Add HostConfig.Umask and pass it to the OCI process spec for container
entrypoints, exec processes, and healthchecks.
Preserve the configured umask when exec user resolution reconstructs the
OCI User value, so runtimes receive it in the per-exec process spec.
Keep the field aligned with OCI's uint32 representation - raw JSON
clients need to use 18 for octal 0022 for example.
Co-authored-by: Youfu Zhang <zhangyoufu@gmail.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a small wrapper around gddo's NegotiateContentEncoding utility
with a signature tailored to our use, accepting just the request
headers instead of the whole request.
This keeps content-encoding negotiation behind an internal API,
similar to the existing contenttype package, and prepares for
internalising the gddo implementation without changing callers.
Add tests covering explicit encodings, wildcard matching, quality
values, identity encoding, and the case where no encoding is
acceptable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Drop cancellation at the kill boundary because killing starts
irreversible task and cleanup work that must finish after request
cancellation.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
ContainerUpdate only starts applying per-device blkio settings in the
current API version.
The fields existed in the Go request type before that because it shares
`container.Resources` with other endpoints, but they were not documented
as supported for container update and older daemons ignored them.
Clear these fields when handling requests for older API versions so
clients pinned to those versions keep the previous behavior, while v1.55
clients can use the newly supported fields.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Both query parameters are now collectionFormat: multi arrays in the
swagger so they can accept multiple values later without an API
version bump. The server still operates on a single platform and
rejects requests passing more than one; type is read directly as a
list of repeated values instead of a comma-separated string.
Signed-off-by: Sopho Merkviladze <smerkviladze@mirantis.com>
Add a new Engine API endpoint that returns the in-toto attestation
statements attached to an image for a given platform. The endpoint
locates the attestation manifest(s) referencing the requested platform's
image manifest, enumerates the statement layers, and returns each
layer's OCI descriptor (including media type, digest, size, and
annotations) together with its in-toto predicate type.
Query parameters:
- platform: JSON-encoded OCI platform; defaults to the daemon's host
platform if omitted.
- type: comma-separated list of in-toto predicate type URIs; if
omitted, all statements are returned.
- statement: boolean, defaults to false. When true, the daemon reads
each matching statement blob and includes the verbatim in-toto JSON
in the response. When false (or omitted), statement blobs are not
read and the Statement field is absent from each entry.
The manifest-chain walk (locating the platform image manifest and its
associated attestation manifest) is delegated to policy-helpers'
image.ResolveSignatureChain so that moby and BuildKit agree on how to
interpret the attestation storage format. The statement-layer iteration
and blob reading is inlined: when statement bodies are requested it
fails fast on the first unreadable blob and reads matching blobs
eagerly into memory; otherwise statement-layer blobs are never read
from the content store.
The endpoint is implemented for the containerd image store. The legacy
graphdriver store returns errdefs.NotImplemented (HTTP 501).
Signed-off-by: Sopho Merkviladze <smerkviladze@mirantis.com>
The wrapOutputBufferedUntilRequestRead helper was added as a workaround
for Go not supporting full-duplex HTTP/1 responses (golang/go#15527,
golang/go#22209). Since Go 1.21, the standard library ships
http.ResponseController.EnableFullDuplex which tells the server that
the handler will interleave reads and writes, making the buffering
wrap unnecessary.
Replace the workaround with a single EnableFullDuplex call and remove
the helper types (wcf, rcNotifier, flusher, nopFlusher) that were only
used by the old path.
Fixes#51209
Signed-off-by: Vedant Madane <vedant.madane@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move parsing the wire format to the router instead of in the daemon, so
that a strong type can be used internally.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commits df506c107e and aef5d996ce
fixed the content-type advertised by the `/events` endpoint, and added content
negotiation as an "opt-in" by clients.
A fallback / default value was added to keep the old (`application/json`)
content type, however, some clients may send `*/*` as a default, which
would considered as "opt-in" in the negotiation, and pick the first "offer"
(`application/jsonl`) instead of the fallback.
On docker 28.x and lower, omitting an `Accept` header, or sending `*/*`
would produce the `application/json` content-type:
```
curl -sS -D - --unix-socket /var/run/docker.sock 'http://localhost/v1.50/events?until=1' | grep 'Content-Type'
curl -sS -D - -H 'Accept: */*' --unix-socket /var/run/docker.sock 'http://localhost/v1.50/events?until=1' | grep 'Content-Type'
```
On docker 29.x, a missing accept header, or a `*/*` would use the new content-type,
not the previous default;
```
curl -sS -D - --unix-socket /var/run/docker.sock 'http://localhost/v1.50/events?until=1' | grep 'Content-Type'
curl -sS -D - -H 'Accept: */*' --unix-socket /var/run/docker.sock 'http://localhost/v1.50/events?until=1' | grep 'Content-Type'
```
With this patch, the default depends on the API version, and we only
override the content-type if there's a match with any of the types
set in the `Accept` header, ignoring wildcards (`*/*`) that are sent
as default by some clients, such as cURL or `docker-py`;
```
curl -sS -D - --unix-socket /var/run/docker.sock 'http://localhost/v1.51/events?until=1' | grep 'Content-Type'
curl -sS -D - -H 'Accept: */*' --unix-socket /var/run/docker.sock 'http://localhost/v1.51/events?until=1' | grep 'Content-Type'
curl -sS -D - --unix-socket /var/run/docker.sock 'http://localhost/v1.52/events?until=1' | grep 'Content-Type'
Content-Type: application/jsonl
curl -sS -D - -H 'Accept: */*' --unix-socket /var/run/docker.sock 'http://localhost/v1.52/events?until=1' | grep 'Content-Type'
curl -sS -D - -H 'Accept: application/json-seq' --unix-socket /var/run/docker.sock 'http://localhost/v1.50/events?until=1' | grep 'Content-Type'
```
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows negotiating the content-type without wildcard-matching.
In most of our uses, we want to provide the best match that the
client accepts, but have to avoid picking the first match if a
client would send "*/*" (or, e.g., "application/*").
For example, the events endpoint added support for JSON-stream
content types, but older API versions unconditionally returned
"application/json". Clients sending "*/*" (such as docker/docker-py)
would now get a different content type as before.
For convenience, also adding a wrapper for the gddo NegotiateContentType
utility with a slightly different signature (accepting just the headers
instead of the whole request).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Extend the previous commit to support API v1.40 (Docker 19.03) by
lowering defaultMinAPIVersion and client MinAPIVersion from 1.41 to
1.40.
Reject container create requests that set the HostConfig.Capabilities
field on API v1.40, since this daemon can no longer honor it. The field
was removed before API v1.41 (24f173a003) and the Go type no longer
includes it, so without this check the field would be silently dropped.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Lower the default minimum API version from v1.44 to v1.41, restore
VirtualSize in image list and disk usage responses for API < 1.44, and
add version-gated skips for integration tests that need newer APIs.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
The /grpc and /session endpoints are now deprecated as the Engine has
been upgraded to properly support HTTP/2 and h2c requests, making these
specialized endpoints unnecessary.
These endpoints will be removed in the next major API version to
complete the cleanup.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
On daemon shutdown, the HTTP server tries to gracefully shutdown for 5
seconds. If there's an open API connection to the '/events' endpoint, it
fails to do so as nothing interrupts that connection, thus forcing the
daemon to wait until that timeout is reached.
Add a Close method to the EventsService, and call it during daemon
shutdown. It'll close any events channel, signaling to the '/events'
handler to return and close the connection.
It now takes ~1s (or less) to shutdown the daemon when there's an active
'/events' connection, instead of 5.
Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
These fields have been removed from the API specification, and the struct
was only needed to produce legacy responses (server), or to unmarshal
legacy responses in the client.
As the API module only provides API definitions for the current API version,
we should remove these legacy structs, and keep them internal to the daemon
and client.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that we separated the legacy response from non-legacy responses,
we can consume the data produced by the backend as-is; the backend
takes care of omitting "verbose" data (leaving the `Items` slices
empty), and with an early return for the legacy responses, we won't
end up with returning _both_ responses on API < v1.52, but (TBD) still
return both responses for API v1.52.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use early return for legacy response. When using API < v1.52, we'd
never return the new fields, so we can return early, and produce the
legacy-fields only.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move calculation of the data to the builder backend, to align with
the other type of objects. This also allows us to skip the verbose
data if it's not used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn