Rootless dockerd refused to use overlay2 whenever SELinux was enabled
on the host, forcing users onto fuse-overlayfs:
```
overlay is not supported for Rootless with SELinux
```
The check was added for Fedora 34, where rootless overlayfs on kernel
5.11 hit SELinux denials.
That no longer happens on current hosts such as Fedora 41.
The containerd overlayfs snapshotter never had an equivalent check and
already runs natively in rootless mode with SELinux enforcing.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The vm workflow only covers oraclelinux-8, which is kept for cgroup v1.
Add openSUSE Tumbleweed to the matrix for a rolling-release host: a recent
kernel, SELinux in enforcing mode, and an iptables-nft based userspace.
Support SUSE-compatible guests in the provisioning script by selecting the
package manager and the packages that differ between the distributions.
Run the tests from /var/tmp, not /tmp. The latter is a tmpfs on SUSE, which
is too small for the test daemons' data roots and consumes the guest memory.
Look up selinuxenabled by absolute path, as /usr/sbin is not in the login
user's PATH on all distributions, and the rootless daemons were started with
overlay2 instead of fuse-overlayfs. Sanitize the template locator for the
report artifact names, which cannot contain the "/" of "experimental/".
Unset XDG_CONFIG_HOME and XDG_DATA_HOME before switching to the rootless
account. dockerd honors them when running with RootlessKit, and sudo
--preserve-env passes on the ones of the invoking user. SUSE sets them from
PAM, so they pointed at root's home, and the daemon failed to read its
configuration.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The VM jobs vary the kernel while running the daemon and tests inside the
Debian development image. This masks the guest's userspace, systemd, and
security configuration, limiting the host OS coverage of these jobs.
Build the pinned dependency bundle on the runner, provision native guest
packages and the rootless account, and invoke the harness in the guest.
The development image and make previously supplied the tools, account,
Git configuration, and GitHub Actions environment; native execution needs
these set up explicitly. Use fuse-overlayfs for rootless SELinux guests.
Install the bundle as root without overwriting existing guest directory
metadata, and make bundles/ traversable before copying the checkout.
BuildKit exports have runner ownership and mode 0700, including newly
created parents. DIND did not extract these onto the guest or copy their
permissions into daemon binary and data paths. Move the export outside
the checkout so source and report copies exclude build dependencies.
Document provisioning and native integration test commands for local VMs.
Assisted-by: Codex
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
- slirp4netns/vpnkit is no longer needed as gvisor-tap-vsock is now embedded in RootlessKit.
slirp4netns/vpnkit is still used when installed.
- The `builtin` port driver can now correctly propagate the source IP, when
`userland-proxy` is disabled.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This option was added in 9672afa339 in 2016,
at which time tweaking GOGC showed a significant difference when building
the binary (`1m14.221s` vs `0m49.929s`).
Testing this Today doesn't show a real difference;
With GOGC=1000:
rm -rf bundles/
time hack/make.sh binary
real 0m15.303s
user 0m26.285s
sys 0m6.383s
real 0m4.931s
user 0m3.103s
sys 0m1.670s
real 0m5.693s
user 0m3.827s
sys 0m2.384s
Without GOGC set;
real 0m5.012s
user 0m3.689s
sys 0m1.549s
real 0m5.298s
user 0m3.997s
sys 0m1.695s
real 0m4.899s
user 0m3.579s
sys 0m1.423s
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This option was added in 0bff2515f7 to control
what packages were built for the deb and rpm packages.
This repository no longer builds the deb and rpm packages, and this variable
is no longer used, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove mention of `BIND_DIR` as it's no longer needed
- Update some links to files that were moved
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When creating development containers currently, `Makefile` doesn't use
the GIT_BRANCH variable to tag `docker-dev` image. But in some
documentation files for contributing, references remain for image tags
with the `git branch` name.
This commit simply removes those references. Correct image tag names are
important for newcomers, especially for copy-pasteable commands.
Related PR: 42652
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
Markdown subheading name was changed in `CONTRIBUTING.md` in the past,
so this commit fixes the link by changing it from `docker` to `moby`.
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
Follow-up to fcc8209e12, which didn't
make the window for API v1.51, so had to be adjusted for the API
version it requires.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This parameter was already supported for some time in the backend (for
purposes related to docker system prune). It was also already present in
the imagetypes.ListOptions but was never actually handled by the client.
Make it available by default in the response.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
More recent versions of go-swagger failed on this, because the value
is interpolated as JSON numberic value, which assumes int64 (signed).
Quote the value to prevent it being handled before validated against
uint64.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change adds the ability to delete a specific platform from a
multi-platform image.
Previously, image deletion was an all-or-nothing operation - when
deleting a multi-platform image, all platforms would be removed
together. This change allows users to selectively remove individual
platforms from a multi-architecture image while keeping other platforms
intact.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
commit af0cdc36c7 marked these fields as
deprecated and to be removed in API v1.47 (which was targeted for v28.0).
We shipped v1.47 with the v27.2 release, but did not yet remove the erroneous
fields, so the version to deprecate was updated to v1.48 through
3df03d8e66
This patch removes fields that are not part of the image by replacing the
type with the Config struct from the docker image-spec.
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/images/alpine/json | jq .Config
{
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh"
]
}
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/images/alpine/json | jq .Config
{
"Hostname": "",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh"
],
"Image": "",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": null,
"OnBuild": null,
"Labels": null
}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `BridgeNfIptables` and `BridgeNfIp6tables` fields in the
`GET /info` response were deprecated in API v1.48, and are now omitted
in API v1.50.
With this patch, old API version continue to return the field:
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIp6tables
false
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIptables
false
Omitting the field in API v1.50 and above
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/info | jq .BridgeNfIp6tables
null
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/info | jq .BridgeNfIptables
null
This reverts commit eacbbdeec6, and re-applies
a variant of 5d2006256f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add ability for the device driver to implement a device discovery
mechanism and expose discovered devices in the `docker info` output.
Currently it's only implemented for CDI devices.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This reverts commit 5d2006256f, which
caused some issues in the docker/cli formatting code that needs some
investigating.
Let's (temporarily) revert this while we look what's wrong.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Copy the swagger / OpenAPI file to the documentation. This is the API
version used by the upcoming v28.1.0 release.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The `BridgeNfIptables` and `BridgeNfIp6tables` fields in the
`GET /info` response were deprecated in API v1.48, and are now omitted
in API v1.49.
With this patch, old API version continue to return the field:
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIp6tables
false
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIptables
false
Omitting the field in API v1.49 and above
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/info | jq .BridgeNfIp6tables
null
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/info | jq .BridgeNfIptables
null
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- registry.ServiceConfig: add a "ExtraFields" for outputting deprecated
fields.
- remove uses of AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Report FirewallBackend in "docker info".
It's currently "iptables" or "iptables+firewalld" on Linux, and
omitted on Windows.
Signed-off-by: Rob Murray <rob.murray@docker.com>
`GET /image/{name}/json` now supports `platform` parameter allowing to
specify which platform variant of a multi-platform image to inspect.
For servers that do not use containerd image store integration, this
option will cause an error if the requested platform doesn't match the
image's actual platform
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- error (ErrorMessage) was deprecated in 3043c26419
which was part of docker v0.6.0 / API v1.4
- progress (ProgressMessage) was deprecated in 597e0e69b4
which was part of docker v0.7.1 / API v1.8
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Paweł Gronowski