dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-06 13:27:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,231 Commits 31 Branches 333 Tags
bb5988d3d1da170491bbb83564976729d85c227e
Commit Graph
20 Commits
Author SHA1 Message Date
Sebastiaan van Stijn dc609cf4b4 core/remotes/docker: use SystemCertPool on Windows 
This code was added in [containerd@17b6050] (containerd v1.4.0-beta.0), at
which time containerd was using go1.13.8, which didn't support system-pools
([x509.SystemCertPool]) on Windows, so an empty pool was constructed, similar
to [docker/go-connections@55aadc3].

Support for system pools on Windows originally added in Go 1.8 (through
[golang/go@05471e9]), but reverted, and re-implemented in Go 1.18 (through
[golang/go@3544082]).

Go 1.18 and up now implement this, but, unlike Linux, which uses a pure-Go
implementation, certificate validation is handled by the system:

> On macOS and Windows, certificate verification is handled by system APIs,
> but the package aims to apply consistent validation rules across operating
> systems.

On macOS and Windows, x509.SystemCertPool returns an empty Pool, with the
`systemPool` set to `true` (see [loadSystemRoots]). This must be considered
an implementation detail; custom CAs can be appended to this pool, and handled
as usual.

This patch removes the special handling on Windows, allowing it to use the
system-pool, aligned with Linux.

[containerd@17b6050]: https://github.com/containerd/containerd/commit/17b6050d20bf7d25d15e26ed867f774e8c7c72fe
[docker/go-connections@55aadc3]: https://github.com/docker/go-connections/commit/55aadc3cc561684699edcdd0921b9293c3ee6b49
[golang/go@05471e9]: https://github.com/golang/go/commit/05471e9ee64a300bd2dcc4582ee1043c055893bb
[golang/go@3544082]: https://github.com/golang/go/commit/3544082f75fd3d2df7af237ed9aef3ddd499ab9c
[x509.SystemCertPool]: https://pkg.go.dev/crypto/x509#SystemCertPool
[loadSystemRoots]: https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/root_windows.go;l=15-17

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-03-26 13:00:13 +01:00
Sebastiaan van Stijn 6b58f13443 replace some uses of interface{} in (go)docs 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-03-17 13:38:25 +01:00
Sebastiaan van Stijn 92b0b289e3 core: modernize: any 
go install golang.org/x/tools/go/analysis/passes/modernize/cmd/modernize@latest
    modernize -any -fix ./...

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-03-15 18:24:14 +01:00
Derek McGowan b668614b55 Add referrers to host config 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2025-09-24 17:59:19 -07:00
Tonis Tiigi c1b1297c6c Update capabilities for referrers 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-09-24 17:59:18 -07:00
yashsingh74 1ff5900044 fix: QF1004: strings.ReplaceAll instead (staticcheck) 
Signed-off-by: yashsingh74 <yashsingh1774@gmail.com>
 2025-06-18 14:16:41 +05:30
Jin Dong 10b4eb4a90 Add hosts.toml headers to auth requests 
This patch fixed an issue that when we create
a `DockerAuthorizer`, we didn't pass the
headers read from hosts.toml to it, causing
the headers are missing in auth requests.

Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2025-04-08 20:26:42 -04:00
Jin Dong 53eec6c783 move host tlsconfig update to a separate function 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2025-03-15 01:36:25 +00:00
Jin Dong f702bf9fe5 [hosts] wrong explicitTLS value when dialTimeout is set 
If `host.caCerts, host.clientPairs, host.skipVerify` are
all `nil` and `host.skipVerify` not `nil`, `explicitTLS`
will be set to be `true` instead of `false`.

Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2025-03-15 01:25:00 +00:00
Philip Laine c4982bffc6 Add dial timeout field to hosts toml configuration 
Signed-off-by: Philip Laine <philip.laine@gmail.com>
 2025-03-13 23:33:53 -07:00
Derek McGowan ccb4c7429e Merge pull request #11167 from djdongjin/unify-resolver-transport 
Unify default transport in docker resolver
 2025-01-10 23:22:35 +00:00
Jin Dong a4e3218e8f change tmp dir creation in fuzz to t.TempDir 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2025-01-02 20:26:07 +00:00
Jin Dong 2de1030299 Move fuzz tests to go native fuzz [part1] 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2024-12-24 22:48:20 +00:00
Jin Dong 47c4dba409 Unify default transport in docker resolver 
The default transport are used in 3 places:

1. `ConfigureDefaultRegistries` (no `hosts_dir` is set)
2. `ConfigureHosts` (when `hosts_dir` is set)
3. in cri service

2 and 3 use/duplicate the same default transport, whereas 1
uses go's default Client/Transport

This PR moves the default transport to a common funcion (can pass in tls config).

Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2024-12-16 04:00:01 +00:00
Derek McGowan 02b6c6939f Allow fallback across default ports 
When no port is specified, allow falling back from 443 to 80 when
http is specified along with a TLS configuration.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-06-05 14:39:57 -07:00
zouyee 11d8beff80 optimize error logs by providing absolute file paths 
Signed-off-by: zouyee <zouyee1989@gmail.com>
 2024-04-30 09:08:01 +08:00
Derek McGowan 5e470e1cae Update HTTPFallback to handle tls handshake timeout 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-04-22 18:53:27 -07:00
Derek McGowan fb9b59a843 Switch to new errdefs package 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-01-25 22:18:45 -08:00
Derek McGowan 44a836c9b5 Move errdefs to pkg/errdefs 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-01-17 09:54:45 -08:00
Derek McGowan 0dabf6f154 Move remotes to core/remotes 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-01-17 09:52:21 -08:00