Commit Graph

52845 Commits

Author SHA1 Message Date
CrazyMax
a3c8f7fa8c dockerfile: update govulncheck to v1.1.4
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit fcf666f9b0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:26:11 +02:00
Sebastiaan van Stijn
5beb93de84 Merge pull request #50309 from crazy-max/28.x_pick_buildkit-0.23.2
[28.x backport] vendor: update buildkit to v0.23.2
v28.3.1
2025-07-02 15:31:29 +02:00
Tonis Tiigi
e17e96e3c5 vendor: update buildkit to v0.23.2
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2025-07-02 11:48:40 +02:00
Sebastiaan van Stijn
e0183475e0 Merge pull request #50264 from vvoland/50263-28.x
[28.x backport] gha/bin-image: add major and minor version image tags
2025-06-25 14:47:55 +02:00
Paweł Gronowski
a2af8bdebd gha/bin-image: add major and minor version image tags
Adding image tags that follow the semver major and minor versions (e.g., `28`
and `28.3`) for the moby-bin images.

This makes it easier for users to reference the latest build within a
major or minor version series without having to know the exact
minor/patch version.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 38b98bcf68)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-24 23:32:35 +02:00
Paweł Gronowski
265f709647 Merge pull request #50247 from vvoland/50245-28.x
[28.x backport] docs: cut api docs for v1.51
v28.3.0 v28.3.0-rc.2
2025-06-20 16:22:35 +00:00
Paweł Gronowski
b2a9318a1e docs: cut api docs for v1.51
Used by the upcoming 28.3.0 release

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit ef50844a0b)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-20 18:16:33 +02:00
Sebastiaan van Stijn
b3e2e22b2a Merge pull request #50244 from vvoland/50177-28.x
[28.x backport] gha: lower timeouts on "build" and "merge" steps
2025-06-20 17:37:41 +02:00
Sebastiaan van Stijn
c571cd8513 Merge pull request #50243 from vvoland/50238-28.x
[28.x backport] vendor: update buildkit to v0.23.1
2025-06-20 17:36:18 +02:00
Sebastiaan van Stijn
8c713c1af4 gha: lower timeouts on "build" and "merge" steps
We had some runs timeout after 120 minutes; expected duration is much
lower than that, so let's lower the timeout to make actions fail faster.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 0a30b98447)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-20 16:29:08 +02:00
Paweł Gronowski
539c115023 Merge pull request #50240 from thaJeztah/28.x_backport_validate_mirrors
[28.x backport] daemon/config: Validate: add missing validation for registry mirrors and improve errors
2025-06-20 14:16:09 +00:00
CrazyMax
8e7ea470cf vendor: update buildkit to v0.23.1
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit 5a02e7f4e3)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-20 16:05:04 +02:00
Jonathan A. Sternberg
222baf4ccb vendor: github.com/moby/buildkit v0.23.0
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
(cherry picked from commit e43968d7ed)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-20 16:04:30 +02:00
Paweł Gronowski
1627e828d7 Merge pull request #50241 from thaJeztah/28.x_backport_update_cgroups
[28.x backport] vendor: github.com/opencontainers/cgroups v0.0.3
2025-06-20 14:00:46 +00:00
Paweł Gronowski
4070ebda88 Merge pull request #50242 from thaJeztah/28.x_backport_fix_event_ordering
[28.x backport] daemon: containerStop: fix ordering of "stop" and "die" events
2025-06-20 13:38:31 +00:00
Paweł Gronowski
b613ac489e Merge pull request #50239 from vvoland/50237-28.x
[28.x backport] Update containerd to v2.1.3
2025-06-20 11:36:57 +00:00
Sebastiaan van Stijn
0e0ca09ddc daemon: containerStop: fix ordering of "stop" and "die" events
Commit 8e6cd44ce4 added synchronisation to
wait for the container's status to be updated in memory. However, since
952902efbc, a defer was used to produce
the container's "stop" event.

As a result of the sychronisation that was added, the "die" event would
now be produced before the "stop" event.

This patch moves the locking inside the defer to restore the previous
behavior.

Unfortunately the order of events is still not guaranteed, because events
are emited from multiple goroutines that don't have synchronisation between
them; this is something to look at for follow ups. This patch keeps the status
quo and should preserve the old behavior, which was "more" correct in most
cases.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 062082ec9b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-20 13:29:19 +02:00
Sebastiaan van Stijn
e62b0e2234 vendor: github.com/opencontainers/cgroups v0.0.3
- ConvertCPUSharesToCgroupV2Value: improve
- Add .github/dependabot.yml
- Remove annotations from Resources (fixes a regression introduced in v0.0.2)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit a90da2edc3)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-20 13:26:46 +02:00
Sebastiaan van Stijn
06ab9cd1ed daemon/config: Validate: add missing validation for registry mirrors
Validation of registry mirrors was performed during daemon startup,
but after the config-file was validated. As a result, the `--validate`
option would incorrectly print that the configuration was valid, but
the daemon would fail to start;

    echo '{"registry-mirrors":["example.com"]}' > my-config.json
    dockerd --config-file ./my-config.json --validate
    configuration OK

    dockerd --config-file ./my-config.json
    # ...
    failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'

With this patch applied, validation is also performed as part of the
daemon config validation;

    echo '{"registry-mirrors":["example.com"]}' > my-config.json
    dockerd --config-file ./my-config.json --validate
    unable to configure the Docker daemon with file ./my-config.json: merged configuration validation from file and command line flags failed: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'

    # fix the invalid config
    echo '{"registry-mirrors":["https://example.com"]}' > my-config.json
    dockerd --config-file ./my-config.json --validate
    configuration OK

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1d8545d60c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-20 13:20:27 +02:00
Sebastiaan van Stijn
97aa4e8550 registry: ValidateMirror: improve validation for missing schemes
Before this patch, a missing scheme would sometimes produce a confusing
error message. If no scheme was specified at all, an empty "" would be
included in the message;

    echo '{"registry-mirrors":["example.com"]}' > my-config.json
    dockerd --config-file ./my-config.json
    # ...
    failed to start daemon: invalid mirror: unsupported scheme "" in "example.com"

If a scheme was missing, but a port was included, the hostname would be
printed as the scheme;

    echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
    dockerd --config-file ./my-config.json
    # ...
    failed to start daemon: invalid mirror: unsupported scheme "example.com" in "example.com:8080"

With this patch applied, the error messages are slightly more user-friendly;

    echo '{"registry-mirrors":["example.com"]}' > my-config.json
    dockerd --config-file ./my-config.json
    # ...
    failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'

    echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
    dockerd --config-file ./my-config.json
    # ...
    failed to start daemon: invalid mirror: no scheme specified for "example.com:8080": must use either 'https://' or 'http://'

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 307c18598d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-20 13:20:26 +02:00
Derek McGowan
e18a9c95b8 Update containerd to v2.1.3
Fixes various issues with pulling from registries

Signed-off-by: Derek McGowan <derek@mcg.dev>
(cherry picked from commit b466c35da1)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-20 11:28:31 +02:00
Sebastiaan van Stijn
b959bebdfc Merge pull request #50219 from thaJeztah/28.x_backport_deprecate_execconfig_detach
[28.x backport] api/types/container: deprecate ExecOptions.Detach
2025-06-18 23:03:00 +02:00
Sebastiaan van Stijn
02ade1a34c Merge pull request #50210 from thaJeztah/28.x_backport_pkg_idtools_deprecate
[28.x backport] pkg/idtools: deprecate IdentityMapping, Identity.Chown
2025-06-18 23:02:12 +02:00
Paweł Gronowski
106c4b0af6 Merge pull request #50211 from thaJeztah/28.x_backport_bump_swarmkit
[28.x backport] vendor: github.com/moby/swarmkit/v2 v2.0.0
2025-06-17 16:18:54 +00:00
Sebastiaan van Stijn
54d2eee6d6 Merge pull request #50217 from thaJeztah/28.x_backport_update-buildkit-v0.23.0-rc2
[28.x backport] vendor: update buildkit to v0.13.0-rc2
2025-06-17 15:10:47 +02:00
Sebastiaan van Stijn
09fef2b26e api/types/container: deprecate ExecOptions.Detach
This field was added in 5130fe5d38, which
added it for use as intermediate struct when parsing CLI flags (through
`runconfig.ParseExec`) in c786a8ee5e.

Commit 9d9dff3d0d rewrote the CLI to use
Cobra, and as part of this introduced a separate `execOptions` type in
`api/client/container`.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 0c182d4d57)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-17 13:10:50 +02:00
Tonis Tiigi
44c8cd2e8f vendor: update buildkit to v0.13.0-rc2
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 1289519b03)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-17 11:36:27 +02:00
Cory Snider
78b6204f9e vendor: github.com/moby/swarmkit/v2 v2.0.0
Use the tagged version instead of the v2.0.0-20250613170222-a45be3cac15c
pseudo-version. The referenced commit has not changed.

Signed-off-by: Cory Snider <csnider@mirantis.com>
(cherry picked from commit c3ac979ecf)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-17 11:23:57 +02:00
Cory Snider
cf98237186 vendor: github.com/moby/swarmkit/v2 v2.0.0-20250613170222-a45be3cac15c
- fix task scheduler infinite loop

full diff: 8c19597365...a45be3cac1

Signed-off-by: Cory Snider <csnider@mirantis.com>
(cherry picked from commit 2d60b8eacd)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-16 17:53:26 +02:00
Sebastiaan van Stijn
fd96b01b0e pkg/idtools: deprecate IdentityMapping, Identity.Chown
The IdentityMapping and Identity types are still used internally, but
should be considered transitional.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit b7ef527bdc)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-16 17:40:11 +02:00
Paweł Gronowski
6a1fb46d48 Merge pull request #50169 from robmry/revert_overlay_refactoring
[28.x]: Revert overlay bug fixes / refactoring
v28.3.0-rc.1
2025-06-13 15:49:07 +00:00
Paweł Gronowski
9a9cade0df Merge pull request #50199 from vvoland/c8d-push-fixtag
c8d/push: Fix fallback single-manifest push not creating a tag
2025-06-13 13:42:50 +00:00
Paweł Gronowski
987b8a88a6 c8d/push: Extract shared push logic
Just a refactor of the previous commit to reduce duplication.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-13 14:51:18 +02:00
Sebastiaan van Stijn
e921abf618 Merge pull request #50198 from thaJeztah/bump_containerd
vendor: github.com/containerd/containerd/v2 v2.1.2
2025-06-13 14:39:07 +02:00
Paweł Gronowski
d9e7b86de4 c8d/push: Fix fallback single-manifest push not creating a tag
After pushing the multi-platform index fails due to missing content, we
retry with the single-platform manifest. While the target descriptor was
changed for the second push, the actual target digested reference still
pointed to the original multi-platform index. Obviously, with the
fallback that didn't really work correctly, because the multi-platform
index is not pushed.

This commit fixes the issue by updating the target reference to point to
the single-platform manifest.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-13 14:31:34 +02:00
Sebastiaan van Stijn
5dc1ccdfc8 Merge pull request #50136 from mabrarov/50133-container_stop_state_sync
fix: daemon: state of stopped container visible to other queries when container is stopped
2025-06-13 14:16:37 +02:00
Sebastiaan van Stijn
53d12c96f8 vendor: github.com/containerd/containerd/v2 v2.1.2
no significant changes other than error messages that now contain more
information

full diff: https://github.com/containerd/containerd/compare/v2.1.1...v2.1.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-13 13:50:48 +02:00
Paweł Gronowski
72145a8ad2 Merge pull request #50146 from vvoland/image-list-containers
api/image/list: Return `Containers` count
2025-06-13 11:34:38 +00:00
Rob Murray
f9e6f25677 Merge pull request #50196 from robmry/fix_TestDaemonRestartRestoreBridgeNetwork
Fix flaky test TestDaemonRestartRestoreBridgeNetwork
2025-06-13 12:21:19 +01:00
Sebastiaan van Stijn
9e985bd96f Merge pull request #50158 from mmorel-35/errorlint
fix errorlint linter
2025-06-13 12:38:38 +02:00
Rob Murray
aac0260d21 Fix flaky test TestDaemonRestartRestoreBridgeNetwork
It checked for "Bind for 0.0.0.0:80 failed: port is already
allocated". But, since commit d662091 ("portallocator: always
check for ports allocated for 0.0.0.0/::"), the message is
sometimes about ":::80".

Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-06-13 10:53:22 +01:00
Paweł Gronowski
cfcbfabb0f api/image/list: Return Containers count
This parameter was already supported for some time in the backend (for
purposes related to docker system prune). It was also already present in
the imagetypes.ListOptions but was never actually handled by the client.

Make it available by default in the response.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-13 11:46:09 +02:00
Sebastiaan van Stijn
52a54d9ef6 Merge pull request #50176 from dmcgowan/handle-token-server-error-messages
Handle error message from token server with containerd backend
2025-06-13 10:40:33 +02:00
Matthieu MOREL
6d737371b8 fix comparison rule from errorlint
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-06-13 08:26:56 +00:00
Paweł Gronowski
b65c31427c Merge pull request #50174 from jsternberg/buildkit-update
vendor: github.com/moby/buildkit v0.23.0-rc1
2025-06-12 18:55:04 +00:00
Rob Murray
5de6c1f6f3 Merge pull request #50189 from thaJeztah/fix_TestCopyFromContainerPathIsNotDir
integration-cli: TestCopyFromContainerPathIsNotDir: adjust for win 2025
2025-06-12 19:54:41 +01:00
Sebastiaan van Stijn
84f5e5351c Merge pull request #50145 from vvoland/api-151
api: bump to 1.51
2025-06-12 20:18:50 +02:00
Derek McGowan
941d09e265 Handle error message from token server with containerd backend
Signed-off-by: Derek McGowan <derek@mcg.dev>
2025-06-12 11:13:34 -07:00
Jonathan A. Sternberg
e4e7fcf668 vendor: github.com/moby/buildkit v0.23.0-rc1
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-06-12 19:08:16 +02:00
Sebastiaan van Stijn
a057f98a30 Merge pull request #50187 from thaJeztah/bump_buildkit_deps
vendor: update buildkit and containerd dependencies
2025-06-12 19:08:04 +02:00