Commit Graph

52577 Commits

Author SHA1 Message Date
Matthieu MOREL
6ee53a6831 errdefs: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:39:19 +00:00
Matthieu MOREL
083ccfa486 distribution: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:39:02 +00:00
Matthieu MOREL
55da8ea276 daemon: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:38:39 +00:00
Matthieu MOREL
364d8d8b31 container: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:38:15 +00:00
Matthieu MOREL
415fc7b41e builder: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:37:58 +00:00
Matthieu MOREL
f0eaf228c1 api: replace uses of errdefs package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
2025-05-28 05:37:31 +00:00
Sebastiaan van Stijn
a9649e7a5d Merge pull request #49982 from vvoland/c8d-image-remove-platform
c8d/delete: Add support for deleting specific platforms
2025-05-26 18:47:34 +02:00
Paweł Gronowski
d0ad1357a1 Merge pull request #48457 from thaJeztah/api_remove_deprecated_fields
image-inspect: remove Config fields that are not part of the image
2025-05-26 16:04:57 +00:00
Paweł Gronowski
072483f9d7 c8d/delete: Require --force when deleting platforms
When deleting specific platforms from a multi-platform image, there's
potential risk as platform-specific content might be shared across
images/containers.

For now, require `force` parameter to make the user aware.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 17:43:10 +02:00
Paweł Gronowski
30da69d694 c8d/delete: Support deleting specific platforms
This change adds the ability to delete a specific platform from a
multi-platform image.

Previously, image deletion was an all-or-nothing operation - when
deleting a multi-platform image, all platforms would be removed
together. This change allows users to selectively remove individual
platforms from a multi-architecture image while keeping other platforms
intact.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 17:43:10 +02:00
Paweł Gronowski
acf6b6542e daemon/images: Make ImageDelete take opts struct
Pass whole `RemoveOptions` struct instead of individual `force` and
`prune` parameters.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 17:43:09 +02:00
Paweł Gronowski
871675be9b c8d/delete: Extract untagReferences
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 17:43:08 +02:00
Paweł Gronowski
153b16ad27 c8d: Extract memoryLabelStore
Move to an internal testutils package

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 17:43:07 +02:00
Paweł Gronowski
536b35299b Merge pull request #50077 from vvoland/update-syscalls
profile/seccomp: Update to kernel v6.13 (libseccomp v2.6.0, containerd)
2025-05-26 15:17:58 +00:00
Paweł Gronowski
d15f59243a Merge pull request #50074 from thaJeztah/update_systemd_units
contrib: systemd: update deprecated StartLimit options
2025-05-26 15:15:54 +00:00
Sebastiaan van Stijn
d7cca3f997 docs/api: update deprecation version for erroneous fields
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-26 17:14:44 +02:00
Sebastiaan van Stijn
4dc961d0e9 image-inspect: remove Config fields that are not part of the image
commit af0cdc36c7 marked these fields as
deprecated and to be removed in API v1.47 (which was targeted for v28.0).
We shipped v1.47 with the v27.2 release, but did not yet remove the erroneous
fields, so the version to deprecate was updated to v1.48 through
3df03d8e66

This patch removes fields that are not part of the image by replacing the
type with the Config struct from the docker image-spec.

    curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/images/alpine/json | jq .Config
    {
      "Env": [
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      ],
      "Cmd": [
        "/bin/sh"
      ]
    }

    curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/images/alpine/json | jq .Config
    {
      "Hostname": "",
      "Domainname": "",
      "User": "",
      "AttachStdin": false,
      "AttachStdout": false,
      "AttachStderr": false,
      "Tty": false,
      "OpenStdin": false,
      "StdinOnce": false,
      "Env": [
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      ],
      "Cmd": [
        "/bin/sh"
      ],
      "Image": "",
      "Volumes": null,
      "WorkingDir": "",
      "Entrypoint": null,
      "OnBuild": null,
      "Labels": null
    }

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-26 17:14:37 +02:00
Paweł Gronowski
0ec3278d48 profiles/seccomp: kernel v6.13
reference: seccomp/libseccomp@42b5968 (libseccomp v2.6.0)
           containerd/containerd@1a4c3210

- v6.13:
  * getxattrat, listxattrat, removexattrat, setxattrat (torvalds/linux@6140be9)

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 15:45:09 +02:00
Paweł Gronowski
6aa8288cfb profiles/seccomp: kernel v6.12
reference: seccomp/libseccomp@f01e675 (libseccomp v2.6.0)
           containerd/containerd@6180d62

- v6.8:
  * listmount (torvalds/linux@b4c2bea)
  * lsm_get_self_attr, lsm_set_self_attrs (torvalds/linux@a04a119)
  * lsm_list_modules (torvalds/linux@ad4aff9)
  * statmount (torvalds/linux@46eae99)

- v6.9:
  * mseal (torvalds/linux@8be7258)

- v6.11:
  * uretprobe (torvalds/linux@190fec7)

- v6.12:
  * riscv_hwprobe (torvalds/linux@3db80c9)

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-26 15:45:03 +02:00
Sebastiaan van Stijn
b1c0bfa225 Merge pull request #50076 from thaJeztah/createCDICache_fix_err_capitalization
daemon: createCDICache: fix error-capitalization
2025-05-26 15:28:59 +02:00
Sebastiaan van Stijn
e03ac1fad9 daemon: createCDICache: fix error-capitalization
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-26 14:44:15 +02:00
Sebastiaan van Stijn
a5a3a74a79 Merge pull request #50064 from thaJeztah/registry_errdefs
registry: replace uses of errdefs package
2025-05-26 14:40:09 +02:00
Sebastiaan van Stijn
7263ae74cd contrib: systemd: update deprecated StartLimit options
These were originally added in 7b9ecb9700.

The `StartLimitBurst` and `StartLimitInterval` options used to be
options for `[Service]`, but were moved to the `[Unit]` in systemd 229,
and systemd 230 respectively. The `StartLimitInterval` was renamed to
`StartLimitIntervalSec`, which either takes a number (using "seconds" as
default unit) or an optional unit;

- 6bf0f408e4
- f0367da7d1

We kept these deprecated options to provide compatibility with older distros
that not yet had systemd 230, but all distros we support are now on versions
of systemd that support the new options;

    docker run --rm registry.access.redhat.com/ubi8/ubi systemctl --version
    systemd 239 (239-82.el8_10.5)
    +PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy

    docker run -it --rm debian:
    apt-get update && apt-get install -y systemd
    ...
    systemctl --version
    systemd 247 (247.3-7+deb11u6)
    +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +ZSTD +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=unified

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-26 13:49:57 +02:00
Akihiro Suda
158c04fac8 Merge pull request #50070 from thaJeztah/bump_cgroups
vendor: github.com/opencontainers/cgroups v0.0.2
2025-05-26 19:52:30 +09:00
Sebastiaan van Stijn
6021139a9f Merge pull request #50055 from thaJeztah/fix_fluent_migration
daemon: restore: fix fluentd-async-connect migration for downgrades
2025-05-26 12:14:07 +02:00
Sebastiaan van Stijn
888cbfddf2 vendor: github.com/opencontainers/cgroups v0.0.2
- Mark some fields with `omitempty` JSON attribute.
- Modernize code by using new Go features.
- systemd: write rounded CPU quota to cgroupfs.

full diff: https://github.com/opencontainers/cgroups/compare/v0.0.1...v0.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-26 11:30:39 +02:00
Sebastiaan van Stijn
42970fc461 registry: replace uses of errdefs package
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-24 13:14:08 +02:00
Akihiro Suda
926a4dd23c Merge pull request #50041 from thaJeztah/bump_containerd_api_1.9
vendor: github.com/containerd/containerd/api v1.9.0
2025-05-24 17:55:24 +09:00
Sebastiaan van Stijn
979f18691a daemon: restore: fix fluentd-async-connect migration for downgrades
The "fluentd-async-connect" option was deprecated in 20.10 through
cc1f3c750e, and removed in 28.0 trough
49ec488036, which added migration code
on daemon startup.

However, the migration code _copied_ the deprecated option to the new
("fluentd-async") option, preserving the old field. Doing so could cause
an issue if a user would downgrade the daemon to a previous release, as
the changes in cc1f3c750e invalidate a config
that has both fields set (see [daemon/logger/fluentd/fluentd.go#L198-L200]);

    if cfg[asyncKey] != "" && cfg[asyncConnectKey] != "" {
        return config, errors.Errorf("conflicting options: cannot specify both '%s' and '%s", asyncKey, asyncConnectKey)
    }

This patch updates the migration code to remove the deprecated option.

[daemon/logger/fluentd/fluentd.go#L198-L200]: cc1f3c750e/daemon/logger/fluentd/fluentd.go (L198-L200)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-23 14:47:50 +02:00
Sebastiaan van Stijn
32c5774524 Merge pull request #48038 from thaJeztah/builder_allow_buildkit
api/server/router/build: BuilderVersion: allow buildkit on Windows
v28.2.0-rc.2
2025-05-22 14:13:50 +02:00
Sebastiaan van Stijn
56d5a46c0f Merge pull request #49740 from profnandaa/wcow-builder-next
builder-next: add buildkit executor for wcow
2025-05-22 13:42:28 +02:00
Sebastiaan van Stijn
c6b9bb00f9 api/server/router/build: BuilderVersion: allow buildkit on Windows
Commit 7b153b9e28 changed the daemon to
advertise the recommended builder to use to V2 (BuildKit) for Linux
daemons, and V1 (Legacy Builder) for Windows daemons. For Linux daemons
we allowed the default to be overridden through the "features" field
in the daemon config (daemon.json), but for Windows we hard-coded it
to be V1, and no option to override.

With work in progress on implementing support for Windows in BuildKit,
we should remove this hardcoded assumption, and allow the default to
be overridden to advertise that BuildKit is supported.

Note that BuildKit on Windows is still very much a "work in progress",
and enabling it in the daemon may not even work, so users should not
try to enable this feature; a warning-level log is added to make it
visible that the feature is enabled.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-22 12:36:47 +02:00
Paweł Gronowski
f4ffeb8c38 Merge pull request #50047 from thaJeztah/re_enable_integrationcli_check
validation: re-enable check for changes in integration-cli"
2025-05-22 08:41:22 +00:00
Sebastiaan van Stijn
dddc943a6a Merge pull request #49977 from robmry/nftables_util_updates
nftables: util updates, including table reload
2025-05-22 02:15:34 +02:00
Sebastiaan van Stijn
560299a16f validation: re-enable check for changes in integration-cli"
This reverts commit a891e4e3e1.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-22 01:13:16 +02:00
Sebastiaan van Stijn
b3160e88bf Merge pull request #50036 from thaJeztah/buildkit_rm_schema1
builder-next: remove support for deprecated schema1 images
2025-05-21 23:44:12 +02:00
Sebastiaan van Stijn
7148c6a5f5 Merge pull request #42300 from thaJeztah/carry_39384_remove_v2_schema1_push
Remove support for pulling v2 schema1
2025-05-21 23:43:41 +02:00
Paweł Gronowski
b590eff717 Merge pull request #50046 from crazy-max/buildkit-0.22.0
vendor: update buildkit to v0.22.0
2025-05-21 17:24:27 +00:00
CrazyMax
e354e42e14 vendor: update buildkit to v0.22.0
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2025-05-21 18:31:50 +02:00
Rob Murray
0facb0cd63 Merge pull request #49969 from robmry/firewaller_wsl2_param
Make WSL2Mirrored into a Firewaller param
2025-05-21 15:32:04 +01:00
Sebastiaan van Stijn
61a1a297c0 Merge pull request #50042 from vvoland/daemon-create-platformnil
daemon/create: Simplify `GetImage` args
2025-05-21 16:01:08 +02:00
Paweł Gronowski
94b5e85c10 Merge pull request #50039 from vvoland/netlink-1.3.1
vendor: github.com/vishvananda/netlink v1.3.1
2025-05-21 11:03:11 +00:00
Paweł Gronowski
a2ada6b258 daemon/create: Simplify GetImage args
`opts.params.Platform` is always nil inside this branch so we can omit
it from the `GetImage` call to make it less confusing.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-21 12:50:27 +02:00
Paweł Gronowski
894244cc37 Merge pull request #50030 from vvoland/client-c8dhttp
client: Use containerd errdefs to convert http errors
2025-05-21 10:29:26 +00:00
Sebastiaan van Stijn
2c57455339 vendor: github.com/containerd/containerd/api v1.9.0
full diff: https://github.com/containerd/containerd/compare/api/v1.8.0...api/v1.9.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-21 12:19:52 +02:00
Paweł Gronowski
a3ce441ae0 client: Use containerd errdefs to convert http errors
Previously, we were using our own `FromStatusCode` function to map HTTP
status codes to Docker error types. Switch to the containerd code.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-21 11:41:23 +02:00
Paweł Gronowski
86187b2606 vendor: github.com/vishvananda/netlink v1.3.1
full diff: https://github.com/vishvananda/netlink/compare/655392bc778a...v1.3.1

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-05-21 11:26:17 +02:00
Paweł Gronowski
a3bee4156f Merge pull request #49973 from ctalledo/fix-for-48659
Replace platforms.Format with platforms.FormatAll in user-visible messages and logs.
2025-05-21 08:03:34 +00:00
Sebastiaan van Stijn
e8c269843c builder-next: remove support for deprecated schema1 images
the core/remotes/docker/schema1 package is deprecated and removed
in containerd v2.1; remove its use as we already deprecated these
images for "docker pull" and elsewhere.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-05-20 23:33:39 +02:00
Anthony Nandaa
a9ec07a005 builder-next: add buildkit executor for wcow
WCOW support on Buildkit is now coming to maturity. As part
of making this generally available, integrating it in
Docker Engine is critical for it's adoption.

This commit adds the buildkit execuitor for WCOW as the
next-builder (backend) for building Windows containers.

This will be an opt-in feature, with the end users setting
DOCKER_BUILDKIT=1 environment variable to use it.

The integration tests bit has also been handled.
https://github.com/moby/buildkit/pull/5956,
BUILDKIT_REF has been set to `master` for now, so
that the tests can run successfully. On the next
release, we will revert this back to using releases.

Signed-off-by: Anthony Nandaa <profnandaa@gmail.com>
2025-05-20 00:14:09 +03:00