Commit graph

43794 commits

Author SHA1 Message Date
Sebastiaan van Stijn
2bc07370ec
daemon/graphdriver: remove unused graphdriver.IsInitialized()
It's no longer used, and has no external consumers.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-07 16:21:31 +02:00
Sebastiaan van Stijn
d570bc4922
remove deprecated support for overlay(2) on backing FS without d_type (fstype=1)
Support for overlay on a backing filesystem without d_type was deprecated in
0abb8dec3f (Docker 17.12), with an exception
for existing installations (0a4e793a3d).

That deprecation was nearly 5 years ago, and running without d_type is known to
cause serious issues (so users will likely already have run into other problems).

This patch removes support for running overlay and overlay2 on these filesystems,
returning the error instead of logging it.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-07 16:15:26 +02:00
Sebastiaan van Stijn
a461373146
Merge pull request #43453 from thaJeztah/bump_buildx_0.8.2
Makefile: update buildx to v0.8.2
2022-04-07 10:45:57 +02:00
Sebastiaan van Stijn
39e52b0b6d
Merge pull request #43467 from thaJeztah/jenkinsfile_enable_all_s390_and_power
Jenkinsfile: allow all ppc64le / s390x stages through checkbox
2022-04-06 22:13:27 +02:00
Sebastiaan van Stijn
87948c7892
Jenkinsfile: allow all ppc64le / s390x stages through checkbox
Previously, the ppc64ls and s390x stages only ran on non-PR commits,
but the unit-tests and integration/xx tests could be enabled with
a checkbox.

This patch changes the Jenkinsfile to also allow the integration-cli
tests to be run on pull requests if the checkbox is enabled.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-06 15:40:47 +02:00
Akihiro Suda
7691d17a37
Merge pull request #43455 from thaJeztah/daemon_add_experimental_note
cmd/dockerd: update --ip6tables description to include "experimental"
2022-04-05 12:13:20 +09:00
Akihiro Suda
f1b52b5c1a
Merge pull request #43462 from thaJeztah/carry_43155_update_authors
Updated AUTHORS and .mailmap files
2022-04-05 12:12:42 +09:00
Gabriel Goller
2ff043c9fe
Updated AUTHORS and .mailmap files
Updated the list of AUTHORS using the generate-authors.sh script.

Also updating the .mailmap file to prevent some duplicates, and
to include some updates from containerd, which had a more up-to-date
list of author's preferred e-mail addresses.

Signed-off-by: Gabriel Goller <gabrielgoller123@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-04 20:33:51 +02:00
Sebastiaan van Stijn
846af8e413
cmd/dockerd: update --ip6tables description to include "experimental"
This feature requires experimental mode to be enabled, so mentioning that
in the flag description.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-04 11:54:01 +02:00
Sebastiaan van Stijn
ae7d3efafd
Makefile: update buildx to v0.8.2
release notes: https://github.com/docker/buildx/releases/tag/v0.8.2

Notable changes:

- Update Compose spec used by buildx bake to v1.2.1 to fix parsing ports definition
- Fix possible crash on handling progress streams from BuildKit v0.10
- Fix parsing groups in buildx bake when already loaded by a parent group

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-04-04 11:03:52 +02:00
Tianon Gravi
83970db5ef
Merge pull request #43445 from AkihiroSuda/runc-1.1.1
update runc to v1.1.1
2022-04-01 16:04:46 -07:00
Sebastiaan van Stijn
99b2894e17
Merge pull request #43434 from tonistiigi/amd64-variant-support
distribution: fix matching amd64 variants
2022-04-02 00:12:33 +02:00
Akihiro Suda
ffc903d7a6
update runc binary to v1.1.1
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-04-01 15:24:13 +09:00
Akihiro Suda
69993c1c57
vendor: github.com/opencontainers/runc v1.1.1
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-04-01 15:23:46 +09:00
Tonis Tiigi
482d1d15bf distribution: use the maximum compatible platform by default
When no specific platform is set, pull the platform that
most matches the current host.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2022-03-31 15:20:59 -07:00
Sebastiaan van Stijn
a6005ef380
Merge pull request #43368 from TBBle/generalised-Windows-device-syntax
Introduce `://` syntax for Windows Devices in DeviceMapping.PathOnHost
2022-03-31 22:34:12 +02:00
Tonis Tiigi
fcc42d5682 distribution: use correct platform matcher for containerd
This uses the correct comparison with compatibility
checks for variants.

The deprecated arm variant matcher is left as is.
Although it is not needed for valid cases it is not
fully compatible as also matches some invalid
combinations, so should be removed separately.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2022-03-27 19:46:45 -07:00
Sebastiaan van Stijn
88e1fec490
Merge pull request #43432 from crazy-max/fix-buildkit-tests
vendor: github.com/moby/buildkit d7744bc
2022-03-27 14:34:09 +02:00
CrazyMax
d74bf97f40
vendor: github.com/moby/buildkit d7744bc
full diff: 8d45bd6...d7744bc

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-27 13:07:05 +02:00
Paul "TBBle" Hampson
064650dd09 Pass TestPsListContainersFilterCreated if other created containers exist
The test was dependent on its container being _first_ in the response,
but anywhere on the line should be fine.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
31e1fec950 Suport vpci-class-guid in the non-containerd backend
IDType `vpci-class-guid` is a synonym of `class`.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
cb07afa3cc Implement :// separator for arbitrary Windows Device IDTypes
Arbitrary here does not include '', best to catch that one early as it's
almost certainly a mistake (possibly an attempt to pass a POSIX path
through this API)

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:47 +11:00
Paul "TBBle" Hampson
92f13bad88 Allow Windows Devices to be activated for HyperV Isolation
If not using the containerd backend, this will still fail, but later.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:26:41 +11:00
Paul "TBBle" Hampson
c60f70f112 Break out setupWindowsDevices and add tests
Since this function is about to get more complicated, and change
behaviour, this establishes tests for the existing implementation.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2022-03-27 13:23:48 +11:00
Sebastiaan van Stijn
8941dcfcc5
Merge pull request #43428 from thaJeztah/prevent_rootlesskit_dependency_in_cli
registry: remove dependency on rootlesskit, add `SetCertsDir()`
2022-03-26 18:11:51 +01:00
Sebastiaan van Stijn
1ad9a09af8
Merge pull request #43369 from sestegra/stop
Allow STOPSIGNAL instruction in commit change
2022-03-26 14:40:32 +01:00
Sebastiaan van Stijn
aaf70b5c6b
Merge pull request #42064 from thaJeztah/swarm_ping
API: add "Swarm" header to _ping endpoint
2022-03-26 14:39:50 +01:00
Sebastiaan van Stijn
070726194d
Merge pull request #43427 from AkihiroSuda/rootlesskit-1.0.0
update RootlessKit to v1.0.0
2022-03-26 00:14:18 +01:00
Sebastiaan van Stijn
1e645fb70f
client: Ping(): add handling for swarm status headers
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 23:57:58 +01:00
Sebastiaan van Stijn
adf4bf772d
API: add "Swarm" header to _ping endpoint
This adds an additional "Swarm" header to the _ping endpoint response,
which allows a client to detect if Swarm is enabled on the daemon, without
having to call additional endpoints.

This change is not versioned in the API, and will be returned irregardless
of the API version that is used. Clients should fall back to using other
endpoints to get this information if the header is not present.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 23:54:14 +01:00
Sebastiaan van Stijn
0729fbd343
Merge pull request #43378 from thaJeztah/deprecate_storage_drivers
daemon: require storage-driver to be set if the driver is deprecated
2022-03-25 20:33:23 +01:00
Sebastiaan van Stijn
ffd5d2665d
Merge pull request #43379 from evol262/overlay2-fix-deadlock
libnetwork/overlay:fix sandbox deadlock
2022-03-25 19:48:00 +01:00
Akihiro Suda
4d7ab4b214
update RootlessKit to v1.0.0
Only minor changes since v0.14.6, such as upgrading Go to 1.18:
https://github.com/rootless-containers/rootlesskit/compare/v0.14.6...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-03-26 02:10:52 +09:00
Akihiro Suda
19a7875c3c
vendor: golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2022-03-26 02:10:12 +09:00
Sebastiaan van Stijn
85572cac14
registry: remove dependency on rootlesskit, add SetCertsDir()
The registry package contained code to automatically set the CertsDir() path,
based on wether or not the daemon was running in rootlessmode. In doing so,
it made use of the `pkg/rootless.RunningWithRootlessKit()` utility.

A recent change in de6732a403 added additional
functionality in the `pkg/rootless` package, introducing a dependency on
`github.com/rootless-containers/rootlesskit`. Unfortunately, the extra
dependency also made its way into the docker cli, which also uses the
registry package.

This patch introduces a new `SetCertsDir()` function, which allows
the default certs-directory to be overridden, and updates the daemon
to configure this location during startup.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 16:21:45 +01:00
Sebastiaan van Stijn
3853eb59d1
daemon: require storage-driver to be set if the driver is deprecated
Previously, we only printed a warning if a storage driver was deprecated. The
intent was to continue supporting these drivers, to allow users to migrate
to a different storage driver.

This patch changes the behavior; if the user has no storage driver specified
in the daemon configuration (so if we try to detect the previous storage
driver based on what's present in /var/lib/docker), we now produce an error,
informing the user that the storage driver is deprecated (and to be removed),
as well as instructing them to change the daemon configuration to explicitly
select the storage driver (to allow them to migrate).

This should make the deprecation more visible; this will be disruptive, but
it's better to have the failure happening *now* (while the drivers are still
there), than for users to discover the storage driver is no longer there
(which would require them to *downgrade* the daemon in order to migrate
to a different driver).

With this change, `docker info` includes a link in the warnings that:

    / # docker info
    Client:
    Context:    default
    Debug Mode: false

    Server:
    ...
    Live Restore Enabled: false

    WARNING: The overlay storage-driver is deprecated, and will be removed in a future release.
    Refer to the documentation for more information: https://docs.docker.com/go/storage-driver/

When starting the daemon without a storage driver configured explicitly, but
previous state was using a deprecated driver, the error is both logged and
printed:

    ...
    ERRO[2022-03-25T14:14:06.032014013Z] [graphdriver] prior storage driver overlay is deprecated and will be removed in a future release; update the the daemon configuration and explicitly choose this storage driver to continue using it; visit https://docs.docker.com/go/storage-driver/ for more information
    ...
    failed to start daemon: error initializing graphdriver: prior storage driver overlay is deprecated and will be removed in a future release; update the the daemon configuration and explicitly choose this storage driver to continue using it; visit https://docs.docker.com/go/storage-driver/ for more information

When starting the daemon and explicitly configuring it with a deprecated storage
driver:

    WARN[2022-03-25T14:15:59.042335412Z] [graphdriver] WARNING: the overlay storage-driver is deprecated and will be removed in a future release; visit https://docs.docker.com/go/storage-driver/ for more information

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 15:22:06 +01:00
Sebastiaan van Stijn
020fd68326
daemon: graphdriver: some minor cleanup
- use pkg/errors for errors and fix error-capitalisation
- remove one redundant call to logDeprecatedWarning() (we're already skipping
  deprecated drivers in that loop).
- rename `list` to `priorityList` for readability.
- remove redundant "skip" for the vfs storage driver, as it's already
  excluded by `scanPriorDrivers()`
- change one debug log to an "info", so that the daemon logs contain the driver
  that was configured, and include "multiple prior states found" error in the
  daemon logs, to assist in debugging failed daemon starts.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-25 15:21:14 +01:00
Sebastiaan van Stijn
0a3336fd7d
Merge pull request #43366 from corhere/finish-identitymapping-refactor
Finish refactor of UID/GID usage to a new struct
2022-03-25 14:51:05 +01:00
Sebastiaan van Stijn
4a26fdda76
Merge pull request #43334 from thaJeztah/api_swagger_inline_examples
api: swagger: use explicit definitions, use inline examples, and fix indentation.
2022-03-25 09:51:13 +01:00
Sebastiaan van Stijn
9a14f93b84
Merge pull request #43418 from thaJeztah/bump_containerd_1.6.2
update containerd binary and vendor to v1.6.2
2022-03-25 08:09:20 +01:00
Akihiro Suda
94bb5992a4
Merge pull request #43422 from rumpl/remove-os-index-comment
Remove comment that is no longer relevant
2022-03-25 13:20:08 +09:00
Djordje Lukic
7b277f62cc Remove comment that is no longer relevant
The #42511 PR removed layer store indexing by OS but this comment was left behind

Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
2022-03-24 19:04:33 +01:00
Sebastiaan van Stijn
ec221d6881
vendor: github.com/containerd/containerd v1.6.2
includes a fix for CVE-2022-24769.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-24 17:33:54 +01:00
Sebastiaan van Stijn
e69529c94a
update containerd binary to v1.6.2
The second patch release for containerd 1.6 includes a fix for
 [CVE-2022-24769](https://github.com/containerd/containerd/security/advisories/GHSA-c9cp-9c75-9v8c).

Notable Updates

- **Fix the inheritable capability defaults** ([GHSA-c9cp-9c75-9v8c](https://github.com/containerd/containerd/security/advisories/GHSA-c9cp-9c75-9v8c))

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-24 17:26:40 +01:00
Sebastiaan van Stijn
56ea5881fe
Merge pull request #43239 from crazy-max/buildkit-0.10
vendor buildkit v0.10.0
2022-03-24 17:25:38 +01:00
Sebastiaan van Stijn
d967ffbee0
Merge pull request #42638 from eliaskoromilas/host-devices
Mount (accessible) host devices in `--privileged` rootless containers
2022-03-24 11:19:57 +01:00
Brian Goff
8236be1207
Merge pull request #43398 from thaJeztah/client_error_handling
client: remove wrapResponseError()
2022-03-23 22:26:59 -07:00
Sebastiaan van Stijn
2bbc786e4c
Merge pull request from GHSA-2mm7-x5h6-5pvq
oci: inheritable capability set should be empty
2022-03-23 22:10:17 +01:00
Elias Koromilas
8c7ea316d1 Mount (accessible) host devices in --privileged rootless containers
Signed-off-by: Elias Koromilas <elias.koromilas@gmail.com>
2022-03-23 22:30:22 +02:00
CrazyMax
ff35785cfc
vendor buildkit 8d45bd6 that fixes dockerd worker integration tests
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-03-23 16:07:04 +01:00