cli: remove cli/config package, integrate into cmd/dockerd

The configDir (and "DOCKER_CONFIG" environment variable) is now only used
for the default location for TLS certificates to secure the daemon API.
It is a leftover from when the "docker" and "dockerd" CLI shared the same
binary, allowing the DOCKER_CONFIG environment variable to set the location
for certificates to be used by both.

This patch merges it into cmd/dockerd, which is where it was used.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

cli/config/configdir.go

@@ -1,27 +0,0 @@
-package config // import "github.com/docker/docker/cli/config"
-
-import (
-	"os"
-	"path/filepath"
-
-	"github.com/docker/docker/pkg/homedir"
-)
-
-var (
-	configDir     = os.Getenv("DOCKER_CONFIG")
-	configFileDir = ".docker"
-)
-
-// Dir returns the path to the configuration directory as specified by the DOCKER_CONFIG environment variable.
-// If DOCKER_CONFIG is unset, Dir returns ~/.docker .
-// Dir ignores XDG_CONFIG_HOME (same as the docker client).
-// TODO: this was copied from cli/config/configfile and should be removed once cmd/dockerd moves
-func Dir() string {
-	return configDir
-}
-
-func init() {
-	if configDir == "" {
-		configDir = filepath.Join(homedir.Get(), configFileDir)
-	}
-}

cmd/dockerd/options.go

@@ -4,9 +4,9 @@ import (
 	"os"
 	"path/filepath"
 
-	cliconfig "github.com/docker/docker/cli/config"
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/opts"
+	"github.com/docker/docker/pkg/homedir"
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/spf13/pflag"
 )
@@ -27,6 +27,40 @@ const (
 )
 
 var (
+	// The configDir (and "DOCKER_CONFIG" environment variable) is now only used
+	// for the default location for TLS certificates to secure the daemon API.
+	// It is a leftover from when the "docker" and "dockerd" CLI shared the
+	// same binary, allowing the DOCKER_CONFIG environment variable to set
+	// the location for certificates to be used by both.
+	//
+	// We need to change this, as there's various issues:
+	//
+	//   - DOCKER_CONFIG only affects TLS certificates, but does not change the
+	//     location for the actual *daemon configuration* (which defaults to
+	//     "/etc/docker/daemon.json").
+	//   - If no value is set, configDir uses "~/.docker/" as default, but does
+	//     not take $XDG_CONFIG_HOME into account (it uses pkg/homedir.Get, which
+	//     is not XDG_CONFIG_HOME-aware).
+	//   - Using the home directory can be problematic in cases where the CLI and
+	//     daemon actually live on the same host; if DOCKER_CONFIG is set to set
+	//     the "docker" CLI configuration path (and if the daemon shares that
+	//     environment variable, e.g. "sudo -E dockerd"), the daemon may create
+	//     the "~/.docker/" directory, but now the directory may be owned by "root".
+	//
+	// We should:
+	//
+	//   - deprecate DOCKER_CONFIG for the daemon
+	//   - decide where the TLS certs should live by default ("/etc/docker/"?)
+	//   - look at "when" (and when _not_) XDG_CONFIG_HOME should be used. Its
+	//     needed for rootless, but perhaps could be used for non-rootless(?)
+	//   - When changing  the location for TLS config, (ideally) they should
+	//     live in a directory separate from "non-sensitive" (configuration-)
+	//     files, so that general configuration can be shared (dotfiles repo
+	//     etc) separate from "sensitive" config (TLS certificates).
+	//
+	// TODO(thaJeztah): deprecate DOCKER_CONFIG and re-design daemon config locations. See https://github.com/moby/moby/issues/44640
+	configDir       = os.Getenv("DOCKER_CONFIG")
+	configFileDir   = ".docker"
 	dockerCertPath  = os.Getenv("DOCKER_CERT_PATH")
 	dockerTLSVerify = os.Getenv("DOCKER_TLS_VERIFY") != ""
 )
@@ -44,6 +78,16 @@ type daemonOptions struct {
 	Validate     bool
 }
 
+// defaultCertPath uses $DOCKER_CONFIG or ~/.docker, and does not look up
+// $XDG_CONFIG_HOME. See the comment on configDir above for further details.
+func defaultCertPath() string {
+	if configDir == "" {
+		// Set the default path if DOCKER_CONFIG is not set.
+		configDir = filepath.Join(homedir.Get(), configFileDir)
+	}
+	return configDir
+}
+
 // newDaemonOptions returns a new daemonFlags
 func newDaemonOptions(config *config.Config) *daemonOptions {
 	return &daemonOptions{
@@ -54,9 +98,7 @@ func newDaemonOptions(config *config.Config) *daemonOptions {
 // installFlags adds flags for the common options on the FlagSet
 func (o *daemonOptions) installFlags(flags *pflag.FlagSet) {
 	if dockerCertPath == "" {
-		// cliconfig.Dir returns $DOCKER_CONFIG or ~/.docker.
+		dockerCertPath = defaultCertPath()
-		// cliconfig.Dir does not look up $XDG_CONFIG_HOME
-		dockerCertPath = cliconfig.Dir()
 	}
 
 	flags.BoolVarP(&o.Debug, "debug", "D", false, "Enable debug mode")
@@ -65,6 +107,7 @@ func (o *daemonOptions) installFlags(flags *pflag.FlagSet) {
 	flags.BoolVar(&o.TLS, FlagTLS, DefaultTLSValue, "Use TLS; implied by --tlsverify")
 	flags.BoolVar(&o.TLSVerify, FlagTLSVerify, dockerTLSVerify || DefaultTLSValue, "Use TLS and verify the remote")
 
+	// TODO(thaJeztah): set default TLSOptions in config.New()
 	o.TLSOptions = &tlsconfig.Options{}
 	tlsOptions := o.TLSOptions
 	flags.StringVar(&tlsOptions.CAFile, "tlscacert", filepath.Join(dockerCertPath, DefaultCaFile), "Trust certs signed only by this CA")

cmd/dockerd/options_test.go

@@ -4,7 +4,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	cliconfig "github.com/docker/docker/cli/config"
 	"github.com/docker/docker/daemon/config"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
@@ -27,10 +26,6 @@ func TestCommonOptionsInstallFlags(t *testing.T) {
 	assert.Check(t, is.Equal(opts.TLSOptions.KeyFile, "/foo/key"))
 }
 
-func defaultPath(filename string) string {
-	return filepath.Join(cliconfig.Dir(), filename)
-}
-
 func TestCommonOptionsInstallFlagsWithDefaults(t *testing.T) {
 	flags := pflag.NewFlagSet("testing", pflag.ContinueOnError)
 	opts := newDaemonOptions(&config.Config{})
@@ -38,7 +33,7 @@ func TestCommonOptionsInstallFlagsWithDefaults(t *testing.T) {
 
 	err := flags.Parse([]string{})
 	assert.Check(t, err)
-	assert.Check(t, is.Equal(defaultPath("ca.pem"), opts.TLSOptions.CAFile))
+	assert.Check(t, is.Equal(filepath.Join(defaultCertPath(), "ca.pem"), opts.TLSOptions.CAFile))
-	assert.Check(t, is.Equal(defaultPath("cert.pem"), opts.TLSOptions.CertFile))
+	assert.Check(t, is.Equal(filepath.Join(defaultCertPath(), "cert.pem"), opts.TLSOptions.CertFile))
-	assert.Check(t, is.Equal(defaultPath("key.pem"), opts.TLSOptions.KeyFile))
+	assert.Check(t, is.Equal(filepath.Join(defaultCertPath(), "key.pem"), opts.TLSOptions.KeyFile))
 }