Commit graph

20960 commits

Author SHA1 Message Date
Justin Cormack
6c3ea7a511 Block vm86 syscalls in default seccomp profile
These provide an in kernel virtual machine for x86 real mode on x86
used by one very early DOS emulator. Not required for any normal use.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 15:47:23 +00:00
Justin Cormack
6300a08be9 Block stime in default seccomp profile
The stime syscall is a legacy syscall on some architectures
to set the clock, should be blocked as time is not namespaced.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 15:28:05 +00:00
Doug Davis
b3e1178ad0 Fix error messages
`docker kill 123` will show something like:
`Error response from daemon: Cannot kill container 123: nosuchcontainer: No such container: 123`
Notice the `nosuchcontainer` text, that should not be there as that's an internal ID that means nothing to the end user.
This PR fixes this by using `util.GetErrorMessage()` to extract just the message.

While in that dir I found a couple of other spots that could use the same call, just to be safe.

Signed-off-by: Doug Davis <dug@us.ibm.com>
2015-12-29 06:08:52 -08:00
Justin Cormack
0e5c43cdda Block clock_adjtime in default seccomp config
clock_adjtime is the new posix style version of adjtime allowing
a specific clock to be specified. Time is not namespaced, so do
not allow.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 12:48:16 +00:00
Justin Cormack
0d5306a0b6 Deny finit_module in default seccomp profile
This is a new version of init_module that takes a file descriptor
rather than a file name.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 12:31:33 +00:00
Justin Cormack
9be0d93cf7 Block original umount syscall in default seccomp filter
The original umount syscall without flags argument needs to
be blocked too.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 11:57:16 +00:00
Vincent Demeester
eb551baf6f Merge pull request #18951 from jfrazelle/fix-code-comment
fix code comment
2015-12-29 12:00:37 +01:00
Justin Cormack
7b133e7235 Allow use of robust list syscalls
The set_robust_list syscall sets the list of futexes which are
cleaned up on thread exit, and are needed to avoid mutexes
being held forever on thread exit.

See for example in Musl libc mutex handling:
http://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_mutex_trylock.c#n22

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 10:22:05 +00:00
Lei Jitang
82051ab996 Add DOCKER_BUILD_ARGS env to pass build-arg for building deb and rpm
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2015-12-29 04:09:44 -05:00
Jessica Frazelle
b4c14a0bb8
fix code comment
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 22:36:54 -08:00
Huanzhong Zhang
85e355605a print the registry name.
Signed-off-by: Huanzhong Zhang <zhanghuanzhong90@gmail.com>
2015-12-29 13:33:04 +08:00
Jessica Frazelle
ae54e39c80
fix libseccomp where version < 2.2.1
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 21:30:49 -08:00
Jessica Frazelle
94b45310f4
fix default profile where unsupported
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 20:42:15 -08:00
David Calavera
78ce43bad8 Merge pull request #18780 from jfrazelle/seccomp-default
set default seccomp profile
2015-12-28 16:46:30 -08:00
Sebastiaan van Stijn
a3ca176e3c Merge pull request #18945 from jbruni/patch-2
Fixed /etc/defaults/docker to /etc/default/docker
2015-12-29 00:05:45 +01:00
J Bruni
153948ac46 Fixed /etc/defaults/docker to /etc/default/docker
/etc/default/docker is the correct file location in my system, and also according Docker's own documentation at https://github.com/docker/docker/blob/master/docs/articles/configuring.md#configuring-docker

Signed-off-by: J Bruni <contato@jbruni.com.br>
2015-12-28 20:57:36 -02:00
Vincent Demeester
6cd167386b Merge pull request #18835 from dnephin/move_validate_context_dir
Move utils.ValidateContextDirectory to the one package that uses it
2015-12-28 22:06:13 +01:00
Sebastiaan van Stijn
8c6ad0991e Merge pull request #18899 from cpswan/18898-fix-storage-driver-example
Fix --storage-driver example
2015-12-28 21:58:43 +01:00
Jess Frazelle
8b68853ef5 Merge pull request #18937 from cbalducci/patch-1
[mkimage-alpine.sh] Additional repo and container cleanup
2015-12-28 12:51:31 -08:00
David Calavera
1d4306d2fa Merge pull request #18905 from coolljt0725/fix_disconnect_not_save
Fix network disconnect does not save the config to disk
2015-12-28 12:38:16 -08:00
David Calavera
b6a251a551 Merge pull request #18942 from thaJeztah/move-vish-to-alumni
Move Vishnu to alumni
2015-12-28 12:31:18 -08:00
Arnaud Porterie
baee7ae045 Merge pull request #18715 from calavera/remove_is_paused_from_interface
Remove `IsPaused` from backend interface.
2015-12-28 11:25:11 -08:00
Jess Frazelle
38440cadf3 Merge pull request #18897 from runcom/fix-net-none-build
integration-cli: fix --net=none build
2015-12-28 10:51:18 -08:00
Jessica Frazelle
d34bbb66d5
bump docker-py
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:26:52 -08:00
Jessica Frazelle
15674c5fb7
add docs and unconfined to run a container without the default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:26:51 -08:00
Jessica Frazelle
a48fe62384
add default seccomp profile tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:26:48 -08:00
Jessica Frazelle
947293a280
set default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:18:47 -08:00
Jess Frazelle
00362f8ea2 Merge pull request #18923 from albers/completion-network-ls--filter
bash completion for `docker network ls --filter`
2015-12-28 10:16:17 -08:00
Daniel Nephin
91154e9235 Move graph driver registration out of the daemon package.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2015-12-28 13:02:24 -05:00
Daniel Nephin
f5916b10ae Remove the graph driver from the daemon, move it into the layer store.
Support restoreCustomImage for windows with a new interface to extract
the graph driver from the LayerStore.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2015-12-28 12:55:48 -05:00
Vincent Demeester
ad56c972b4 Merge pull request #18939 from dnephin/dont_use_parse_from_builder
Remove the need for runconfig.Parse() in the builder
2015-12-28 18:47:05 +01:00
Jess Frazelle
206046f0ba Merge pull request #18807 from FlorinAsavoaie/master
New features in mkimage-yum.sh script
2015-12-28 09:09:33 -08:00
David Calavera
8669ea01ba Merge pull request #15078 from hqhq/hq_add_set_api_v2
Implement docker update command
2015-12-28 08:55:32 -08:00
Daniel Nephin
9e19b4839f Move ValidateContextDirectory to the one package that uses it.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2015-12-28 11:22:39 -05:00
Sebastiaan van Stijn
5facd0e94b Move Vishnu to alumni
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2015-12-28 16:30:05 +01:00
cristiano balducci
7fa40ef513 Additional repo and container cleanup
- Added support for adding custom repo (defaults to community)
- Added cleanup of the test container (--rm)
- Added --text to grep in apkv() to avoid "Binary file matches" output on Fedora

Signed-off-by: Cristiano Balducci <cristiano.balducci@gmail.com>
2015-12-28 14:11:56 +01:00
Qiang Huang
8799c4fc0f Implemet docker update command
It's used for updating properties of one or more containers, we only
support resource configs for now. It can be extended in the future.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
2015-12-28 19:19:26 +08:00
Daniel Nephin
6dba0b5d89 Remove the need for runconfig.Parse() in the builder.
By using a container.Config directly.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2015-12-27 19:58:51 -05:00
Sebastiaan van Stijn
849f64eeab Be more explicit about "+1" comments
Add some more information about not leaving random
"+1" comments.

Also removed the requirements to send "uname -a",
because that information is now included in the output
of "docker version".

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2015-12-28 00:26:05 +01:00
Harald Albers
f2ba1e4d80 bash completion for docker network ls --filter
Signed-off-by: Harald Albers <github@albersweb.de>
2015-12-27 09:28:19 -08:00
Arnaud Porterie
603d488a00 Merge pull request #18907 from mountkin/rm
ingnore the NotExist error when removing inexistent files
2015-12-26 19:20:10 -08:00
Sebastiaan van Stijn
087e4c1024 Merge pull request #18782 from aditirajagopal/docker-no-like-x86
Specify that Docker requires x64
2015-12-27 01:19:38 +01:00
Aditi Rajagopal
8134a562c6 Specify that Docker requires x64
Adds this requirement to docker/docker. Already replicated in docker/tutorials

Resolves: #18401

Signed-off-by: Aditi Rajagopal <arajagopal@us.ibm.com>
2015-12-26 19:02:20 -05:00
Sebastiaan van Stijn
d4270c1764 Merge pull request #18775 from mrjana/mh
libnetwork vendoring
2015-12-26 11:42:55 +01:00
Shijiang Wei
de7f6cf16b ingnore the NotExist error when removing inexistent files
Signed-off-by: Shijiang Wei <mountkin@gmail.com>
2015-12-25 15:19:48 +08:00
Lei Jitang
c0bde4e92c Fix network disconnect does not save the config to disk
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2015-12-25 02:09:37 -05:00
Jess Frazelle
d1b7d58e73 Merge pull request #18900 from icecrime/dirty_to_unsupported
Rename `-dirty` to `-unsupported`
2015-12-24 11:06:25 -07:00
Arnaud Porterie
3e298c5928 Rename -dirty to -unsupported
Nightly and unofficial builds of Docker bear the suffix `-dirty` in the
version string. Change this suffix to `-unsupported` to make it explicit
that no support will be provided on such versions, and that it is for
example unnecessary to file an issue for it.

Signed-off-by: Arnaud Porterie <arnaud.porterie@docker.com>
2015-12-24 09:11:49 -08:00
Chris Swan
5eef38d364 Fix --storage-driver example (and --graph)
Signed-off-by: Chris Swan <chris.swan@iee.org>
2015-12-24 17:02:58 +00:00
Chris Swan
b6be4acfcc Fix --storage-driver example
Signed-off-by: Chris Swan <chris.swan@iee.org>
2015-12-24 16:43:37 +00:00