Commit graph

2500 commits

Author SHA1 Message Date
David Calavera
78ce43bad8 Merge pull request #18780 from jfrazelle/seccomp-default
set default seccomp profile
2015-12-28 16:46:30 -08:00
Jess Frazelle
38440cadf3 Merge pull request #18897 from runcom/fix-net-none-build
integration-cli: fix --net=none build
2015-12-28 10:51:18 -08:00
Jessica Frazelle
15674c5fb7
add docs and unconfined to run a container without the default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:26:51 -08:00
Jessica Frazelle
a48fe62384
add default seccomp profile tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:26:48 -08:00
Jessica Frazelle
947293a280
set default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:18:47 -08:00
Qiang Huang
8799c4fc0f Implemet docker update command
It's used for updating properties of one or more containers, we only
support resource configs for now. It can be extended in the future.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
2015-12-28 19:19:26 +08:00
Antonio Murdaca
bb8e1dc8fa integration-cli: fix --net=none build
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2015-12-24 16:36:37 +01:00
Arnaud Porterie
914fad8b7d Merge pull request #18810 from runcom/pkg-authz-fixes
pkg: authorization: do not register the same plugin
2015-12-23 15:09:06 -08:00
Antonio Murdaca
c28fc06e00 pkg: authorization: do not register the same plugin
This patches avoids registering (and calling) the same plugin more than
once. Using an helper map which indexes by name guarantees this and keeps
the order.
The behavior of overriding the same name in a flag is consistent with,
for instance, the `docker run -v /test -v /test` flag which register
the volume just once.
Adds integration tests.

Without this patch:
```
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.080901676+01:00" level=debug msg="Calling
GET
/v1.22/info"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081213202+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081268132+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081699788+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081762507+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.082092480+01:00" level=debug msg="GET
/v1.22/info"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.628691038+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.629880930+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
```

With this patch:
```
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376523958+01:00" level=debug msg="Calling
GET
/v1.22/info"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376715483+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376771230+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.377698897+01:00" level=debug msg="GET
/v1.22/info"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.951016441+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
```

Also removes a somehow duplicate debug statement (leaving only the
second one as it's a loop of plugin's manifest):
```
Dec 20 19:52:30 localhost.localdomain docker[25767]:
time="2015-12-20T19:52:30.544090518+01:00" level=debug
msg="docker-novolume-plugin's manifest: &{[authz]}"
Dec 20 19:52:30 localhost.localdomain docker[25767]:
time="2015-12-20T19:52:30.544170677+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
```

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2015-12-23 21:08:40 +01:00
Daniel Nephin
83237aab2b Remove package pkg/ulimit, use go-units instead.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2015-12-23 13:27:58 -05:00
David Calavera
95b708cf19 Merge pull request #18839 from aaronlehmann/v1-fallback-404
When a manifest is not found, allow fallback to v1
2015-12-23 10:01:39 -08:00
Zhang Wei
26dd026bd7 Add filter for network ls to hide predefined net
Add filter support for `network ls` to hide predefined network,
then user can use "docker network rm `docker network ls -f type=custom`"
to delete a bundle of userdefined networks.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
2015-12-23 13:26:40 +08:00
David Calavera
eacedcbe21 Merge pull request #18831 from calavera/test_event_observer
Extract event processing to a common function for testing.
2015-12-22 15:04:32 -08:00
Alexander Morozov
030347c3c9 Merge pull request #18762 from calavera/runconfig_to_types
Move container configuration types to api/types/container.
2015-12-22 14:22:08 -08:00
David Calavera
af51df20bd Extract event processing to a common function for testing.
We keep only one logic to test event related behavior that will help us
diagnose flacky event errors.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-22 17:10:06 -05:00
Dan Walsh
89a775d2dc No options to tmpfs is valid
If you run a

docker run command with --tmpfs /mountpoint:noexec

Or certain options that get translated into mount options, the mount command can get passed "" for mount data.
So this should be valid.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
2015-12-22 14:15:07 -05:00
David Calavera
7ac4232e70 Move Config and HostConfig from runconfig to types/container.
- Make the API client library completely standalone.
- Move windows partition isolation detection to the client, so the
  driver doesn't use external types.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-22 13:34:30 -05:00
David Calavera
056e744903 Replace usage of pkg/nat with go-connections/nat.
Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-22 13:31:46 -05:00
Ma Shimiao
673f2b8697 upate TestRunWithBlkioInvalidWeightDevice with clearly invalid device name
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
2015-12-22 12:43:42 +08:00
Aaron Lehmann
9d6acbee92 When a manifest is not found, allow fallback to v1
PR #18590 caused compatibility issues with registries such as gcr.io
which support both the v1 and v2 protocols, but do not provide the same
set of images over both protocols. After #18590, pulls from these
registries would never use the v1 protocol, because of the
Docker-Distribution-Api-Version header indicating that v2 was supported.

Fix the problem by making an exception for the case where a manifest is
not found. This should allow fallback to v1 in case that image is
exposed over the v1 protocol but not the v2 protocol.

This avoids the overly aggressive fallback behavior before #18590 which
would allow protocol fallback after almost any error, but restores
interoperability with mixed v1/v2 registry setups.

Fixes #18832

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
2015-12-21 18:19:38 -08:00
Sebastiaan van Stijn
312c82677b Merge pull request #15879 from Mashimiao/add-support-blkio_throtte_iops
Add support for blkio read/write iops device
2015-12-21 23:45:18 +01:00
Alexander Morozov
42460b6772 Merge pull request #17692 from vdemeester/images-format
Add --format support to images command
2015-12-21 09:57:29 -08:00
Vincent Demeester
34a3c3cacf Add --format support to images command
- rename `api/client/ps` to `api/client/formatter`
- add a a image formatter

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2015-12-21 17:38:07 +01:00
Boaz Shuster
60b4db7eb1 Change the quiet flag behavior in the build command
Right now, the quiet (-q, --quiet) flag ignores the output
generated from within the container.

However, it ought to be quiet in a way that all kind
of diagnostic output should be ignored, unless the build
process fails.

This patch makes the quiet flag behave in the following way:
 1. If the build process succeeds, stdout contains the image ID
    and stderr is empty.
 2. If the build process fails, stdout is empty and stderr
    has the error message and the diagnostic output of that process.

If the quiet flag is not set, then everything goes to stdout
and error messages, if there are any, go to stderr.

Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
2015-12-21 16:38:50 +02:00
Ma Shimiao
843084b08b Add support for blkio read/write iops device
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
2015-12-21 09:14:49 +08:00
Doug Davis
58c049595f Merge pull request #18767 from wenchma/add_checkduplicate_test
Add network create api test on CheckDuplicate
2015-12-19 10:46:11 -05:00
Wen Cheng Ma
5649dae89b Add network create api test on CheckDuplicate
Signed-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>
2015-12-19 22:29:30 +08:00
Aditi Rajagopal
278e75800c pkg/version.Version: use the new String() method
Resolves #18750

Signed-off-by: Aditi Rajagopal <arajagopal@us.ibm.com>
2015-12-18 15:29:32 -05:00
Antonio Murdaca
5a64c8027e authZ: more fixes
- fix naming and formatting
- provide more context when erroring auth
- do not capitalize errors
- fix wrong documentation
- remove ugly remoteError{}

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2015-12-18 16:29:01 +01:00
David Calavera
406da8616c Merge pull request #18716 from clnperez/fix-blkio-tests
Update TestRunWithBlkioInvalidDevice Tests
2015-12-17 10:23:59 -08:00
Antonio Murdaca
98be580794 Merge pull request #18590 from aaronlehmann/limit-v1-fallbacks
Limit v1 protocol fallbacks
2015-12-17 14:44:05 +01:00
Sebastiaan van Stijn
5baa93c04e Merge pull request #18662 from runcom/pkg-authZ-response
pkg: authorization: add Err to tweak response status code
2015-12-17 11:12:27 +01:00
Antonio Murdaca
46e3a249a1 pkg: authorization: add Err to tweak response status code
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2015-12-17 11:08:47 +01:00
Vincent Demeester
0f749ad55a Merge pull request #18559 from ahmetalpbalkan/return-container-networks
Proposal: Add container networks list to /containers/json
2015-12-17 10:11:18 +01:00
Aaron Lehmann
a57478d65f Do not fall back to the V1 protocol when we know we are talking to a V2 registry
If we detect a Docker-Distribution-Api-Version header indicating that
the registry speaks the V2 protocol, no fallback to V1 should take
place.

The same applies if a V2 registry operation succeeds while attempting a
push or pull.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
2015-12-16 15:02:03 -08:00
David Calavera
905f3336b2 Merge pull request #15964 from duglin/APIVersion
Add a DOCKER_API_VERSION env var
2015-12-16 14:23:47 -08:00
Tonis Tiigi
15d84a3a48 Improve reference parse errors
Fixes #18093

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-12-16 11:58:53 -08:00
Brian Goff
ebb1d56ecb Merge pull request #18705 from runcom/cleanups
Cleanups
2015-12-16 12:40:31 -05:00
Christy Perez
2236ecddfb Update TestRunWithBlkioInvalidDevice Tests
/dev/sda wasn't an invalid device and this test failed, so, hopefully
/dev/sdX isn't going to exist in other envs.

Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>
2015-12-16 10:58:31 -06:00
Antonio Murdaca
baba1a8493 reorder imports with goimports
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2015-12-16 16:50:25 +01:00
Antonio Murdaca
bb2c92355c Merge pull request #18655 from dmcgowan/fix-docker-inspect-container
Add metadata function to layer store
2015-12-16 12:23:41 +01:00
David Calavera
e98cae4919 Move filters package to the API.
These filters are only use to interchange data between clients and daemons.
They don't belong to the parsers package.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-15 18:13:26 -05:00
David Calavera
27220ecc6b Move timeutils functions to the only places where they are used.
- Move time json marshaling to the jsonlog package: this is a docker
  internal hack that we should not promote as a library.
- Move Timestamp encoding/decoding functions to the API types: This is
  only used there. It could be a standalone library but I don't this
it's worth having a separated repo for this. It could introduce more
complexity than it solves.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-15 14:56:14 -05:00
Brian Goff
ce0b1841c8 Merge pull request #17034 from rhvgoyal/volume-propagation
Capability to specify per volume mount propagation mode
2015-12-15 12:14:41 -05:00
Alexander Morozov
812a7c204a Merge pull request #18531 from coolljt0725/update_container_networking_on_create
fix docker inspect return unconsistent network settings  of created container and stopped container
2015-12-15 08:47:54 -08:00
Ahmet Alp Balkan
755f8609f6 Add containers’ networks to /containers/json
After addition of multi-host networking in Docker 1.9, Docker Remote
API is still returning only the network specified during creation
of the container in the “List Containers” (`/containers/json`) endpoint:

    ...
    "HostConfig": {
      "NetworkMode": "default"
    },

The list of networks containers are attached to is only available at
Get Container (`/containers/<id>/json`) endpoint.
This does not allow applications utilizing multi-host networking to
be built on top of Docker Remote API.

Therefore I added a simple `"NetworkSettings"` section to the
`/containers/json` endpoint. This is not identical to the NetworkSettings
returned in Get Container (`/containers/<id>/json`) endpoint. It only
contains a single field `"Networks"`, which is essentially the same
value shown in inspect output of a container.

This change adds the following section to the `/containers/json`:

    "NetworkSettings": {
      "Networks": {
        "bridge": {
          "EndpointID": "2cdc4edb1ded3631c81f57966563e...",
          "Gateway": "172.17.0.1",
          "IPAddress": "172.17.0.2",
          "IPPrefixLen": 16,
          "IPv6Gateway": "",
          "GlobalIPv6Address": "",
          "GlobalIPv6PrefixLen": 0,
          "MacAddress": "02:42:ac:11:00:02"
        }
      }
    }

This is of type `SummaryNetworkSettings` type, a minimal version of
`api/types#NetworkSettings`.

Actually all I need is the network name and the IPAddress fields. If folks
find this addition too big, I can create a `SummaryEndpointSettings` field
as well, containing just the IPAddress field.

Signed-off-by: Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>
2015-12-14 19:03:23 -08:00
Derek McGowan
a7e0968321 Add metadata function to layer store
Add function to get metadata from layer store for a mutable layer

fixes #18614

Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
2015-12-14 16:52:15 -08:00
Alexander Morozov
260cbb19c9 Merge pull request #18486 from aboch/vnd
Vendoring libnetwork bbd6e6d8ca1e7c9b42f6f53277b0bde72847ff90
2015-12-14 13:32:01 -08:00
Doug Davis
6287ec9095 Add a DOCKER_API_VERSION env var
Closes: #11486

Just for @ahmetalpbalkan  :-)

Fixed some comment formatting too while in there.

Signed-off-by: Doug Davis <dug@us.ibm.com>
2015-12-14 12:45:34 -08:00
Vivek Goyal
f988c98ff3 Add some unit and integration tests
Add a unit test and couple of integration tests for volume propagation.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
2015-12-14 10:39:53 -05:00