Sebastiaan van Stijn
af0415257e
Merge pull request #40694 from kolyshkin/moby-sys-mount-part-II
...
switch to moby/sys/{mount,mountinfo} part II
2020-04-02 21:52:21 +02:00
Akihiro Suda
3802830989
cgroup2: implement docker stats
...
The following fields are unsupported:
* BlkioStats: all fields other than IoServiceBytesRecursive
* CPUStats: CPUUsage.PercpuUsage
* MemoryStats: MaxUsage and Failcnt
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-04-02 17:51:34 +09:00
Drew Erny
1dbf34f3aa
Bump swarmkit to ebe39a32e3ed4c3a3783a02c11cccf388818694c
...
Bumps swarmkit vendoring. Includes docker/swarmkit#2938 , which fixes
tasks.db growing out of control on worker nodes.
Signed-off-by: Drew Erny <derny@mirantis.com>
2020-03-26 11:04:58 -05:00
Kir Kolyshkin
75f7e435a2
vndr: vendor in github.com/moby/sys
...
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-03-20 09:46:16 -07:00
Jintao Zhang
ea44be4b8f
vendor: bump libnetwork ef149a924dfde2e506ea3cb3f617d7d0fa96b8ee
...
fix https://github.com/moby/moby/issues/40715
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2020-03-19 17:15:58 +08:00
Sebastiaan van Stijn
e26e1cc5c1
vendor: vishvananda/netlink v1.1.0
...
- vishvananda/netlink: https://github.com/vishvananda/netlink/compare/v1.0.0...v1.1.0
- vishvananda/netns: 7109fa855b...0a2b9b5464bf2bd42abc...beab24292c
2020-03-12 22:57:23 +01:00
Sebastiaan van Stijn
1d08ccd4ff
vendor: update fsnotify v1.4.9
...
full diff: 1485a34d5d
2020-03-12 09:58:09 +01:00
Sebastiaan van Stijn
e1710b42d3
vendor: bump libnetwork bf2bd42abc0a3734f12b5ec724e571434e42c669
...
full diff: 264bffcb88...bf2bd42abcdocker/libnetwork#2407 Macvlan internal network should not change default gateway
- fixes docker/libnetwork#2406 Internal macvlan network overrides default gateway
- vendor godbus/dbus v5
- Fix InhibitIPv4 nil panic
- Cleanup VFP during overlay network removal
- fixes VFP leak in windows overlay network deletion
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-07 00:35:47 +01:00
Akihiro Suda
9a82a9a8ea
vendor containerd, BuildKit, protobuf, grpc, and golang.org/x
...
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-03-03 10:25:20 +09:00
Sebastiaan van Stijn
fa67cff34b
vendor: update opencontainers/selinux v1.3.3
...
full diff: https://github.com/opencontainers/selinux/compare/v1.3.1...v1.3.3
- go-selinux/SetKeyLabel: fix for RHEL7 kernels
- getSELinuxfs: optimize/simplify using sync.Once
- xattr: use x/sys/unix, simplify
- Use /proc/thread-self if available
- Fix EnforceMode, SetEnforceMode, and SecurityCheckContext
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-28 19:19:46 +01:00
Sam Whited
8c0f6142a8
Update DNS library
...
This makes sure that we don't become vulnerable to CVE-2018-17419 or
CVE-2019-19794 in the future.
Signed-off-by: Sam Whited <sam@samwhited.com>
2020-02-25 17:05:57 -05:00
Tonis Tiigi
33baa55353
vendor: update buildkit to d75ed2b68
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-02-24 15:38:51 -08:00
Sebastiaan van Stijn
12c7541f1f
vendor: update opencontainers/selinux v1.3.1
...
full diff: 5215b1806f
2020-02-20 14:40:25 +01:00
Samuel Karp
44a8e10bfc
awslogs: Update aws-sdk-go to support IMDSv2
...
AWS recently launched a new version of the EC2 Instance Metadata
Service, which is used to provide credentials to the awslogs driver when
running on Amazon EC2. This new version of the IMDS adds
defense-in-depth mechanisms against open firewalls, reverse proxies, and
SSRF vulnerabilities and is generally an improvement over the previous
version. An updated version of the AWS SDK is able to handle the both
the previous version and the new version of the IMDS and functions when
either is enabled.
More information about IMDSv2 is available at the following links:
* https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
* https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
Closes https://github.com/moby/moby/issues/40422
Signed-off-by: Samuel Karp <skarp@amazon.com>
2020-02-06 10:56:05 -08:00
Drew Erny
fb155a1125
Fix leak related to service logs
...
See the commit message for the new swarmkit commit. That change fixes a
leaking goroutine related to service logs.
Signed-off-by: Drew Erny <derny@mirantis.com>
2020-01-29 10:36:17 -06:00
Akihiro Suda
6d68080907
update runc library to v1.0.0-rc10 (CVE-2019-19921)
...
Notable changes:
* Fix CVE-2019-19921 (Volume mount race condition with shared mounts): https://github.com/opencontainers/runc/pull/2207
* Fix exec FIFO race: https://github.com/opencontainers/runc/pull/2185
* Basic support for cgroup v2. Almost feature-complete, but still missing support for systemd mode in rootless.
See also https://github.com/opencontainers/runc/issues/2209 for the known issues.
Full changes: https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc10
Also updates go-selinux: 3a1f366feb...5215b1806fhttps://github.com/containerd/cri/pull/1383#issuecomment-578227009 )
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-01-25 04:06:24 +09:00
Akihiro Suda
f9d136b6c6
Merge pull request #40307 from dperny/swarm-jobs
...
Add support for swarm jobs
2020-01-20 12:57:05 +09:00
Brian Goff
e5c8eca2ee
Merge pull request #40384 from arkodg/bump-libnetwork-latest
...
Bump Libnetwork to latest refpoint
2020-01-16 21:03:26 -08:00
Arko Dasgupta
4c407caada
Bump libnetwork to latest refpoint
...
Commits:
feeff4f0 Merge pull request #2380 from liskin/bridge-atomic-hwaddr
fec6476d Merge pull request #2489 from suwang48404/doc
8757597e Added document describing libnetwork traffic flow.
eaea5722 Merge pull request #2445 from kdomanski/ipv6-addr-in-hosts
1680ce71 Merge pull request #2462 from arkodg/fix-key-spi-panic
4420ee92 Fix panic in drivers/overlay/encryption.go
57178323 Merge pull request #2472 from thaJeztah/bump_golang_1.12.12
f741dc9c Update Golang 1.12.12 (CVE-2019-17596)
79c19d09 Merge pull request #2461 from suwang48404/master
94facacc Added API to set ephemeral port allocator range.
Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>
2020-01-16 16:28:23 -08:00
Sebastiaan van Stijn
fa291552d5
vendor: bump prometheus/client_golang v1.3.0
...
full diff: https://github.com/prometheus/client_golang/compare/v1.1.0...v1.3.0
This requires LK4D$/vndr v0.1.0 or newer for vendoring; also adds a new
dependency: github.com/cespare/xxhash
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-16 21:32:07 +01:00
Sebastiaan van Stijn
34a65cb3ba
vendor: bump prometheus/client_golang v1.1.0
...
full diff: https://github.com/prometheus/client_golang/compare/v0.9.4...v1.1.0
Using v1.1.0, because version v1.2.0 and up use versioned import paths for the
github.com/cespare/xxhash/v2 dependency (prometheus/client_golang#657 ), which
causes vendoring with vndr to break due to the v2 in the import-path.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-16 21:32:05 +01:00
Sebastiaan van Stijn
b2db7c8bc9
vendor: bump prometheus/client_golang v0.9.4, docker/go-metrics v0.0.1
...
bump docker/go-metrics v0.0.1:
full diff: d466d4f6fddocker/go-metrics#16 fix the compilation error against prometheus/client-golang master
- fixes docker/go-metrics#12 No longer builds against Prom master
- docker/go-metrics#18 metrics: address compile error correctly
- fixes docker/go-metrics#12 No longer builds against Prom master
- docker/go-metrics#15 Add functions that instruments http handler using promhttp
- docker/go-metrics#20 Rename LICENSE.code → LICENSE
- docker/go-metrics#22 Support Go Modules
bump prometheus/client_golang v0.9.4:
full diff: c5b7fccd20
2020-01-16 21:32:04 +01:00
Sebastiaan van Stijn
12a83ac27e
vendor: bump prometheus/procfs v0.0.8
...
full diff: 7d6f385de8
2020-01-16 21:32:02 +01:00
Sebastiaan van Stijn
54dc6f355b
vendor: bump prometheus/common v0.7.0
...
full diff: 7600349dcf
2020-01-16 21:32:00 +01:00
Sebastiaan van Stijn
9c99f8b9b3
vendor: bump prometheus/client_model v0.1.0
...
full diff: 6f38060186prometheus/client_model#22 add `go_package`, regenerate Go binding file
- prometheus/client_model#31 Support Go Modules
- prometheus/client_model#38 Remove all languages but Go and add a deprecation note
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-16 21:31:58 +01:00
Sebastiaan van Stijn
ab6e9b94d3
Merge pull request #40370 from thaJeztah/bump_dependencies2
...
vendor: bump google/shlex b3f49c06ffaeef, beorn7/perks v1.0.1
2020-01-16 21:29:35 +01:00
Drew Erny
30d9fe30b1
Add swarm jobs
...
Adds support for ReplicatedJob and GlobalJob service modes. These modes
allow running service which execute tasks that exit upon success,
instead of daemon-type tasks.
Signed-off-by: Drew Erny <drew.erny@docker.com>
2020-01-13 13:21:12 -06:00
Sebastiaan van Stijn
94a8c8b3c0
vendor: update fsutil 0f039a052ca1da01626278199624b62aed9b3729
...
full diff: 3bbb99cdbd...0f039a052ctonistiigi/fsutil#66 copy: add fast copy path for darwin
- tonistiigi/fsutil#67 Treat Unix sockets as regular files
- relates to moby/buildkit#1144 Fix socket handling
- tonistiigi/fsutil#68 fix gocrypto commit
- tonistiigi/fsutil#69 receive: use filter on receive diff
- prevents incremental transfers with userns because the metadata
on disk is always different than the one being transferred.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-13 14:28:14 +01:00
Sebastiaan van Stijn
67a0695e8b
vendor: update containerd/continuity to 26c1120b8d4107d2471b93ad78ef7ce1fc84c4c4
...
full diff: f2a389ac0a...26c1120b8dcontainerd/continuity#109 Add OpenBSD support for fs subpackage
- containerd/continuity#141 Add src string to copyDirectory error message
- containerd/continuity#143 fstest: have CreateSocket actually create a socket
- containerd/continuity#144 Support Go Modules
- containerd/continuity#147 xattr lost when copying directory
- containerd/continuity#148 fs: don't convert syscall.Timespec to unix.Timespec directly (doesn't work with gccgo)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-13 14:23:38 +01:00
Sebastiaan van Stijn
5c73cacefc
vendor: bump beorn7/perks v1.0.1
...
full diff: e7f67b54ab
2020-01-13 13:04:56 +01:00
Sebastiaan van Stijn
940a1292db
vendor: bump google/shlex e7afc7fbc51079733e9468cdfd1efcd7d196cd1d
...
full diff: 6f45313302...e7afc7fbc5google/shlex#2 Remove unnecessary UnreadRune call
- google/shlex#3 Add go.mod
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-13 13:04:54 +01:00
Drew Erny
07efe6a0a7
Bump swarmkit to 24fb4cfe8af56803640180c5592bf32da732ced2
...
Bumps the vendoring of github.com/docker/swarmkit to the above commit,
which is the current master at commit time.
Most notably, this includes a change making the ingress network respect
the default address pool. Because of this change, a change to network
integration tests was needed.
Signed-off-by: Drew Erny <drew.erny@docker.com>
2020-01-07 09:43:22 -06:00
Brian Goff
0971ab57f7
Merge pull request #40257 from thaJeztah/bump_go_runc
...
bump containerd/go-runc a2952bc25f5116103a8b78f3817f6df759aa7def
2019-12-19 11:32:38 -08:00
Sebastiaan van Stijn
4afda3bb7c
Merge pull request #40122 from tonistiigi/buildkit-leases2
...
Update buildkit to containerd leases
2019-11-26 23:35:24 +01:00
Sebastiaan van Stijn
9aa55d97e5
bump containerd/go-runc a2952bc25f5116103a8b78f3817f6df759aa7def
...
full diff: e029b79d8c...a2952bc25fcontainerd/go-runc#56 fix typo in successfully
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-11-26 15:14:54 +01:00
Vikram bir Singh
a7b6c3f0bf
Bump hcsshim to b3f49c06ffaeef24d09c6c08ec8ec8425a
...
Among other things, this is required to pull in
microsoft/hcsshim#718
Also fixes microsoft/hcsshim#737
which was caught by checks while attempting to bump
up hcsshim version.
Signed-off-by: Vikram bir Singh <vikrambir.singh@docker.com>
2019-11-25 09:58:10 -08:00
Sebastiaan van Stijn
9cf349d0f8
bump libnetwork 90afbb01e1d8acacb505a092744ea42b9f167377
...
full diff: 0025177e3d...90afbb01e1#2339 from phyber/iptables-check"
- reverts docker/libnetwork#/2339 controller: Check if IPTables is enabled for arrangeUserFilterRule
- re-opens docker/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER
- re-opens moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules
- re-opens docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-11-07 13:43:42 -08:00
Tonis Tiigi
f632e2d8d3
vendor: update containerd to acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-11-05 12:50:38 -08:00
Tonis Tiigi
fb1601d5ab
vendor: update buildkit to leases support
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-11-05 10:14:33 -08:00
Sebastiaan van Stijn
27552ceb15
bump containerd/cgroups 5fbad35c2a7e855762d3c60f2e474ffcad0d470a
...
full diff: c4b9ac5c76...5fbad35c2acontainerd/cgroups#82 Add go module support
- containerd/cgroups#96 Move metrics proto package to stats/v1
- containerd/cgroups#97 Allow overriding the default /proc folder in blkioController
- containerd/cgroups#98 Allows ignoring memory modules
- containerd/cgroups#99 Add Go 1.13 to Travis
- containerd/cgroups#100 stats/v1: export per-cgroup stats
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-31 01:09:12 +01:00
Sebastiaan van Stijn
a5341aaf32
bump Microsoft/hcsshim 2226e083fc390003ae5aa8325c3c92789afa0e7a
...
Adds osversion.Build() utility
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-22 02:51:21 +02:00
Sebastiaan van Stijn
1fab7c6457
bump Graylog2/go-gelf to 1550ee647df0510058c9d67a45c56f18911d80b8
...
4143646226...1550ee647dGraylog2/go-gelf#20 Prevent panic when unmarshalling JSON
- Graylog2/go-gelf#23 Feat: Use more precise time stamps
- Graylog2/go-gelf#31 bugfix. Not goroutine safe for TCP writer
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-17 18:41:03 +02:00
Grant Millar
df7b8f458a
daemon: Use short libnetwork ID in exec-root & update libnetwork
...
Signed-off-by: Grant Millar <rid@cylo.io>
2019-10-15 11:40:24 +01:00
Brian Goff
e443512ce4
Use ocischema package instead of custom handler
...
Previously we were re-using schema2.DeserializedManifest to handle oci
manifests. The issue lies in the fact that distribution started
validating the media type string during json deserialization. This
change broke our usage of that type.
Instead distribution now provides direct support for oci schemas, so use
that instead of our custom handlers.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2019-10-11 10:19:29 -07:00
Tibor Vass
b3be2802d4
Merge pull request #39713 from thaJeztah/containerd_1.3
...
bump containerd and dependencies to v1.3.0
2019-10-08 10:43:56 -07:00
Sebastiaan van Stijn
bb5650619e
bump gorilla/mux v1.7.3
...
full diff: ed099d4238...00bdffe0f3gorilla/mux#477 Improve CORS Method Middleware
- implements gorilla/mux#477 Make CORSMethodMiddleware actually make sense
- gorilla/mux#489 Fix nil panic in authentication middleware example
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-06 11:38:53 +02:00
Sebastiaan van Stijn
38418287f7
bump olang/gddo 72a348e765d293ed6d1ded7b699591f14d6cd921
...
no local code changes, just keeping up with upstream
full diff: 9b12a26f3f...72a348e765
2019-10-06 11:30:52 +02:00
Sebastiaan van Stijn
e5dce0f8c5
bump creack/pty v1.1.9
...
full diff: https://github.com/creack/pty/compare/v1.1.7...v1.1.9
adds go mod support
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-06 03:01:05 +02:00
Sebastiaan van Stijn
61a2b7ac94
bump gofrs/flock v0.7.1
...
full diff: https://github.com/gofrs/flock/compare/v0.7.0...v0.7.1
- gofrs/flock#34 don't mention sync.Locker in package documentation
- fixes gofrs/flock#33 incorrect interface
- gofrs/flock#35 Fix linting issues and add goreportcard badge
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-06 02:39:43 +02:00
Sebastiaan van Stijn
9bd1b1a8ec
bump imdario/mergo v0.3.8
...
full diff: https://github.com/imdario/mergo/compare/v0.3.7...v0.3.8
includes:
- imdario/mergo#112 Add strict override
- fixes imdario/mergo#111 WithOverride should be able to check types
- imdario/mergo#106 Fix merging of interface types with concrete values
- imdario/mergo#120 should not overwrite pointers directly, instead check embedded values
- fixes imdario/mergo#114 Embedded struct of pointer types will overwrite the whole destination struct
- imdario/mergo#125 added WithOverrideEmptySlice config flag
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-06 02:39:24 +02:00
