The probe echoes to stdout and then sleeps. The test gives it a 50ms
timeout and asserts that the timeout message carries the echoed output.
The 50ms clock starts when the exec request is accepted, not when the
probe process is running. On Windows the process still has to be
scheduled, sh has to initialize, echo has to run, and the bytes have to
reach the daemon. That often exceeds 50ms, so the probe is killed having
written nothing and the daemon reports the timeout without any output.
The assertion then fails on the missing "logs1 logs2 logs3".
Raise the Windows probe timeout to 500ms and leave Linux at 50ms,
following the same reasoning as TestHealthStartInterval in this file.
Measured on a Windows daemon built from master, Hyper-V isolation,
servercore ltsc2022, 30 iterations per value:
50ms: 14/30 failed
200ms: 0/30 failed
500ms: 0/30 failed
2s: 0/30 failed
Linux, 5 iterations: unchanged, all pass in about 1s.
Signed-off-by: Srijan Keshri <srijankeshri007@gmail.com>
Move the service removal, daemon registration, environment setup, and
readiness checks into a composite action.
Pass the containerd, runtime, and storage modes explicitly so other
Windows integration workflows can use the same daemon configuration.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Current GitHub Windows runner images install Docker CE through
`install-docker-ce.ps1`, not as a PowerShell PackageManagement package.
`Uninstall-Package -Name docker` therefore cannot be relied on to find
or remove the installed engine.
The workflow only needs to free the `docker` service name before
registering its test daemon. Keep removing the service directly and
update the comment to explain why this narrower operation is used.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- Fix a regression introduced in v0.3.0 that caused archive extraction
to reject hardlinks with absolute targets, as produced by some image
builders. Absolute hardlink targets are now resolved relative to the
extraction root, while paths that escape the root remain rejected.
- Fix a regression introduced in v0.3.0 that caused archive extraction
to fail when applying permissions to device nodes, including nodes on
`nodev` filesystems and `dev/ptmx`. Device nodes are now referenced
without opening the underlying device before applying their mode.
- Set close-on-exec on file descriptors used by the Linux permission
fallback to prevent them from leaking into child processes.
full diff: https://github.com/moby/go-archive/compare/v0.3.2...v0.3.3
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Network records have persisted a non-empty scope since January 2016. The
store therefore no longer needs to replace a missing persisted value
with `scope.Local`.
Load the persisted scope directly while still supplying the controller
before the datastore publishes the network. The default for newly
constructed networks remains in the driver path.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Create the default archive options before entering the container filesystem,
and refactor container-specific ownership handling into
applyTarCopyOptions.
Keep user and group resolution inside the container filesystem so lookups
continue to use the container's passwd and group files.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add MapElementDeleteFunc, which deletes every element of a named map that
a predicate selects. The elements to remove are selected from the map's
contents when the change is applied. That lets a caller replace
whichever of a map's elements are currently its own without keeping a
record of what it wrote last time. The predicate is given the whole
element, so the comment can carry metadata to select on, such as which
caller owns it.
"Whatever happens to match" has no inverse to roll back to, so commands
are now resolved into individually reversible operations as they're
applied, rather than each being one such operation.
That makes it possible for a command to have no inverse at all, so split
the type that holds them in two: a Modifier still takes only object
creations and deletions and can therefore always be reversed, while a
Batch takes any Cmd and has no Reverse method. Table.Apply accepts
either.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Support atomically replacing an element of an interval map by deleting
the existing key and adding a replacement element with the same key.
This is necessary to support updating interval maps as nftables rejects
an `add element` whose key overlaps the interval of an existing key with
EEXIST, even when the intervals are identical.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The syntax for specifying the parameters of a base chain is documented
to have a mandatory semicolon terminating each parameter clause. In
practice, nft sometimes accepts a chain definition with a newline
instead of a semicolon after the terminal parameter, only to reject the
rules that follow with strange errors. Add trailing semicolons to the
policy parameters of base chain definitions to satisfy the parsers of
all versions of nft we might encounter.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Swarm suite teardown stopped daemons while holding daemonsLock. A
nonzero daemon exit made Stop call Fatalf, so the test goroutine left
the mutex locked and retained stale daemons for the next test.
Snapshot and clear suite state under the lock, then stop each daemon
in its own cleanup subtest. A failed stop now releases suite state,
cleanup still runs for that daemon, and teardown continues with the
remaining daemons.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Use per-job concurrency groups so that a pull-request event only cancels an
older instance of the same validation job.
Previously, an event such as adding a label could cancel the entire workflow
run, including unrelated checks that are skipped by the replacement run.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
