Sebastiaan van Stijn
fb0fca8607
[19.03] roll-back libnetwork iptables forward policy change
...
The patch made in docker/libnetwork#2450 caused a breaking change in the
networking behaviour, causing Kubernetes installations on Docker Desktop
(and possibly other setups) to fail.
Rolling back this change in the 19.03 branch while we investigate if there
are alternatives.
diff: 45c710223c...96bcc0dae8
2019-10-07 18:11:13 +02:00
Andrew Hsu
b6a7124855
Merge pull request #383 from thaJeztah/19.03_backport_test_fixes_2
...
[19.03 backport] Testing and Jenkinsfile changes [step 2]
2019-09-27 16:58:30 -07:00
Sebastiaan van Stijn
3136dea250
Re-group vendor.conf deps to reflect reality
...
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 05a0621fd0
2019-09-27 16:25:56 +02:00
Sebastiaan van Stijn
8ddb4c4e95
bump runc vendor v1.0.0-rc8-92-g84373aaa
...
full diff: https://github.com/opencontainers/runc/compare/v1.0.0-rc8...3e425f80a8c931f88e6d94a8c831b9d5aa481657
- opencontainers/runc#2010 criu image path permission error when checkpoint rootless container
- opencontainers/runc#2028 Update to Go 1.12 and drop obsolete versions
- opencontainers/runc#2029 Update dependencies
- opencontainers/runc#2034 Support for logging from children processes
- opencontainers/runc#2035 specconv: always set "type: bind" in case of MS_BIND
- opencontainers/runc#2038 `r.destroy` can defer exec in `runner.run` method
- opencontainers/runc#2041 Change the permissions of the notify listener socket to rwx for everyone
- opencontainers/runc#2042 libcontainer: intelrdt: add missing destroy handler in defer func
- opencontainers/runc#2047 Move systemd.Manager initialization into a function in that module
- opencontainers/runc#2057 main: not reopen /dev/stderr
- closes opencontainers/runc#2056 Runc + podman|cri-o + systemd issue with stderr
- closes kubernetes/kubernetes#77615 kubelet fails starting CRI-O containers (Ubuntu 18.04 + systemd cgroups driver)
- closes cri-o/cri-o#2368 Joining worker node not starting flannel or kube-proxy / CRI-O error "open /dev/stderr: no such device or address"
- opencontainers/runc#2061 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
- opencontainers/runc#2065 Fix cgroup hugetlb size prefix for kB
- opencontainers/runc#2067 libcontainer: change seccomp test for clone syscall
- opencontainers/runc#2074 Update dependency libseccomp-golang
- opencontainers/runc#2081 Bump CRIU to 3.12
- opencontainers/runc#2089 doc: First process in container needs `Init: true`
- opencontainers/runc#2094 Skip searching /dev/.udev for device nodes
- closes opencontainers/runc#2093 HostDevices() race with older udevd versions
- opencontainers/runc#2098 man: fix man-pages
- opencontainers/runc#2103 cgroups/fs: check nil pointers in cgroup manager
- opencontainers/runc#2107 Make get devices function public
- opencontainers/runc#2113 libcontainer: initial support for cgroups v2
- opencontainers/runc#2116 Avoid the dependency on cgo through go-systemd/util package
- removes github.com/coreos/pkg as dependency
- opencontainers/runc#2117 Remove libcontainer detection for systemd features
- fixes opencontainers/runc#2117 Cache the systemd detection results
- opencontainers/runc#2119 libcontainer: update masked paths of /proc
- relates to moby/moby#36368 Add /proc/keys to masked paths
- relates to moby/moby#38299 Masked /proc/asound
- relates to moby/moby#37404 Add /proc/acpi to masked paths (CVE-2018-10892)
- opencontainers/runc#2122 nsenter: minor fixes
- opencontainers/runc#2123 Bump x/sys and update syscall for initial Risc-V support
- opencontainers/runc#2125 cgroup: support mount of cgroup2
- opencontainers/runc#2126 libcontainer/nsenter: Don't import C in non-cgo file
- opencontainers/runc#2129 Only allow proc mount if it is procfs
- addresses opencontainers/runc#2129 AppArmor can be bypassed by a malicious image that specifies a volume at /proc (CVE-2019-16884)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit ac0ab114a2
2019-09-27 16:25:48 +02:00
Tibor Vass
c3d8cb99a0
vendor: remove vdemeester/shakers and go-check/check
...
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 3aa4ff64aa
2019-09-26 23:52:41 +02:00
Sebastiaan van Stijn
559be42fc2
bump libnetwork to 96bcc0dae898308ed659c5095526788a602f4726
...
full diff: 92d1fbe1eb...96bcc0dae8docker/libnetwork#2429 Updating IPAM config with results from HNS create network call
- addresses moby/moby#38358
- docker/libnetwork#2450 Always configure iptables forward policy
- related to moby/moby#14041 and docker/libnetwork#1526
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 75477f0b3c
2019-09-24 20:45:32 +02:00
Andrew Hsu
0ff52c285d
Merge pull request #289 from thaJeztah/19.03_backport_bump_gorilla_mux
...
[19.03 backport] bump gorilla/mux v1.7.2
2019-09-24 11:36:24 -07:00
Andrew Hsu
53b9d440b8
Merge pull request #373 from tonistiigi/19.03-buildkit
...
[19.03] vendor: update buildkit for 19.03
2019-09-23 15:43:25 -07:00
Andrew Hsu
c27f11fa2e
Merge pull request #340 from thaJeztah/19.03_backport_bump_grpc
...
[19.03 backport] bump google.golang.org/grpc v1.23.0 (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515)
2019-09-23 09:32:43 -07:00
Tonis Tiigi
b71e1008a5
vendor: update buildkit for 19.03
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-09-23 09:23:35 -07:00
Sebastiaan van Stijn
ef4366ee89
Revert "[19.03] bump swarmkit to f35d9100f2c6ac810cc8d7de6e8f93dcc7a42d29"
...
This reverts commit 02465c9f9d
2019-09-21 10:32:58 +02:00
Sebastiaan van Stijn
486953e2ff
bump gorilla/mux v1.7.2
...
full diff: https://github.com/gorilla/mux/compare/v1.7.0...v1.7.2
includes:
- gorilla/mux#457 adding Router.Name to create new Route
- gorilla/mux#447 host:port matching does not require a :port to be specified
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 25b451e01b
2019-09-20 19:07:11 +02:00
Andrew Hsu
2399b7a91b
Merge pull request #369 from thaJeztah/19.03_bump_swarmkit
...
[19.03] bump swarmkit to f35d9100f2c6ac810cc8d7de6e8f93dcc7a42d29
2019-09-19 17:48:36 -07:00
Andrew Hsu
7cb08ca538
Merge pull request #334 from thaJeztah/19.03_backport_switch_creack_pty
...
[19.03 backport] switch kr/pty to creack/pty v1.1.7
2019-09-19 17:46:32 -07:00
Sebastiaan van Stijn
02465c9f9d
[19.03] bump swarmkit to f35d9100f2c6ac810cc8d7de6e8f93dcc7a42d29
...
full diff: bbe341867e...f35d9100f2docker/swarmkit#2891 [19.03 backport] Remove hardcoded IPAM config subnet value for ingress network
- backport of docker/swarmkit#2890 Remove hardcoded IPAM config subnet value for ingress network
- fixes [ENGORC-2651] Specifying --default-addr-pool for docker swarm init is not picked up by ingress network
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-09-19 09:21:46 +02:00
Sebastiaan van Stijn
5196dc65e7
bump hashicorp/go-sockaddr v1.0.2
...
full diff: 6d291a969bhashicorp/go-sockaddr#25 Add android os
- hashicorp/go-sockaddr#28 Add go.mod
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 492945c2d5
2019-09-16 18:34:24 +02:00
Sebastiaan van Stijn
8abb005598
bump hashicorp/go-multierror v1.0.0, add errwrap v1.0.0
...
full diff: fcdddc395d720b66ee1f
2019-09-16 18:34:22 +02:00
Sebastiaan van Stijn
44ca36c7cf
bump lib network to 92d1fbe1eb0883cf11d283cea8e658275146411d
...
full diff: 09cdcc8c0e...92d1fbe1ebdocker/libnetwork#2433 Fix parseIP error when parseIP before get AddressFamily
- fixes docker/libnetwork#2431 parseIP Error ip=[172 17 0 2 0 0 0 0 0 0 0 0 0 0 0 0]
- https://github.com/docker/libnetwork/issues/2289
- this was a regression introduced in docker/libnetwork#2416 Fix hardcoded AF_INET for IPv6 address handling
- docker/libnetwork#2440 Bump hashicorp go-sockaddr v1.0.2, go-multierror v1.0.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit bab58c1924
2019-09-16 18:34:20 +02:00
Sebastiaan van Stijn
b6190c2713
bump libnetwork to 09cdcc8c0eab3946c2d70e8f6225b05baf1e90d1
...
full diff: 83d30db536...09cdcc8c0edocker/libnetwork#2416 Fix hardcoded AF_INET for IPv6 address handling
- docker/libnetwork#2411 Macvlan network handles netlabel.Internal wrong
- fixes docker/libnetwork#2410 Macvlan network handles netlabel.Internal wrong
- docker/libnetwork#2414 Allow network with --config-from to be --internal
- fixes docker/libnetwork#2413 Network with --config-from does not honor --internal
- docker/libnetwork#2351 Use fewer modprobes
- relates to moby/moby#38930 Use fewer modprobes
- docker/libnetwork#2415 Support dockerd and system restarts for ipvlan and macvlan networks
- carry of docker/libnetwork#2295 phantom ip/mac vlan network after a powercycle
- fixes docker/libnetwork#1743 Phantom docker network
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 6f234db9fe
2019-09-16 18:34:18 +02:00
CarlosEDP
ca89db221f
Update modules to support riscv64
...
Signed-off-by: CarlosEDP <me@carlosedp.com>
(cherry picked from commit 9eaab0425b
2019-09-16 18:34:16 +02:00
Sebastiaan van Stijn
f3e1aff81d
bump libnetwork. vishvananda/netlink 1.0, vishvananda/netns
...
full diffs:
- fc5a7d91d5...62a13ae87cb2de5d10e3604eaf189edocker/libnetwork#2366 Bump vishvananda/netlink to 1.0.0
- docker/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule
- addresses docker/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER
- addresses moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules
- addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway
- docker/libnetwork#2394 Make DNS records and queries case-insensitive
- addresses moby/moby#28689 Embedded DNS is case-sensitive
- addresses moby/moby#21169 hostnames with new networking are case-sensitive
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 344b093258
2019-09-16 18:34:13 +02:00
Andrew Hsu
48282bea40
Merge pull request #353 from thaJeztah/19.03_bump_swarmkit
...
[19.03 backport] bump swarmkit to bbe341867eae1615faf8a702ec05bfe986e73e06 (bump_v19.03 branch)
2019-09-12 08:22:18 -07:00
Sebastiaan van Stijn
525e8ed3fe
bump containerd/ttrpc 92c8520ef9f86600c650dd540266a007bf03670f
...
full diff: 699c4e40d1...92c8520ef9containerd/ttrpc#37 Handle EOF to prevent file descriptor leak
- containerd/ttrpc#38 Improve connection error handling
- containerd/ttrpc#40 Support headers
- containerd/ttrpc#41 Add client and server unary interceptors
- containerd/ttrpc#43 metadata as KeyValue type
- containerd/ttrpc#42 Refactor close handling for ttrpc clients
- containerd/ttrpc#44 Fix method full name generation
- containerd/ttrpc#46 Client.Call(): do not return error if no Status is set (gRPC v1.23 and up)
- containerd/ttrpc#49 Handle ok status
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 8769255d1b
2019-09-12 12:09:50 +02:00
Sebastiaan van Stijn
5772636dc6
bump google.golang.org/grpc v1.23.0
...
full diff: https://github.com/grpc/grpc-go/compare/v1.20.1...v1.23.0
This update contains security fixes:
- transport: block reading frames when too many transport control frames are queued (grpc/grpc-go#2970 )
- Addresses CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).
Other changes can be found in the release notes:
https://github.com/grpc/grpc-go/releases/tag/v1.23.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f1cd79976a
2019-09-12 12:09:48 +02:00
Sebastiaan van Stijn
892dbfb87e
switch kr/pty to creack/pty v1.1.7
...
kr/pty was moved to creak/pty and the old location was
archived.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 0595c01718
2019-09-12 10:24:55 +02:00
Tibor Vass
f1a639bf53
vendor: containerd to 7c1e88399
...
Fixes https://github.com/moby/buildkit/issues/1062
when DOCKER_BUILDKIT=1
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 14bd416d0e
2019-09-12 10:12:05 +02:00
Sebastiaan van Stijn
f7dbee3eea
bump swarmkit to bbe341867eae1615faf8a702ec05bfe986e73e06 (bump_v19.03 branch)
...
full diff: 4fb9e961ab...bbe341867edocker/swarmkit#2889 [19.03 backport] Fix update out of sequence and increase max recv gRPC message size for nodes and secrets
Which relates to
- moby/moby#39531 integration-cli: fix swarm tests flakiness
- docker/engine#345 [19.03 backport] integration-cli: fix swarm tests flakiness
And includes backports of
- docker/swarmkit#2808 Fix flaky tests
- docker/swarmkit#2866 Swap gometalinter for golangci-lint
- docker/swarmkit#2869 Increase max recv gRPC message size to initialize connection broker
- related / similar to moby/moby#38103 / docker/engine#102 cluster: set bigger grpc limit for array requests
- related / similar to moby/moby#39306 Increase max recv gRPC message size for nodes and secrets
- fixes https://github.com/docker/swarmkit/issues/2733 Error generated when messages size is too big
- docker/swarmkit#2870 Fix update out of sequence
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-09-12 10:07:13 +02:00
Tonis Tiigi
278cb7aed5
vendor: update buildkit to 588c73e1e4
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 52ed97c5c1
2019-08-22 18:10:16 +00:00
Tonis Tiigi
65f964aa6b
vendor: update buildkit to v0.6.1
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit e59b26087f
2019-08-14 18:56:38 -07:00
Andrew Hsu
37d9901e0f
Merge pull request #306 from thaJeztah/19.03_bump_swarmkit
...
[19.03] bump swarmkit to 4fb9e961aba635f0240a140e89ece6d6c2082585 (bump_v19.03)
2019-08-08 22:52:52 -07:00
Justin Terry (VM)
8ba31dccd1
Update Microsoft/go-winio v0.4.14
...
Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
(cherry picked from commit 35fe16b7eb
2019-08-08 17:10:55 +02:00
Kevin Parsons
80376f9e13
Revendor go-winio
...
This is needed to provide fixes for ETW on ARM. The updated ETW package will
no-op on ARM, rather than crashing. Further changes are needed to Go itself to
allow ETW on ARM to work properly.
Signed-off-by: Kevin Parsons <kevpar@microsoft.com>
(cherry picked from commit e1f0f77bf4
2019-08-08 17:10:52 +02:00
Sebastiaan van Stijn
ee64eae903
bump swarmkit to 4fb9e961aba635f0240a140e89ece6d6c2082585 (bump_v19.03 branch)
...
full diff: 961ec3a56b...4fb9e961abdocker/swarmkit#2873 [19.03 backport] Only update non-terminal tasks on node removal
- backport of docker/swarmkit#2867 Only update non-terminal tasks on node removal
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-08-08 17:08:57 +02:00
Tonis Tiigi
eaa83640fa
vendor: update buildkit to f5a55a95
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit c60e53a274
2019-08-07 14:02:45 -07:00
Andrew Hsu
5fbc0a16e2
Merge pull request #260 from thaJeztah/19.03_backport_buildkit_systemd_resolvconf
...
[19.03 backport] build: buildkit now also uses systemd's resolv.conf
2019-06-04 11:44:18 -07:00
Andrew Hsu
0678d71038
Merge pull request #252 from thaJeztah/19.03_bump_swarmkit
...
[19.03 backport] Revert docker/swarmkit#2804
2019-06-04 10:33:22 -07:00
Tibor Vass
feb373a216
build: buildkit now also uses systemd's resolv.conf
...
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 8ff4ec98cf
2019-06-04 18:11:14 +02:00
Tonis Tiigi
2de4afdee5
vendor: update buildkit to 37d53758
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 85bbbd4495
2019-06-04 11:17:10 +02:00
Drew Erny
d0f4f42bd4
Revert docker/swarmkit#2804
...
Reverts the change to swarmkit that made all updates set UpdateStatus to
Completed
Signed-off-by: Drew Erny <drew.erny@docker.com>
(cherry picked from commit c7d9599e3d
2019-06-03 15:52:54 +02:00
Sebastiaan van Stijn
939aa52465
bump libnetwork 5ac07abef4eee176423fdc1b870d435258e2d381
...
full diff: 9ff9b57c34...5ac07abef4docker/libnetwork#2376 Forcing a nil IP specified in PortBindings to IPv4zero (0.0.0.0)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit a66ddd8ab8
2019-05-21 14:49:34 +02:00
Drew Erny
56e92239a6
backport ConstraintEnforcer fix
...
Revendors docker/swarmkit to backport fixes made to the
ConstraintEnforcer (see docker/swarmkit#2857 )
Signed-off-by: Drew Erny <drew.erny@docker.com>
2019-05-20 13:30:00 -05:00
Sebastiaan van Stijn
bff7e300e6
Merge pull request #215 from thaJeztah/19.03_backport_buildkit_fixes
...
[19.03 backport] BuildKit fixes
2019-05-13 20:16:34 -07:00
Sebastiaan van Stijn
d371b283c3
bump google.golang.org/grpc v1.20.1
...
full diff: https://github.com/grpc/grpc-go/compare/v1.12.2...v1.20.1
includes grpc/grpc-go#2695 transport: do not close channel that can lead to panic
addresses moby/moby#39053
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 28ad54d84f
2019-05-13 17:59:40 -07:00
Tonis Tiigi
31b0688de7
vendor: update buildkit to f238f1ef
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit a3cbd53ed2
2019-05-13 17:44:23 -07:00
Sebastiaan van Stijn
6896305b57
bump golang.org/x/crypto 88737f569e3a9c7ab309cdc09a07fe7fc87233c3
...
no local changes, just syncing with containerd
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit d6d2b30fd2
2019-05-13 17:43:56 -07:00
Sebastiaan van Stijn
931c4c1023
bump gogo/googleapis v1.2.0
...
full diff: 08a7655d275d51ac544b
2019-05-13 17:43:45 -07:00
Sebastiaan van Stijn
6cc14f5854
bump gogo/protobuf v1.2.1
...
full diff: https://github.com/gogo/protobuf/compare/v1.2.0...v1.2.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 647f31b7d0
2019-05-13 17:43:25 -07:00
Sebastiaan van Stijn
1910607215
bump containerd/console 0650fd9eeb50bab4fc99dceb9f2e14cf58f36e7f
...
full diff: c12b1e7919...0650fd9eebcontainerd/console#30 Add common project repo checks/README references
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 3d7d8a579f
2019-05-13 17:43:14 -07:00
Sebastiaan van Stijn
dfa1031015
bump containerd 3a3f0aac8819165839a41fee77a4f4ac8b103097
...
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 25e6487fc2
2019-05-13 17:42:40 -07:00
Sebastiaan van Stijn
790388a8c5
bump containerd/continuity aaeac12a7ffcd198ae25440a9dff125c2e2703a7
...
- containerd/continuity#140 Fix directory comparison in changes
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 447cbff50a
2019-05-13 17:25:31 -07:00
