Commit Graph

44057 Commits

Author SHA1 Message Date
Djordje Lukic
70dc392bfa Use hashicorp/go-memdb instead of truncindex
memdb already knows how to search by prefix so there is no need to keep
a separate list of container ids in the truncindex

Benchmarks:

$ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix100$ github.com/docker/docker/container
goos: linux
goarch: amd64
pkg: github.com/docker/docker/container
cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz
BenchmarkDBGetByPrefix100-6        16018             73935 ns/op           33888 B/op       1100 allocs/op
BenchmarkDBGetByPrefix100-6        16502             73150 ns/op           33888 B/op       1100 allocs/op
BenchmarkDBGetByPrefix100-6        16218             74014 ns/op           33856 B/op       1100 allocs/op
BenchmarkDBGetByPrefix100-6        15733             73370 ns/op           33792 B/op       1100 allocs/op
BenchmarkDBGetByPrefix100-6        16432             72546 ns/op           33744 B/op       1100 allocs/op
PASS
ok      github.com/docker/docker/container      9.752s

$ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet100$ github.com/docker/docker/pkg/truncindex
goos: linux
goarch: amd64
pkg: github.com/docker/docker/pkg/truncindex
cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz
BenchmarkTruncIndexGet100-6        16862             73732 ns/op           44776 B/op       1173 allocs/op
BenchmarkTruncIndexGet100-6        16832             73629 ns/op           45184 B/op       1179 allocs/op
BenchmarkTruncIndexGet100-6        17214             73571 ns/op           45160 B/op       1178 allocs/op
BenchmarkTruncIndexGet100-6        16113             71680 ns/op           45360 B/op       1182 allocs/op
BenchmarkTruncIndexGet100-6        16676             71246 ns/op           45056 B/op       1184 allocs/op
PASS
ok      github.com/docker/docker/pkg/truncindex 9.759s

$ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix500$ github.com/docker/docker/container
goos: linux
goarch: amd64
pkg: github.com/docker/docker/container
cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz
BenchmarkDBGetByPrefix500-6         1539            753541 ns/op          169381 B/op       5500 allocs/op
BenchmarkDBGetByPrefix500-6         1624            749975 ns/op          169458 B/op       5500 allocs/op
BenchmarkDBGetByPrefix500-6         1635            761222 ns/op          169298 B/op       5500 allocs/op
BenchmarkDBGetByPrefix500-6         1693            727856 ns/op          169297 B/op       5500 allocs/op
BenchmarkDBGetByPrefix500-6         1874            710813 ns/op          169570 B/op       5500 allocs/op
PASS
ok      github.com/docker/docker/container      6.711s

$ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet500$ github.com/docker/docker/pkg/truncindex
goos: linux
goarch: amd64
pkg: github.com/docker/docker/pkg/truncindex
cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz
BenchmarkTruncIndexGet500-6         1934            780328 ns/op          224073 B/op       5929 allocs/op
BenchmarkTruncIndexGet500-6         1713            713935 ns/op          225011 B/op       5937 allocs/op
BenchmarkTruncIndexGet500-6         1780            702847 ns/op          224090 B/op       5943 allocs/op
BenchmarkTruncIndexGet500-6         1736            711086 ns/op          224027 B/op       5929 allocs/op
BenchmarkTruncIndexGet500-6         2448            508694 ns/op          222322 B/op       5914 allocs/op
PASS
ok      github.com/docker/docker/pkg/truncindex 6.877s

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
2022-05-20 18:22:21 +02:00
Sebastiaan van Stijn
2cfbb039d1 Merge pull request #43571 from crazy-max/vendor-buildkit-0.10.3
vendor: github.com/moby/buildkit v0.10.3
2022-05-20 02:11:35 +02:00
Sebastiaan van Stijn
80862d61d0 gha: temporarily override buildkit version for tests
This includes a single fix that only affects the tests, so using
a temporary override to update the tests to make CI pass, but keeping
the module version to the tagged release.

https://github.com/moby/buildkit/compare/v0.10.3..0da740f7d4f782a52b416a44f564ac37504b9ee1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-20 00:32:07 +02:00
CrazyMax
90fb4eca20 vendor: github.com/moby/buildkit v0.10.3
full diff: https://github.com/moby/buildkit/compare/v0.10.2...v0.10.3

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-19 23:31:30 +02:00
Sebastiaan van Stijn
d633169483 Merge pull request #43484 from ndeloof/create_host_path
introduce CreateMountpoint for parity between binds and mounts
2022-05-19 23:06:01 +02:00
Sebastiaan van Stijn
32f7551e61 Merge pull request #43597 from shoeffner/43596-mask-cifs-passwords
volume: mask password in cifs mount error messages
2022-05-19 22:52:26 +02:00
Sebastiaan van Stijn
5996b32fe4 Merge pull request #43294 from corhere/logfile-follow-without-fsnotify
LogFile follow without filenotify
2022-05-19 22:50:23 +02:00
Cory Snider
a67e159909 daemon/logger: hold LogFile lock less on ReadLogs
Reduce the amount of time ReadLogs holds the LogFile fsop lock by
releasing it as soon as all the files are opened, before parsing the
compressed file headers.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:23:18 -04:00
Cory Snider
c609523a8c pkg/filenotify: delete unused package
Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:23:18 -04:00
Cory Snider
01915a725e daemon/logger: follow LogFile without file watches
File watches have been a source of complexity and unreliability in the
LogFile follow implementation, especially when combined with file
rotation. File change events can be unreliably delivered, especially on
Windows, and the polling fallback adds latency. Following across
rotations has never worked reliably on Windows. Without synchronization
between the log writer and readers, race conditions abound: readers can
read from the file while a log entry is only partially written, leading
to decode errors and necessitating retries.

In addition to the complexities stemming from file watches, the LogFile
follow implementation had complexity from needing to handle file
truncations, and (due to a now-fixed bug in the polling file watcher
implementation) evictions to unlock the log file so it could be rotated.
Log files are now always rotated, never truncated, so these situations
no longer need to be handled by the follow code.

Rewrite the LogFile follow implementation in terms of waiting until
LogFile notifies it that a new message has been written to the log file.
The LogFile informs the follower of the file offset of the last complete
write so that the follower knows not to read past that, preventing it
from attempting to decode partial messages and making retries
unnecessary. Synchronization between LogFile and its followers is used
at critical points to prevent missed notifications of writes and races
between file rotations and the follower opening files for read.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
6d5bc07189 daemon/logger: fix refcounting decompressed files
The refCounter used for sharing temporary decompressed log files and
tracking when the files can be deleted is keyed off the source file's
path. But the path of a log file is not stable: it is renamed on each
rotation. Consequently, when logging is configured with both rotation
and compression, multiple concurrent readers of a container's logs could
read logs out of order, see duplicates or decompress a log file which
has already been decompressed.

Replace refCounter with a new implementation, sharedTempFileConverter,
which is agnostic to the file path, keying off the source file's
identity instead. Additionally, sharedTempFileConverter handles the full
lifecycle of the temporary file, from creation to deletion. This is all
abstracted from the consumer: all the bookkeeping and cleanup is handled
behind the scenes when Close() is called on the returned reader value.
Only one file descriptor is used per temporary file, which is shared by
all readers.

A channel is used for concurrency control so that the lock can be
acquired inside a select statement. While not currently utilized, this
makes it possible to add support for cancellation to
sharedTempFileConverter in the future.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
49aa66b597 daemon/logger: rotate log files, never truncate
Truncating the current log file while a reader is still reading through
it results in log lines getting missed. In contrast, rotating the file
allows readers who have the file open can continue to read from it
undisturbed. Rotating frees up the file name for the logger to create a
new file in its place. This remains true even when max-file=1; the
current log file is "rotated" from its name without giving it a new one.

On POSIXy filesystem APIs, rotating the last file is straightforward:
unlink()ing a file name immediately deletes the name from the filesystem
and makes it available for reuse, even if processes have the file open
at the time. Windows on the other hand only makes the name available
for reuse once the file itself is deleted, which only happens when no
processes have it open. To reuse the file name while the file is still
in use, the file needs to be renamed. So that's what we have to do:
rotate the file to a temporary name before marking it for deletion.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
990b0e28ba daemon/logger/local: fix appending newlines
The json-file driver appends a newline character to log messages with
PLogMetaData.Last set, but the local driver did not. Alter the behavior
of the local driver to match that of the json-file driver.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
3844d1a3d1 daemon/logger: drain readers when logger is closed
The LogFile follower would stop immediately upon the producer closing.
The close signal would race the file watcher; if a message were to be
logged and the logger immediately closed, the follower could miss that
last message if the close signal (formerly ProducerGone) was to win the
race. Add logic to perform one more round of reading when the producer
is closed to catch up on any final logs.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
906b979b88 daemon/logger: remove ProducerGone from LogWatcher
Whether or not the logger has been closed is a property of the logger,
and only of concern to its log reading implementation, not log watchers.
The loggers and their reader implementations can communicate as they see
fit. A single channel per logger which is closed when the logger is
closed is plenty sufficient to broadcast the state to log readers, with
no extra bookeeping or synchronization required.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
ae5f664f4e daemon/logger: open log reader synchronously
The asynchronous startup of the log-reading goroutine made the
follow-tail tests nondeterministic. The Log calls in the tests which
were supposed to happen after the reader started reading would sometimes
execute before the reader, throwing off the counts. Tweak the ReadLogs
implementation so that the order of operations is deterministic.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:22 -04:00
Cory Snider
9aa9d6fafc daemon/logger: add test suite for LogReaders
Add an extensive test suite for validating the behavior of any
LogReader. Test the current LogFile-based implementations against it.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:21 -04:00
Cory Snider
961d32868c daemon/logger: improve jsonfilelog read benchmark
The jsonfilelog read benchmark was incorrectly reusing the same message
pointer in the producer loop. The message value would be reset after the
first call to jsonlogger.Log, resulting in all subsequent calls logging
a zero-valued message. This is not a representative workload for
benchmarking and throws off the throughput metric.

Reduce variation between benchmark runs by using a constant timestamp.

Write to the producer goroutine's error channel only on a non-nil error
to eliminate spurious synchronization between producer and consumer
goroutines external to the logger being benchmarked.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-05-19 15:22:21 -04:00
Sebastiaan van Stijn
517afce0c4 Merge pull request #43557 from neersighted/overlay2-report-metacopy
[v2] overlay2: test for and report metacopy status
2022-05-19 21:16:40 +02:00
Sebastiaan van Stijn
4f8031313f Merge pull request #43617 from crazy-max/fix-rogue-certs
integration-cli: fix test rogue certs
2022-05-19 20:35:02 +02:00
Nicolas De Loof
304fbf0804 introduce CreateMountpoint for parity between binds and mounts
Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
2022-05-19 16:43:06 +02:00
Sebastiaan van Stijn
c9d04033d4 Merge pull request #43616 from kolyshkin/byte-slice-to-string
all: use unix.ByteSliceToString for utsname fields
2022-05-19 11:28:07 +02:00
Sebastiaan van Stijn
b6dab55339 Merge pull request #43593 from vvoland/3554-initial-console-size
daemon/linux: Set console size on creation
2022-05-19 11:04:21 +02:00
CrazyMax
3b157dc3b6 integration-cli: fix test rogue certs
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-05-19 10:54:31 +02:00
Paweł Gronowski
85a7f5a09a daemon/linux: Set console size on creation
On Linux the daemon was not respecting the HostConfig.ConsoleSize
property and relied on cli initializing the tty size after the container
was created. This caused a delay between container creation and
the tty actually being resized.

This is also a small change to the api description, because
HostConfig.ConsoleSize is no longer Windows-only.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2022-05-19 07:57:27 +02:00
Kir Kolyshkin
8a5c13155e all: use unix.ByteSliceToString for utsname fields
This also fixes the GetOperatingSystem function in
pkg/parsers/operatingsystem which mistakenly truncated utsname.Machine
to the index of \0 in utsname.Sysname.

Fixes: 7aeb3efcb4
Cc: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2022-05-18 17:13:20 -07:00
Sebastiaan van Stijn
1a0587bd76 Merge pull request #43609 from thaJeztah/websocket_streams_docs_touch_ups
API: fix documentation for containers/{id}/attach/ws
2022-05-18 18:35:49 +02:00
Tianon Gravi
ca98aff5ee Merge pull request #43578 from thaJeztah/swarm_version_stringer
api/types/swarm: Version: implement stringer interface
2022-05-18 09:35:04 -07:00
Sebastiaan van Stijn
1aea4c2bbd Merge pull request #43146 from evol262/fix/ingress-namespace-performance
Apply peformance tuning to new sandboxes also
2022-05-18 18:28:30 +02:00
Sebastiaan van Stijn
a5a77979dd docs: api: /containers/{id}/attach/ws: remove unsupported query-args < v1.42
These query-args were documented, but not actually supported until
ea6760138c (API v1.42).

This removes them from the documentation, as these arguments were ignored
(and defaulted to `true` (enabled))

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-18 11:05:15 +02:00
Sebastiaan van Stijn
d4a0a422da docs: api: add note about websocket attach streams
Slightly make the change in API v1.42 more visible, and add a snippet
about what users should do to preserve the pre-v1.41 behavior.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-18 11:03:09 +02:00
Sebastiaan van Stijn
4cac624fef Merge pull request #43322 from ndeloof/websocket_streams
wsContainersAttach attach to stdin/out/err streams as requested
2022-05-18 10:50:39 +02:00
Ryan Barry
0dd3a2eade Apply performance tuning to new sandboxes also
relates to #35082, moby/libnetwork#2491

Previously, values for expire_quiescent_template, conn_reuse_mode,
and expire_nodest_conn were set only system-wide. Also apply them
for new lb_* and ingress_sbox sandboxes, so they are appropriately
propagated

Signed-off-by: Ryan Barry <rbarry@mirantis.com>
2022-05-17 15:44:49 -04:00
Bjorn Neergaard
ce3e2d1955 overlay2: account for UserNS/userxattr in metacopy test
Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
2022-05-17 06:58:50 -06:00
Nicolas De Loof
ea6760138c wsContainersAttach attach to stdin/out/err streams as requested
Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
2022-05-17 13:23:07 +02:00
Sebastiaan van Stijn
eefbd9dcde Merge pull request #43605 from rumpl/rename-reservation
Rename Reservation to Reservations in the open API
2022-05-17 13:18:31 +02:00
Djordje Lukic
cc3848f2b7 Rename Reservation to Reservations in the open API
The correct name for this property is, and always was "Reservations"

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
2022-05-17 10:14:07 +02:00
Sebastiaan van Stijn
c9ac3ed7c9 Merge pull request #43599 from cpuguy83/rm_mountspec_backport
Remove mount spec backport
2022-05-14 11:12:42 +02:00
Sebastian Höffner
9a7298a3e6 volume: mask password in cifs mount error messages
In managed environment (such as Nomad clusters), users are not always
supposed to see credentials used to mount volumes.
However, if errors occur (most commonly, misspelled mount paths), the
error messages will output the full mount command -- which might contain
a username and a password in the case of CIFS mounts.

This PR detects password=... when error messages are wrapped and masks
them with ********.

Closes https://github.com/fsouza/go-dockerclient/issues/905.
Closes https://github.com/hashicorp/nomad/issues/12296.
Closes https://github.com/moby/moby/issues/43596.

Signed-off-by: Sebastian Höffner <sebastian.hoeffner@mevis.fraunhofer.de>
2022-05-14 02:45:06 +02:00
Brian Goff
4e025b54d5 Remove mount spec backport
This was added in 1.13 to "upgrade" old mount specs to the new format.
This is no longer needed.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2022-05-13 23:14:43 +00:00
Brian Goff
8a0cb10840 Merge pull request #43591 from thaJeztah/volumes_fixup_part1
volumes/local: remove legacy migration code, and some cleanups
2022-05-13 14:37:12 -07:00
Sebastiaan van Stijn
0ec744f43b Merge pull request #43594 from rumpl/seccomp-5.16
Allow different syscalls from kernels 5.12 -> 5.16
2022-05-13 20:52:32 +02:00
Bjorn Neergaard
2c3d1f7b4b overlay2: test for and report metacopy status
This is a first, naive implementation, that does not account for
userxattr/UserNS.

Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
2022-05-13 07:37:20 -06:00
Djordje Lukic
7de9f4f82d Allow different syscalls from kernels 5.12 -> 5.16
Kernel 5.12:

    mount_setattr: needs CAP_SYS_ADMIN

Kernel 5.14:

    quotactl_fd: needs CAP_SYS_ADMIN
    memfd_secret: always allowed

Kernel 5.15:

    process_mrelease: always allowed

Kernel 5.16:

    futex_waitv: always allowed

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
2022-05-13 12:35:08 +02:00
Justin Cormack
f1dd6bf84e Merge pull request #43553 from AkihiroSuda/riscv64
seccomp: support riscv64
2022-05-13 10:41:53 +01:00
Sebastiaan van Stijn
e9712464ad Merge pull request #43199 from Xyene/allow-landlock
seccomp: add support for Landlock syscalls in default policy
2022-05-13 10:18:45 +02:00
Samuel Karp
a75620086f Merge pull request #43580 from thaJeztah/remove_initlayer_stub 2022-05-13 01:09:01 -07:00
Brian Goff
f32b304a8f Merge pull request #42501 from tianon/always-seccomp
Remove "seccomp" build tag
2022-05-12 19:12:15 -07:00
Sebastiaan van Stijn
34e02d9b04 Merge pull request #43524 from thaJeztah/daemon_fix_hosts_validation_step2
opts: ParseTCPAddr(): extract parsing logic, consistent errors
2022-05-13 02:42:40 +02:00
Sebastiaan van Stijn
d9524d92a9 api/types/swarm: Version: implement stringer interface
makes the code a bit more DRY.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-13 02:40:14 +02:00