The containerd image store is not supported with userns-remap, so the
daemon disables the containerd-snapshotter feature and refuses to start
when it is explicitly enabled.
The containerd-migration feature was not covered by this, so a daemon
with both userns-remap and containerd-migration still switched to the
containerd image store.
Refuse to start in that case too, with the same kind of error as for
containerd-snapshotter.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The getController method only returns the network's controller pointer,
without performing any additional operations.
Replace its callers with direct access to n.ctrlr and remove the
unnecessary accessor. Rename the ctrlr field to "controller" for
clarity.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The controller pointer is initialized when a network is created and
is not modified afterward. Reading it therefore does not require
holding the network mutex.
Remove the unnecessary locking from getController.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Every daemon with an extension host opened an extra full-access API
socket at startup, even when no extension used the API.
The socket is now created when an extension first connects to the API.
The daemonapi client looks up the endpoint on its first connection, so
NewClient no longer takes a context.
The socket is served separately from the configured hosts, returns 503
until the daemon is ready, and closes after extensions shut down.
It is accessible only to the daemon user, or to Administrators and
LocalSystem on Windows.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Extensions had no supported way to call the Engine API.
The configured hosts may be socket-activated or TLS-only TCP.
Add the org.mobyproject.extension.daemon.api.v0 point.
It returns the address of a private unix socket where the daemon serves
its regular API handler.
daemonapiv0.NewClient helper resolves the point and returns a
*client.Client.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When the daemon started with the nftables backend after a release older
than 28.0.0 had run with iptables, NewCleaner deleted the jumps from
filter-FORWARD to DOCKER-FORWARD and DOCKER-ISOLATION-STAGE-1, then
removed Docker's chains. Those releases also jumped from FORWARD to the
filter table's DOCKER chain for each bridge ("-o docker0 -j DOCKER").
iptables refuses to delete a chain that a rule still jumps to, and
removeIPChains ignores the error. The cleaner's DelNetwork deleted the
per-bridge jump later, when the bridge driver restored the network, but
nothing tried to remove the chain again. The empty DOCKER chain
remained.
When the bridge driver has restored its networks and endpoints, call
the cleaner's new Done method, which removes the chains again.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When the daemon started with the nftables backend after a release older
than 28.0.1 had run with iptables, the iptables cleaner's DelNetwork
left the per-bridge rules those releases put in filter-FORWARD:
"-i docker0 ! -o docker0 -j ACCEPT" and the ICC rules. The iptables
backend deleted them in setupNonInternalNetworkRules and setIcc, but
only when adding a network's rules, and DelNetwork returned early for an
internal network.
Delete all the legacy per-bridge FORWARD rules in
deleteLegacyFilterRules, which the iptables backend and the cleaner call
for every network.
With the iptables backend, setupIPTables deletes the legacy rules after
calling setupNonInternalNetworkRules, which used to delete
"-i docker0 ! -o docker0 -j ACCEPT" before adding the DOCKER-FORWARD
rule that replaces it. Now, for a moment, both rules are present. Both
accept outgoing packets from the bridge.
Signed-off-by: Cory Snider <csnider@mirantis.com>
matchesType tests a network against only the first value of the type
filter. The values come from a map. Their order is random and changes
from one network to the next. A GET /networks request that filters on
both type=builtin and type=custom lists a random subset of the
networks. Before networks were filtered one at a time, the daemon
filtered the list once for each type value and listed every network
that matched any of them.
Match a network when its type is any of the filter's values.
integration-cli's TestDockerNetworkLsFilter checks this request but is
skipped in every run. Its OnlyDefaultNetworks requirement is met only
when GET /networks lists no networks at all. The daemon always lists
the predefined bridge, host and none networks. Port the test to
integration/network as TestNetworkListFilters, which uses the API
client. The new test checks the same id, name, type, label and driver
filter terms against two networks that it creates and the predefined
networks. It derives the expected results for type=custom and
driver=bridge from the unfiltered list, as the daemon can have other
networks. Remove the integration-cli test, its assertNwList helper and
the OnlyDefaultNetworks requirement. Nothing else uses them.
Add the combined type values to the filter unit test as well. Both
tests fail on the combined values without the fix.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Remove the redundant ErrorCoder type assertion and let the
recursive call handle unsupported error types.
Make all switch cases return explicitly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add missing mappings for ErrFailedPrecondition (412) and
ErrResourceExhausted (429), aligning with containerd's errhttp
implementation.
Add table-driven tests covering the errdefs mappings, gRPC and
distribution errors, and wrapped and joined errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use errors.AsType to preserve the original JSON error details
when the error is wrapped, instead of replacing them with a
generic error containing only the message.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This error response was added in [moby@1421293], at which time the response
only contained a flat `error` field. This field was deprecated in favor of
an `errorDetails` struct in [moby@3043c26], but failed to update `FormatError`,
which continued to use the deprecated
`error` field.
Update `FormatError` to use the non-deprecated field, and update the error
message to be more descriptive. We're intentionally not preserving the actual
JSON marshal error, as it should be very unlikely to happen, and quoting the
error-message is not guaranteed to produce a JSON-compatible format.
[moby@1421293]: https://github.com/moby/moby/commit/14212930e40439d0cfc635d56e084736867f9e30
[moby@3043c26]: https://github.com/moby/moby/commit/3043c2641990d94298c6377b7ef14709263a4709
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the iptables firewall backend, the overlay driver programs iptables
rules which mark VXLAN datagrams of encrypted networks for encryption,
drop cleartext VXLAN datagrams received for those networks, and strip
the encryption mark from datagrams marked by local processes. A
firewalld reload can flush these rules. The node then sends the
network's VXLAN datagrams in cleartext and accepts forged cleartext
datagrams for it until the last local endpoint of the network leaves and
another joins, or the daemon restarts.
On firewalld reload, restore all rules which were previously programmed
by the overlay driver.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
v2: Fix YAML unmarshaler validation bypass
Quoted null and tilde scalars bypass UnmarshalYAML, allowing invalid
values to escape application-defined validation. In applications
accepting configuration from less-trusted sources, this can lead to
denial of service or shared configuration corruption.
Require implicit scalar resolution before treating untagged scalars
as null. Add regression tests covering custom validation, both quote
styles, explicit tags, and actual null values.
full diff: https://github.com/yaml/go-yaml/compare/v2.4.4...v2.4.5
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Paweł Gronowski