dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-07-11 18:13:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
44,344 Commits 19 Branches 583 Tags
2bfc7aedab34758e62ea102acaa2cdca712042c8
Commit Graph

76 Commits

Author SHA1 Message Date
Sebastiaan van Stijn
9880e6a1ef vendor: github.com/opencontainers/selinux v1.10.1 
- relabel links instead of their targets

full diff: https://github.com/opencontainers/selinux/compare/v1.10.0...v1.10.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2022-05-02 14:40:47 +02:00
Cory Snider
1c129103b4 Bump swarmkit to v2 
Signed-off-by: Cory Snider <csnider@mirantis.com>
 2022-04-21 17:33:07 -04:00
Akihiro Suda
69993c1c57 vendor: github.com/opencontainers/runc v1.1.1 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2022-04-01 15:23:46 +09:00
CrazyMax
a2aaf4cc83 vendor buildkit v0.10.0 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2022-03-22 18:51:27 +01:00
Akihiro Suda
b79dec8138 vendor: github.com/opencontainers/runc v1.1.0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2022-02-06 17:16:23 +09:00
Sebastiaan van Stijn
e5d28115ee vendor: regenerate 
- all changes here are attributed to difference in behaviour between,
  namely:
  - resolution of secondary test dependencies
  - prunning of non-Go files

Signed-off-by: Ilya Dmitrichenko <errordeveloper@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2022-01-18 15:46:04 +01:00
Sebastiaan van Stijn
cef0a7c14e vendor: github.com/opencontainers/image-spec v1.0.2 
- Bring mediaType out of reserved status
- specs-go: adding mediaType to the index and manifest structures

full diff: https://github.com/opencontainers/image-spec/compare/v1.0.1...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-11-18 00:00:05 +01:00
Sebastiaan van Stijn
615ff22437 vendor: github.com/opencontainers/selinux v1.9.1 
full diff: https://github.com/opencontainers/selinux/compare/v1.8.2...v1.9.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-11-16 10:33:00 +01:00
Akihiro Suda
82c978ad95 vendor: github.com/opencontainers/runc v1.0.2 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2021-08-23 23:28:47 +09:00
Akihiro Suda
1256aa0241 vendor: github.com/opencontainers/runc v1.0.1 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2021-07-19 15:55:28 +09:00
Sebastiaan van Stijn
22186d2645 vendor: github.com/opencontainers/selinux v1.8.2 
full diff:

- https://github.com/opencontainers/selinux/compare/v1.8.0...v1.8.2
- https://github.com/bits-and-blooms/bitset/compare/v1.1.11...v1.2.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-06-07 10:09:21 +02:00
Sebastiaan van Stijn
a927fc7831 vendor: github.com/opencontainers/runc v1.0.0-rc95 
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc92...v1.0.0-rc95

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-06-02 17:55:49 +02:00
Sebastiaan van Stijn
b7dbed85b3 vendor: github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 
full diff: 4d89ac9fbf...1c3f411f04

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-06-02 17:55:42 +02:00
Sebastiaan van Stijn
2834f842ee Use containerd's apparmor package to detect if apparmor can be used 
The runc/libcontainer apparmor package on master no longer checks if apparmor_parser
is enabled, or if we are running docker-in-docker.

While those checks are not relevant to runc (as it doesn't load the profile), these
checks _are_ relevant to us (and containerd). So switching to use the containerd
apparmor package, which does include the needed checks.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2021-04-08 20:22:08 +02:00
Sebastiaan van Stijn
1c0af18c6c vendor: opencontainers/selinux v1.8.0, and remove selinux build-tag and stubs 
full diff: https://github.com/opencontainers/selinux/compare/v1.7.0...v1.8.0

Remove "selinux" build tag

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-12-24 00:47:16 +01:00
Sebastiaan van Stijn
ab06bb3ec0 vendor: opencontainers/selinux v1.7.0 
full diff: https://github.com/opencontainers/selinux/compare/v1.6.0...v1.7.0

- Implement get_default_context_with_level() from libselinux
- Wrap some syscalls (lgetattr, lsetattr, fstatfs, statfs) to retry on EINTR.
- Improve code quality by turning fixing many problems found by linters
- Use bufio.Scanner for parsing labels and policy confilabelg
- Cache the value for SELinux policy directory
- test on ppc64le and go 1.15

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-12-22 13:57:09 +01:00
Sebastiaan van Stijn
968133c86c vendor: opencontainers/go-digest v1.0.0 
full diff: https://github.com/opencontainers/go-digest/compare/v1.0.0-rc1...v1.0.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-09-18 02:13:25 +02:00
Sebastiaan van Stijn
245f2d922a vendor: github.com/opencontainers/selinux v1.6.0 
full diff: https://github.com/opencontainers/selinux/compare/v1.5.2...v1.6.0

This also adds a new dependency: github.com/willf/bitset

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-08-31 15:29:05 +02:00
Jintao Zhang
c353c7cc71 vendor runc library to v1.0.0-rc92 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2020-08-14 14:19:01 +08:00
Jintao Zhang
9ad35b7e69 vendor runc 67169a9d43456ff0d5ae12b967acb8e366e2f181 
v1.0.0-rc91-48-g67169a9d

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2020-07-30 16:16:11 +00:00
Tonis Tiigi
8774804ca7 vendor: update buildkit to 4d1f260e8 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2020-07-20 11:34:22 -07:00
Sebastiaan van Stijn
a9569f5243 vendor: opencontainers/selinux v1.5.2 
full diff: https://github.com/opencontainers/selinux/compare/v1.5.1...v1.5.2

- Implement FormatMountLabel unconditionally
  Implementing FormatMountLabel on situations built without selinux
  should be possible; the context will be ignored if no SELinux is available.
- Remote potential race condition, where mcs label is freed
  Theorectially if you do not change the MCS Label then we free it and two
  commands later reserve it. If some other process was grabbing MCS Labels
  at the same time, the other process could get the same label.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-26 16:24:43 +02:00
Sebastiaan van Stijn
64bc9281de vendor: opencontainers/runtime-spec v1.0.2 
full diff: 29686dbc55...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-09 14:40:29 +02:00
Sebastiaan van Stijn
a8216806ce vendor: opencontainers/selinux v1.5.1 
full diff: https://github.com/opencontainers/selinux/compare/v1.3.3...v1.5.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-05-05 20:33:06 +02:00
Sebastiaan van Stijn
fa67cff34b vendor: update opencontainers/selinux v1.3.3 
full diff: https://github.com/opencontainers/selinux/compare/v1.3.1...v1.3.3

- go-selinux/SetKeyLabel: fix for RHEL7 kernels
- getSELinuxfs: optimize/simplify using sync.Once
- xattr: use x/sys/unix, simplify
- Use /proc/thread-self if available
- Fix EnforceMode, SetEnforceMode, and SecurityCheckContext

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-28 19:19:46 +01:00
Sebastiaan van Stijn
12c7541f1f vendor: update opencontainers/selinux v1.3.1 
full diff: 5215b1806f...v1.3.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2020-02-20 14:40:25 +01:00
Akihiro Suda
6d68080907 update runc library to v1.0.0-rc10 (CVE-2019-19921) 
Notable changes:
* Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207
* Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185
* Basic support for cgroup v2.  Almost feature-complete, but still missing support for systemd mode in rootless.
  See also https://github.com/opencontainers/runc/issues/2209 for the known issues.

Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Also updates go-selinux: 3a1f366feb...5215b1806f
(See https://github.com/containerd/cri/pull/1383#issuecomment-578227009)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-01-25 04:06:24 +09:00
Tonis Tiigi
f632e2d8d3 vendor: update containerd to acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2019-11-05 12:50:38 -08:00
Sebastiaan van Stijn
ac0ab114a2 bump runc vendor v1.0.0-rc8-92-g84373aaa 
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc8...3e425f80a8c931f88e6d94a8c831b9d5aa481657

  - opencontainers/runc#2010 criu image path permission error when checkpoint rootless container
  - opencontainers/runc#2028 Update to Go 1.12 and drop obsolete versions
  - opencontainers/runc#2029 Update dependencies
  - opencontainers/runc#2034 Support for logging from children processes
  - opencontainers/runc#2035 specconv: always set "type: bind" in case of MS_BIND
  - opencontainers/runc#2038 `r.destroy` can defer exec in `runner.run` method
  - opencontainers/runc#2041 Change the permissions of the notify listener socket to rwx for everyone
  - opencontainers/runc#2042 libcontainer: intelrdt: add missing destroy handler in defer func
  - opencontainers/runc#2047 Move systemd.Manager initialization into a function in that module
  - opencontainers/runc#2057 main: not reopen /dev/stderr
      - closes opencontainers/runc#2056 Runc + podman|cri-o + systemd issue with stderr
      - closes kubernetes/kubernetes#77615 kubelet fails starting CRI-O containers (Ubuntu 18.04 + systemd cgroups driver)
      - closes cri-o/cri-o#2368 Joining worker node not starting flannel or kube-proxy / CRI-O error "open /dev/stderr: no such device or address"
  - opencontainers/runc#2061 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
  - opencontainers/runc#2065 Fix cgroup hugetlb size prefix for kB
  - opencontainers/runc#2067 libcontainer: change seccomp test for clone syscall
  - opencontainers/runc#2074 Update dependency libseccomp-golang
  - opencontainers/runc#2081 Bump CRIU to 3.12
  - opencontainers/runc#2089 doc: First process in container needs `Init: true`
  - opencontainers/runc#2094 Skip searching /dev/.udev for device nodes
      - closes opencontainers/runc#2093 HostDevices() race with older udevd versions
  - opencontainers/runc#2098 man: fix man-pages
  - opencontainers/runc#2103 cgroups/fs: check nil pointers in cgroup manager
  - opencontainers/runc#2107 Make get devices function public
  - opencontainers/runc#2113 libcontainer: initial support for cgroups v2
  - opencontainers/runc#2116 Avoid the dependency on cgo through go-systemd/util package
      - removes github.com/coreos/pkg as dependency
  - opencontainers/runc#2117 Remove libcontainer detection for systemd features
      - fixes opencontainers/runc#2117 Cache the systemd detection results
  - opencontainers/runc#2119 libcontainer: update masked paths of /proc
      - relates to moby/moby#36368 Add /proc/keys to masked paths
      - relates to moby/moby#38299 Masked /proc/asound
      - relates to moby/moby#37404 Add /proc/acpi to masked paths (CVE-2018-10892)
  - opencontainers/runc#2122 nsenter: minor fixes
  - opencontainers/runc#2123 Bump x/sys and update syscall for initial Risc-V support
  - opencontainers/runc#2125 cgroup: support mount of cgroup2
  - opencontainers/runc#2126 libcontainer/nsenter: Don't import C in non-cgo file
  - opencontainers/runc#2129 Only allow proc mount if it is procfs
      - addresses opencontainers/runc#2129 AppArmor can be bypassed by a malicious image that specifies a volume at /proc (CVE-2019-16884)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-09-27 16:22:37 +02:00
Sebastiaan van Stijn
0d453115fe bump opencontainers/selinux v1.2.2 
full diff: https://github.com/opencontainers/selinux/compare/v1.2.1...v1.2.2

- opencontainers/selinux#51 Older kernels do not support keyring labeling

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-25 18:57:04 -07:00
Sebastiaan van Stijn
6df6fe6020 bump runc vendor v1.0.0-rc8 
full diff: 029124da7a...425e105d5a

- opencontainers/runc#2043 Vendor in latest selinux code for keycreate errors

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-25 18:56:57 -07:00
Jintao Zhang
c28171c7c4 Vendor runc 029124da7af7360afa781a0234d1b083550f797c 
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
 2019-04-06 18:02:52 +00:00
Sebastiaan van Stijn
606ac478ad bump opencontainers/selinux v1.2.1 
full diff: https://github.com/opencontainers/selinux/compare/v1.2...v1.2.1

brings in opencontainers/selinux#49 Ignore attempts to setLabels "" on SELinux disabled systems

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-03 21:45:22 +02:00
Sebastiaan van Stijn
f43826c433 bump opencontainers/selinux to v1.2 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-03-21 10:10:05 +01:00
Sebastiaan van Stijn
79f5fbee01 Vendor runc 2b18fe1d885ee5083ef9f0838fee39b62d653e30 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-03-13 21:15:32 +01:00
Sebastiaan van Stijn
c4763e02d1 Update containerd to 1.2.3 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-02-12 14:39:27 +01:00
John Howard
9f1b2b7031 Vendor opencontainers/runtime-spec 29686dbc 
Signed-off-by: John Howard <jhoward@microsoft.com>
 2019-02-07 18:46:38 -08:00
Andrew Hsu
615eecf8ac update containerd to v1.2.1 
Signed-off-by: Andrew Hsu <andrewhsu@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-12-07 18:28:06 +01:00
Michael Crosby
d13528c635 wip: bump containerd and runc version 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-11-19 09:49:56 -05:00
Kir Kolyshkin
335736fb01 Bump runc 
Changes: a00bf01908...9f1e94488e

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2018-11-06 10:45:24 -08:00
Sebastiaan van Stijn
dd7799afd4 update containerd client and dependencies to v1.2.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-11-05 18:46:26 +01:00
Akihiro Suda
275044bbc3 bump up runc 
Changes: 69663f0bd4...a00bf01908

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
 2018-10-16 14:31:19 +09:00
Sebastiaan van Stijn
dd622c81a4 Update containerd client and dependencies to v1.2.0-rc.1 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-10-04 15:20:34 +02:00
Sebastiaan van Stijn
31a9c9e791 Update containerd dependencies 
This updates the containerd dependencies to match
the versions used by the vendored containerd version

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-10-04 15:19:53 +02:00
Tibor Vass
effa24bf48 vendor buildkit to fix a couple of bugs 
Signed-off-by: Tibor Vass <tibor@docker.com>
 2018-09-04 15:17:40 +00:00
Derek McGowan
98e23f2a8e Update containerd vendor to 1.2 beta 
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
 2018-08-17 13:08:22 -07:00
Eli Uriegas
c5ce4cf654 Fix compilation on 32 bit systems 
* Update runc commit to ad0f525
* Update buildkit to dbf67a6

Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
 2018-06-15 20:41:03 +00:00
Tonis Tiigi
2092adf309 vendor: update runc for helper packages 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2018-06-10 10:05:31 -07:00
Derek McGowan
52ed3e0896 Update containerd to 1.1 
Updates swarmkit, grpc, and all related vendors

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
 2018-06-04 15:37:03 -07:00
Sebastiaan van Stijn
82c44711cc Bump go-digest to v1.0.0-rc.1 
Changes included:

- digest: allow separators in algorithm field
- disallow upper characters (/A-F/) in hex-encoded portion

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-03-26 22:17:35 +02:00