The daemon uses firewalld only if firewalld is running when the daemon
starts. If firewalld is started later, the daemon does not react to it
starting or reloading. On firewalld configurations which delete other
applications' iptables rules when firewalld starts, the daemon's rules
stay deleted. The daemon's bridges are not added to the docker zone.
Keep the D-Bus connection when firewalld is not running at startup.
When firewalld acquires its D-Bus name, set up the docker zone and
forwarding policy before running the reload callbacks.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The daemon checks whether firewalld is running by calling
getDefaultZone at startup, and again whenever firewalld's D-Bus name
changes owner. The check infers firewalld's state from whether a
method call succeeds.
firewalld does not handle method calls until it has finished starting.
It is ready as soon as it owns its name. Ask the bus whether the name
has an owner at startup, after subscribing to NameOwnerChanged so that
no change of owner is missed, and take the state from each
NameOwnerChanged signal after that.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When firewalld is stopped with CleanupOnExit=yes (the default), it
deletes the iptables rules, including the daemon's rules for
masquerading, published ports and network isolation. The daemon does
not restore them until firewalld is started again or the daemon is
restarted.
firewalld deletes the rules before it releases its D-Bus name. Run the
reload callbacks when firewalld releases its name, as well as when it
acquires it. By then, UsingFirewalld() reports false and the callbacks
restore the rules using iptables directly.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Fill in the `Pattern` field on an `http.Request`. This field is filled
out by the standard library's `http.ServeMux` but is not filled in by
`gorilla/mux`. It is used to identify the matching route pattern and is
primarily used for traces and metrics to reduce cardinality on paths
that have variables in the routes so they can be recorded to traces.
The primary result of this change is that HTTP request traces will now
have the name `{method} {route}` rather than only `{method}` so an
invocation of `docker ps` will show up as `GET /containers/json` instead
of just `GET`.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Build RootlessKit with the `urfave_cli_no_docs` tag to exclude unused Markdown
and man-page generation code from `urfave/cli`.
This reduces the RootlessKit binary size by approximately 414 KiB.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Build containerd binaries with the `grpcnotrace` tag to exclude the legacy
`golang.org/x/net/trace` dependency, allowing the linker to eliminate unused
tracing code.
- containerd: 36,700,322 → 36,307,106 bytes (−384 KiB)
- ctr: 21,561,506 → 21,168,290 bytes (−384 KiB)
See https://github.com/grpc/grpc-go/blob/v1.83.2/trace_notrace.go#L23-L25
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These releases include 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.26.10
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Replace the rapid-based property test for plugin capability IDs
with a table-driven test and Go's built-in fuzzing support.
Preserve the comparison against the historical JSON parser to
catch compatibility regressions, and add explicit test cases for
the supported serialization formats and invalid inputs.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
openContainerFS remounted such a mount read-only with only
ro,remount,bind, but the rootless daemon runs in a user namespace, where
the kernel locks the nosuid, nodev, noexec and atime flags of mounts
inherited from the parent namespace, and rejects a remount which drops
them.
Keep those flags on the remount when running in a user namespace, using
mountopts.UnprivilegedMountFlags as the container spec already does for
bind mounts.
This is typical for X11 sockets on hosts where /tmp is a tmpfs, such as:
/tmp/.X11-unix/X0.
Before this patch, any `docker cp` call on a container with such path
bind-mounted errored out with:
```
Error response from daemon: remount-ro .../tmp/.X11-unix/X0,
flags: 0x1021: operation not permitted
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Mend Renovate