- deprecate sockets.GetProxyEnv, sockets.DialerFromEnvironment
- add support for unix sockets on Windows
- remove legacy CBC cipher suites from client config
- align client and server defaults to be the same.
- remove support for encrypted TLS private keys.
- nat: optimize ParsePortSpec
full diff: https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The current detection based on mediaType only accounted for the non-signed
mediatype (`application/vnd.docker.distribution.manifest.v1+json`), but
most (if not all) v1 images used the "signed" manifest type; for example;
docker buildx imagetools inspect docker:1.0.1
Name: docker.io/library/docker:1.0.1
MediaType: application/vnd.docker.distribution.manifest.v1+prettyjws
Digest: sha256:666987df8e0c46670ea52bcd078547297a738fd6b421ec77aac910e1c0f688fd
Various code-paths would still detect the unsupported type through type-
matching the `*schema1.SignedManifest` type, but given that the only reason
for this is to detect whether the image is supported, we might as well just
match the mediaType.
Unfortunately, the [containerd images package][1] currently only defines a
const for the signed variant, and not for the unsigned ones, so to remove
the dependency on the `schema1` package, this patch introduces a (temporary)
local definition.
With this patch, the dependency on the "schema1" package is removed, and with
that also the use of "libtrust"; the dependency still shows up in vendor.mod
due to the docker/distribution dependency not being a go module, but should
dissolve once we remove that dependency in future.
This patch can also be verified using the `distribution` endpoint, which
returns an error when trying to get information for a "v1" image;
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:1.0.1/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:1.0.1/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:00:18 GMT
< Content-Length: 311
{"message":"Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0.1 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/"}
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:28/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:28/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:01:06 GMT
< Content-Length: 541
{"Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:0a2ee60851e1b61a54707476526c4ed48cc55641a17a5cba8a77fb78e7a4742c","size":5165},"Platforms":[{"architecture":"amd64","os":"linux"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v6"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v7"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm64","os":"linux","variant":"v8"},{"architecture":"unknown","os":"unknown"}]}
[1]: https://github.com/containerd/containerd/blob/v2.1.3/core/images/mediatypes.go#L54-L55
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Fix storageDriver gcs not registered in binaries
- reference: replace uses of deprecated function SplitHostname
- Dont parse errors as JSON unless Content-Type is set to JSON
- update to go1.20.8
- Set Content-Type header in registry client ReadFrom
- deprecate reference package, migrate to github.com/distribution/reference
- digestset: deprecate package in favor of go-digest/digestset
- Do not close HTTP request body in HTTP handler
full diff: https://github.com/distribution/distribution/compare/v2.8.2...v2.8.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- all changes here are attributed to difference in behaviour between,
namely:
- resolution of secondary test dependencies
- prunning of non-Go files
Signed-off-by: Ilya Dmitrichenko <errordeveloper@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update libnetwork to make `docker run -p 80:80` functional again on environments
with kernel boot parameter `ipv6.disable=1`.
full diff: b3507428be...64b7a4574d
- fix port forwarding with ipv6.disable=1
- fixes moby/moby/42288 Docker 20.10.6: all containers stopped and cannot start if ipv6 is disabled on host
- fixes docker/libnetwork/2629 Network issue with IPv6 following update to version 20.10.6
- fixesdocker/for-linux/1233 Since 20.10.6 it's not possible to run docker on a machine with disabled IPv6 interfaces
- vendor: github.com/ishidawataru/sctp f2269e66cdee387bd321445d5d300893449805be
- Enforce order of lock acquisitions on network/controller, fixes#2632
- fixes docker/libnetwork/2632 Name resolution stuck due to deadlock between different network struct methods
- fixes moby/moby/42032 Docker deamon get's stuck, can't serve DNS requests
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: fa125a3512...b3507428be
- fixed IPv6 iptables rules for enabled firewalld (libnetwork#2609)
- fixes "Docker uses 'iptables' instead of 'ip6tables' for IPv6 NAT rule, crashes"
- Fix regression in docker-proxy
- introduced in "Fix IPv6 Port Forwarding for the Bridge Driver" (libnetwork#2604)
- fixes/addresses: "IPv4 and IPv6 addresses are not bound by default anymore" (libnetwork#2607)
- fixes/addresses "IPv6 is no longer proxied by default anymore" (moby#41858)
- Use hostIP to decide on Portmapper version
- fixes docker-proxy not being stopped correctly
Port mapping of containers now contain separatet mappings for IPv4 and IPv6 addresses, when
listening on "any" IP address. Various tests had to be updated to take multiple mappings into
account.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: 2e24aed516...9e99af28df
- docker/libnetwork#2548 Add docker interfaces to firewalld docker zone
- fixesdocker/for-linux#957 DNS Not Resolving under Network [CentOS8]
- fixesdocker/libnetwork#2496 Port Forwarding does not work on RHEL 8 with Firewalld running with FirewallBackend=nftables
- store.getNetworksFromStore() remove unused error return
- docker/libnetwork#2554 Fix 'failed to get network during CreateEndpoint'
- fixes/addresses docker/for-linux#888 failed to get network during CreateEndpoint
- docker/libnetwork#2558 [master] bridge: disable IPv6 router advertisements
- docker/libnetwork#2563 log error instead if disabling IPv6 router advertisement failed
- fixesdocker/for-linux#1033 Shouldn't be fatal: Unable to disable IPv6 router advertisement: open /proc/sys/net/ipv6/conf/docker0/accept_ra: read-only file system
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- relates to moby/buildkit 1111
- relates to moby/buildkit 1079
- relates to docker/buildx 129
full diff: 9461782956...e31b211e4f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Bumps swarmkit vendoring. Includes docker/swarmkit#2938, which fixes
tasks.db growing out of control on worker nodes.
Signed-off-by: Drew Erny <derny@mirantis.com>
