Commit Graph

55387 Commits

Author SHA1 Message Date
Paweł Gronowski
e4f1408738 Merge pull request #51628 from locnnil/patch-1
Dockerfile: Update buildx to 0.30.1
2025-12-02 15:23:36 +00:00
Paweł Gronowski
5ecc72679d Merge pull request #51645 from thaJeztah/api_relax_replace_check
hack/validate/module-replace: relax check
2025-12-02 15:23:02 +00:00
Sebastiaan van Stijn
7687298e0a hack/validate/module-replace: relax check
Do not require replace rules to be added if there's no code-changes
in the module. Note that changes in api/swagger.yaml may result in
changes in generated code, but this should be checked separate from
the swagger itself.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-02 16:14:07 +01:00
Paweł Gronowski
45be1a39b3 Merge pull request #51617 from vvoland/validate-share-image
gha/test-validate: Reuse the dev image
2025-12-02 15:13:03 +00:00
Lincoln Wallace
a828af4d8d Dockerfile: Update buildx to 0.30.1
Signed-off-by: Lincoln Wallace <lincoln.wallace@canonical.com>
2025-12-02 16:00:28 +01:00
Paweł Gronowski
616e53c12b Merge pull request #51633 from Xeeynamo/bump-runc-v134
Dockerfile: update runc binary to v1.3.4
2025-12-02 11:45:39 +00:00
Sebastiaan van Stijn
587d38292b Merge pull request #51629 from vvoland/c8d-fix-images
c8d/inspect: Fix image inspect for incomplete images
2025-12-02 12:35:27 +01:00
Luciano Ciccariello
f97f234729 Dockerfile: update runc binary to v1.3.4
- release notes: https://github.com/opencontainers/runc/releases/tag/v1.4.0
- full diff: opencontainers/runc@v1.3.3...v1.4.0

This version bump aims to fix a regression in runc v1.3.3, which caused
/dev/shm to have inappropriate permissions exposed to containers:
* https://github.com/opencontainers/runc/issues/4971
* https://github.com/opencontainers/runc/pull/4976

Signed-off-by: Luciano Ciccariello <xeeynamo@hotmail.com>
2025-12-02 09:31:00 +00:00
Brian Goff
a1836eb283 Merge pull request #51631 from thaJeztah/fix_df_shared_usage
system: df: fix SharedUsage on non-containerd
2025-12-01 13:30:07 -08:00
Akihiro Suda
b9d18a107a integration: cdi: add TestEtcCDI to verify /etc/cdi is used in rootless mode
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-12-02 02:30:14 +09:00
Akihiro Suda
a55f610e2a cdi: resolve symlinks
Fix using /etc/cdi entries in rootless mode:

> level=warning msg="Refreshing the CDI registry generated errors"
> error="failed to monitor for changes: no such file or directory\nfailed to monitor for changes: no such file or directory"

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-12-02 02:30:14 +09:00
Akihiro Suda
e29eaedf65 cdi: skip scanning non-readable dirs
This simplifies `dockerd-rootless.sh` by removing the workaround for
`CDI: Error associated with spec file /etc/cdi: failed to monitor for changes: permission denied`.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-12-02 02:30:14 +09:00
Akihiro Suda
cd4397b4dc cdi: read XDG_CONFIG_HOME/cdi and XDG_RUNTIME_DIR/cdi for rootless
Fix issue 51601

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-12-02 02:30:14 +09:00
Paweł Gronowski
2e3a23c8ec c8d/inspect: Fix image inspect for incomplete images
When inspecting multi-platform images where some layer blobs were
missing from the content store, the image inspect operation would return
too early causing some data (like config details or unpacked size) to be
omitted even though are available.

This ensures that `docker image inspect` returns as much information as
possible.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-12-01 17:38:45 +01:00
Sebastiaan van Stijn
4ff8942d0d Merge pull request #51621 from robmry/fix-crash-with-nil-portbindings
PublishAllPorts: don't crash with nil PortBindings
2025-12-01 17:22:34 +01:00
Sebastiaan van Stijn
69c4ea7aad system: df: fix SharedUsage on non-containerd
The value was calculated, but due to 0af2962fdd
changing to a non-pointer, the value was not written back to the resulting
slice.

Before this patch:

    docker pull nginx:alpine
    docker pull alpine

    docker system df -v
    Images space usage:

    REPOSITORY   TAG       IMAGE ID       CREATED       SIZE      SHARED SIZE   UNIQUE SIZE   CONTAINERS
    nginx        alpine    cbad6347cca2   4 weeks ago   53.4MB    N/A           N/A           0
    alpine       latest    171e65262c80   7 weeks ago   8.51MB    N/A           N/A           0

With this patch:

    docker system df -v
    Images space usage:

    REPOSITORY   TAG       IMAGE ID       CREATED       SIZE      SHARED SIZE   UNIQUE SIZE   CONTAINERS
    nginx        alpine    cbad6347cca2   4 weeks ago   53.4MB    8.512MB       44.91MB       0
    alpine       latest    171e65262c80   7 weeks ago   8.51MB    8.512MB       0B            0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-01 16:45:38 +01:00
Paweł Gronowski
3964729182 Merge pull request #51622 from AkihiroSuda/fix-51602
dockerd-rootless-setuptool.sh: fix `nsenter: no namespace specified`
2025-12-01 10:06:50 +00:00
Akihiro Suda
8c0751aa4d dockerd-rootless-setuptool.sh: fix nsenter: no namespace specified
Fix issue 51602

Corresponds to https://github.com/containerd/nerdctl/blob/v2.2.0/extras/rootless/containerd-rootless-setuptool.sh#L654

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-12-01 16:43:46 +09:00
Rob Murray
7517464283 PublishAllPorts: don't crash with nil PortBindings
Introduced by commit 85b260f ("PublishAllPorts: create
port mappings for exposed ports").

Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-11-29 19:43:30 +00:00
Sebastiaan van Stijn
2faf258d4d Merge pull request #51616 from akerouanton/fix-51591
libnet/pms/nat: don't bind IPv6 ports if not supported by port driver
2025-11-29 00:54:16 +01:00
Aditya Mishra
87583c9029 integration: migrate TestAPIImagesSizeCompatibility to integration test
Signed-off-by: Aditya Mishra <mishraaditya675@gmail.com>
2025-11-29 00:28:44 +05:30
Albin Kerouanton
310aa9241a libnet/pm: log when stopping userland proxy
Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
2025-11-28 19:40:37 +01:00
Albin Kerouanton
52fae09ec0 libnet/pms/nat: don't bind IPv6 ports if not supported by port driver
In rootless mode, the Engine needs to call the rootless port driver to
know which IP address it should bind to inside of its network namespace.

The slirp4netns port drivers doesn't support binding to IPv6 address, so
we need to detect that before listening on the port.

Before commit 201968cc0, this wasn't a problem because the Engine was
binding the port, then calling rootless port driver to learn whether the
proto/IP family was supported, and listen on the port if so.

Starting with that commit, the Engine does bind + listen in one go, and
then calls the port driver — this is too late. Fix the bug by checking
if the port driver supports the PortBindingReq, and only allocate the
port if so.

Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
2025-11-28 19:40:34 +01:00
Paweł Gronowski
955650b33f gha/test-validate: Reuse the dev image
Don't build the dev image separately for each validation.

Build it once and then cache it so the validations can reuse it.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-11-28 16:26:29 +01:00
Sebastiaan van Stijn
9a84135d52 Merge pull request #51615 from akerouanton/revert-51507
Revert "libnet: setupDNS: don't overwrite user-modified resolv.conf"
docker-v29.1.1
2025-11-28 11:31:49 +01:00
Albin Kerouanton
56e8e43339 Revert "libnet: populateNetworkResourcesOS: updateDNS only if !needResolver"
This reverts commit 937246a868.

Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
2025-11-28 09:47:07 +01:00
Albin Kerouanton
83f00e9f2b Revert "libnet: rebuildDNS: update the hash file"
This reverts commit eb18b398d4.

Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
2025-11-28 09:47:04 +01:00
Albin Kerouanton
14a955db2f Revert "libnet: setupDNS: don't overwrite user-modified resolv.conf"
This reverts commit 7639e193ff.

Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
2025-11-28 09:47:01 +01:00
Rob Murray
710302ecf2 Merge pull request #51612 from robmry/client-v0.2.1
vendor: update to client 0.2.1
docker-v29.1.0 v2.0.0-beta.5
2025-11-27 16:38:00 +00:00
Rob Murray
4219768511 vendor: update to client 0.2.1
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-11-27 16:28:48 +00:00
Paweł Gronowski
b6f067c0cf Merge pull request #51607 from robmry/fix-api-vendor
client - use tagged api module
client/v0.2.1
2025-11-27 16:45:56 +01:00
Rob Murray
ea539d267d client - use tagged api module
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-11-27 15:33:52 +00:00
Paweł Gronowski
e7cd814b67 Merge pull request #51610 from vvoland/validate-nofailfast
gha/validate: Actually dont fail fast
2025-11-27 16:31:17 +01:00
Paweł Gronowski
c74559df60 gha/validate: Actually dont fail fast
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-11-27 16:27:28 +01:00
Paweł Gronowski
e22cc91c8d Merge pull request #51609 from vvoland/validate-nofailfast
gha/validate: Don't fail fast
2025-11-27 16:17:47 +01:00
Paweł Gronowski
ecf4446e46 gha/validate: Don't fail fast
Allow other validate checks to finish even if one of them failed.

Sometimes a check is faulty and its failure is expected - in such case
we want to ignore that one validation fail but still run all the others.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-11-27 16:13:15 +01:00
Paweł Gronowski
e7d3eb855e Merge pull request #51608 from vvoland/validate-modulereplace-fix
validate/module-replace: Fix check
2025-11-27 16:10:11 +01:00
Paweł Gronowski
46ca7f19cd validate/module-replace: Fix check
The bash array usage was wrong - change to a simpler check that just
compares if the diff is empty.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-11-27 15:58:26 +01:00
Rob Murray
5a6be3fb51 Merge pull request #51606 from robmry/vendor-client-0.2.0
vendor: client/0.2.0
v2.0.0-beta.4
2025-11-27 14:12:11 +00:00
Rob Murray
f745fe7f14 vendor: client/0.2.0
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-11-27 14:05:10 +00:00
Paweł Gronowski
15a669176b Merge pull request #51604 from robmry/drop_replace
Drop replace rules
client/v0.2.0
2025-11-27 14:32:11 +01:00
Rob Murray
a60bea5412 Drop replace rules
Prepare v29.1.0

Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-11-27 13:15:03 +00:00
Paweł Gronowski
d55f77dbfc Merge pull request #51501 from thaJeztah/negotiate_default
client: enable API-version negotiation by default
2025-11-27 14:01:02 +01:00
Sebastiaan van Stijn
04ab3d562c client: don't downgrade when failing to negotiate
Historically, the client would downgrade to API v1.24 when failing
to negotiate as this was the API version from before API-version
negotiation was introduced.

Given that those daemons are EOL and those API versions no longer
supported, we should not fall back to an older API version, and
just continue using the latest / current version.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-11-27 13:52:27 +01:00
Sebastiaan van Stijn
189942570a client: enable API-version negotiation by default
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-11-27 13:52:27 +01:00
Sebastiaan van Stijn
e752ec0f8e client: fix typo in comment
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-11-27 13:52:24 +01:00
Paweł Gronowski
2eff406673 Merge pull request #51603 from thaJeztah/client_test_improvements
client: various test improvements
2025-11-27 13:46:47 +01:00
Albin Kerouanton
20634eddce Merge pull request #51496 from thaJeztah/discoverapi_cleanups
libnetwork: some minor refactor / cleanups
2025-11-27 12:22:01 +01:00
Sebastiaan van Stijn
bec7ab7f62 client: TestTLSCloseWriter: test with version negotiation enabled
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-11-27 12:05:27 +01:00
Sebastiaan van Stijn
701f2fdade client: improve mocking responses
Make the mocked responses match the API closer;

- Add headers as returned by the daemon's VersionMiddleware
- By default handle "/_ping" requests to allow the client to
  perform API-version negotiation as part of tests.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-11-27 12:05:27 +01:00