Only consider a registry insecure through CIDR matching when all of its
resolved IP addresses match a configured insecure subnet.
This prevents a registry that resolves to both loopback and non-loopback
addresses from falling back to insecure requests.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add descriptive names and run the isSecureIndex test cases as subtests.
This makes failures easier to identify and prepares the table for adding
coverage of registries that resolve to multiple addresses.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make the order of insecure registries deterministic, and update TestNewServiceConfig
to also test the config that was produced, not just errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility was originally added in 73823e5e56,
and looks to be a hand-crafted equivalent for request.Clone (which may not have
been available yet at the time).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
A managed volume plugin could return a path containing dot-dot
elements that passed the propagated-mount string prefix check, then
escaped the host mount root when filepath.Join cleaned it. Sibling
paths sharing the same string prefix were also treated as propagated
paths.
Normalize returned paths in the plugin's rooted namespace. Use
filepath.Rel and filepath.IsLocal so only path-component descendants
are mapped through the propagated mount. Other paths remain confined
beneath the plugin rootfs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Define the recursion-prevention type from NRIOpts instead of *NRIOpts.
The named pointer type was handled correctly by the legacy JSON decoder,
but Go 1.27's new JSON implementation resolves NRIOpts.UnmarshalJSON
through it, causing infinite recursion and eventually a stack overflow.
Using a distinct type with NRIOpts as its underlying type removes the
method set while preserving the same fields and JSON representation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace go-fuzz-headers with native fuzz parameters and construct Record
values directly from the fuzz input.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Plugin specs built by (*v2.Plugin).InitSpec never went through
daemon/internal/rootless/specconv.ToRootless, so the /sys fix-up
for network=host under detach-netns (added in 84aedb805 "rootless:
support detach-netns mode") was skipped for plugins. This made
`docker plugin install` fail in rootless mode.
Apply the same rootless conversion that container specs receive in
daemon/oci_linux.go, gated on rootless.RunningWithRootlessKit().
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Time namespaces were introduced in [Linux Kernel 5.6], and are supported by
[OCI runtime spec v1.1.0] and up. This patch updates the default OCI spec for
containers to use a private time-namespace if the host support it. We do not
yet provide options to customize this option (e.g. to allow switching between
"private", "host", or to join another container's time-namespace), which can be
added in a future update (but requires API changes).
With this patch applied:
docker run -dq nginx:alpine
54220be49a47d09f74ee918e65233365e94ecb306e4104a4468ab50221262bf7
ctr -n moby c info 54220be49a47d09f74ee918e65233365e94ecb306e4104a4468ab50221262bf7 | jq .Spec.linux.namespaces
[
{"type": "mount"},
{"type": "network"},
{"type": "uts"},
{"type": "pid"},
{"type": "ipc"},
{"type": "time"},
{"type": "cgroup"}
]
[Linux Kernel 5.6]: https://lwn.net/Articles/779104/
[OCI runtime spec v1.1.0]: https://github.com/opencontainers/runtime-spec/releases/tag/v1.1.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update the docstring to accurately reflect the behavior of netip.ParseAddr,
which does not allow leading/trailing whitespace and does not support IPv6
addresses in square brackets.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Fix an off-by-one error in isEqual() where the comparison loop started
at index 1 instead of 0, causing the first privilege (after sorting
alphabetically by name) to never be validated.
This allowed a malicious plugin to request different values for
whichever privilege sorts first — most notably "allow-all-devices",
which grants unrestricted rwm access to all host devices.
The bug also meant that plugins requesting exactly one privilege had
zero iterations of the comparison loop, bypassing validation entirely.
Also fix an existing test case ("diff-order-but-same-value") that only
passed due to the off-by-one bug, and add test cases for single-element
and first-sorted-element mismatches.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This was removed in f651a5d5e9, because
at the time docker/cli was importing this package. It's now moved
internal to the daemon, and should no longer be used externally,
so we can revert that change.
This reverts commit f651a5d5e9.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Updates docker pull to pull related attestation manifest and
any signatures for that manifest in cosign referrer objects.
These objects are transferred with the image when running
docker save and docker load and can be used to identify
the image in future updates.
Push is not updated atm as the currect push semantics
in containerd mode do not have correct immutability
guaranteed and don't work with image indexes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This type was used as Aux message for docker push, was not documented,
and only present for Docker Content Trust (which is deprecated).
This patch removes it from the API module, and moves the type internal.
We can stop sending this Aux message once DCT is fully phased out.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the progress package up into the client as a temporary shared location for
common clients like CLI and compose.
The progress package is used by the daemon to write progress updates to
some sink, typically a streamformatter. This package is of little use to
API clients as this package does not provide any facilities to consume
the progress updates.
Co-authored-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Most of the code in the filters package relates to the unmarshaling,
validation and application of filters from client requests. None of this
is necessary or particularly useful for Go SDK users. Move the full-fat
filters package into daemon/internal and switch all the daemon code to
import that package so we are free to iterate upon the code without
worrying about source-code interface compatibility.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The DockerVersion field was present for informational purposes, but was
not used anywhere. This patch stops propagating the field, which also
reduces the number of places where the `dockerversion` package is used,
which still needs a new home.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These utilities are very handy to use in integration tests, too. Move
the package so it can be imported by them.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The wire type of Plugin.Config.Interface.Types is an array of strings,
not of objects with three properties. We just so happen to have a Go
struct type to represent a plugin-interface-type value in memory with
all the fields parsed out for convenience, but that is not part of the
REST API contract documented by the Swager spec.U pdate the Swagger spec
to correctly document that the Types property is an array of strings in
the API, while still generating Go definitions that unmarshal into the
convenient struct type.
Move the definition and marshal/unmarshal methods for
PluginInterfaceType into a more appropriate location than api/types.
Rename the type to one that does not stutter or overload already
heavily overloaded terminology.
Modernize the parser and use property-based testing to assert that it
behaves the same as the old parser for all well-formed inputs.
Signed-off-by: Cory Snider <csnider@mirantis.com>
It's now only used to back the `Service.ResolveAuthConfig` method, and
not used outside of the package currently.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Shane Jonas