dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-13 17:07:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,459 Commits 29 Branches 315 Tags
7ad184331fa3e55e52b890ea95e65ba581ae3429
Commit Graph

4459 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Derek McGowan
7ad184331f Merge pull request #4033 from thaJeztah/release_1.2.13 
[release/1.2] Prepare v1.2.13 release
v1.2.13 		2020-02-18 11:00:59 -08:00
Sebastiaan van Stijn
f141d0f7a1 Prepare v1.2.13 release 
The thirteenth patch release for `containerd` 1.2 fixes a regression introduced
in v1.2.12 that caused container/shim to hang on single core machines, fixes an
issue with blkio, and updates the Golang runtime to 1.12.17.

Notable Updates
----------------------------------

* Fix container pid race condition [containerd#4025](https://github.com/containerd/containerd/pull/4025)
* Update containerd/cgroups dependency to address blkio issue [containerd#4001](https://github.com/containerd/containerd/pull/4001)
* Set octet-stream content-type on PUT request [containerd#4028](https://github.com/containerd/containerd/pull/4028)
* Pin to libseccomp 2.3.3 to preserve compatibility with hosts that do not have libseccomp 2.4 or higher installed [containerd#4015](https://github.com/containerd/containerd/pull/4015)
* Update Golang runtime to 1.12.17, which includes a fix to the runtime [containerd#4031](https://github.com/containerd/containerd/pull/4031)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-18 16:28:03 +01:00
Sebastiaan van Stijn
0c10aca55e Update .mailmap with changes from master 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-18 10:25:40 +01:00
Wei Fu
b9b4fa7f10 Merge pull request #4025 from thaJeztah/1.2_backport_fix_container_pid 
[release/1.2 backport] Fix container pid race condition
 2020-02-18 09:29:31 +08:00
Phil Estes
1f6ea50be7 Merge pull request #4028 from estesp/cp-1.2-4017 
[release/1.2] backport: Set octet-stream content-type on put request
 2020-02-17 12:08:54 -05:00
Lantao Liu
b970987628 Fix container pid. 
Signed-off-by: Lantao Liu <lantaol@google.com>
(cherry picked from commit a6b6097c90)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-17 16:34:09 +01:00
Josh Dolitsky
567ca6785c Set octet-stream content-type on put request 
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
 2020-02-17 10:14:26 -05:00
Phil Estes
89c46ed579 Merge pull request #4035 from fuweid/cp12-246a560e 
[release/1.2 backport] script: use github.com/kubernetes-sigs/cri-tools directly
 2020-02-17 10:13:11 -05:00
Wei Fu
c9524284e4 Merge pull request #4031 from thaJeztah/1.2_bump_golang_1.12.17 
[release/1.2 backport] Update Golang 1.12.17
 2020-02-17 22:16:16 +08:00
Wei Fu
28eb964b00 script: use github.com/kubernetes-sigs/cri-tools directly 
When we call `go get -d -v
github.com/kubernetes-incubator/cri-tools/...` which repos has been
moved to `github.com/kubernetes-sigs/cri-tools`, `go get` will create
package `github.com/kubernetes-sigs/cri-tools`.

```
go get -d -v github.com/kubernetes-incubator/cri-tools/...
github.com/kubernetes-incubator/cri-tools (download)
github.com/kubernetes-sigs/cri-tools (download)
```

According to old version of `github.com/kubernetes-incubator/cri-tools`
Makefile, if there is no `github.com/kubernetes-sigs/cri-tools` package,
it will create softlink self to `github.com/kubernetes-sigs/cri-tools`.
But `go get` will create `github.com/kubernetes-sigs/cri-tools` and
there is no softlink. Therefore, the critools are always latest one, not
specific version.

So, use `github.com/kubernetes-sigs/cri-tools` will be better and save
traffic from `go get`.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
(cherry picked from commit 246a560edb)
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2020-02-17 22:06:46 +08:00
Phil Estes
5bead4582c Merge pull request #4001 from DataDog/lbernail/upgrade-cgroups 
[release/1.2] bump cgroups dependency to address blkio issue
 2020-02-17 08:53:56 -05:00
Phil Estes
01edb7cddb Merge pull request #4015 from hakman/fix-libseccomp-ver 
[release/1.2 backport] Pin to libseccomp 2.3.3
 2020-02-17 08:42:52 -05:00
Sebastiaan van Stijn
2a0ca2d077 Update Golang 1.12.17 
full diff: https://github.com/golang/go/compare/go1.12.16...go1.12.17

go1.12.17 (released 2020/02/12) includes a fix to the runtime. See the Go 1.12.17
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.17+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 6a3416449e)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-17 11:17:27 +01:00
Phil Estes
a7c9b7605c Fix incorrect comment from copy/paste of starting script 
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
(cherry picked from commit 75d0c5f2e7)
Signed-off-by: Ciprian Hacman <ciprian.hacman@sematext.com>
 2020-02-14 12:58:04 +02:00
Michael Crosby
6ad255383a Pin to libseccomp 2.3.3 
lib seccomp 2.4 has huge performance regressions.
This change pins to 2.3.3 where that is not an issue

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
(cherry picked from commit b5f03eacd3)
Signed-off-by: Ciprian Hacman <ciprian.hacman@sematext.com>
 2020-02-14 12:58:03 +02:00
Laurent Bernaille
25a806c508 bump cgroups dependency to address blkio issue 
Signed-off-by: Laurent Bernaille <laurent.bernaille@datadoghq.com>
 2020-02-05 23:35:55 +01:00
Derek McGowan
35bd7a5f69 Merge pull request #3984 from thaJeztah/release_1.2.12 
[release/1.2] Prepare v1.2.12 release
v1.2.12 		2020-02-04 00:00:00 -08:00
Sebastiaan van Stijn
79d65767e4 Prepare v1.2.12 release 
* Update the runc vendor to v1.0.0-rc10 which includes a mitigation for [CVE-2019-19921](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19921).
* Update the opencontainers/selinux which includes a mitigation for [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884).
* Update Golang runtime to 1.12.16, mitigating the [CVE-2020-0601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0601) certificate verification bypass on Windows, and [CVE-2020-7919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7919), which only affects 32-bit architectures.
* Update Golang runtime to 1.12.15, which includes a fix to the runtime (Go 1.12.14, Go 1.12.15) and and the `net/http` package (Go 1.12.15)
* A fix to prevent `SIGSEGV` when starting containerd-shim [containerd/containerd#3960](https://github.com/containerd/containerd/pull/3960)
* Fixes to `exec` [containerd/containerd#3755](https://github.com/containerd/containerd/pull/3755)
    - Prevent `docker exec` hanging if an earlier `docker exec` left a zombie process
    - Prevent High system load/CPU utilization with liveness and readiness probes
    - Prevent Docker healthcheck causing high CPU utilization

* CRI fixes:
    - Update the `gopkg.in/yaml.v2` vendor to v2.2.8 with a mitigation for [CVE-2019-11253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11253)

* API
    - Fix API filters to properly handle and return parse errors [containerd/containerd#3950](https://github.com/containerd/containerd/pull/3950)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-03 23:24:55 -08:00
Derek McGowan
9be62a7ee9 Update mailmap 
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
 2020-02-03 23:24:55 -08:00
Derek McGowan
7018df2284 Merge pull request #3996 from thaJeztah/1.2_bump_containerd_cri 
[release/1.2] vendor: bump containerd/cri b1052f3b73fb9f0a6805d3c20e884a4cef265a38
 2020-01-31 15:43:20 -08:00
Phil Estes
9c7bd5072d Merge pull request #3997 from thaJeztah/1.2_backport_dockerfile_test_fixes 
[release/1.2 backport] Fix btrfs packages in contrib Dockerfile
 2020-01-31 22:21:52 +00:00
Derek McGowan
89c589bf03 Merge pull request #3995 from thaJeztah/1.2_backport_bump_grpc 
[release/1.2 backport] bump google.golang.org/grpc v1.23.1
 2020-01-31 13:44:25 -08:00
Phil Estes
8761b1bf86 Update name for btrfs headers package 
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
(cherry picked from commit fda652be5a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-31 16:41:10 +01:00
unknown
5db3987ebf Fix dependency in BUILDING.md 
btrfs/ioctl.h is now included in libbtrfs-dev instead of btrfs-tools.
Update BUILDING.md Dockerfile to install the correct dependency.

Resolves: #3813

Signed-off-by: Reid Li <reid.li@utexas.edu>
(cherry picked from commit a647407ca0)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-31 16:40:54 +01:00
Sebastiaan van Stijn
945611681c [release/1.2] vendor: bump containerd/cri b1052f3b73fb9f0a6805d3c20e884a4cef265a38 
full diff: b075cc4e9f...b1052f3b73

- containerd/cri#1389 pick up fix for CVE-2019-19921 in opencontainers/selinux
- containerd/cri#1392 [release/1.2] Sync vendors with containerd 1.2.11

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-31 16:05:19 +01:00
Sebastiaan van Stijn
520c8cb846 bump google.golang.org/grpc v1.23.1 
full diff: https://github.com/grpc/grpc-go/compare/v1.23.0...v1.23.1

- grpc/grpc-go#3018 server: set and advertise max frame size of 16KB
- grpc/grpc-go#3017 grpclb: fix deadlock in grpclb connection cache
    - Before the fix, if the timer to remove a SubConn fires at the
      same time NewSubConn cancels the timer, it caused a mutex leak
      and deadlock.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 885232b72f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-31 15:22:43 +01:00
Maksym Pavlenko
a558638ee7 Merge pull request #3993 from thaJeztah/1.2_update_containerd_cri 
[release/1.2] vendor: bump containerd/cri b075cc4e9f394780dbed101601c48dcc3d37c828 (release/1.2 branch)
 2020-01-30 11:18:24 -08:00
Sebastiaan van Stijn
c12aaf0e59 vendor: bump gopkg.in/yaml.v2 v2.2.8 
full diff: https://github.com/go-yaml/yaml/compare/v2.2.1...v2.2.8

Includes bb4e33bf68
to address CVE-2019-11253

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-30 14:04:15 +01:00
Sebastiaan van Stijn
9d1954f2ec vendor: bump containerd/cri b075cc4e9f394780dbed101601c48dcc3d37c828 (release/1.2 branch) 
full diff: bab7348fcf...b075cc4e9f

relevant changes:

- containerd/cri#1305 [release/1.2] Sync vendors with containerd
- containerd/cri#1354 [release/1.2] Better handle unknown state
- containerd/cri#1388 [release/1.2] vendor: bump gopkg.in/yaml.v2 v2.2.8

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-30 13:51:02 +01:00
Phil Estes
92b40b6254 Merge pull request #3988 from thaJeztah/1.2_bump_golang_1.12.16 
[release/1.2] Update Golang 1.12.16, x/crypto (CVE-2020-0601, CVE-2020-7919)
 2020-01-29 11:00:14 +02:00
Sebastiaan van Stijn
1bc2590d98 vendor: update golang.org/x/crypto 69ecbb4d6d5dab05e49161c6e77ea40a030884e1 
full diff: 49796115aa...69ecbb4d6d

Includes 69ecbb4d6d
(forward-port of 8b5121be2f),
which fixes CVE-2020-7919:

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.
The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.
Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-28 18:53:59 +01:00
Sebastiaan van Stijn
44b5bac0c0 Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919) 
full diff: https://github.com/golang/go/compare/go1.12.15...go1.12.16

go1.12.16 (released 2020/01/28) includes two security fixes. One mitigates the
CVE-2020-0601 certificate verification bypass on Windows. The other affects only
32-bit architectures.

https://github.com/golang/go/issues?q=milestone%3AGo1.12.16+label%3ACherryPickApproved

- X.509 certificate validation bypass on Windows 10
  A Windows vulnerability allows attackers to spoof valid certificate chains when
  the system root store is in use. These releases include a mitigation for Go
  applications, but it’s strongly recommended that affected users install the
  Windows security update to protect their system.
  This issue is CVE-2020-0601 and Go issue golang.org/issue/36834.
- Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
  On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
  functions of golang.org/x/crypto/cryptobyte can lead to a panic.
  The malformed certificate can be delivered via a crypto/tls connection to a
  client, or to a server that accepts client certificates. net/http clients can
  be made to crash by an HTTPS server, while net/http servers that accept client
  certificates will recover the panic and are unaffected.
  Thanks to Project Wycheproof for providing the test cases that led to the
  discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
  This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of golang.org/x/crypto/cryptobyte.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-28 18:52:39 +01:00
Phil Estes
7276974071 Merge pull request #3982 from dims/bump-opencontainers/selinux-for-CVE-2019-16884-release-1.2 
[release/1.2 backport] Pick up fix for CVE-2019-16884 in opencontainers/selinux
 2020-01-27 23:32:54 +02:00
Davanum Srinivas
4c03d5dfb8 Pick up fix for CVE-2019-16884 in opencontainers/selinux 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
(cherry picked from commit faf03c3d23)
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-01-25 21:29:35 -05:00
Phil Estes
318111bdfe Merge pull request #3977 from dims/update-to-new-rc10-of-opencontainers/runc-release-1.2 
[release/1.2 backport] Bump to opencontainers/runc new version - v1.0.0-rc10
 2020-01-25 23:05:49 +02:00
Davanum Srinivas
87648d2a7b Bump to opencontainers/runc new version - v1.0.0-rc10 
We have a new release of runc ( opencontainers/runc#2217 ). This release
has a fix for a race condition we are struggling with in kubernetes
(especially CI jobs) which was fixed in opencontainers/runc#2185

The v1.0.0-rc10 includes the fix for CVE-2019-19921 as well. The full
diff upstream is here:
https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
(cherry picked from commit 923c05bed1)
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-01-24 20:30:09 -05:00
Phil Estes
701a8d0db8 Merge pull request #3968 from thaJeztah/1.2_bump_golang_1.12.15 
[release/1.2 backport] Update Golang 1.12.15
 2020-01-17 11:58:53 -05:00
Sebastiaan van Stijn
f106ae4ab5 Update Golang 1.12.15 
full diff: https://github.com/golang/go/compare/go1.12.14...go1.12.15

go1.12.15 (released 2020/01/09) includes fixes to the runtime and the net/http
package. See the Go 1.12.15 milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.15+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 72d9dd9bb4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-17 15:51:54 +01:00
Akihiro Suda
625b11b6e1 Merge pull request #3960 from fuweid/cp-3559 
[backport release/1.2] runtime: only check killall for init process
 2020-01-17 18:14:15 +09:00
Wei Fu
4288ba10fd runtime: only check killall for init process 
When containerd-shim does reaper, the most processes are not init
process. Since json.Decode consumes more CPU resource, we should check
killall option for init process only.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2020-01-14 11:52:54 +08:00
Maksym Pavlenko
28d162717f Merge pull request #3918 from thaJeztah/1.2_bump_golang_1.12.14 
[release/1.2 backport] Update Golang 1.12.14
 2019-12-24 11:58:25 -08:00
Sebastiaan van Stijn
e7b06baa68 Update Golang 1.12.14 
go1.12.14 (released 2019/12/04) includes a fix to the runtime. See the Go 1.12.14
milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.14+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f4824d5a61)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-12-23 15:36:59 +01:00
Phil Estes
b584375bdf Merge pull request #3909 from estesp/cp-3898-1.2 
[release/1.2] backport: Disable criu tests in Travis CI
 2019-12-20 21:15:13 -05:00
Phil Estes
34978bf3bd Disable criu tests in Travis CI 
Temporarily disable criu tests until the 5.0.0 CI kernel issue is
resolved. Also update criu to v3.13

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
 2019-12-20 14:17:35 -05:00
Michael Crosby
79f4c650d5 Merge pull request #3755 from thaJeztah/1.2_backport_avoid_unnecessary_runc_state 
[release/1.2 backport] backport exec fixes
 2019-11-27 19:33:35 -05:00
Derek McGowan
ec48c95015 Merge pull request #3856 from fuweid/cp-1.2-3853 
[release 1.2] Fix cleanup error on content client test
 2019-11-27 11:10:25 -08:00
Derek McGowan
de8ed89b12 Fix cleanup error on content client test 
A race occurs today where the cleanup runs after the lease
has been deleted, making all the content and statuses
eligible for collection during the cleanup. There is a case
where a status could be listed but removed before the
abort is called. In this case, abort will return a not found
and the test cleanup should ignore it.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
(cherry picked from commit 8da4346686)
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2019-11-27 23:36:38 +08:00
Derek McGowan
f772c10a58 Merge pull request #3811 from thaJeztah/release_1.2.11 
[release/1.2] Prepare v1.2.11 release
v1.2.11 		2019-11-26 14:16:37 -08:00
Sebastiaan van Stijn
1b4aebd681 Prepare v1.2.11 release 
* Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for
  [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884).
    - More details on the runc CVE in [opencontainers/runc#2128](https://github.com/opencontainers/runc/issues/2128),
      and the additional mitigations in [opencontainers/runc#2130](https://github.com/opencontainers/runc/pull/2130).
* Add local-fs.target to service file to fix corrupt image after unexpected host reboot.
  Reported in [containerd/containerd#3671](https://github.com/containerd/containerd/issues/3671),
  and fixed by [containerd/containerd#3746](https://github.com/containerd/containerd/pull/3746).
* Update Golang runtime to 1.12.13, which includes security fixes to the `crypto/dsa`
  package made in Go 1.12.11 ([CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596)),
  and fixes to the go command, `runtime`, `syscall` and `net` packages (Go 1.12.12).

* CRI fixes:
    - Fix shim delete error code to avoid unnecessary retries in the CRI plugin.
      Discovered in [containerd/cri#1309](https://github.com/containerd/cri/issues/1309),
      and fixed by [containerd/containerd#3732](https://github.com/containerd/containerd/pull/3732)
      and [containerd/containerd#3739](https://github.com/containerd/containerd/pull/3739).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-11-19 22:31:23 -08:00
Michael Crosby
db4537e43d Merge pull request #3821 from fuweid/cherry-pick-3819-1.2 
[release/1.2] snapshots: return error if readSnapshot fails
 2019-11-12 11:24:04 -05:00