Merge pull request #45789 from thaJeztah/update_debian
Dockerfile: update to Debian "bookworm", and update frozen images to debian:bookworm-slim
This commit is contained in:
Tianon Gravi
GitHub
commit
488fe76eb8
13 changed files with 58 additions and 53 deletions
52
Dockerfile
52
Dockerfile
|
|
@ -1,7 +1,7 @@
|
|||
# syntax=docker/dockerfile:1
|
||||
|
||||
ARG GO_VERSION=1.21.3
|
||||
ARG BASE_DEBIAN_DISTRO="bullseye"
|
||||
ARG BASE_DEBIAN_DISTRO="bookworm"
|
||||
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
|
||||
ARG XX_VERSION=1.2.1
|
||||
|
||||
|
|
@ -16,7 +16,6 @@ ARG BUILDX_VERSION=0.12.0
|
|||
ARG COMPOSE_VERSION=v2.20.1
|
||||
|
||||
ARG SYSTEMD="false"
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG DOCKER_STATIC=1
|
||||
|
||||
# REGISTRY_VERSION specifies the version of the registry to download from
|
||||
|
|
@ -40,14 +39,12 @@ FROM --platform=$BUILDPLATFORM ${GOLANG_IMAGE} AS base
|
|||
COPY --from=xx / /
|
||||
RUN echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
|
||||
ARG APT_MIRROR
|
||||
RUN test -n "$APT_MIRROR" && sed -ri "s#(httpredir|deb|security).debian.org#${APT_MIRROR}#g" /etc/apt/sources.list || true
|
||||
ARG DEBIAN_FRONTEND
|
||||
RUN test -n "$APT_MIRROR" && sed -ri "s#(httpredir|deb|security).debian.org#${APT_MIRROR}#g" /etc/apt/sources.list.d/debian.sources || true
|
||||
RUN apt-get update && apt-get install --no-install-recommends -y file
|
||||
ENV GO111MODULE=off
|
||||
ENV GOTOOLCHAIN=local
|
||||
|
||||
FROM base AS criu
|
||||
ARG DEBIAN_FRONTEND
|
||||
ADD --chmod=0644 https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_11/Release.key /etc/apt/trusted.gpg.d/criu.gpg.asc
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-criu-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-criu-aptcache,target=/var/cache/apt \
|
||||
|
|
@ -120,7 +117,6 @@ EOT
|
|||
# See also frozenImages in "testutil/environment/protect.go" (which needs to
|
||||
# be updated when adding images to this list)
|
||||
FROM debian:${BASE_DEBIAN_DISTRO} AS frozen-images
|
||||
ARG DEBIAN_FRONTEND
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-frozen-images-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-frozen-images-aptcache,target=/var/cache/apt \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
|
|
@ -134,7 +130,7 @@ ARG TARGETVARIANT
|
|||
RUN /download-frozen-image-v2.sh /build \
|
||||
busybox:latest@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209 \
|
||||
busybox:glibc@sha256:1f81263701cddf6402afe9f33fca0266d9fff379e59b1748f33d3072da71ee85 \
|
||||
debian:bullseye-slim@sha256:dacf278785a4daa9de07596ec739dbc07131e189942772210709c5c0777e8437 \
|
||||
debian:bookworm-slim@sha256:2bc5c236e9b262645a323e9088dfa3bb1ecb16cc75811daf40a23a824d665be9 \
|
||||
hello-world:latest@sha256:d58e752213a51785838f9eed2b7a498ffa1cb3aa7f946dda11af39286c3db9a9 \
|
||||
arm32v7/hello-world:latest@sha256:50b8560ad574c779908da71f7ce370c0a2471c098d44d1c8f6b513c5a55eeeb1
|
||||
|
||||
|
|
@ -208,12 +204,14 @@ RUN git fetch -q --depth 1 origin "${CONTAINERD_VERSION}" +refs/tags/*:refs/tags
|
|||
|
||||
FROM base AS containerd-build
|
||||
WORKDIR /go/src/github.com/containerd/containerd
|
||||
ARG DEBIAN_FRONTEND
|
||||
ARG TARGETPLATFORM
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-containerd-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-containerd-aptcache,target=/var/cache/apt \
|
||||
apt-get update && xx-apt-get install -y --no-install-recommends \
|
||||
gcc libbtrfs-dev libsecret-1-dev
|
||||
gcc \
|
||||
libbtrfs-dev \
|
||||
libsecret-1-dev \
|
||||
pkg-config
|
||||
ARG DOCKER_STATIC
|
||||
RUN --mount=from=containerd-src,src=/usr/src/containerd,rw \
|
||||
--mount=type=cache,target=/root/.cache/go-build,id=containerd-build-$TARGETPLATFORM <<EOT
|
||||
|
|
@ -291,12 +289,15 @@ RUN git fetch -q --depth 1 origin "${RUNC_VERSION}" +refs/tags/*:refs/tags/* &&
|
|||
|
||||
FROM base AS runc-build
|
||||
WORKDIR /go/src/github.com/opencontainers/runc
|
||||
ARG DEBIAN_FRONTEND
|
||||
ARG TARGETPLATFORM
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-runc-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-runc-aptcache,target=/var/cache/apt \
|
||||
apt-get update && xx-apt-get install -y --no-install-recommends \
|
||||
dpkg-dev gcc libc6-dev libseccomp-dev
|
||||
dpkg-dev \
|
||||
gcc \
|
||||
libc6-dev \
|
||||
libseccomp-dev \
|
||||
pkg-config
|
||||
ARG DOCKER_STATIC
|
||||
RUN --mount=from=runc-src,src=/usr/src/runc,rw \
|
||||
--mount=type=cache,target=/root/.cache/go-build,id=runc-build-$TARGETPLATFORM <<EOT
|
||||
|
|
@ -323,7 +324,6 @@ RUN git fetch -q --depth 1 origin "${TINI_VERSION}" +refs/tags/*:refs/tags/* &&
|
|||
|
||||
FROM base AS tini-build
|
||||
WORKDIR /go/src/github.com/krallin/tini
|
||||
ARG DEBIAN_FRONTEND
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-tini-aptcache,target=/var/cache/apt \
|
||||
apt-get update && apt-get install -y --no-install-recommends cmake
|
||||
|
|
@ -331,7 +331,9 @@ ARG TARGETPLATFORM
|
|||
RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-tini-aptcache,target=/var/cache/apt \
|
||||
xx-apt-get install -y --no-install-recommends \
|
||||
gcc libc6-dev
|
||||
gcc \
|
||||
libc6-dev \
|
||||
pkg-config
|
||||
RUN --mount=from=tini-src,src=/usr/src/tini,rw \
|
||||
--mount=type=cache,target=/root/.cache/go-build,id=tini-build-$TARGETPLATFORM <<EOT
|
||||
set -e
|
||||
|
|
@ -356,12 +358,13 @@ RUN git fetch -q --depth 1 origin "${ROOTLESSKIT_VERSION}" +refs/tags/*:refs/tag
|
|||
|
||||
FROM base AS rootlesskit-build
|
||||
WORKDIR /go/src/github.com/rootless-containers/rootlesskit
|
||||
ARG DEBIAN_FRONTEND
|
||||
ARG TARGETPLATFORM
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-rootlesskit-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-rootlesskit-aptcache,target=/var/cache/apt \
|
||||
apt-get update && xx-apt-get install -y --no-install-recommends \
|
||||
gcc libc6-dev
|
||||
gcc \
|
||||
libc6-dev \
|
||||
pkg-config
|
||||
ENV GO111MODULE=on
|
||||
ARG DOCKER_STATIC
|
||||
RUN --mount=from=rootlesskit-src,src=/usr/src/rootlesskit,rw \
|
||||
|
|
@ -429,7 +432,11 @@ RUN git fetch -q --depth 1 origin "${CONTAINERUTILITY_VERSION}" +refs/tags/*:ref
|
|||
FROM base AS containerutil-build
|
||||
WORKDIR /usr/src/containerutil
|
||||
ARG TARGETPLATFORM
|
||||
RUN xx-apt-get install -y --no-install-recommends gcc g++ libc6-dev
|
||||
RUN xx-apt-get install -y --no-install-recommends \
|
||||
gcc \
|
||||
g++ \
|
||||
libc6-dev \
|
||||
pkg-config
|
||||
RUN --mount=from=containerutil-src,src=/usr/src/containerutil,rw \
|
||||
--mount=type=cache,target=/root/.cache/go-build,id=containerutil-build-$TARGETPLATFORM <<EOT
|
||||
set -e
|
||||
|
|
@ -495,7 +502,6 @@ RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
|||
ENTRYPOINT ["hack/dind-systemd"]
|
||||
|
||||
FROM dev-systemd-${SYSTEMD} AS dev-base
|
||||
ARG DEBIAN_FRONTEND
|
||||
RUN groupadd -r docker
|
||||
RUN useradd --create-home --gid docker unprivilegeduser \
|
||||
&& mkdir -p /home/unprivilegeduser/.local/share/docker \
|
||||
|
|
@ -529,9 +535,6 @@ RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
|||
net-tools \
|
||||
patch \
|
||||
pigz \
|
||||
python3-pip \
|
||||
python3-setuptools \
|
||||
python3-wheel \
|
||||
sudo \
|
||||
systemd-journal-remote \
|
||||
thin-provisioning-tools \
|
||||
|
|
@ -547,8 +550,6 @@ RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
|||
RUN update-alternatives --set iptables /usr/sbin/iptables-legacy || true \
|
||||
&& update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true \
|
||||
&& update-alternatives --set arptables /usr/sbin/arptables-legacy || true
|
||||
ARG YAMLLINT_VERSION=1.27.1
|
||||
RUN pip3 install yamllint==${YAMLLINT_VERSION}
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \
|
||||
apt-get update && apt-get install --no-install-recommends -y \
|
||||
|
|
@ -559,7 +560,8 @@ RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
|||
libseccomp-dev \
|
||||
libsecret-1-dev \
|
||||
libsystemd-dev \
|
||||
libudev-dev
|
||||
libudev-dev \
|
||||
yamllint
|
||||
COPY --link --from=dockercli /build/ /usr/local/cli
|
||||
COPY --link --from=dockercli-integration /build/ /usr/local/cli-integration
|
||||
|
||||
|
|
@ -568,7 +570,6 @@ COPY --from=gowinres /build/ /usr/local/bin/
|
|||
WORKDIR /go/src/github.com/docker/docker
|
||||
ENV GO111MODULE=off
|
||||
ENV CGO_ENABLED=1
|
||||
ARG DEBIAN_FRONTEND
|
||||
RUN --mount=type=cache,sharing=locked,id=moby-build-aptlib,target=/var/lib/apt \
|
||||
--mount=type=cache,sharing=locked,id=moby-build-aptcache,target=/var/cache/apt \
|
||||
apt-get update && apt-get install --no-install-recommends -y \
|
||||
|
|
@ -586,7 +587,8 @@ RUN --mount=type=cache,sharing=locked,id=moby-build-aptlib,target=/var/lib/apt \
|
|||
libseccomp-dev \
|
||||
libsecret-1-dev \
|
||||
libsystemd-dev \
|
||||
libudev-dev
|
||||
libudev-dev \
|
||||
pkg-config
|
||||
ARG DOCKER_BUILDTAGS
|
||||
ARG DOCKER_DEBUG
|
||||
ARG DOCKER_GITCOMMIT=HEAD
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
ARG GO_VERSION=1.21.3
|
||||
|
||||
ARG BASE_DEBIAN_DISTRO="bullseye"
|
||||
ARG BASE_DEBIAN_DISTRO="bookworm"
|
||||
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
|
||||
|
||||
FROM ${GOLANG_IMAGE}
|
||||
|
|
@ -16,7 +16,7 @@ ENV GOTOOLCHAIN=local
|
|||
|
||||
# allow replacing debian mirror
|
||||
ARG APT_MIRROR
|
||||
RUN test -n "$APT_MIRROR" && sed -ri "s#(httpredir|deb|security).debian.org#${APT_MIRROR}#g" /etc/apt/sources.list || true
|
||||
RUN test -n "$APT_MIRROR" && sed -ri "s#(httpredir|deb|security).debian.org#${APT_MIRROR}#g" /etc/apt/sources.list.d/debian.sources || true
|
||||
|
||||
# Compile and runtime deps
|
||||
# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
## Generate `event_messages.bin`
|
||||
|
||||
```console
|
||||
$ docker run --rm -it -v "$(pwd):/winresources" debian:bullseye bash
|
||||
$ docker run --rm -it -v "$(pwd):/winresources" debian:bookworm-slim bash
|
||||
root@9ad2260f6ebc:/# apt-get update -y && apt-get install -y binutils-mingw-w64-x86-64
|
||||
root@9ad2260f6ebc:/# x86_64-w64-mingw32-windmc -v /winresources/event_messages.mc
|
||||
root@9ad2260f6ebc:/# mv MSG00001.bin /winresources/event_messages.bin
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
FROM debian:bullseye-slim
|
||||
FROM debian:bookworm-slim
|
||||
RUN apt-get update && apt-get install -y gcc libc6-dev --no-install-recommends
|
||||
|
||||
COPY . /usr/src/
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
FROM debian:bullseye-slim
|
||||
FROM debian:bookworm-slim
|
||||
RUN apt-get update && apt-get install -y gcc libc6-dev --no-install-recommends
|
||||
|
||||
COPY . /usr/src/
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# syntax=docker/dockerfile:1
|
||||
|
||||
ARG GO_VERSION=1.21.3
|
||||
ARG BASE_DEBIAN_DISTRO="bullseye"
|
||||
ARG BASE_DEBIAN_DISTRO="bookworm"
|
||||
ARG PROTOC_VERSION=3.11.4
|
||||
|
||||
# protoc is dynamically linked to glibc so can't use alpine base
|
||||
|
|
|
|||
|
|
@ -1647,7 +1647,10 @@ func (s *DockerDaemonSuite) TestDaemonNoSpaceLeftOnDeviceError(c *testing.T) {
|
|||
defer mount.Unmount(testDir)
|
||||
|
||||
// create a 3MiB image (with a 2MiB ext4 fs) and mount it as graph root
|
||||
// Why in a container? Because `mount` sometimes behaves weirdly and often fails outright on this test in debian:bullseye (which is what the test suite runs under if run from the Makefile)
|
||||
//
|
||||
// Why in a container? Because `mount` sometimes behaves weirdly and often
|
||||
// fails outright on this test in debian:jessie (which is what the test suite
|
||||
// runs under if run from the Makefile at the time this patch was added).
|
||||
cli.DockerCmd(c, "run", "--rm", "-v", testDir+":/test", "busybox", "sh", "-c", "dd of=/test/testfs.img bs=1M seek=3 count=0")
|
||||
icmd.RunCommand("mkfs.ext4", "-F", filepath.Join(testDir, "testfs.img")).Assert(c, icmd.Success)
|
||||
|
||||
|
|
@ -1671,7 +1674,7 @@ func (s *DockerDaemonSuite) TestDaemonNoSpaceLeftOnDeviceError(c *testing.T) {
|
|||
defer s.d.Stop(c)
|
||||
|
||||
// pull a repository large enough to overfill the mounted filesystem
|
||||
pullOut, err := s.d.Cmd("pull", "debian:bullseye-slim")
|
||||
pullOut, err := s.d.Cmd("pull", "debian:bookworm-slim")
|
||||
assert.Check(c, err != nil)
|
||||
assert.Check(c, is.Contains(pullOut, "no space left on device"))
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1580,7 +1580,7 @@ func (s *DockerCLINetworkSuite) TestEmbeddedDNSInvalidInput(c *testing.T) {
|
|||
cli.DockerCmd(c, "network", "create", "-d", "bridge", "nw1")
|
||||
|
||||
// Sending garbage to embedded DNS shouldn't crash the daemon
|
||||
cli.DockerCmd(c, "run", "-i", "--net=nw1", "--name=c1", "debian:bullseye-slim", "bash", "-c", "echo InvalidQuery > /dev/udp/127.0.0.11/53")
|
||||
cli.DockerCmd(c, "run", "-i", "--net=nw1", "--name=c1", "debian:bookworm-slim", "bash", "-c", "echo InvalidQuery > /dev/udp/127.0.0.11/53")
|
||||
}
|
||||
|
||||
func (s *DockerCLINetworkSuite) TestDockerNetworkConnectFailsNoInspectChange(c *testing.T) {
|
||||
|
|
|
|||
|
|
@ -2895,7 +2895,7 @@ func (s *DockerCLIRunSuite) TestRunUnshareProc(c *testing.T) {
|
|||
|
||||
go func() {
|
||||
name := "acidburn"
|
||||
out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:bullseye-slim", "unshare", "-p", "-m", "-f", "-r", "--mount-proc=/proc", "mount")
|
||||
out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:bookworm-slim", "unshare", "-p", "-m", "-f", "-r", "--mount-proc=/proc", "mount")
|
||||
if err == nil ||
|
||||
!(strings.Contains(strings.ToLower(out), "permission denied") ||
|
||||
strings.Contains(strings.ToLower(out), "operation not permitted")) {
|
||||
|
|
@ -2907,7 +2907,7 @@ func (s *DockerCLIRunSuite) TestRunUnshareProc(c *testing.T) {
|
|||
|
||||
go func() {
|
||||
name := "cereal"
|
||||
out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:bullseye-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
|
||||
out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:bookworm-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
|
||||
if err == nil ||
|
||||
!(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
|
||||
strings.Contains(strings.ToLower(out), "permission denied") ||
|
||||
|
|
@ -2921,7 +2921,7 @@ func (s *DockerCLIRunSuite) TestRunUnshareProc(c *testing.T) {
|
|||
/* Ensure still fails if running privileged with the default policy */
|
||||
go func() {
|
||||
name := "crashoverride"
|
||||
out, _, err := dockerCmdWithError("run", "--privileged", "--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=docker-default", "--name", name, "debian:bullseye-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
|
||||
out, _, err := dockerCmdWithError("run", "--privileged", "--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=docker-default", "--name", name, "debian:bookworm-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
|
||||
if err == nil ||
|
||||
!(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
|
||||
strings.Contains(strings.ToLower(out), "permission denied") ||
|
||||
|
|
|
|||
|
|
@ -846,12 +846,12 @@ func (s *DockerCLIRunSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
|
|||
assert.Assert(c, strings.Contains(out, option))
|
||||
}
|
||||
|
||||
// We use debian:bullseye-slim as there is no findmnt in busybox. Also the output will be in the format of
|
||||
// We use debian:bookworm-slim as there is no findmnt in busybox. Also the output will be in the format of
|
||||
// TARGET PROPAGATION
|
||||
// /tmp shared
|
||||
// so we only capture `shared` here.
|
||||
expectedOptions = []string{"shared"}
|
||||
out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:bullseye-slim", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp").Combined()
|
||||
out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:bookworm-slim", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp").Combined()
|
||||
for _, option := range expectedOptions {
|
||||
assert.Assert(c, strings.Contains(out, option))
|
||||
}
|
||||
|
|
@ -887,7 +887,7 @@ func (s *DockerCLIRunSuite) TestRunSysctls(c *testing.T) {
|
|||
})
|
||||
}
|
||||
|
||||
// TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:bullseye-slim unshare' exits with operation not permitted.
|
||||
// TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:bookworm-slim unshare' exits with operation not permitted.
|
||||
func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
||||
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, Apparmor)
|
||||
const jsonData = `{
|
||||
|
|
@ -910,7 +910,7 @@ func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
|||
}
|
||||
icmd.RunCommand(dockerBinary, "run", "--security-opt", "apparmor=unconfined",
|
||||
"--security-opt", "seccomp="+tmpFile.Name(),
|
||||
"debian:bullseye-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc").Assert(c, icmd.Expected{
|
||||
"debian:bookworm-slim", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc").Assert(c, icmd.Expected{
|
||||
ExitCode: 1,
|
||||
Err: "Operation not permitted",
|
||||
})
|
||||
|
|
@ -950,7 +950,7 @@ func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
|
|||
})
|
||||
}
|
||||
|
||||
// TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:bullseye-slim unshare --map-root-user --user sh -c whoami' with a specific profile to
|
||||
// TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:bookworm-slim unshare --map-root-user --user sh -c whoami' with a specific profile to
|
||||
// deny unshare of a userns exits with operation not permitted.
|
||||
func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T) {
|
||||
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, Apparmor)
|
||||
|
|
@ -982,7 +982,7 @@ func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T)
|
|||
}
|
||||
icmd.RunCommand(dockerBinary, "run",
|
||||
"--security-opt", "apparmor=unconfined", "--security-opt", "seccomp="+tmpFile.Name(),
|
||||
"debian:bullseye-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami").Assert(c, icmd.Expected{
|
||||
"debian:bookworm-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami").Assert(c, icmd.Expected{
|
||||
ExitCode: 1,
|
||||
Err: "Operation not permitted",
|
||||
})
|
||||
|
|
@ -1034,12 +1034,12 @@ func (s *DockerCLIRunSuite) TestRunSeccompProfileAllow32Bit(c *testing.T) {
|
|||
icmd.RunCommand(dockerBinary, "run", "syscall-test", "exit32-test").Assert(c, icmd.Success)
|
||||
}
|
||||
|
||||
// TestRunSeccompAllowSetrlimit checks that 'docker run debian:bullseye-slim ulimit -v 1048510' succeeds.
|
||||
// TestRunSeccompAllowSetrlimit checks that 'docker run debian:bookworm-slim ulimit -v 1048510' succeeds.
|
||||
func (s *DockerCLIRunSuite) TestRunSeccompAllowSetrlimit(c *testing.T) {
|
||||
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
||||
|
||||
// ulimit uses setrlimit, so we want to make sure we don't break it
|
||||
icmd.RunCommand(dockerBinary, "run", "debian:bullseye-slim", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success)
|
||||
icmd.RunCommand(dockerBinary, "run", "debian:bookworm-slim", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success)
|
||||
}
|
||||
|
||||
func (s *DockerCLIRunSuite) TestRunSeccompDefaultProfileAcct(c *testing.T) {
|
||||
|
|
@ -1335,7 +1335,7 @@ func (s *DockerCLIRunSuite) TestRunApparmorProcDirectory(c *testing.T) {
|
|||
func (s *DockerCLIRunSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
|
||||
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
||||
|
||||
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:bullseye-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
|
||||
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:bookworm-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
|
||||
assert.ErrorContains(c, err, "", out)
|
||||
assert.Equal(c, strings.TrimSpace(out), "unshare: unshare failed: Operation not permitted")
|
||||
}
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ func ensureSyscallTest(ctx context.Context, c *testing.T) {
|
|||
|
||||
dockerFile := filepath.Join(tmp, "Dockerfile")
|
||||
content := []byte(`
|
||||
FROM debian:bullseye-slim
|
||||
FROM debian:bookworm-slim
|
||||
COPY . /usr/bin/
|
||||
`)
|
||||
err = os.WriteFile(dockerFile, content, 0o600)
|
||||
|
|
@ -66,7 +66,7 @@ func ensureSyscallTest(ctx context.Context, c *testing.T) {
|
|||
}
|
||||
|
||||
func ensureSyscallTestBuild(ctx context.Context, c *testing.T) {
|
||||
err := load.FrozenImagesLinux(ctx, testEnv.APIClient(), "debian:bullseye-slim")
|
||||
err := load.FrozenImagesLinux(ctx, testEnv.APIClient(), "debian:bookworm-slim")
|
||||
assert.NilError(c, err)
|
||||
|
||||
var buildArgs []string
|
||||
|
|
@ -104,7 +104,7 @@ func ensureNNPTest(ctx context.Context, c *testing.T) {
|
|||
|
||||
dockerfile := filepath.Join(tmp, "Dockerfile")
|
||||
content := `
|
||||
FROM debian:bullseye-slim
|
||||
FROM debian:bookworm-slim
|
||||
COPY . /usr/bin
|
||||
RUN chmod +s /usr/bin/nnp-test
|
||||
`
|
||||
|
|
@ -121,7 +121,7 @@ func ensureNNPTest(ctx context.Context, c *testing.T) {
|
|||
}
|
||||
|
||||
func ensureNNPTestBuild(ctx context.Context, c *testing.T) {
|
||||
err := load.FrozenImagesLinux(ctx, testEnv.APIClient(), "debian:bullseye-slim")
|
||||
err := load.FrozenImagesLinux(ctx, testEnv.APIClient(), "debian:bookworm-slim")
|
||||
assert.NilError(c, err)
|
||||
|
||||
var buildArgs []string
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ func TestBuildUserNamespaceValidateCapabilitiesAreV2(t *testing.T) {
|
|||
clientUserRemap := dUserRemap.NewClientT(t)
|
||||
defer clientUserRemap.Close()
|
||||
|
||||
err = load.FrozenImagesLinux(ctx, clientUserRemap, "debian:bullseye-slim")
|
||||
err = load.FrozenImagesLinux(ctx, clientUserRemap, "debian:bookworm-slim")
|
||||
assert.NilError(t, err)
|
||||
|
||||
dUserRemapRunning := true
|
||||
|
|
@ -56,7 +56,7 @@ func TestBuildUserNamespaceValidateCapabilitiesAreV2(t *testing.T) {
|
|||
}()
|
||||
|
||||
dockerfile := `
|
||||
FROM debian:bullseye-slim
|
||||
FROM debian:bookworm-slim
|
||||
RUN apt-get update && apt-get install -y libcap2-bin --no-install-recommends
|
||||
RUN setcap CAP_NET_BIND_SERVICE=+eip /bin/sleep
|
||||
`
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ import (
|
|||
"gotest.tools/v3/assert"
|
||||
)
|
||||
|
||||
var frozenImages = []string{"busybox:latest", "busybox:glibc", "hello-world:frozen", "debian:bullseye-slim"}
|
||||
var frozenImages = []string{"busybox:latest", "busybox:glibc", "hello-world:frozen", "debian:bookworm-slim"}
|
||||
|
||||
type protectedElements struct {
|
||||
containers map[string]struct{}
|
||||
|
|
|
|||
Loading…
Reference in a new issue