped
 2022-10-11 16:32:31 -07:00
Justin Terry d4b9dade13 Updates oci image config to support upstream ArgsEscaped 
ArgsEscaped has now been merged into upstream OCI image spec.
This change removes the workaround we were doing in containerd
to deserialize the extra json outside of the spec and instead
just uses the formal spec types.

Signed-off-by: Justin Terry <jlterry@amazon.com>
 2022-10-11 13:29:56 -07:00
Sebastiaan van Stijn e2d8f3859a vendor: github.com/opencontainers/selinux v1.10.2 
full diff: https://github.com/opencontainers/selinux/compare/v1.10.1...v1.10.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2022-10-05 22:33:35 +02:00
log1cb0mb ae29594d0b Bump opencontainers/selinux from 1.10.0 to 1.10.1 
Signed-off-by: Nabeel Rana <nabeelnrana@gmail.com>
 2022-04-27 22:55:25 +03:00
Ed Bartosh 825c1c58a9 CDI: update go.mod and vendor deps 
Signed-off-by: Ed Bartosh <eduard.bartosh@intel.com>
 2022-04-06 13:10:59 +03:00
Kazuyoshi Kato 388ee880d2 Upgrade containerd/imgcrypt and opencontainers/image-spec 
- Upgrade github.com/containerd/imgcrypt to prepare for typeurl upgrade
  (see https://github.com/containerd/imgcrypt/pull/72)
- Upgrade github.com/opencontainers/image-spec since imgcrypto needs at
  least 1.0.2.

Signed-off-by: Kazuyoshi Kato <katokazu@amazon.com>
 2022-03-22 21:17:18 +00:00
Kazuyoshi Kato 040babe003 Vendor dependencies with module graph pruning 
The empty-mod hack no longer works with Go 1.18.

This commit fixes #6586.

Signed-off-by: Kazuyoshi Kato <katokazu@amazon.com>
 2022-03-18 16:49:09 +00:00
Akihiro Suda 21a748e381 go.mod: github.com/opencontainers/runc v1.1.0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2022-01-18 13:35:22 +09:00
Sebastiaan van Stijn fc8138468f go.mod: update image-spec to latest (v1.0.3-dev) 
The OCI image spec did a v1.0.2 security release for CVE-2021-41190, however
commit 09c9270fee, depends on MediaTypes that
have not yet been released by the OCI image-spec, so using current "main" instead.

full diff: https://github.com/opencontainers/image-space/compare/5ad6f50d6283...693428a734f5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-12-09 17:50:09 +01:00
Kohei Tokunaga 09c9270fee images: enable converter to uncompress zstd 
Currently uncompress converter only supports gzip. This commit fixes it to
support zstd as well.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
 2021-09-27 11:08:44 +09:00
Akihiro Suda a12c7bd1cf go.mod: runc v1.0.1 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2021-07-18 20:39:34 +09:00
Akihiro Suda f913a42755 go.mod: runc v1.0.0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2021-06-22 10:26:46 -04:00
Davanum Srinivas 9a451d103c Update opencontainers/selinux to v1.8.2 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2021-06-03 10:35:11 -04:00
Davanum Srinivas 1093f05ab2 Bump github.com/opencontainers/selinux from 1.8.0 to 1.8.1 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2021-05-18 11:08:04 -04:00
Davanum Srinivas de6db4038c Update vendored runc to v1.0.0.0-rc94 
Note that this is the code in containerd that uses runc (as almost
a library). Please see the other commit for the update to runc binary
itself.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2021-05-10 13:12:48 -04:00
Sebastiaan van Stijn 9bc8d63c9f cri/server: use containerd/oci instead of libcontainer/devices 
Looks like we had our own copy of the "getDevices" code already, so use
that code (which also matches the code that's used to _generate_ the spec,
so a better match).

Moving the code to a separate file, I also noticed that the _unix and _linux
code was _exactly_ the same (baring some `//nolint:` comments), so also
removing the duplicated code.

With this patch applied, we removed the dependency on the libcontainer/devices
package (leaving only libcontainer/user).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-04-08 23:25:21 +02:00
Sebastiaan van Stijn 04d061fa6a update runc to v1.0.0-rc93 
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc92...v1.0.0-rc93

also removes dependency on libcontainer/configs

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-02-04 16:13:30 +01:00
Akihiro Suda 7e6e4c466f remove "selinux" build tag 
The build tag was removed in go-selinux v1.8.0: opencontainers/selinux#132

Related: remove "apparmor" build tag: 0a9147f3aa

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-15 20:05:25 +09:00
Shengjing Zhu 7e46676e7c Go mod vendor 
Signed-off-by: Shengjing Zhu <zhsj@debian.org>
 2020-12-01 01:41:25 +08:00
Sebastiaan van Stijn eba94a15c8 pkg/cri/server: remove dependency on libcontainer/apparmor, libcontainer/utils 
recent versions of libcontainer/apparmor simplified the AppArmor
check to only check if the host supports AppArmor, but no longer
checks if apparmor_parser is installed, or if we're running
docker-in-docker;

https://github.com/opencontainers/runc/commit/bfb4ea1b1b2452bb3ddc8183b35dec4914bb5128

> The `apparmor_parser` binary is not really required for a system to run
> AppArmor from a runc perspective. How to apply the profile is more in
> the responsibility of higher level runtimes like Podman and Docker,
> which may do the binary check on their own.

This patch copies the logic from libcontainer/apparmor, and
restores the additional checks.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-11-12 15:42:25 +01:00
Akihiro Suda 8433602989 update runc to v1.0.0-rc92 
Changes: https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-08-06 20:31:33 +09:00
Akihiro Suda 362b7167a7 vendor: update cri (no more libseccomp cgo dependency) 
https://github.com/containerd/cri/compare/8448b92d237e877bed1e4aa7a0baf0dee234dbcb...8871d5cdf8102a7d5989c307f2a366946feb54ee

The cgo dependency on libseccomp was removed in containerd/cri#1548.

The `seccomp` build tag is now ignored (and the seccomp support is
always built-in).

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-07-31 14:32:08 +09:00
Jintao Zhang b870231854 vendor runc library to v1.0.0-rc91-48-g67169a9d 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2020-07-29 14:52:48 +08:00
Michael Crosby 3611efdcef update cri to 8448b92d23 
This includes an update of the selinux package and the ability in the CRI
configuration to set the upper bounds for the selinux category labels that are
generated.

Signed-off-by: Michael Crosby <michael@thepasture.io>
 2020-07-23 17:11:18 -04:00
Davanum Srinivas 212c29833f Updates to go-systemd and selinux 
caught these when i was looking at cadvisor's deps.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-07-15 17:08:34 -04:00
Davanum Srinivas 963625d7bc Update runc to v1.0.0-rc91 
https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-07-04 14:46:03 -04:00
Michael Crosby 785f4c5cd9 Bump CRI for 1.4x release 
includes selinux bump.

Signed-off-by: Michael Crosby <michael@thepasture.io>
 2020-06-15 16:07:00 -04:00
Michael Crosby c5273930bd Update CRI to 52c2c6b5df 
This bump contains updates for CRI with selinux support.

Signed-off-by: Michael Crosby <michael@thepasture.io>
 2020-05-26 21:06:18 -04:00
Sebastiaan van Stijn 3e7bbb8a49 vendor: update containerd/cri, remove "docker/distribution" dependency 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-12 15:00:51 +02:00
Sebastiaan van Stijn 2c77dc63a4 vendor: update containerd/cri to current master 
- Remove dependency on libcontainer/system
- Get rid of socat for port forwarding
- Roll docker/distribution back to latest (v2.7.1) release
  Now that 901bcb2231 was merged in containerd,
  we no longer depend on the ParseDockerRef utility from docker/distribution,
  so we can safely roll back to the latest release for this dependency.
- vendor: kubernetes v1.18.2
  Fix client watch reestablishment handling of client-side timeouts
- Add config flag to default empty seccomp profile

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-11 09:09:39 +02:00
Davanum Srinivas f328f61b81 Update to selinux 1.5.1 
Changes are listed here:
https://github.com/opencontainers/selinux/compare/v1.3.3...v1.5.1

Not urgent as such, just keep up with eco-system.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-04-08 06:29:50 -04:00
Sebastiaan van Stijn e822296fc4 vendor: runtime-spec v1.0.2 
full diff: https://github.com/opencontainers/runtime-spec/compare/29686dbc5559d93fb1ef402eeda3e35c38d75af4...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-04-04 00:21:43 +02:00
Davanum Srinivas 026e43806a Update to a released version of opencontainers/selinux (1.3.3) 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-02-28 11:34:40 -05:00
Phil Estes a1e0303e7a Merge pull request #3978 from dims/sync-with-latest-containerd-cri-master-including-selinux-change 
Sync with latest changes in containerd/cri
 2020-01-25 23:41:13 +02:00
Davanum Srinivas faf03c3d23 Pick up fix for CVE-2019-16884 in opencontainers/selinux 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-01-25 14:19:59 -05:00
Davanum Srinivas 923c05bed1 Bump to opencontainers/runc new version - v1.0.0-rc10 
We have a new release of runc ( opencontainers/runc#2217 ). This release
has a fix for a race condition we are struggling with in kubernetes
(especially CI jobs) which was fixed in opencontainers/runc#2185

The v1.0.0-rc10 includes the fix for CVE-2019-19921 as well. The full
diff upstream is here:
https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-01-24 10:13:56 -05:00
Wei Fu 074b453ac6 vendor: call vndr to remove useless pkgs and update vendor 
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2019-10-18 17:49:22 +08:00
Michael Crosby f277665edb Bump runc to 1b8a1eeec3f337ab5d94f28980 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2019-10-03 10:36:35 -04:00
Michael Crosby 95dbbdc8c1 Bump runc for CVE-2019-16884 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2019-09-26 10:09:42 -04:00
Sebastiaan van Stijn cb4a8f51a6 bump runc v1.0.0-rc8-32-gf4982d86 
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc8...f4982d86f7fde0b6f953cc62ccc4022c519a10a9

possibly relevant changes included:

- opencontainers/runc#2074 Update dependency libseccomp-golang
  - fixes https://nvd.nist.gov/vuln/detail/CVE-2017-18367
- opencontainers/runc#2065 Fix cgroup hugetlb size prefix for kB
- opencontainers/runc#2042 libcontainer: intelrdt: add missing destroy handler in defer func
- opencontainers/runc#2042 main: not reopen /dev/stderr
- opencontainers/runc#2038 `r.destroy` can defer exec in `runner.run` method
- opencontainers/runc#2035 specconv: always set "type: bind" in case of MS_BIND
- opencontainers/runc#2035 Move systemd.Manager initialization into a function in that module
- opencontainers/runc#2034 Support for logging from children processes

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-06-25 13:03:23 +02:00
Sebastiaan van Stijn e5aab17a0e bump opencontainers/selinux v1.2.2 
full diff: https://github.com/opencontainers/selinux/compare/v1.2.1...v1.2.2

- opencontainers/selinux#51 Older kernels do not support keyring labeling

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-25 22:43:05 -07:00
Sebastiaan van Stijn dd85aea625 bump runc v1.0.0-rc8 
full diff: https://github.com/opencontainers/runc/compare/029124da7af7360afa781a0234d1b083550f797c...425e105d5a03fabd737a126ad93d62a9eeede87f

- opencontainers/runc#2043 Vendor in latest selinux code for keycreate errors

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-25 22:42:50 -07:00