dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-07-15 12:01:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
38,603 Commits 19 Branches 583 Tags
2a331a5ef7f2d3f044773010ff3221d2ea36a921
Commit Graph

219 Commits

Author SHA1 Message Date
Akihiro Suda
17bb5f4b15 bump up rootlesskit to v0.9.5 
Supports numeric ID in /etc/subuid and /etc/subgid .
Fix #40926

Full changes: https://github.com/rootless-containers/rootlesskit/compare/v0.9.4...v0.9.5

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-05-11 10:25:00 +09:00
Akihiro Suda
f6ac841633 bump up rootlesskit to v0.9.4 
Now `rootlesskit-docker-proxy` returns detailed error message on
exposing privileged ports: https://github.com/rootless-containers/rootlesskit/pull/136

Full changes: https://github.com/rootless-containers/rootlesskit/compare/v0.9.2...v0.9.4

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-04-27 13:02:30 +09:00
Jintao Zhang
fbaaca6351 update containerd to v1.3.4 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2020-04-16 14:36:38 +08:00
Sebastiaan van Stijn
7f8b4b621b Merge pull request #40689 from AkihiroSuda/test-rootless2 
test-integration: support more rootless tests
 2020-03-30 14:13:34 +02:00
Jintao Zhang
ea44be4b8f vendor: bump libnetwork ef149a924dfde2e506ea3cb3f617d7d0fa96b8ee 
fix https://github.com/moby/moby/issues/40715

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2020-03-19 17:15:58 +08:00
Akihiro Suda
f310bd29bd rootless: support forwarding signals from RootlessKit to dockerd 
See https://github.com/rootless-containers/rootlesskit/pull/127

RootlessKit changes: https://github.com/rootless-containers/rootlesskit/compare/v0.9.1...v0.9.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-15 12:24:23 +09:00
Sebastiaan van Stijn
e26e1cc5c1 vendor: vishvananda/netlink v1.1.0 
- vishvananda/netlink: https://github.com/vishvananda/netlink/compare/v1.0.0...v1.1.0
- vishvananda/netns: 7109fa855b...0a2b9b5464
- libnetwork: bf2bd42abc...beab24292c
- github.com/moby/ipvs: new dependency (was previously part of libnetwork)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-03-12 22:57:23 +01:00
Tianon Gravi
87c2e65259 Merge pull request #40661 from thaJeztah/update_golangci_lint 
ci: update golangci-lint v1.23.8
 2020-03-10 14:09:41 -07:00
Sebastiaan van Stijn
51ea39c592 Merge pull request #40658 from AkihiroSuda/install-shim-v2 
containerd.installer: install containerd-shim-runc-v2
 2020-03-10 16:06:28 +01:00
Sebastiaan van Stijn
e36d222666 ci: update golangci-lint v1.23.8 
full diff: https://github.com/golangci/golangci-lint/compare/v1.20.0...v1.23.8

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-03-10 11:52:40 +01:00
Akihiro Suda
d949fddc6c containerd.installer: install containerd-shim-runc-v2 
cgroup2 mode requires containerd-shim-runc-v2 (containerd v1.4).

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-10 10:35:21 +09:00
Sebastiaan van Stijn
d5595a5845 Merge pull request #40596 from thaJeztah/bump_libnetwork 
vendor: bump libnetwork bf2bd42abc0a3734f12b5ec724e571434e42c669
 2020-03-09 17:23:06 +01:00
Akihiro Suda
1ea3a2b7f5 rootless: launch rootlesskit with --propagation=rslave 
The propagation was previously set to rprivate and didn't propagate
mounts from the host mount namespace into the daemon's mount namespace.

Further information about --propagation: https://github.com/rootless-containers/rootlesskit/tree/v0.9.1#mount-propagation
RootlessKit changes: https://github.com/rootless-containers/rootlesskit/compare/v0.8.0...v0.9.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-07 21:16:29 +09:00
Sebastiaan van Stijn
e1710b42d3 vendor: bump libnetwork bf2bd42abc0a3734f12b5ec724e571434e42c669 
full diff: 264bffcb88...bf2bd42abc

relevant changes:

- docker/libnetwork#2407 Macvlan internal network should not change default gateway
    - fixes docker/libnetwork#2406 Internal macvlan network overrides default gateway
- vendor godbus/dbus v5
- Fix InhibitIPv4 nil panic
- Cleanup VFP during overlay network removal
    - fixes VFP leak in windows overlay network deletion

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-03-07 00:35:47 +01:00
Akihiro Suda
3cf82748dd run shfmt 
git grep --name-only '^#!' | egrep -v '(vendor|\.go|Jenkinsfile)' | xargs shfmt -w -bn -ci -sr

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-03 12:27:49 +09:00
Akihiro Suda
eb484fcb67 validate: add shfmt 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-03-03 12:25:51 +09:00
Brian Goff
76e3a49933 Merge pull request #40486 from AkihiroSuda/rootless-cgroup2-systemd 
rootless: support `--exec-opt native.cgroupdriver=systemd`
 2020-03-02 16:11:21 -08:00
Sam Whited
8c0f6142a8 Update DNS library 
This makes sure that we don't become vulnerable to CVE-2018-17419 or
CVE-2019-19794 in the future.

Signed-off-by: Sam Whited <sam@samwhited.com>
 2020-02-25 17:05:57 -05:00
Akihiro Suda
ca4b51868a rootless: support --exec-opt native.cgroupdriver=systemd 
Support cgroup as in Rootless Podman.

Requires cgroup v2 host with crun.
Tested with Ubuntu 19.10 (kernel 5.3, systemd 242), crun v0.12.1.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-02-14 15:32:31 +09:00
Brian Goff
3473ff2893 Merge pull request #40469 from thaJeztah/containerd_1.3.3 
update containerd binary to v1.3.3
 2020-02-07 12:16:40 -08:00
Sebastiaan van Stijn
486161a63a bump vndr v0.1.1 
full diff: https:/github.com/LK4D4/vndr/compare/v0.1.0...v0.1.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-07 13:37:45 +01:00
Sebastiaan van Stijn
27649ee44f update containerd binary to v1.3.3 
full diff: https://github.com/containerd/containerd/compare/v1.3.2...v1.3.3
release notes: https://github.com/containerd/containerd/releases/tag/v1.3.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-07 10:21:01 +01:00
Akihiro Suda
cd43c1d1ac update runc binary to v1.0.0-rc10 (CVE-2019-19921) 
Notable changes:
* Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207
* Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185
* Basic support for cgroup v2.  Almost feature-complete, but still missing support for systemd mode in rootless.
  See also https://github.com/opencontainers/runc/issues/2209 for the known issues.

Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-01-25 03:55:39 +09:00
Arko Dasgupta
4c407caada Bump libnetwork to latest refpoint 
Commits:
feeff4f0 Merge pull request #2380 from liskin/bridge-atomic-hwaddr
fec6476d Merge pull request #2489 from suwang48404/doc
8757597e Added document describing libnetwork traffic flow.
eaea5722 Merge pull request #2445 from kdomanski/ipv6-addr-in-hosts
1680ce71 Merge pull request #2462 from arkodg/fix-key-spi-panic
4420ee92 Fix panic in drivers/overlay/encryption.go
57178323 Merge pull request #2472 from thaJeztah/bump_golang_1.12.12
f741dc9c Update Golang 1.12.12 (CVE-2019-17596)
79c19d09 Merge pull request #2461 from suwang48404/master
94facacc Added API to set ephemeral port allocator range.

Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>
 2020-01-16 16:28:23 -08:00
Sebastiaan van Stijn
d4f05c168d bump vndr v0.1.0 to support versioned import paths 
With this change, go packages/modules that use versioned
import paths (github.com/foo/bar/v2), but don't use a directory
in the repository, can now be supported.

For example:

```
github.com/coreos/go-systemd/v22 v22.0.0
```

will vendor the github.com/coreos/go-systemd repository
into `vendor/github.com/coreos/go-systemd/v22`.

full diff: f5ab8fc5fb...v0.1.0

- LK4D4/vndr#83 migrate bitbucket to api 2.0
    - fixes LK4D4/vndr#82 https://api.bitbucket.org/1.0/repositories/ww/goautoneg: 410 Gone
- LK4D4/vndr#86 Replace sort.Sort with sort.Strings
- LK4D4/vndr#87 support `github.com/coreos/go-systemd/v22`

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-01-09 21:56:20 +01:00
Akihiro Suda
658723badd rootless: fix proxying UDP packets 
UDP reply packets were not proxied: https://github.com/rootless-containers/rootlesskit/issues/86

The issue was fixed in RootlessKit v0.7.1: https://github.com/rootless-containers/rootlesskit/pull/87

Full changes since v0.7.0: https://github.com/rootless-containers/rootlesskit/compare/v0.7.0...v0.7.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2019-12-18 19:33:27 +09:00
Jintao Zhang
7f809e1080 Update containerd to v1.3.2 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-12-09 01:23:40 +08:00
Brian Goff
3152f94362 Merge pull request #40048 from tao12345666333/update-to-runc-1.0.0-rc9 
Update containerd to v1.3.1, runc v1.0.0-rc9
 2019-11-27 14:20:17 -08:00
Jintao Zhang
517946eb47 Update containerd to v1.3.1 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-11-20 23:23:07 +08:00
Sebastiaan van Stijn
9cf349d0f8 bump libnetwork 90afbb01e1d8acacb505a092744ea42b9f167377 
full diff: 0025177e3d...90afbb01e1

includes:

- docker/libnetwork#/2459 Fix Error Check in NewNetwork
- docker/libnetwork#/2466 Revert "Merge pull request #2339 from phyber/iptables-check"
    - reverts docker/libnetwork#/2339 controller: Check if IPTables is enabled for arrangeUserFilterRule
    - re-opens docker/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER
    - re-opens moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules
    - re-opens docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-11-07 13:43:42 -08:00
Jintao Zhang
5ce9df2a40 Update to runc v1.0.0-rc9 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-10-29 01:59:24 +08:00
Sebastiaan van Stijn
9cb9c6eba4 bump golangci-lint v1.20.0 
release notes:

- v1.20.0: https://github.com/golangci/golangci-lint/releases/tag/v1.20.0
    - Add WSL linter (#771)
    - Add gocognit linter (#756)
    - govet: add more analyzers
    - dramatically reduce memory usage
    - reduce 1.5x memory usage on large repos on repeated runs
    - Rename deadline option to timeout and mark deadline as deprecated
- v1.19.1: https://github.com/golangci/golangci-lint/releases/tag/v1.19.1
- v1.19.0: https://github.com/golangci/golangci-lint/releases/tag/v1.19.0
    - Add dogsled linter.
    - Add whitespace linter
    - Add Godox linter support
    - Various performance optimizations
- v1.18.0: https://github.com/golangci/golangci-lint/releases/tag/v1.18.0
    - Support go1.13
    - Update format of junit xml output to mark failures as such
    - Speed up linting: use deduplicated packages
    - Add user supplied error messages in depguard issues
    - Add funlen linter

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-10-18 00:46:15 +02:00
Grant Millar
df7b8f458a daemon: Use short libnetwork ID in exec-root & update libnetwork 
Signed-off-by: Grant Millar <rid@cylo.io>
 2019-10-15 11:40:24 +01:00
Justen Martin
095ca77f48 Use build args to override binary commits in dockerfile 
Signed-off-by: Justen Martin <jmart@the-coder.com>
 2019-10-10 14:52:57 -05:00
Derek McGowan
6c94a50f41 update containerd binary v1.3.0 
full diff: https://github.com/containerd/containerd/compare/v1.2.8..v1.3.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
 2019-10-04 15:05:32 -07:00
Sebastiaan van Stijn
bc9a7ec898 update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) 
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc8...3e425f80a8c931f88e6d94a8c831b9d5aa481657

  - opencontainers/runc#2010 criu image path permission error when checkpoint rootless container
  - opencontainers/runc#2028 Update to Go 1.12 and drop obsolete versions
  - opencontainers/runc#2029 Update dependencies
  - opencontainers/runc#2034 Support for logging from children processes
  - opencontainers/runc#2035 specconv: always set "type: bind" in case of MS_BIND
  - opencontainers/runc#2038 `r.destroy` can defer exec in `runner.run` method
  - opencontainers/runc#2041 Change the permissions of the notify listener socket to rwx for everyone
  - opencontainers/runc#2042 libcontainer: intelrdt: add missing destroy handler in defer func
  - opencontainers/runc#2047 Move systemd.Manager initialization into a function in that module
  - opencontainers/runc#2057 main: not reopen /dev/stderr
      - closes opencontainers/runc#2056 Runc + podman|cri-o + systemd issue with stderr
      - closes kubernetes/kubernetes#77615 kubelet fails starting CRI-O containers (Ubuntu 18.04 + systemd cgroups driver)
      - closes cri-o/cri-o#2368 Joining worker node not starting flannel or kube-proxy / CRI-O error "open /dev/stderr: no such device or address"
  - opencontainers/runc#2061 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
  - opencontainers/runc#2065 Fix cgroup hugetlb size prefix for kB
  - opencontainers/runc#2067 libcontainer: change seccomp test for clone syscall
  - opencontainers/runc#2074 Update dependency libseccomp-golang
  - opencontainers/runc#2081 Bump CRIU to 3.12
  - opencontainers/runc#2089 doc: First process in container needs `Init: true`
  - opencontainers/runc#2094 Skip searching /dev/.udev for device nodes
      - closes opencontainers/runc#2093 HostDevices() race with older udevd versions
  - opencontainers/runc#2098 man: fix man-pages
  - opencontainers/runc#2103 cgroups/fs: check nil pointers in cgroup manager
  - opencontainers/runc#2107 Make get devices function public
  - opencontainers/runc#2113 libcontainer: initial support for cgroups v2
  - opencontainers/runc#2116 Avoid the dependency on cgo through go-systemd/util package
      - removes github.com/coreos/pkg as dependency
  - opencontainers/runc#2117 Remove libcontainer detection for systemd features
      - fixes opencontainers/runc#2117 Cache the systemd detection results
  - opencontainers/runc#2119 libcontainer: update masked paths of /proc
      - relates to moby/moby#36368 Add /proc/keys to masked paths
      - relates to moby/moby#38299 Masked /proc/asound
      - relates to moby/moby#37404 Add /proc/acpi to masked paths (CVE-2018-10892)
  - opencontainers/runc#2122 nsenter: minor fixes
  - opencontainers/runc#2123 Bump x/sys and update syscall for initial Risc-V support
  - opencontainers/runc#2125 cgroup: support mount of cgroup2
  - opencontainers/runc#2126 libcontainer/nsenter: Don't import C in non-cgo file
  - opencontainers/runc#2129 Only allow proc mount if it is procfs
      - addresses opencontainers/runc#2129 AppArmor can be bypassed by a malicious image that specifies a volume at /proc (CVE-2019-16884)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-09-27 16:22:34 +02:00
Jintao Zhang
c4ec02b0af Update containerd to v1.2.10 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-09-27 11:47:20 +08:00
Sebastiaan van Stijn
75477f0b3c bump libnetwork to 96bcc0dae898308ed659c5095526788a602f4726 
full diff: 92d1fbe1eb...96bcc0dae8

changes included:

- docker/libnetwork#2429 Updating IPAM config with results from HNS create network call
  - addresses moby/moby#38358
- docker/libnetwork#2450 Always configure iptables forward policy
  - related to moby/moby#14041 and docker/libnetwork#1526

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-09-20 19:48:49 +02:00
Sebastiaan van Stijn
85b89c9e50 Replace gometalinter with golangci-lint 
Replacing gometalinter, because it has been deprecated,
and the repository was archived.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-09-18 12:57:57 +02:00
Jintao Zhang
9ef9a337f6 Update containerd to v1.2.9 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-09-06 10:07:08 +08:00
Sebastiaan van Stijn
edaf292c6e Merge pull request #39840 from AkihiroSuda/slirp4netns-sandbox 
rootless: harden slirp4netns with mount namespace and seccomp
 2019-09-04 20:45:19 +02:00
Sebastiaan van Stijn
bab58c1924 bump lib network to 92d1fbe1eb0883cf11d283cea8e658275146411d 
full diff: 09cdcc8c0e...92d1fbe1eb

relevant changes included (omitting some changes that were added _and_ reverted in this bump):

- docker/libnetwork#2433 Fix parseIP error when parseIP before get AddressFamily
  - fixes docker/libnetwork#2431 parseIP Error ip=[172 17 0 2 0 0 0 0 0 0 0 0 0 0 0 0]
  - https://github.com/docker/libnetwork/issues/2289
  - this was a regression introduced in docker/libnetwork#2416 Fix hardcoded AF_INET for IPv6 address handling
- docker/libnetwork#2440 Bump hashicorp go-sockaddr v1.0.2, go-multierror v1.0.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-09-03 11:49:06 +02:00
Akihiro Suda
e20b7323fb rootless: harden slirp4netns with mount namespace and seccomp 
When slirp4netns v0.4.0+ is used, now slirp4netns is hardened using
mount namespace ("sandbox") and seccomp to mitigate potential
vulnerabilities.

bump up rootlesskit: 2fcff6ceae...791ac8cb20

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2019-09-02 14:58:58 +09:00
Jintao Zhang
1264a85303 Update containerd to v1.2.8 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-08-23 11:13:10 +08:00
Vincent Demeester
4e83c90ae8 Merge pull request #39638 from tiborvass/unit-junit 
added entry for running unit tests with junit report
 2019-08-01 23:03:16 -04:00
Andrew Hsu
42f0a0db75 run unit tests and generate junit report 
Signed-off-by: Andrew Hsu <andrewhsu@docker.com>
 2019-08-01 06:08:35 +00:00
Sebastiaan van Stijn
6f234db9fe bump libnetwork to 09cdcc8c0eab3946c2d70e8f6225b05baf1e90d1 
full diff: 83d30db536...09cdcc8c0e

changes included:

- docker/libnetwork#2416 Fix hardcoded AF_INET for IPv6 address handling
- docker/libnetwork#2411 Macvlan network handles netlabel.Internal wrong
  - fixes docker/libnetwork#2410 Macvlan network handles netlabel.Internal wrong
- docker/libnetwork#2414 Allow network with --config-from to be --internal
  - fixes docker/libnetwork#2413 Network with --config-from does not honor --internal
- docker/libnetwork#2351 Use fewer modprobes
  - relates to moby/moby#38930 Use fewer modprobes
- docker/libnetwork#2415 Support dockerd and system restarts for ipvlan and macvlan networks
  - carry of docker/libnetwork#2295 phantom ip/mac vlan network after a powercycle
  - fixes docker/libnetwork#1743 Phantom docker network

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-07-30 10:37:48 -07:00
Akihiro Suda
34f4729bc0 rootless: allow exposing dockerd TCP socket easily 
eg.

  $ DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2376:2376/tcp" \
   dockerd-rootless.sh --experimental \
   -H tcp://0.0.0.0:2376 \
   --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem

This commit bumps up RootlessKit from v0.4.1 to v0.6.0:
27a0c7a248...2fcff6ceae

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2019-07-11 11:09:29 +09:00
CarlosEDP
9eaab0425b Update modules to support riscv64 
Signed-off-by: CarlosEDP <me@carlosedp.com>
 2019-06-29 18:45:42 +00:00
Sebastiaan van Stijn
0a3c9b935c bump vndr to f5ab8fc5f, and revendor 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-06-28 18:13:17 +00:00