Read the next version for the PR's base branch from the
"docker-versions" block of the pinned branch status issue instead of
releases/versions.yaml, so updating milestones no longer needs a PR on
every branch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move extension directories and per-extension configuration into the
extensions object in daemon.json.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The Go test cache does not recheck files outside the module root, so
editing only openapi.yaml or swagger.yaml could reuse a cached
TestCheckedInSwagger result and miss a stale projection in a
persistent development container.
Pass -count=1 to disable caching.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move application/x-tar from the Content-type header parameter to the
POST /build request body's content map alongside
application/octet-stream. This matches the content type sent by the Go
client and lets OpenAPI consumers discover both supported body media
types.
Regenerate Swagger with both media types in consumes.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a Go converter in a separate tooling module and reintroduce
swagger.yaml as generated Swagger 2.0 output. Preserve schema property
order, examples, and generator extensions, and reject unsupported
constructs. Use the union of response media types for Swagger's
operation-wide produces lists.
Leave historical versioned specifications and generated Go models
unchanged.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move reusable schemas into components and describe request bodies and
response media types using OpenAPI 3.2 with the OpenAPI 3.1 schema
dialect. Preserve schema property order, reference annotations,
examples, custom formats, and Go generator extensions.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Keep the contents unchanged so Git can follow the hand-maintained
specification across the rename. Convert the document and reintroduce
swagger.yaml as generated compatibility output in subsequent commits.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
setupHijackConn only closed the response body when the upgrade failed.
otelhttp ends its client span when the body is closed, so the span of
every successful ContainerAttach, ContainerExecAttach and DialHijack
call was never ended. A 101 response has no body, so closing it does not
touch the hijacked connection.
Signed-off-by: berce <75228263+bercedev@users.noreply.github.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Jobs extensions need to know when a container finishes so they can
record the outcome of a run.
Add org.mobyproject.extension.container.state.v0.
Its Wait call returns once the container reaches a requested status,
and Watch streams every status change until the container is removed.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Rootless dockerd refused to use overlay2 whenever SELinux was enabled
on the host, forcing users onto fuse-overlayfs:
```
overlay is not supported for Rootless with SELinux
```
The check was added for Fedora 34, where rootless overlayfs on kernel
5.11 hit SELinux denials.
That no longer happens on current hosts such as Fedora 41.
The containerd overlayfs snapshotter never had an equivalent check and
already runs natively in rootless mode with SELinux enforcing.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The labeler runs again on every push, so a label a maintainer removed
as inaccurate came back with the next commit.
Skip labels the PR already has, and labels with an unlabeled event in
the PR's history.
The workflow never removes labels itself, so any such event comes from
a deliberate removal.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The actions/labeler config had grown hard to keep right.
Apply the labels from a short github-script that matches the changed
paths against globs instead.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add org.mobyproject.daemon.monolith.v0 to expose daemon capabilities
as extension points.
It is a temporary bridge until the daemon is split into independent
extensions.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
State.Wait only reports exits and removal, so callers could not follow
a container through its status changes.
StatusChanges yields the current state and then every status change in
order, until the container is removed.
A consumer that falls too far behind gets an error instead of missing
changes.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add SetPaused and SetDead so that every status change goes through a
State setter, like SetRunning and SetStopped already do.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move the raw inspect response checks from integration-cli into
TestContainerInspectWithRaw.
Share one created container and API 1.24 response to verify legacy
top-level fields, the string Path, and VolumeDriver placement in
HostConfig rather than Config.
Drop the redundant bridge endpoint check because existing network
integration tests already validate and use the inspected address.
Signed-off-by: Jeston Singh <sjestonsingh@gmail.com>
Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Several labels paired their globs with an all-globs-to-all-files
'!vendor/**' check, which requires that no changed file be under
vendor/.
A PR that changed AppArmor code and also bumped a dependency therefore
lost the area/security label.
Pair each repository-wide glob with '!vendor/**' in an
all-globs-to-any-file rule instead, so the label applies when some
non-vendor file matches.
Globs rooted outside vendor/ no longer need the exclusion.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The '**/*.md' glob matched any Markdown file, so code changes that
also touched a README, api/docs/CHANGELOG.md, or files under .github/
got the area/docs label.
Require every changed file to match one of the docs globs instead.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The '**/*log*' glob matched any file with "log" in its name, such as
api/docs/CHANGELOG.md and client/login.go, so every API change got the
area/logging label.
Match '**/*_logs*' instead, which still covers the container, service,
and task logs files in the client.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The area/testing label was added whenever any changed file was under a
test directory, so PRs that also touched daemon code got labeled.
Use any-glob-to-all-files so the label is only applied when every
changed file matches one of the test globs.
The vendor exclusion is dropped since no test glob matches vendor/.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Provide a temporary origin resolv.conf for both sandboxes so host options such as edns0 and trust-ad cannot affect the DNS option assertions
Signed-off-by: akasakariko <148060537+akasakariko@users.noreply.github.com>
The extpoints packages define the extension contract.
Provider selection, timeouts, name validation, and the built-in
fallback are daemon policy, and the daemon is the only caller.
The fallback helper is can be moved to github.com/moby/extensions once
another point needs it.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Allocate all requested port bindings before applying their firewall rules, so nftables rewrites each affected chain once per address family rather than once per port group
Keep grouped port allocation, start proxies after the firewall update, and roll back resources and installed rules if either stage fails
Extend the port-mapping tests to check a single firewall update and verify cleanup and rebinding after setup failures
Signed-off-by: akasakariko <148060537+akasakariko@users.noreply.github.com>
With the userland proxy disabled, the per-port "MASQ TO OWN PORT" rule
is keyed on the container's address and port, not the host port. So,
when more than one host port is mapped to the same container port, the
same rule is generated for each binding.
Commit 785ae9a0f9 dropped the code that ignored "rule exists" and "rule
does not exist" errors for this rule, without setting IgnoreExist. So,
mapping a second host port to the same container port failed with
"rule exists".
Set IgnoreExist on the rule, as for the per-port forwarding rule.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Add `meta/ai-assisted` label when the description has a line starting
with "Created with:" (matching the CONTRIBUTING.md guidelines).
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Paweł Gronowski