Commit graph

37466 commits

Author SHA1 Message Date
Sebastiaan van Stijn
c6511ee4db
bump vndr v0.1.1
full diff: https:/github.com/LK4D4/vndr/compare/v0.1.0...v0.1.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 486161a63a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:49:01 +01:00
Sebastiaan van Stijn
0fa8a0c575
bump vndr v0.1.0 to support versioned import paths
With this change, go packages/modules that use versioned
import paths (github.com/foo/bar/v2), but don't use a directory
in the repository, can now be supported.

For example:

```
github.com/coreos/go-systemd/v22 v22.0.0
```

will vendor the github.com/coreos/go-systemd repository
into `vendor/github.com/coreos/go-systemd/v22`.

full diff: f5ab8fc5fb...v0.1.0

- LK4D4/vndr#83 migrate bitbucket to api 2.0
    - fixes LK4D4/vndr#82 https://api.bitbucket.org/1.0/repositories/ww/goautoneg: 410 Gone
- LK4D4/vndr#86 Replace sort.Sort with sort.Strings
- LK4D4/vndr#87 support `github.com/coreos/go-systemd/v22`

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit d4f05c168d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:48:59 +01:00
Justen Martin
f3009e2f51
Use build args to override binary commits in dockerfile
Signed-off-by: Justen Martin <jmart@the-coder.com>
(cherry picked from commit 095ca77f48)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:48:57 +01:00
Sebastiaan van Stijn
92ca652fc9
Revert "dockerfile: update vndr to 85886e1a"
This reverts commit 0d4f412ecd.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:48:50 +01:00
Kir Kolyshkin
fdad16840c
go-swagger: fix panic
This is an attempt to fix go-swagger panic under Golang 1.13.

Details:
 * https://github.com/go-openapi/jsonpointer/pull/4
 * https://github.com/go-swagger/go-swagger/pull/2059

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 93f9b902af)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:48:44 +01:00
Sebastiaan van Stijn
075e057de5
Dockerfile: set GO111MODULE=off
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 961119db21)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-12 18:48:42 +01:00
Tonis Tiigi
aa6a9891b0 vendor: add local copy of archive/tar
This version avoids doing name lookups on creating tarball that
should be avoided in to not hit loading glibc shared libraries.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-03-09 21:45:05 +00:00
Tonis Tiigi
0d4f412ecd dockerfile: update vndr to 85886e1a
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-03-09 21:45:05 +00:00
Akihiro Suda
71373c6105
Merge pull request #40604 from thaJeztah/19.03_backport_mis_unlock
[19.03 backport] daemon/cluster: add a missing Unlock
2020-02-29 10:37:35 +09:00
Sebastiaan van Stijn
498fbecafd
Merge pull request #40476 from cpuguy83/19.03_fix_exec_id_client
[19.03] Exec inspect field should be "ID" not "ExecID"
2020-02-28 22:23:26 +01:00
Brian Goff
5101ce52ae
Merge pull request #40461 from AkihiroSuda/cherrypick-40243-1903
[19.03 backport] Use certs.d from XDG_CONFIG_HOME when in rootless mode (fixes #40236)
2020-02-28 11:17:39 -08:00
Ziheng Liu
1e3971d556
daemon/cluster: add a missing Unlock
Signed-off-by: Ziheng Liu <lzhfromustc@gmail.com>
(cherry picked from commit 83c0bedba9)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-28 19:10:14 +01:00
Sebastiaan van Stijn
bb19f8cc90
Merge pull request #40566 from thaJeztah/19.03_backport_bump_grpc
[19.03 backport] bump google.golang.org/grpc v1.23.1
2020-02-28 18:17:14 +01:00
Sebastiaan van Stijn
a18dd2e48e
Merge pull request #40586 from thaJeztah/19.03_revert_jenkinsfile_pin_older_windows
[19.03] Revert "Jenkinsfile: temporarily pin windows image to 10.0.17763.973"
2020-02-26 17:45:58 +01:00
Sebastiaan van Stijn
eb7bd90a57
Revert "Jenkinsfile: temporarily pin windows image to 10.0.17763.973"
This reverts commit c694d60364.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-26 16:27:45 +01:00
Dmitry Sharshakov
a2d887b6f5 Use certs.d
from XDG_CONFIG_HOME
 when in rootless mode

Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com>
(cherry picked from commit f4fa98f583)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-26 16:50:59 +09:00
Sebastiaan van Stijn
0594484041
Merge pull request #40575 from thaJeztah/19.03_backport_unify_apis
[19.03 backport] docs: add API versions v1.25 - v1.29, v1.38 - v1.40
2020-02-25 12:40:36 +01:00
Sebastiaan van Stijn
cb5a2beaff
docs: add API versions v1.25 - v1.29, v1.38 - v1.40
Adding separate documents for older API versions, so that these don't have to
be collected from each tag/release branch:

- v1.40 - docker v19.03
- v1.39 - docker v18.09
- v1.38 - docker v18.06
- v1.29 - docker v17.05
- v1.28 - docker v17.04
- v1.27 - docker v17.03
- v1.26 - docker v1.13.1
- v1.25 - docker v1.13.0

Note that:

- API versions v1.30 - v1.37 are yet to be added after the tags and release-
  branches from the docker/docker-ce mono-repo have been extracted.
- docker v1.13.0 made the switch from using a markdown file to using swagger
  to document the API.

Approach taken:

    git mv api/swagger.yaml api/swagger-current.yaml

    git checkout upstream/19.03 -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.40.yaml

    git checkout v18.09.9 -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.39.yaml

    git checkout v18.06.3-ce -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.38.yaml

    git checkout v17.05.0-ce -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.29.yaml

    git checkout v17.04.0-ce -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.28.yaml

    git checkout v17.03.2-ce -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.27.yaml

    git checkout v1.13.1 -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.26.yaml

    git checkout v1.13.0 -- api/swagger.yaml
    git mv api/swagger.yaml docs/api/v1.25.yaml

    git mv api/swagger-current.yaml api/swagger.yaml

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 6fdbc50084)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-25 10:52:59 +01:00
Akihiro Suda
ad2c5440b5
Merge pull request #40477 from cpuguy83/19.03_40446_check_other_mounts
[19.03] Check tmpfs mounts before create anon volume
2020-02-25 09:41:24 +09:00
Akihiro Suda
a515a320f2
Merge pull request #40547 from thaJeztah/19.03_backport_update_selinux_v1.3.1
[19.03 backport] vendor: update opencontainers/selinux v1.3.1
2020-02-25 09:40:40 +09:00
Akihiro Suda
56399cdacf
Merge pull request #40560 from thaJeztah/19.03_backport_33434_api_doc_base64url
[19.03 backport] Update API docs to specify using base64url
2020-02-25 09:40:17 +09:00
Sebastiaan van Stijn
5e6469c088
Merge pull request #40557 from thaJeztah/19.03_bump_buildkit_v0.6.4
[19.03] vendor: update buildkit v0.6.4
2020-02-24 18:00:53 +01:00
Brian Goff
679115602f
Merge pull request #40555 from fuweid/cp1903-40137
[19.03 backport] daemon: add grpc.WithBlock option
2020-02-22 07:26:04 -08:00
Sebastiaan van Stijn
ce1b8c8c93
bump google.golang.org/grpc v1.23.1
full diff: https://github.com/grpc/grpc-go/compare/v1.23.0...v1.23.1

- grpc/grpc-go#3018 server: set and advertise max frame size of 16KB
- grpc/grpc-go#3017 grpclb: fix deadlock in grpclb connection cache
    - Before the fix, if the timer to remove a SubConn fires at the
      same time NewSubConn cancels the timer, it caused a mutex leak
      and deadlock.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 39ad39d220)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-22 16:11:05 +01:00
Mike Bush
0349167554
Fixes #33434 - API docs to specify using base64url
Specify base64url rather than base64. Also correct other links to the base64url section of RFC4648

Signed-off-by: Mike Bush <mpbush@gmail.com>
(cherry picked from commit f282dde877)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-22 15:29:42 +01:00
Sebastiaan van Stijn
b47f177f20
vendor: update buildkit v0.6.4
full diff: 57e8ad5217...v0.6.4

- buildkit#1374 [v0.6] ops: fix deadlock on releasing shared mounts
    - backport of buildkit#1355 ops: fix deadlock on releasing shared mounts
    - fixes buildkit#1322 Deadlock on cache mounts

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-22 12:28:37 +01:00
Wei Fu
9ed0504592 daemon: add grpc.WithBlock option
WithBlock makes sure that the following containerd request is reliable.

In one edge case with high load pressure, kernel kills dockerd, containerd
and containerd-shims caused by OOM. When both dockerd and containerd
restart, but containerd will take time to recover all the existing
containers. Before containerd serving, dockerd will failed with gRPC
error. That bad thing is that restore action will still ignore the
any non-NotFound errors and returns running state for
already stopped container. It is unexpected behavior. And
we need to restart dockerd to make sure that anything is OK.

It is painful. Add WithBlock can prevent the edge case. And
n common case, the containerd will be serving in shortly.
It is not harm to add WithBlock for containerd connection.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
(cherry picked from commit 9f73396dab)
Signed-off-by: Wei Fu <fuweid89@gmail.com>
2020-02-22 14:28:28 +08:00
Sebastiaan van Stijn
1a7d601a15
Merge pull request #40549 from cpuguy83/19.03_stats_use_cond_var
[19.03 backport] Use condition variable to wake stats collector.
2020-02-22 02:29:23 +01:00
Tibor Vass
eee88a2a23
Merge pull request #40551 from thaJeztah/19.03_backport_jenkinsfile_pin_older_windows
[19.03 backport] Jenkinsfile: temporarily pin windows image to 10.0.17763.973
2020-02-21 15:45:04 -08:00
Sebastiaan van Stijn
c694d60364
Jenkinsfile: temporarily pin windows image to 10.0.17763.973
The latest `ltsc2019` image (`10.0.17763.1039`) appear to be broken,
and even a `RUN Write-Host hello` hangs.

Temporarily switching back to an older version so that CI doesn't fail.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit fa2417984b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-21 09:25:09 +01:00
Brian Goff
0901d4ab31 Use condition variable to wake stats collector.
Before the collection goroutine wakes up every 1 second (as configured).
This sleep interval is in case there are no stats to collect we don't
end up in a tight loop.

Instead use a condition variable to signal that a collection is needed.
This prevents us from waking the goroutine needlessly when there is no
one looking for stats.

For now I've kept the sleep just moved it to the end of the loop, which
gives some space between collections.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit e75e6b0e31)
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-02-20 11:38:16 -08:00
Sebastiaan van Stijn
75fa1145da
Merge pull request #40490 from thaJeztah/19.03_backport_swagger_document_constraints
[19.03 backport] swagger: document "node.platform.(arch|os)" constraints
2020-02-20 20:31:51 +01:00
Brian Goff
d1cf6d1303
Merge pull request #40540 from thaJeztah/19.03_update_containerd_1.2.13
[19.03] update containerd runtime v1.2.13
2020-02-20 11:18:42 -08:00
Brian Goff
e145add0ef
Merge pull request #40533 from thaJeztah/19.03_update_golang_1.12.17
[19.03] Update Golang 1.12.17
2020-02-20 11:18:02 -08:00
Sebastiaan van Stijn
2b130c28ca
vendor: update opencontainers/selinux v1.3.1
full diff: 5215b1806f...v1.3.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 12c7541f1f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-20 15:22:08 +01:00
Sebastiaan van Stijn
c6afabf3b3
update containerd runtime v1.2.13
The thirteenth patch release for `containerd` 1.2 fixes a regression introduced
in v1.2.12 that caused container/shim to hang on single core machines, fixes an
issue with blkio, and updates the Golang runtime to 1.12.17.

* Fix container pid race condition
* Update containerd/cgroups dependency to address blkio issue
* Set octet-stream content-type on PUT request
* Pin to libseccomp 2.3.3 to preserve compatibility with hosts that do not have libseccomp 2.4 or higher installed
* Update Golang runtime to 1.12.17, which includes a fix to the runtime

full diff: https://github.com/containerd/containerd/compare/v1.2.12...v1.2.13

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-18 21:33:19 +01:00
Akihiro Suda
4ac62b478d
Merge pull request #40462 from AkihiroSuda/cherrypick-40210-1903
[19.03 backport] overlay[2]: rm extra checks in init
2020-02-18 18:04:05 +09:00
Sebastiaan van Stijn
55af290462
Update Golang 1.12.17
full diff: https://github.com/golang/go/compare/go1.12.16...go1.12.17

go1.12.17 (released 2020/02/12) includes a fix to the runtime. See the Go 1.12.17
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.17+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-17 11:55:15 +01:00
Brian Goff
1b8e9a131c Exec inspect field should be "ID" not "ExecID"
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit cc993a9cbf)
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-02-10 14:09:26 -08:00
Sebastiaan van Stijn
5e23653130
swagger: document "node.platform.(arch|os)" constraints
Support for these constraints was added in docker 1.13.0
(API v1.25), but never documented.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit ed439e4a31)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-10 17:04:42 +01:00
Akihiro Suda
130ae89dab
Merge pull request #40460 from AkihiroSuda/cherrypick-40406-1903
[19.03 backport] dockerd-rootless.sh: remove confusing code comment
2020-02-09 04:23:57 +09:00
Brian Goff
1d8da80dbf Check tmpfs mounts before create anon volume
This makes sure that things like `--tmpfs` mounts over an anonymous
volume don't create volumes uneccessarily.
One method only checks mountpoints, the other checks both mountpoints
and tmpfs... the usage of these should likely be consolidated.

Ideally, processing for `--tmpfs` mounts would get merged in with the
rest of the mount parsing. I opted not to do that for this change so the
fix is minimal and can potentially be backported with fewer changes of
breaking things.
Merging the mount processing for tmpfs can be handled in a followup.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit f464c31668)
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-02-07 14:11:17 -08:00
Kir Kolyshkin
5b6f2e1c59 overlay[2]: rm fs checks
Now that we do check if overlay is working by performing an actual
overlayfs mount, there's no need in extra checks for the kernel version
or the filesystem type. Actual mount check is sufficient.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit e226aea280)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-06 13:18:47 +09:00
Kir Kolyshkin
1b0edb155f Fix/improve overlay support check
Before this commit, overlay check was performed by looking for
`overlay` in /proc/filesystem. This obviously might not work
for rootless Docker (fs is there, but one can't use it as non-root).

This commit changes the check to perform the actual mount, by reusing
the code previously written to check for multiple lower dirs support.

The old check is removed from both drivers, as well as the additional
check for the multiple lower dirs support in overlay2 since it's now
a part of the main check.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 649e4c8889)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-06 13:18:41 +09:00
Kir Kolyshkin
5571ceb5ac overlay: move supportsMultipleLowerDir to utils
This moves supportsMultipleLowerDir() to overlayutils
so it can be used from both overlay and overlay2.

The only changes made were:
 * replace logger with logrus
 * don't use workDirName mergedDirName constants
 * add mnt var to improve readability a bit

This is a preparation for the next commit.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit d5687079ad)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-06 13:18:37 +09:00
Danny Milosavljevic
5e4574526d Use fewer modprobes
Signed-off-by: Danny Milosavljevic <dannym@scratchpost.org>
(cherry picked from commit 074eca1d79)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-06 13:18:23 +09:00
Akihiro Suda
9338d0a6b5 dockerd-rootless.sh: remove confusing code comment
`--userland-proxy-path` is automatically set by dockerd: e6c1820ef5/cmd/dockerd/config_unix.go (L46)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 9bd1ae024a)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-06 13:08:08 +09:00
Brian Goff
5f6d6f3f22
Merge pull request #40453 from thaJeztah/19.03_bump_containerd
[19.03] update containerd 1.12.12, runc v1.0.0-rc10
2020-02-04 14:05:54 -08:00
Akihiro Suda
d3dab1f618
update runc library to v1.0.0-rc10 (CVE-2019-19921)
Notable changes:
* Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207
* Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185
* Basic support for cgroup v2.  Almost feature-complete, but still missing support for systemd mode in rootless.
  See also https://github.com/opencontainers/runc/issues/2209 for the known issues.

Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Also updates go-selinux: 3a1f366feb...5215b1806f
(See https://github.com/containerd/cri/pull/1383#issuecomment-578227009)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 6d68080907)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-04 18:41:02 +01:00
Akihiro Suda
3bd1759f80
update runc binary to v1.0.0-rc10 (CVE-2019-19921)
Notable changes:
* Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207
* Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185
* Basic support for cgroup v2.  Almost feature-complete, but still missing support for systemd mode in rootless.
  See also https://github.com/opencontainers/runc/issues/2209 for the known issues.

Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit cd43c1d1ac)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-04 18:41:00 +01:00