Commit Graph

53103 Commits

Author SHA1 Message Date
Sebastiaan van Stijn
9bcb12aa48 daemon: ContainerExtractToDir: make AllowOverwriteDirWithFile opt-in
This change changes the default for noOverwriteDirNonDir to be true
internally, with the intent to change the default at the API to follow
accordingly.

The `AllowOverwriteDirWithFile` option in the Client was added when
reimplementing the CLI using the API Client lib in [moby@1b2b91b].
Before that refactor, the `noOverwriteDirNonDir` query argument
[would be set unconditionally][1] by the CLI, with no options to
control the behavior.

The `noOverwriteDirNonDir` query parameter was added in [moby@db9cc91] to
set the `NoOverwriteDirNonDir` option that was implemented in pkg/archive
in [moby@a74799b].

It was added in [PR13171-comment2], following a discussion on the risk
of replacing a directory with a file and vice-versa in [PR13171-comment].

> In my latest changes from yesterday:
>
> - Removed the `GET stat-path` endpoint and added a `HEAD` handler to
>   the `archive-path` endpoint. Updated the api docs to reflect this.
>   Also moved api docs changes from `v1.19` to `v1.20`.
> - Added a `NoOverwriteDirNonDir` flag to `archive.TarOptions` to indicate
>   that we do not want to overwrite a directory with a non-directory (and
>   vice versa) when unpacking an archive.
> - Added a corresponding but optional `noOverwriteDirNonDir` parameter
>   to the `PUT extract-to-dir` endpoint to specify desired behavior.
>
> These changes combine to keep the behavior we want

It's unclear why these were added as an *option* and why it was implemented
as opt-in (not opt-out), as overwriting a file with a directory (or vice-versa)
would generally be unexpected behavior.

[1]: 8c9ad7b818/api/client/cp.go (L345-L346)
[moby@1b2b91b]: 1b2b91ba43
[moby@a74799b]: a74799b701
[moby@db9cc91]: db9cc91a9e
[PR13171-comment]: https://github.com/moby/moby/pull/13171#issuecomment-106559765
[PR13171-comment2]: https://github.com/moby/moby/pull/13171#issuecomment-108538643

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-13 16:37:36 +02:00
Sebastiaan van Stijn
1d272a430d Merge pull request #50373 from thaJeztah/registry_deprecated
registry: remove deprecated `HostCertsDir()` and `SetCertsDir()`
2025-07-11 23:32:19 +02:00
Sebastiaan van Stijn
a7488beadd Merge pull request #50383 from thaJeztah/no_inspect_with_size
integration/container: use subtests in some places, add separate test for ContainerInspectWithRaw
2025-07-11 23:20:31 +02:00
Sebastiaan van Stijn
c7f02581b7 Merge pull request #50391 from robmry/no_error_on_stopped_userland_proxy
Don't log a warning when stopping a stopped docker-proxy
2025-07-11 23:17:38 +02:00
Sebastiaan van Stijn
9caa11d3c2 Merge pull request #50370 from thaJeztah/auth_unused_return
daemon: AuthenticateToRegistry: remove statusMessage return
2025-07-11 20:58:36 +02:00
Rob Murray
c31368fffb Don't raise an error when stopping a stopped docker-proxy
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-11 18:29:25 +01:00
Sebastiaan van Stijn
ca3e884c4d Merge pull request #50378 from thaJeztah/container_remove_deprecated
daemon/container: remove deprecated types and functions
2025-07-11 18:23:23 +02:00
Rob Murray
d52edeba07 Merge pull request #50358 from robmry/nftables_iptables_switching
Remove iptables rules when using nftables, and vice-versa
2025-07-11 16:41:23 +01:00
Rob Murray
16c886402d Merge pull request #50388 from robmry/fix_nftablesdoc_results
Fix expected results for nftablesdoc tests
2025-07-11 16:38:39 +01:00
Sebastiaan van Stijn
eb8c54cba5 Merge pull request #50377 from thaJeztah/graphdriver_cleanups
daemon/graphdriver: remove deprecated GetDriver(), redundant `init()`, and leftovers for graphdriver-plugins
2025-07-11 17:17:48 +02:00
Sebastiaan van Stijn
99595adf51 Merge pull request #50385 from thaJeztah/client_add_raw_test
client: TestContainerInspectWithEmptyID test both inspect variants
2025-07-11 17:12:59 +02:00
Rob Murray
d51b0dd786 Merge pull request #50376 from thaJeztah/registry_deprecated_fields
registry: remove deprecated APIEndpoint fields
2025-07-11 15:53:06 +01:00
Rob Murray
b74c1dcca0 Merge pull request #50375 from thaJeztah/api_registry_remove_nondistributable
api/types/registry: remove deprecated fields for non-distributable artifacts
2025-07-11 15:52:10 +01:00
Rob Murray
f44f309edc Merge pull request #50374 from thaJeztah/registry_deprecated_ResolveRepository
registry: remove deprecated Service.ResolveRepository()
2025-07-11 15:51:53 +01:00
Rob Murray
adad33b30e Fix expected results for nftablesdoc tests
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-11 15:32:52 +01:00
Sebastiaan van Stijn
dde698a2e8 integration/container: add basic test for ContainerInspectWithRaw
Make sure we have basic coverage for this function; integration-cli may
have additional tests covering this as well.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 15:00:19 +02:00
Sebastiaan van Stijn
16ed75572f client: TestContainerInspectWithEmptyID test both inspect variants
Test both ContainerInspect and ContainerInspectWithRaw

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 14:52:23 +02:00
Rob Murray
2837112c8e Merge pull request #50355 from robmry/nftablesdoc
Add "nftablesdoc"
2025-07-11 13:01:32 +01:00
Paweł Gronowski
c47a4ab498 Merge pull request #50356 from robmry/nftables_ci
Run nftables in CI
2025-07-11 13:36:22 +02:00
Rob Murray
7f602d3b94 When switching between iptables/nftables, delete old rules
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-11 12:35:28 +01:00
Sebastiaan van Stijn
a5e3f39770 integration/container: avoid ContainerInspectWithRaw with "size"
These tests didn't use the raw output, and didn't use the size.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 13:01:56 +02:00
Sebastiaan van Stijn
88b67eb2fc integration/container: cleanup TestCreateWithCustomReadonlyPaths
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Add test for privileged containers
- Use subtests and run parallel

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 12:51:54 +02:00
Sebastiaan van Stijn
bd091c1a9d integration/container: cleanup TestCreateWithCustomMaskedPaths
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Use subtests and run parallel

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 12:51:30 +02:00
Rob Murray
0d189dd4e1 Merge pull request #50321 from robmry/simplify_gateway_programming
Simplify gateway programming
2025-07-11 10:47:03 +01:00
Rob Murray
779052873d Add nftablesdoc
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-11 09:36:08 +01:00
Sebastiaan van Stijn
ad579b8a1d daemon/container: remove deprecated IsValidStateString
This was deprecated in 44b653ef99, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:47:24 +02:00
Sebastiaan van Stijn
312eebde49 daemon/container: remove deprecated IsValidHealthString
This was deprecated in df662ebc59, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:42:10 +02:00
Sebastiaan van Stijn
e9fb208e87 daemon/container: remove deprecated StateStatus, WaitCondition
These were deprecated in 100102108b, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:42:05 +02:00
Sebastiaan van Stijn
0d24798529 daemon/graphdriver: remove error or deprecated graphdriver-plugins
This error was added in 555dac5e14 to produce
an error for the deprecated graphdriver-plugins.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:24:39 +02:00
Sebastiaan van Stijn
7767525ccd daemon/graphdriver: remove deprecated GetDriver()
This was deprecated in 84cabde357, which
was part of v28.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:16:46 +02:00
Sebastiaan van Stijn
1fe4a0a7ad daemon/graphdriver: remove redundant init()
This was added in a63ff8da46, but looks
like the only reason was to just have the var initialized, so let's
do so when we create the var.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 01:10:47 +02:00
Akihiro Suda
1b072f717a Merge pull request #50371 from thaJeztah/push_auth_body
daemon/server: remove compatibility with API v1.4 auth-config on push
2025-07-11 07:22:38 +09:00
Sebastiaan van Stijn
bd8f9c3c1b registry: remove deprecated APIEndpoint.AllowNondistributableArtifacts
This field was deprecated in 1932091e21,
which is part of v28.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 00:17:29 +02:00
Sebastiaan van Stijn
65d424e126 registry: remove deprecated APIEndpoint.Official
This field was deprecated in d8fa2f8071,
which is part of v28.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 00:17:22 +02:00
Sebastiaan van Stijn
7252c3c78d registry: remove deprecated APIEndpoint.TrimHostName
This field was deprecated in 3014d6d7a3,
which is part of v28.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-11 00:01:20 +02:00
Sebastiaan van Stijn
11a18d3b00 api/types/registry: remove deprecated fields for non-distributable artifacts
These fields were deprecated in 1932091e21,
which is part of v28. They were kept in place for responses in older API
versions, but no longer used since 7d9c50db2b,
which implemented a fallback without requiring the fields to be present.

This patch:

- removes `ServiceConfig.AllowNondistributableArtifactsCIDRs`
- removes `ServiceConfig.AllowNondistributableArtifactsHostnames`

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 23:47:43 +02:00
Sebastiaan van Stijn
b3e513f80a registry: remove deprecated Service.ResolveRepository()
It was deprecated in 6c643bc366, which is
part of v28, and had no external consumers.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 23:19:13 +02:00
Sebastiaan van Stijn
5862b926f5 registry: remove deprecated SetCertsDir and unify CertsDir code
This was deprecated in b633c4cc33, which was
in v28, and no longer has any consumer, so we can remove it.

Now that we no longer have to synchronise `CertsDir` with `SetCertsDir`
we can also remove the synchronization (`homedir.GetConfigHome()` does
some additional lookups, but those usually are just looking up env-vars,
and `user.Current()` already has a `sync.Once` or equivalent). Also
unifying the platform-specific code to remove some abstraction and put
the logic in plain sight.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 22:47:17 +02:00
Sebastiaan van Stijn
924cd22d1d registry: remove deprecated HostCertsDir
This was deprecated in dd7ab0e82b which was
in v28, and no longer has any consumer, so we can remove it.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 21:41:25 +02:00
Rob Murray
178416334f Run CI tests with nftables
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-10 19:53:15 +01:00
Rob Murray
d82900dfde Merge pull request #50184 from robmry/nftables_port_rules
nftables: per-port rules
2025-07-10 19:36:27 +01:00
Cory Snider
5de59ca3d9 Merge pull request #50260 from corhere/libn/overlay-fix-logical-races
libnetwork/d/overlay: fix logical race conditions
2025-07-10 14:04:20 -04:00
Cory Snider
0059929d28 Merge pull request #50342 from corhere/libn/fix-networkdb-tombstone-bug
libn/networkdb: stop forging tombstone entries
2025-07-10 13:04:17 -04:00
Sebastiaan van Stijn
ea29dffaa5 daemon/server: remove compatibility with API v1.4 auth-config on push
Docker [API v1.4] and lower expected registry authentication to be sent in
the request body when pushing or pulling ("creating") images. [API v1.5]
(Docker v0.6.1) changed this to this to use a `X-Registry-Auth` header
instead.

This change was implemented in d04beb7f43,
which kept a fallback for clients using old (< v1.5) API versions which
would send authentication in the request body.

Given that we no longer support API versions older than v1.24, and clients
using API v1.5 would be over 12 Years old.

[API v1.4]: https://github.com/moby/moby/blob/v0.6.1/docs/sources/api/docker_remote_api_v1.4.rst#push-an-image-on-the-registry
[API v1.5]: https://github.com/moby/moby/blob/v0.6.2/docs/sources/api/docker_remote_api_v1.5.rst#push-an-image-on-the-registry

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 18:35:11 +02:00
Albin Kerouanton
aaf3e76ef2 Merge pull request #50344 from corhere/libn/fix-bcast-queue-deadlocks
libnetwork/networkdb: fix broadcast queue deadlocks
2025-07-10 16:22:22 +02:00
Paweł Gronowski
397149482a Merge pull request #50366 from dmcgowan/fix-integration-import-image-dep
Replace integration import test use of image type
2025-07-10 15:15:34 +02:00
Sebastiaan van Stijn
54e67d0054 daemon: AuthenticateToRegistry: remove statusMessage return
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-07-10 14:55:28 +02:00
Rob Murray
e8396af484 nftabler: add per-port rules
Signed-off-by: Rob Murray <rob.murray@docker.com>
2025-07-10 10:27:46 +01:00
Sebastiaan van Stijn
d4aa1cf9a9 Merge pull request #50364 from corhere/libn/ov-writetostore-comment
libn/d/overlay: drop obsolete writeToStore comment
2025-07-10 10:13:39 +02:00
Derek McGowan
b677c1a671 Replace integration import test use of image type
This is the only non-daemon import of the image package. The platform
type is also the better type to use.

Signed-off-by: Derek McGowan <derek@mcg.dev>
2025-07-09 21:06:59 -07:00