The fuzz target only requires []byte and uint64 inputs, so
go-fuzz-headers is unnecessary. Use native fuzz parameters instead.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, the authorization system would silently skip body inspection when
request bodies exceeded the maximum size limit (1MiB).
The authorization plugins would receive an empty body for inspection
while the actual large payload would still be processed by the Docker
daemon, allowing malicious requests to circumvent plugin-based security
controls.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
kernel-memory limits are not supported in cgroups v2, and were obsoleted in
[kernel v5.4], producing a `ENOTSUP` in kernel v5.16. Support for this option
was removed in runc and other runtimes, as various LTS kernels contained a
broken implementation, resulting in unpredictable behavior.
We deprecated this option in [moby@b8ca7de], producing a warning when used,
and actively ignore the option since [moby@0798f5f].
Given that setting this option had no effect in most situations, we should
just remove this option instead of continuing to handle it with the expectation
that a runtime may still support it.
Note that we still support RHEL 8 (kernel 4.18) and RHEL 9 (kernel 5.14). We
no longer build packages for Ubuntu 20.04 (kernel 5.4) and Debian Bullseye 11
(kernel 5.10), which still have an LTS / ESM programme, but for those it would
only impact situations where a runtime is used that still supports it, and
an old API version was used.
[kernel v5.4]: https://github.com/torvalds/linux/commit/0158115f702b0ba208ab0
[moby@b8ca7de]: https://github.com/moby/moby/commit/b8ca7de823acf572cad9becb74fd5cdac1748057
[moby@0798f5f]: https://github.com/moby/moby/commit/0798f5f5cf6908593472b21179360168cd9f4691
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package depends on jsonformatter.JSONProgress and jsonmessage.JSONMessage,
and it looks like it requires some of those for their stringer interface.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the type to the API, but embed it, so that we keep the
methods on the struct in this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can probably use [aec.EmptyBuilder] for managing the output, but
currently we're doing it all manually, so defining some consts for
the basics we use.
[aec.EmptyBuilder]: https://pkg.go.dev/github.com/morikuni/aec#EmptyBuilder
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external users, and this package still has too many different
responsibilities, some of which may be available elsewhere, so moving it
internal so that we can decide to dismantle it further.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the stub implementation for non-Windows platforms, and remove the
os.FileMode argument, which is ignored on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior, making
it not a good candidate to carry in the module.
This moves it to the daemon as a non-exported `resolveSymlinkedDirectory`
utility, so that it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior (including
some potentially surprising behavior), making it not a good candidate to
carry in the module.
This moves it internal to the daemon as a non-exported utility, so that
it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn