Commit graph

43785 commits

Author SHA1 Message Date
Gabriel Goller
2ff043c9fe
Updated AUTHORS and .mailmap files
Updated the list of AUTHORS using the generate-authors.sh script.

Also updating the .mailmap file to prevent some duplicates, and
to include some updates from containerd, which had a more up-to-date
list of author's preferred e-mail addresses.

Signed-off-by: Gabriel Goller <gabrielgoller123@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-04 20:33:51 +02:00
Tianon Gravi
83970db5ef
Merge pull request #43445 from AkihiroSuda/runc-1.1.1
update runc to v1.1.1
2022-04-01 16:04:46 -07:00
Sebastiaan van Stijn
99b2894e17
Merge pull request #43434 from tonistiigi/amd64-variant-support
distribution: fix matching amd64 variants
2022-04-02 00:12:33 +02:00
Akihiro Suda
ffc903d7a6
update runc binary to v1.1.1
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-04-01 15:24:13 +09:00
Akihiro Suda
69993c1c57
vendor: github.com/opencontainers/runc v1.1.1
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-04-01 15:23:46 +09:00
Tonis Tiigi
482d1d15bf distribution: use the maximum compatible platform by default
When no specific platform is set, pull the platform that
most matches the current host.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2022-03-31 15:20:59 -07:00
Sebastiaan van Stijn
a6005ef380
Merge pull request #43368 from TBBle/generalised-Windows-device-syntax
Introduce `://` syntax for Windows Devices in DeviceMapping.PathOnHost
2022-03-31 22:34:12 +02:00
Tonis Tiigi
fcc42d5682 distribution: use correct platform matcher for containerd
This uses the correct comparison with compatibility
checks for variants.

The deprecated arm variant matcher is left as is.
Although it is not needed for valid cases it is not
fully compatible as also matches some invalid
combinations, so should be removed separately.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2022-03-27 19:46:45 -07:00
Sebastiaan van Stijn
88e1fec490
Merge pull request #43432 from crazy-max/fix-buildkit-tests
vendor: github.com/moby/buildkit d7744bc
2022-03-27 14:34:09 +02:00
CrazyMax
d74bf97f40
vendor: github.com/moby/buildkit d7744bc
full diff: 8d45bd6...d7744bc

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-27 13:07:05 +02:00
Paul "TBBle" Hampson
064650dd09 Pass TestPsListContainersFilterCreated if other created containers exist
The test was dependent on its container being _first_ in the response,
but anywhere on the line should be fine.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
31e1fec950 Suport vpci-class-guid in the non-containerd backend
IDType `vpci-class-guid` is a synonym of `class`.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
cb07afa3cc Implement :// separator for arbitrary Windows Device IDTypes
Arbitrary here does not include '', best to catch that one early as it's
almost certainly a mistake (possibly an attempt to pass a POSIX path
through this API)

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
92f13bad88 Allow Windows Devices to be activated for HyperV Isolation
If not using the containerd backend, this will still fail, but later.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:41 +11:00
Paul "TBBle" Hampson
c60f70f112 Break out setupWindowsDevices and add tests
Since this function is about to get more complicated, and change
behaviour, this establishes tests for the existing implementation.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:23:48 +11:00
Sebastiaan van Stijn
8941dcfcc5
Merge pull request #43428 from thaJeztah/prevent_rootlesskit_dependency_in_cli
registry: remove dependency on rootlesskit, add `SetCertsDir()`
2022-03-26 18:11:51 +01:00
Sebastiaan van Stijn
1ad9a09af8
Merge pull request #43369 from sestegra/stop
Allow STOPSIGNAL instruction in commit change
2022-03-26 14:40:32 +01:00
Sebastiaan van Stijn
aaf70b5c6b
Merge pull request #42064 from thaJeztah/swarm_ping
API: add "Swarm" header to _ping endpoint
2022-03-26 14:39:50 +01:00
Sebastiaan van Stijn
070726194d
Merge pull request #43427 from AkihiroSuda/rootlesskit-1.0.0
update RootlessKit to v1.0.0
2022-03-26 00:14:18 +01:00
Sebastiaan van Stijn
1e645fb70f
client: Ping(): add handling for swarm status headers
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 23:57:58 +01:00
Sebastiaan van Stijn
adf4bf772d
API: add "Swarm" header to _ping endpoint
This adds an additional "Swarm" header to the _ping endpoint response,
which allows a client to detect if Swarm is enabled on the daemon, without
having to call additional endpoints.

This change is not versioned in the API, and will be returned irregardless
of the API version that is used. Clients should fall back to using other
endpoints to get this information if the header is not present.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 23:54:14 +01:00
Sebastiaan van Stijn
0729fbd343
Merge pull request #43378 from thaJeztah/deprecate_storage_drivers
daemon: require storage-driver to be set if the driver is deprecated
2022-03-25 20:33:23 +01:00
Sebastiaan van Stijn
ffd5d2665d
Merge pull request #43379 from evol262/overlay2-fix-deadlock
libnetwork/overlay:fix sandbox deadlock
2022-03-25 19:48:00 +01:00
Akihiro Suda
4d7ab4b214
update RootlessKit to v1.0.0
Only minor changes since v0.14.6, such as upgrading Go to 1.18:
https://github.com/rootless-containers/rootlesskit/compare/v0.14.6...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-03-26 02:10:52 +09:00
Akihiro Suda
19a7875c3c
vendor: golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-03-26 02:10:12 +09:00
Sebastiaan van Stijn
85572cac14
registry: remove dependency on rootlesskit, add SetCertsDir()
The registry package contained code to automatically set the CertsDir() path,
based on wether or not the daemon was running in rootlessmode. In doing so,
it made use of the `pkg/rootless.RunningWithRootlessKit()` utility.

A recent change in de6732a403 added additional
functionality in the `pkg/rootless` package, introducing a dependency on
`github.com/rootless-containers/rootlesskit`. Unfortunately, the extra
dependency also made its way into the docker cli, which also uses the
registry package.

This patch introduces a new `SetCertsDir()` function, which allows
the default certs-directory to be overridden, and updates the daemon
to configure this location during startup.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 16:21:45 +01:00
Sebastiaan van Stijn
3853eb59d1
daemon: require storage-driver to be set if the driver is deprecated
Previously, we only printed a warning if a storage driver was deprecated. The
intent was to continue supporting these drivers, to allow users to migrate
to a different storage driver.

This patch changes the behavior; if the user has no storage driver specified
in the daemon configuration (so if we try to detect the previous storage
driver based on what's present in /var/lib/docker), we now produce an error,
informing the user that the storage driver is deprecated (and to be removed),
as well as instructing them to change the daemon configuration to explicitly
select the storage driver (to allow them to migrate).

This should make the deprecation more visible; this will be disruptive, but
it's better to have the failure happening *now* (while the drivers are still
there), than for users to discover the storage driver is no longer there
(which would require them to *downgrade* the daemon in order to migrate
to a different driver).

With this change, `docker info` includes a link in the warnings that:

    / # docker info
    Client:
    Context:    default
    Debug Mode: false

    Server:
    ...
    Live Restore Enabled: false

    WARNING: The overlay storage-driver is deprecated, and will be removed in a future release.
    Refer to the documentation for more information: https://docs.docker.com/go/storage-driver/

When starting the daemon without a storage driver configured explicitly, but
previous state was using a deprecated driver, the error is both logged and
printed:

    ...
    ERRO[2022-03-25T14:14:06.032014013Z] [graphdriver] prior storage driver overlay is deprecated and will be removed in a future release; update the the daemon configuration and explicitly choose this storage driver to continue using it; visit https://docs.docker.com/go/storage-driver/ for more information
    ...
    failed to start daemon: error initializing graphdriver: prior storage driver overlay is deprecated and will be removed in a future release; update the the daemon configuration and explicitly choose this storage driver to continue using it; visit https://docs.docker.com/go/storage-driver/ for more information

When starting the daemon and explicitly configuring it with a deprecated storage
driver:

    WARN[2022-03-25T14:15:59.042335412Z] [graphdriver] WARNING: the overlay storage-driver is deprecated and will be removed in a future release; visit https://docs.docker.com/go/storage-driver/ for more information

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 15:22:06 +01:00
Sebastiaan van Stijn
020fd68326
daemon: graphdriver: some minor cleanup
- use pkg/errors for errors and fix error-capitalisation
- remove one redundant call to logDeprecatedWarning() (we're already skipping
  deprecated drivers in that loop).
- rename `list` to `priorityList` for readability.
- remove redundant "skip" for the vfs storage driver, as it's already
  excluded by `scanPriorDrivers()`
- change one debug log to an "info", so that the daemon logs contain the driver
  that was configured, and include "multiple prior states found" error in the
  daemon logs, to assist in debugging failed daemon starts.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 15:21:14 +01:00
Sebastiaan van Stijn
0a3336fd7d
Merge pull request #43366 from corhere/finish-identitymapping-refactor
Finish refactor of UID/GID usage to a new struct
2022-03-25 14:51:05 +01:00
Sebastiaan van Stijn
4a26fdda76
Merge pull request #43334 from thaJeztah/api_swagger_inline_examples
api: swagger: use explicit definitions, use inline examples, and fix indentation.
2022-03-25 09:51:13 +01:00
Sebastiaan van Stijn
9a14f93b84
Merge pull request #43418 from thaJeztah/bump_containerd_1.6.2
update containerd binary and vendor to v1.6.2
2022-03-25 08:09:20 +01:00
Akihiro Suda
94bb5992a4
Merge pull request #43422 from rumpl/remove-os-index-comment
Remove comment that is no longer relevant
2022-03-25 13:20:08 +09:00
Djordje Lukic
7b277f62cc Remove comment that is no longer relevant
The #42511 PR removed layer store indexing by OS but this comment was left behind

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
2022-03-24 19:04:33 +01:00
Sebastiaan van Stijn
ec221d6881
vendor: github.com/containerd/containerd v1.6.2
includes a fix for CVE-2022-24769.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-24 17:33:54 +01:00
Sebastiaan van Stijn
e69529c94a
update containerd binary to v1.6.2
The second patch release for containerd 1.6 includes a fix for
 [CVE-2022-24769](https://github.com/containerd/containerd/security/advisories/GHSA-c9cp-9c75-9v8c).

Notable Updates

- **Fix the inheritable capability defaults** ([GHSA-c9cp-9c75-9v8c](https://github.com/containerd/containerd/security/advisories/GHSA-c9cp-9c75-9v8c))

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-24 17:26:40 +01:00
Sebastiaan van Stijn
56ea5881fe
Merge pull request #43239 from crazy-max/buildkit-0.10
vendor buildkit v0.10.0
2022-03-24 17:25:38 +01:00
Sebastiaan van Stijn
d967ffbee0
Merge pull request #42638 from eliaskoromilas/host-devices
Mount (accessible) host devices in `--privileged` rootless containers
2022-03-24 11:19:57 +01:00
Brian Goff
8236be1207
Merge pull request #43398 from thaJeztah/client_error_handling
client: remove wrapResponseError()
2022-03-23 22:26:59 -07:00
Sebastiaan van Stijn
2bbc786e4c
Merge pull request from GHSA-2mm7-x5h6-5pvq
oci: inheritable capability set should be empty
2022-03-23 22:10:17 +01:00
Elias Koromilas
8c7ea316d1 Mount (accessible) host devices in --privileged rootless containers
Signed-off-by: Elias Koromilas <elias.koromilas@gmail.com>
2022-03-23 22:30:22 +02:00
CrazyMax
ff35785cfc
vendor buildkit 8d45bd6 that fixes dockerd worker integration tests
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:04 +01:00
CrazyMax
32f0561715
ci: buildkit integration test
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:04 +01:00
CrazyMax
fda0226a89
builder: add buildinfo for buildkit
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:03 +01:00
CrazyMax
b899db6423
builder: enable shm-size and ulimit for buildkit
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:03 +01:00
CrazyMax
aadb3bf766
builder: changes needed since buildkit 0.10.0
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:03 +01:00
CrazyMax
a2aaf4cc83
vendor buildkit v0.10.0
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-22 18:51:27 +01:00
Brian Goff
6b9b445af6
Merge pull request #42330 from AkihiroSuda/rootlesskit-info
version: add RootlessKit, slirp4netns, and VPNKit version
2022-03-22 10:27:07 -07:00
Martin Dojcak
feab0cca9f libnetwork/overlay:fix join sandbox deadlock
Operations performed on overlay network sandboxes are handled by
dispatching operations send through a channel. This allows for
asynchronous operations to be performed which, since they are
not called from within another function, are able to operate in
an idempotent manner with a known/measurable starting state from
which an identical series of iterative actions can be performed.

However, it was possible in some cases for an operation dispatched
from this channel to write a message back to the channel in the
case of joining a network when a sufficient volume of sandboxes
were operated on.

A goroutine which is simultaneously reading and writing to an
unbuffered channel can deadlock if it sends a message to a channel
then waits for it to be consumed and completed, since the only
available goroutine is more or less "talking to itself". In order
to break this deadlock, in the observed race, a goroutine is now
created to send the message to the channel.

Signed-off-by: Martin Dojcak <martin.dojcak@lablabs.io>
Signed-off-by: Ryan Barry <rbarry@mirantis.com>
2022-03-22 11:15:14 -04:00
Sebastiaan van Stijn
301eba7fa4
Merge pull request #43399 from thaJeztah/errdefs_reduce_client_deps_alternative
errdefs: move GetHTTPErrorStatusCode to api/server/httpstatus
2022-03-22 11:05:52 +01:00
Sebastiaan van Stijn
e82b7b2fa0
errdefs: move GetHTTPErrorStatusCode to api/server/httpstatus
This reverts the changes made in 2a9c987e5a, which
moved the GetHTTPErrorStatusCode() utility to the errdefs package.

While it seemed to make sense at the time to have the errdefs package provide
conversion both from HTTP status codes errdefs and the reverse, a side-effect
of the move was that the errdefs package now had a dependency on various external
modules, to handle conversio of errors coming from those sub-systems, such as;

- github.com/containerd/containerd
- github.com/docker/distribution
- google.golang.org/grpc

This patch moves the conversion from (errdef-) errors to HTTP status-codes to a
 api/server/httpstatus package, which is only used by the API server, and should
not be needed by client-code using the errdefs package.

The MakeErrorHandler() utility was moved to the API server itself, as that's the
only place it's used. While the same applies to the GetHTTPErrorStatusCode func,
I opted for keeping that in its own package for a slightly cleaner interface.

Why not move it into the api/server/httputils package?

The api/server/httputils package is also imported in the client package, which
uses the httputils.ParseForm() and httputils.HijackConnection() functions as
part of the TestTLSCloseWriter() test. While this is only used in tests, I
wanted to avoid introducing the indirect depdencencies outside of the api/server
code.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-21 12:22:39 +01:00