Commit graph

38612 commits

Author SHA1 Message Date
Akihiro Suda
225d64ebf1
Merge pull request #40969 from cpuguy83/fix_flakey_log_rotate_test
Fix flakey test for log file rotate.
2020-05-20 00:24:58 +09:00
Sebastiaan van Stijn
30d75348e3
Merge pull request #40991 from cyenyxe/36583-integration-tests-no-names
Use unique names in integration tests (build, container, image)
2020-05-19 16:57:18 +02:00
Brian Goff
5ea5c02c88 Fix flakey test for log file rotate.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-05-18 10:27:53 -07:00
Cristina Yenyxe Gonzalez Garcia
0154dc7a23 Using test names instead of hardcoded ones in integration/image directory
Signed-off-by: Cristina Yenyxe Gonzalez Garcia <cristina.yenyxe@gmail.com>
2020-05-18 16:37:09 +01:00
Cristina Yenyxe Gonzalez Garcia
4cabad6bae Using test names instead of hardcoded ones in integration/container directory
Signed-off-by: Cristina Yenyxe Gonzalez Garcia <cristina.yenyxe@gmail.com>
2020-05-18 16:37:04 +01:00
Cristina Yenyxe Gonzalez Garcia
6bc112abde Fixed small documentation typo
Signed-off-by: Cristina Yenyxe Gonzalez Garcia <cristina.yenyxe@gmail.com>
2020-05-18 16:36:53 +01:00
Cristina Yenyxe Gonzalez Garcia
ebd025b63a Using test names instead of hardcoded ones in integration/build directory
Signed-off-by: Cristina Yenyxe Gonzalez Garcia <cristina.yenyxe@gmail.com>
2020-05-18 16:36:23 +01:00
Tibor Vass
327a0b4ae4
Merge pull request #40979 from thaJeztah/fix_gotestsum_install
Fix bug in gotestsum installer causing dependencies to not be downloaded
2020-05-17 10:39:29 -07:00
Sebastiaan van Stijn
aadc55c605
Dockerfile.windows: fix build of gotestsum
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-16 20:12:39 +02:00
Sebastiaan van Stijn
1d9da1b233
Fix bug in gotestsum installer causing dependencies to not be downloaded
Building gotestsum started to fail after the repository removed some
dependencies on master.

What happens is that first, we `go get` the package (with go modules disabled);

    GO111MODULE=off go get -d gotest.tools/gotestsum

Which gets the latest version from master, and fetches the dependencies used
on master. Then we checkout the version we want to install (for example `v0.3.5`)
and run go build.

However, `v0.3.5` depends on logrus, and given that we ran `go get` for `master`,
that dependency was not fetched, and build fails.

This patch modifies the installer to use go modules (alternatively we could
probably run `go get .` after checking out the `v0.3.5` version),

We need to modify all installers, as it looks like this is a standard pattern
we use, but other dependencies were not failing (yet), so this patch only
addresses the immediate failure.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-16 18:52:53 +02:00
Sebastiaan van Stijn
dd16f2f219 Merge pull request #40929 from stanislavlevin/seccomp_allow_clock_adjtime
seccomp: Whitelist `clock_adjtime`
2020-05-15 22:25:45 +02:00
Sebastiaan van Stijn
8e2e2bdb9b
Merge pull request #40867 from BurtonQin/double-lock
plugin: Add No-Lock version of resolvePluginID to fix double Rlock
2020-05-15 18:07:39 +02:00
BurtonQin
a36db14ce0 plugin: remove Rlock in resolvePluginID to fix double Rlock
Signed-off-by: BurtonQin <bobbqqin@gmail.com>
2020-05-15 09:13:37 -04:00
Sebastiaan van Stijn
8593b3db36
Merge pull request #40442 from jecepeda/docker-ps-filter-publish-fix
Fix docker ps --filter publish
2020-05-15 12:19:49 +02:00
Jaime Cepeda
f48b7d66f3
Fix filter on expose and publish
- Add tests to ensure it's working
- Rename variables for better clarification
- Fix validation test
- Remove wrong filter assertion based on publish filter
- Change port on test

Signed-off-by: Jaime Cepeda <jcepedavillamayor@gmail.com>
2020-05-15 11:12:03 +02:00
Tibor Vass
c85b2e5c30
Merge pull request #40908 from thaJeztah/bump_runtime_spec
vendor: opencontainers/runtime-spec v1.0.2
2020-05-14 22:20:47 -07:00
Tibor Vass
1e315b42e9
Merge pull request #40949 from thaJeztah/fix_TestSwarmManagerAddress_on_other_cli
Fix TestSwarmManagerAddress to not depend on "pretty" format
2020-05-14 22:18:44 -07:00
Tibor Vass
2cc328ebdd
Merge pull request #40940 from thaJeztah/bump_gorilla_mux
vendor: gorilla/mux v1.7.4
2020-05-14 21:11:47 -07:00
Tibor Vass
e85f3b5dfb
Merge pull request #40883 from thaJeztah/regroup_makefile_targets
Makefile: remove empty targets, and slight refactor
2020-05-14 16:47:23 -07:00
Sebastiaan van Stijn
5da88705cc
Merge pull request #40959 from AkihiroSuda/archive-40939
pkg/archive: escape ":" symbol in overlay lowerdir
2020-05-14 21:30:20 +02:00
Sebastiaan van Stijn
2f003f7774
Merge pull request #40930 from thaJeztah/bump_cobra
vendor: spf13/cobra v1.0.0, spf13/pflag v1.0.5
2020-05-14 21:28:51 +02:00
Akihiro Suda
4e102ab1f0
Merge pull request #40931 from AkihiroSuda/rootless-requires-slirp4netns-040
dockerd-rootless.sh: bump up slirp4netns requirement to v0.4.0
2020-05-13 12:19:16 +09:00
Brian Goff
4b03f520d3
Merge pull request #40856 from cpuguy83/reduce_allocs_on_env_repalce
Use strings.Index instead of strings.Split
2020-05-12 15:19:10 -07:00
Akihiro Suda
6a5e3547fb pkg/archive: escape ":" symbol in overlay lowerdir
lowerdir needs escaping:
https://github.com/torvalds/linux/blob/v5.4/fs/overlayfs/super.c#L835-L853

Fix #40939

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-05-12 13:28:04 +09:00
Brian Goff
a93e9eb0e9
Merge pull request #40945 from thaJeztah/fix_selinux_enotsup
SELinux: fix ENOTSUP errors not being detected when relabeling
2020-05-11 08:24:16 -07:00
Sebastiaan van Stijn
6a441845cc
Merge pull request #40948 from AkihiroSuda/rootlesskit-095
bump up rootlesskit to v0.9.5
2020-05-11 16:27:12 +02:00
Sebastiaan van Stijn
9871b6e30e
Fix TestSwarmManagerAddress to not depend on "pretty" format
This allows this test to be run on other versions of the CLI

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-11 14:07:04 +02:00
Akihiro Suda
17bb5f4b15 bump up rootlesskit to v0.9.5
Supports numeric ID in /etc/subuid and /etc/subgid .
Fix #40926

Full changes: https://github.com/rootless-containers/rootlesskit/compare/v0.9.4...v0.9.5

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-05-11 10:25:00 +09:00
Sebastiaan van Stijn
49f8a4224c
SELinux: fix ENOTSUP errors not being detected when relabeling
Commit 12c7541f1f updated the
opencontainers/selinux dependency to v1.3.1, which had a breaking
change in the errors that were returned.

Before v1.3.1, the "raw" `syscall.ENOTSUP` was returned if the
underlying filesystem did not support xattrs, but later versions
wrapped the error, which caused our detection to fail.

This patch uses `errors.Is()` to check for the underlying error.
This requires github.com/pkg/errors v0.9.1 or above (older versions
could use `errors.Cause()`, but are not compatible with "native"
wrapping of errors in Go 1.13 and up, and could potentially cause
these errors to not being detected again.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-10 17:06:44 +02:00
Sebastiaan van Stijn
5fd3496e7a
vendor: gorilla/mux v1.7.4
full diff: https://github.com/gorilla/mux/compare/v1.7.3...v1.7.4

v1.7.4 addresses a number of performance improvements, bugs, and documentation
improvements.

- Reduce allocations in (*routeRegexp).getURLQuery
- Fixed golint warnings
- fix headers regexp test case
- Fix the CORSMethodMiddleware bug with subrouters
- Remove/cleanup request context helpers
- Guess the scheme if r.URL.Scheme is unset
- Added capacity to slice creation, when capacity is known
- Modified http status codes, using constants provided by the http package
- bugfix/subrouter custom methodNotAllowed handler returning 404
- Update README (self-host logo)
- Remove TravisCI badge
- Add documentation for using mux to serve a SPA
- Simplify code
- Avoid unnecessary conversion
- Update config.yml (#495) @elithrar

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-09 18:35:04 +02:00
Sebastiaan van Stijn
64bc9281de
vendor: opencontainers/runtime-spec v1.0.2
full diff: 29686dbc55...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-09 14:40:29 +02:00
Tibor Vass
298ba5b131
Merge pull request #40427 from thaJeztah/prometheus_remove_experimental
Do not require "experimental" for metrics API
2020-05-08 11:10:53 -07:00
Brian Goff
4a1a65a148
Merge pull request #40928 from thaJeztah/bump_term
vendor: moby/term 73f35e472e8f0a3f91347164138ce6bd73b756a9 (and dependencies)
2020-05-08 10:31:34 -07:00
Tibor Vass
751d5f879a
Merge pull request #40646 from thaJeztah/builder_use_pkg_sys_windows
pkg/system: deprecate SetNamedSecurityInfo, GetSecurityDescriptorDacl
2020-05-08 08:21:17 -07:00
Sebastiaan van Stijn
0fc914de5c
Merge pull request #40595 from sfzhu93/GL_2_25
[integration] add buffer to prevent goroutine leak
2020-05-08 16:00:52 +02:00
Sebastiaan van Stijn
e184eac73a
Merge pull request #40380 from thaJeztah/dockerfile_improvements
Dockerfile: improve binary build stages
2020-05-08 15:00:35 +02:00
Akihiro Suda
c86abee1a4 dockerd-rootless.sh: bump up slirp4netns requirement to v0.4.0
slirp4netns v0.3.X turned out not to work with RootlessKit >= v0.7.1:
https://github.com/rootless-containers/rootlesskit/issues/143

As slirp4netns v0.3.X reached EOL on Mar 31, 2020, RootlessKit is not
going to fix support for slirp4netns v0.3.X.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-05-08 20:50:17 +09:00
Stanislav Levin
5d3a9e4319
seccomp: Whitelist clock_adjtime
This only allows making the syscall. CAP_SYS_TIME is still required
for time adjustment (enforced by the kernel):

```
kernel/time/posix-timers.c:

1112 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
1113                 struct __kernel_timex __user *, utx)
...
1121         err = do_clock_adjtime(which_clock, &ktx);

1100 int do_clock_adjtime(const clockid_t which_clock, struct __kernel_timex * ktx)
1101 {
...
1109         return kc->clock_adj(which_clock, ktx);

1299 static const struct k_clock clock_realtime = {
...
1304         .clock_adj              = posix_clock_realtime_adj,

188 static int posix_clock_realtime_adj(const clockid_t which_clock,
189                                     struct __kernel_timex *t)
190 {
191         return do_adjtimex(t);

kernel/time/timekeeping.c:

2312 int do_adjtimex(struct __kernel_timex *txc)
2313 {
...
2321         /* Validate the data before disabling interrupts */
2322         ret = timekeeping_validate_timex(txc);

2246 static int timekeeping_validate_timex(const struct __kernel_timex *txc)
2247 {
2248         if (txc->modes & ADJ_ADJTIME) {
...
2252                 if (!(txc->modes & ADJ_OFFSET_READONLY) &&
2253                     !capable(CAP_SYS_TIME))
2254                         return -EPERM;
2255         } else {
2256                 /* In order to modify anything, you gotta be super-user! */
2257                 if (txc->modes && !capable(CAP_SYS_TIME))
2258                         return -EPERM;

```

Fixes: https://github.com/moby/moby/issues/40919
Signed-off-by: Stanislav Levin <slev@altlinux.org>
2020-05-08 12:33:25 +03:00
Sebastiaan van Stijn
dc0a400738
vendor: spf13/cobra v1.0.0
full diff: https://github.com/spf13/cobra/compare/v0.0.3...v1.0.0

Notable Changes

- Fish completion (including support for Go custom completion)
- API (urgent): Rename BashCompDirectives to ShellCompDirectives
- Remove/replace SetOutput on Command - deprecated
- Custom completions coded in Go (instead of Bash)
- Partial Revert of 922
- Correct documentation for InOrStdin
- Apply formatting to templates
- Revert change so help is printed on stdout again
- Update md2man to v2.0.0
- update viper to v1.4.0
- Update cmd/root.go example in README.md

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-08 10:44:36 +02:00
Sebastiaan van Stijn
69df2589cd
vendor: spf13/pflag v1.0.5
full diff: https://github.com/spf13/pflag/compare/v1.0.1...v1.0.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-08 10:44:27 +02:00
Akihiro Suda
cdf49f37ee
Merge pull request #40672 from tiborvass/19.03.8-forwardport-to-master
vendor: add local copy of archive/tar
2020-05-08 08:11:03 +09:00
Brian Goff
75d655320e
Merge pull request #40920 from cpuguy83/log_rotate_error_handling
logfile: Check if log is closed on close error during rotate
2020-05-07 14:45:42 -07:00
Sebastiaan van Stijn
11a5b1887e
vendor: moby/term 73f35e472e8f0a3f91347164138ce6bd73b756a9
full diff: 063f2cd0b4...73f35e472e

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-07 22:37:41 +02:00
Sebastiaan van Stijn
4ac17adcd3
vendor: golang.org/x/sys 85ca7c5b95cdf1e557abb38a283d1e61a5959c31
full diff: 5c8b2ff675...85ca7c5b95

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-07 22:37:39 +02:00
Sebastiaan van Stijn
de7f0120fd
Dockerfile: mount install scripts instead of copying
These scripts are only used to build the binaries, and
the scripts themselves don't have to be persisted in an
image, so we can mount them instead of copying to the stage

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-07 21:36:37 +02:00
Sebastiaan van Stijn
d1a3a17c67
Dockerfile: remove "INSTALL_BINARY_NAME" envs
Using a variable here doesn't seem to add much, so inlining
the value instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-07 21:35:54 +02:00
Tibor Vass
daa826f9f3
Merge pull request #40891 from thaJeztah/reformat_swagger
swagger: reformat, and wrap to ~80-chars
2020-05-07 12:27:09 -07:00
Tibor Vass
452080d40b
Merge pull request #40915 from thaJeztah/update_vendor_comments
vendor.conf: add version comments
2020-05-07 12:25:41 -07:00
Sebastiaan van Stijn
b453b64d04
Merge pull request #40845 from AkihiroSuda/allow-privileged-cgroupns-private-on-cgroup-v1
support `--privileged --cgroupns=private` on cgroup v1
2020-05-07 21:11:42 +02:00
Brian Goff
47d9489e7c
Merge pull request #40907 from thaJeztah/bump_selinux
vendor: opencontainers/selinux v1.5.1
2020-05-07 11:51:08 -07:00