The github.com/docker/docker/reference package was moved to
github.com/moby/moby/v2/daemon/internal/refstore, so this
check no longer did anything (and no aliasing needed).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The buildSandboxPlatformOptions function was given a pointer to the
sboxOptions and modified it in-place.
Similarly, a pointer to the container was passed and `container.HostsPath`
and `container.ResolvConfPath` mutated. In cases where either of those
failed, we would return an error, but the container (and sboxOptions)
would already be modified.
This patch;
- updates the signature of buildSandboxPlatformOptions to return a fresh
slice of sandbox options, which can be appended to the sboxOptions by
the caller.
- uses intermediate variables for `hostsPath` and `resolvConfPath`, and
only mutates the container if both were obtained successfully.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove/rename named error-return
- remove redundant defer
- use "continue" to reduce nesting
- use structured logs
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Markdown subheading name was changed in `CONTRIBUTING.md` in the past,
so this commit fixes the link by changing it from `docker` to `moby`.
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
handleFirewalldReloadNw locks `d.mu` and then `d.configNetworks`.
However, the rest of the driver locks `d.configNetworks` first and then
`d.mu`.
This could result in deadlocks if `handleFirewalldReloadNw` is called
while the bridge driver is already holding `d.configNetworks` lock.
Other code paths were checked to ensure that they all follow the same
locking order.
This bug was introduced by commit a527e5a.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The bridge driver was embedding `sync.Mutex` which is unconventional and
makes it harder to analyze locks ordering.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Outline the purpose of the Stdin and Systemerr streams and how
they're used.
- Update docs for StdCopy function
- Touch-up error for unknown stream types
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
iota can be convenient for internal use for cases where the value
doesn't matter. It can be a footgun when using it to define public
values; it's easy to accidentally change values (e.g. by re-ordering
or adding a value), which may go undetected within our code because
both producer and consumer would be updated.
This patch updates these consts to have a concrete value, because it's
part of the API contract and must not be changed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Not perfect yet, but addressing some godoc "doc" links that needed
to be updated, and touching up some references.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allow overriding the go-swagger version to install.
With this patch:
docker build -q --call=outline --target=swagger .
TARGET: swagger
BUILD ARG VALUE DESCRIPTION
GO_VERSION 1.24.5
BASE_DEBIAN_DISTRO bookworm
GOLANG_IMAGE golang:1.24.5-bookworm
XX_VERSION 1.6.1
GO_SWAGGER_VERSION v0.32.3 specifies the version of the go-swagger binary to install.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This file was added in 962f347923, at which
time there already were doubts about it being useful. For Go, `gofmt`
already dictates formatting (and proper editors would integrat with
that). For other languages, most editors would already have a config,
and our CI validates formatting for various files.
Give that the file was never updated since it was added, it's fair
to say that it's unmaintained. Let's remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This script was added in 6860c101ad
to allow testing a custom daemon in Docker Desktop, but has not
been maintained since, and likely no longer functional, so let's
remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Dockerfile syntax is now maintained as part of BuildKit in the
https://github.com/moby/buildkit repository, but our contrib still
had syntax highlighting files for various editors;
- The TextMate (`.tmbundle`) syntax was last update 9 months ago
in c2029cb257, but this was a stale
pull request from 2018, so at least 7 Years behind on updates to
the syntax.
- The vim syntax is now integrated in upstream, and our copy was
remove 6 Years ago in 5511f45767.
- The Nano syntax was added 10 Years ago in 76bc44fb91,
and received an update 9 Years ago in 4cb71f8082,
and received no contributions since.
- The kate syntax was already unmaintained, and removed 9 Years ago
in a2f695d7fa.
I think it's fair to state that these are unmaintained and severely outdated.
I _do_ think it would be good to have maintained versions of such files,
as it can improve the experience for users. However, this would be more
suitable for the BuildKit project, and I'm not sure if the current copies
of these files are a good starting point (if needed, they can still be
obtained from git history).
This patch removes the files.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image spec was moved to the github.com/moby/docker-image-spec repository,
and 03a17a2887 removed the files from the
moby repository, but left markdown files in place to point people to
the new location.
As these files were now moved internally, they no longer serve that purpose,
so we can remove them.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a `RouteType` type, type the related consts, and update the
`JoinInfo.AddStaticRoute` signature in the interface.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These use the Linux-specific values as convention, so unfortunately,
the syscall package doesn't define consts for these on Windows, so
keeping our own definition (values are not really relevant here).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a type to help discovery, and update the signatures of
`ResolveName`, `Network.ResolveName`, and `Sandbox.ResolveName`
accordingly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The wire type of Plugin.Config.Interface.Types is an array of strings,
not of objects with three properties. We just so happen to have a Go
struct type to represent a plugin-interface-type value in memory with
all the fields parsed out for convenience, but that is not part of the
REST API contract documented by the Swager spec.U pdate the Swagger spec
to correctly document that the Types property is an array of strings in
the API, while still generating Go definitions that unmarshal into the
convenient struct type.
Move the definition and marshal/unmarshal methods for
PluginInterfaceType into a more appropriate location than api/types.
Rename the type to one that does not stutter or overload already
heavily overloaded terminology.
Modernize the parser and use property-based testing to assert that it
behaves the same as the old parser for all well-formed inputs.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Modernize the field and allow using it as-is in some places, or
convert it to a string (which won't produce an error down the line).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's now only used to back the `Service.ResolveAuthConfig` method, and
not used outside of the package currently.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `session` struct was just bundling a http.Client with a v1Endpoint.
It was never a long-lived service; every use initialized the session,
only to call the `searchRepositories` method on it.
Dismantle it, and make it a regular function that gets a http.Client and
a v1Endpoint passed as argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We want to get rid of the use of using "registry.IndexInfo". Make the
function un-exported to discourage additional use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The distributionRouter receiver was not used; make it a regular function
to make clear it doesn't require the router.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove redundant if/else
- Move vars closer to where used now that we don't have the if/else.
- Touch-up error-message to remove engine version and update doc link to DeprecatedSchema1ImageError.
- Touch-up TODOs and add reference to help trace back what's meant.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is a wrapper for the libnetwork/internal/resolvconf package,
which is a modernized, more performant rewrite of the original parsing
code.
The libnetwork/resolvconf package was still maintained because it was
used by BuildKit, but since [moby/buildkit@3d43066], BuildKit maintains
its own copy of the internal package.
The only remaining uses of this package was as part of some tests (which
would also benefit of using the internal pacakge's implementation directly),
and a _single_ use of `resolvconf.Path` in the daemon, which cannot use
the internal package currently because it's internal to libnetwork.
This patch:
- Removes all functions that were not used.
- Rewrites some tests in libnetwork to use the internal/resolvconf package
directly, instead of depending on the wrapper.
- Add TODOs to consider moving the "Path" function separate (which could
be in daemon/config if we consider it to be the default for the daemon's
resolvconf path configuration).
[moby/buildkit@3d43066]: 3d43066f2e
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was introduced in 1af76ef597
and based on the previous code in the daemon, which had platform-specific
handling for exec inspect in [setPlatformSpecificExecProcessConfig], which
was added in 5fa2e4d4f2 to account for
Windows not having "Privileged" and not setting the "User".
Given that "User" would be empty and "Privileged" not set, we may as well
combine both platforms, and just return the info we have.
[setPlatformSpecificExecProcessConfig]: 1af76ef597/daemon/exec_unix.go (L11-L21)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Looks like I accidentally added these 5 Years ago in
9f0b3f5609, and never
noticed.
Let's clean this up.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 3a447bc079.
Some daemon versions don't handle empty values well, which resulted in
an io.EOF error when sending an empty X-Registry-Auth during decoding
or unmarshaling.
We should investigate what code-paths are hit to trigger this, but
in the meantime, let's revert this patch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Staticcheck is suggesting to cast the type or to directly copy, but
doesn't account for nat.SortPortMap mutating the second argument, so
mutating the HostConfig.PortBindings. From the code, it looks like the
intent here was to prevent that (creating a deep copy), so let's keep
that.
daemon/container_operations.go:109:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
daemon/network.go:952:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to 494677f93f, which added
the aliases, but did not yet replace our own use of the nat types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to update code to not be attached to go-connections
directly (in future we may be able to move the types to be concrete
types).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was an adaptor around DisplayJSONMessagesStream for CLI-specific
primitives that was used in the CLI, but can be implemented by users
of this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The API still returns it for backward-compatibility (but probably
shouldn't), but we should no longer print it. This removes the
use of these fields for printing, but keeps them for streamformatter
to use.
- ErrorMessage was deprecated in 3043c26419
- ProgressMessage was deprecated in 597e0e69b4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package depends on jsonformatter.JSONProgress and jsonmessage.JSONMessage,
and it looks like it requires some of those for their stringer interface.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the type to the API, but embed it, so that we keep the
methods on the struct in this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can probably use [aec.EmptyBuilder] for managing the output, but
currently we're doing it all manually, so defining some consts for
the basics we use.
[aec.EmptyBuilder]: https://pkg.go.dev/github.com/morikuni/aec#EmptyBuilder
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's only used by the client to support API versions older than v1.22.
Make it an internal utility that doesn't depend on internal fields of
`filter.Args`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external users, and this package still has too many different
responsibilities, some of which may be available elsewhere, so moving it
internal so that we can decide to dismantle it further.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the stub implementation for non-Windows platforms, and remove the
os.FileMode argument, which is ignored on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior, making
it not a good candidate to carry in the module.
This moves it to the daemon as a non-exported `resolveSymlinkedDirectory`
utility, so that it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior (including
some potentially surprising behavior), making it not a good candidate to
carry in the module.
This moves it internal to the daemon as a non-exported utility, so that
it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that it's part of the daemon, we can use the internal
package again to help discovery of rootless-specific codepaths
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both locations checked an error from `filepath.Rel` in stdlib, which
would never return a `system.XattrError`, so this was just dead code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The logdriver package should be moved to another external repository for
building plugins. While transitioning, move to internal package using
the same structure.
Signed-off-by: Derek McGowan <derek@mcg.dev>
CONFIG_MEMCG_SWAP has been deprecated since kernel v5.8-rc1 (commit 2d1c498) and removed since kernel v6.1-rc1 (commit e55b9f9).
Since kernel v5.8-rc1, swap tracking has been an integral part of memory control. CONFIG_MEMCG_SWAP becomes invisible to user and simply means CONFIG_MEMCG && CONFIG_SWAP.
Disable the check for kernel v5.8+.
Signed-off-by: 纯真 <38834411+chunzhennn@users.noreply.github.com>
This package is used internally by the daemon, and was only used out
side of the daemon by pkg/plugins (for which we still need to look
where it should be kept).
Making it internal because it's trivial to implement if needed by
anyone. The only reason it's a package is to keep it central, and
to make it easier to discover where we have rootlesskit-specific
codepaths in our codebase.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stdcopy moved to github.com/moby/moby/api/stdcopy, and the 28.4
transitional releasee will provide an alias for those that use
github.com/docker/docker as dependency, so we can remove the alias
for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stringid moved to github.com/moby/moby/client/pkg/stringid, and
the 28.4 transitional releasee will provide an alias for those that
use github.com/docker/docker as dependency, so we can remove the
alias for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is used by the daemon to produce a stack-dump, It has no
external consumers, so we can move it to daemon/internal.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The runconfig package is used by the "container" router to unmarshal, normalize,
and validate a container.CreateRequest. The router converts the result to a
backend.ContainerCreateConfig to be passed on to the backend (daemon).
This package could possibly be part of the router itself, or moved to an
internal package in the server, but we don't have an internal package
there yet.
Put it in daemon/internal for now, which still leaves our options open.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that we no longer need the ContainerDecoder interface, we can
simplify this to just a function; effectively the ContainerDecoder
had three tasks;
- decode a container.CreateRequest
- validate the hostConfig
- split the container.CreateRequest to Config, HostConfig, and NetworkingConfig
Rewrite this to a DecodeCreateRequest function that returns
a DecodeCreateRequest.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These types used to be internal to the container package, but were
moved to the API in 100102108b.
However, the `StateStatus` type is only used internally; it's used
as an intermediate type because [`container.State`] contains a sync.Mutex
field which would make copying it unsafe (see [moby@2998945]).
This moves the type and re-introduces an internal type
in the original location, effectively reverting
100102108b
[`container.State`]: 19e79906cb/container/state.go (L15-L23)
[moby@2998945]: 2998945a54
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These errors were not used as sentinel error, and used as any other
"invalid parameter" / "invalid argument" error, so remove them, and
just produce errors where used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since 28.0.0, an iptables rule related to SCTP has only been
included if escape hatch variable DOCKER_IPTABLES_SCTP_CHECKSUM=1
Nobody's reported that the escape hatch was needed, and the rule
it guards doesn't make sense. So, remove.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The "backend" types in API were designed to decouple the API server
implementation from the daemon, or other parts of the code that
back the API server. This would allow the daemon to evolve (e.g.
functionality moved to different subsystems) without that impacting
the API server's implementation.
Now that the API server is no longer part of the API package (module),
there is no benefit to having it in the API module. The API server
may evolve (and require changes in the backend), which has no direct
relation with the API module (types, responses); the backend definition
is, however, coupled to the API server implementation.
It's worth noting that, while "technically" possible to use the API
server package, and implement an alternative backend implementation,
this has never been a prime objective. The backend definition was
never considered "stable", and we don't expect external users to
(attempt) to use it as such.
This patch moves the backend types to the daemon/server package,
so that they can evolve with the daemon and API server implementation
without that impacting the API module (which we intend to be stable,
following SemVer).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The postCommit used the container-decoder from runconfig to unmarshal
the body. However, this function was written to decode a container
CreateRequest. Commit only accepts a container Config, so we can
just unmarshal to that type.
A local `commitRequest` type was added because the client posts a bare
`*container.Config` but it may be empty / nil (see [Client.ContainerCommit]
and [container.CommitOptions]), in which case it must be ignored, and no
overrides to be applied.
[Client.ContainerCommit]: c4afa77157/client/container_commit.go (L52)
[container.CommitOptions]: c4afa77157/api/types/container/options.go (L30)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some of these tests were making assumptions about the daemon's internals
by using `config.DefaultShmSize` from the daemon config package.
Rewrite them to start a daemon with a custom default, and verify the
tests to use that default.
This migrates the following tests from integration-cli to integration;
- `DockerAPISuite.TestPostContainersCreateShmSizeNegative`
- `DockerAPISuite.TestPostContainersCreateShmSizeHostConfigOmitted`
- `DockerAPISuite.TestPostContainersCreateShmSizeOmitted`
- `DockerAPISuite.TestPostContainersCreateWithShmSize`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The replacement is also deprecated, but at least returns a strong type,
which may help transitioning to using an api-client for these, and
removing one abstraction at a time.
Also rewriting the TestContainerAPIDeleteRemoveVolume to use the API
client (as it's part of the API suite), and touched-up the
TestRunMountShmMqueueFromHost test a bit.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was a very shallow wrapper around reading the response
headers, and querying those directly is more transparent.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It took me some time to find these commands because they were not named
after their canonical name, unlike (most) other commands.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that the types for the backend were moved to api/types/backend,
we can move the actual response-type and related options to
api/types/system.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While it is imported by both the client and the daemon, values of the
PluginCreateOptions struct are not marshaled or unmarshaled. The only
field is mapped to and from an HTTP query parameter. Furthermore, this
options type is the odd one out: the daemon uses types in
api/types/backend to pass options around for the other plugin lifecycle
operations. Move the PluginCreateOptions type into client, and define a
new PluginCreateConfig struct in api/types/backend for the daemon to use
alongside PluginRmConfig, PluginEnableConfig and PluginDisableConfig.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stringid package is used in many places; while it's trivial
to implement a similar utility, let's just provide it as a utility
package in the client, removing the daemon-specific logic.
For integration tests, I opted to use the implementation in the
client, as those should not ideally not make assumptions about
the daemon implementation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Because:
- it's the last thing outside 'daemon/' that uses libnetwork's
resolvconf package
- there's better coverage of the host resolv.conf transformations
in the resolvconf package's unit tests
- there are integration tests that don't modify the test host's
resolv.conf file in 'integration/networking/resolvconf_test.go'
Signed-off-by: Rob Murray <rob.murray@docker.com>
It's not really a helper, and it's trivial to inline it;
registry/registry_test.go:366:19: test helper function should start from t.Helper() (thelper)
testIndexInfo := func(t *testing.T, config *serviceConfig, expectedIndexInfos map[string]*registry.IndexInfo) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/auth.go:43:31: import-shadowing: The name 'auth' shadows an import name (revive)
func NewStaticCredentialStore(auth *registry.AuthConfig) auth.CredentialStore {
^
registry/auth.go:63:7: unused-receiver: method receiver 'scs' is not referenced in method's body, consider removing or renaming it as _ (revive)
func (scs staticCredentialStore) SetRefreshToken(*url.URL, string, string) {
^
registry/auth.go:143:40: import-shadowing: The name 'transport' shadows an import name (revive)
func PingV2Registry(endpoint *url.URL, transport http.RoundTripper) (challenge.Manager, error) {
^
registry/registry_mock_test.go:85:22: response body must be closed (bodyclose)
res, err := http.Get(makeURL("/v1/_ping"))
^
registry/search_session.go:222:96: integer-format: fmt.Sprintf can be replaced with faster strconv.Itoa (perfsprint)
u := r.indexEndpoint.String() + "search?q=" + url.QueryEscape(term) + "&n=" + url.QueryEscape(fmt.Sprintf("%d", limit))
^
registry/auth.go:134:24: import-shadowing: The name 'url' shadows an import name (revive)
func ConvertToHostname(url string) string {
^
registry/search_endpoint_v1.go:61: line-length-limit: line is 437 characters, out of limit 200 (revive)
return nil, invalidParamf("invalid registry endpoint %s: %v. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry %s` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/%s/ca.crt", endpoint, err, endpoint.URL.Host, endpoint.URL.Host)
registry/search_endpoint_v1.go:166:17: import-shadowing: The name 'transport' shadows an import name (revive)
func httpClient(transport http.RoundTripper) *http.Client {
^
registry/search_session.go:239:26: ST1005: error strings should not be capitalized (staticcheck)
return nil, errUnknown{fmt.Errorf("Unexpected status code %d", res.StatusCode)}
^
registry/search_test.go:18:6: test helper function should start from t.Helper() (thelper)
func spawnTestRegistrySession(t *testing.T) *session {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/errors.go:11:2: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e := err.(type) {
^
registry/errors.go:13:3: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2 := e.Err.(type) {
^
registry/errors.go:15:4: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2.Code {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/config.go:267:46: captLocal: `URLHost' should not be capitalized (gocritic)
func isCIDRMatch(cidrs []*registry.NetIPNet, URLHost string) bool {
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 5f91c769f5, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 08654b0b30, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bf6d52bba1, but don't
think it was ever used; at least it's severely outdated, so let's
remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- refactor programIngressPorts to use Rule.Insert/Append/Delete for improved rule management
- split programIngress() and dependent functions on Add and Del functions
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
- Extract plumpIngressProxy steps in a separate function
- Don't create a new listener if there's already one in ingressProxyTbl
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
Make sure iptables rules are restored properly once firewalld
has deleted them.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
This type was deprecated in ca06b222e3,
and is no longer used. Now that the API is in a new module, we can
remove the alias.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to fcc8209e12, which didn't
make the window for API v1.51, so had to be adjusted for the API
version it requires.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The strslice.StrSlice type is a string-slice with a custom JSON Unmarshal
function to provide backward-compatibility with older API requests from
before docker 1.7 (see [moby@17d6f00] and [moby@ea4a067]), which used a
string instead of an array of strings for some fields (Cmd, Entrypoint).
We no longer support those API versions, and we no longer support pulling
v1 images that may contain such a config, so we can remove these tests that
validate the behavior as they're invalid API requests.
This;
- removes DockerAPISuite.TestPostContainerAPICreateWithStringOrSliceEntrypoint
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCmd
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCapAddDrop
- updates DockerAPISuite.TestContainerAPIPostCreateNull, which used an invalid example
[moby@17d6f00]: 17d6f00ec2
[moby@ea4a067]: ea4a06740b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This interface was marked deprecated in 2997c0ddc0.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in 639a1214fa.
Now that the client is in a new module, we can remove the old.
This;
- Removes the `Client.ImageInspectWithRaw` implementation.
- Removes `ImageAPIClient.ImageInspectWithRaw` from the `ImageAPIClient` interface.
- Removes `APIClient.ImageInspectWithRaw` from the `APIClient` interface.
- Removes `ImageAPIClientDeprecated.ImageInspectWithRaw` from the `ImageAPIClientDeprecated`.
- Removes the `ImageAPIClientDeprecated` interface.
Note that the `ImageAPIClientDeprecated` interface itself was not marked
as deprecated, but it has no known external users, and it has no remaining
definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was marked deprecated in 7aa7369f1f,
and is no longer used.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was only used internally, and marked deprecated in
846b2272e6.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `NewClient` and `NewEnvClient` function were deprecated in 2018
through 772edd020c, with the deprecation
message updated in a68ae4a2d9 and
6b9968e8b1 to make sure it's properly
identified as deprecated.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 20d594fb79, but was
written before the API module was added. Now that the API is a separate
module, the check will no longer flag packages importing the API.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Merge the matchAllWithPreference matcher into the matchAnyWithPreference
matcher to reduce code duplication and simplify the code.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Currently the image export and load APIs can be used to export or load all
platforms for the image, or a single specified platform.
This commit updates the API so that it accepts a list of platforms to export or
load, thereby giving clients the ability to export only selected platforms of an
image into a tar file, or load selected platforms from a tar file.
Unit and integration tests were updated accordingly.
As this requires a daemon API change, the API version was bumped.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Before this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
error during connect: Get "http://example.invalid:2375/docker/v1.51/version": dial tcp: lookup example.invalid: no such host
With this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
failed to connect to the docker API at tcp://example.invalid:2375/docker: lookup example.invalid: no such host
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this change, a generic "Cannot connect to the docker daemon" error
was produced which, while helpful, instructed the user to check if the daemon
was running, but didn't provide context on the reason we failed (i.e., the
socket was not found).
This patch adds a dedicated check for cases where the socket was not found,
and preserves the original error.
Before this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
Cannot connect to the Docker daemon at unix:///var/run/no.sock. Is the docker daemon running?
With this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
failed to connect to the docker API at unix:///var/run/no.sock; check if the path is correct and the daemon is running: dial unix /var/run/no.sock: connect: no such file or directory
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, we were using os.IsPermission, which doesn't unwrap errors;
change to use `errors.Is` to detect permission errors, and unwrap the
error to remove information about the request, which is irrelevant if
we weren't able to connect in the first place.
Also tweak the error slightly to not assume "docker socket", instead
mentioning "docker API".
Before this;
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version": dial unix /var/run/docker.sock: connect: permission denied
With this patch applied:
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock: dial unix /var/run/docker.sock: connect: permission denied
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Packets with the given firewall mark are accepted by the bridge
driver's filter-FORWARD rules.
The value can either be an integer mark, or it can include a
mask in the format "<mark>/<mask>".
Signed-off-by: Rob Murray <rob.murray@docker.com>
While the container package had a type for `ExecInspect`, this type only
contained the information currently used by the client, which was a subset
of the information returned by the API endpoint;
curl --unix-socket /var/run/docker.sock http://localhost/v1.51/exec/2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9/json | jq .
{
"ID": "2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9",
"Running": true,
"ExitCode": null,
"ProcessConfig": {
"tty": true,
"entrypoint": "bash",
"arguments": [],
"privileged": false
},
"OpenStdin": true,
"OpenStderr": true,
"OpenStdout": true,
"CanRemove": false,
"ContainerID": "8b7cd6b151613ccc20ebe9fc24d72cc7865b04c592848ab1415a80da9b315479",
"DetachKeys": "EBE=",
"Pid": 19964
}
The API documentation for the endpoint documented the full response, but
we did not have a type for this, other than a type used by the backend.
This patch adds a type for the response. It currently aliases the backend
type to this type to preserve backward compatibility (and allow the API
module to be used in older branches). We can probably switch the backend
to use this type directly though (unless we want the backend to be
decoupled from the API response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When an endpoint in a gateway mode "nat" network is selected
as a container's default gateway, the bridge driver sets up
bindings between host and container ports (NAT, userland proxy
etc).
When gateway mode "routed" was added as an alternative to
the default "nat" mode - port bindings followed the same rules.
But, unlike "nat" mode, there's no host port binding to set
up - there's routing between remote client and the container,
so it doesn't matter what the default gateway is.
So, in "routed" mode, set up the rules to make a container's
published ports accessible when the endpoint is added, and
remove those rules when the endpoint is removed (when the
container is disconnected from the endpoint's network).
Port mappings are only provided by ProgramExternalConnectivity,
they can't be set up during the Join. So, include routed
bindings in the port bindings mode that's stored as part of
endpoint state - and use that to work out whether to add or
remove bindings.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The libnetwork controller naively handled events for endpoint_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, adding a new
service binding without removing the old one. This would
have various side effects, such as having the "transient state" of
having multiple conflicting service bindings where more than one
endpoint is assigned an IP address never settling.
Modify the libnetwork controller to handle an UPDATE by removing the
previous service binding then adding the new one.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The overlay driver naively handled events for overlay_peer_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, inserting a new
entry into peerDB without removing the old one. This would
have various side effects, such as having the "transient state" of
multiple entries in peerDB with the same peer IP never settle.
Update driverapi to pass both the previous and new value of a table
entry into the driver. Modify the overlay driver to handle an UPDATE by
removing the previous peer entry from peerDB then adding the new one.
Modify the Windows overlay driver to match.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Windows and Linux overlay driver instances are interoperable, working
from the same NetworkDB table for peer discovery. As both drivers
produce and consume serialized data through the table, they both need to
have a shared understanding of the shape and semantics of that data.
The Windows overlay driver contains a duplicate copy of the protobuf
definitions used for marshaling and unmarshaling the NetworkDB peer
entries for dubious reasons. It gives us the flexibility to have the
definitions diverge, which is only really useful for shooting ourselves
in the foot.
Make daemon/libnetwork/drivers/overlay the source of truth for the peer
record definitions and the name of the NetworkDB table for distributing
peer records.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The macAddr and ipmac types are generally useful within libnetwork. Move
them to a dedicated package and overhaul the API to be more like that of
the net/netip package.
Update the overlay driver to utilize these types, adapting to the new
API.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Overlay is the only driver which makes use of the EventNotify facility,
yet all other driver implementations are forced to provide a stub
implementation. Move the EventNotify and DecodeTableEntry methods into a
new optional TableWatcher interface and remove the stubs from all the
other drivers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When handling updates to existing entries, it is often necessary to know
what the previous value was. NetworkDB knows the previous and new values
when it broadcasts an update event for an entry. Include both values in
the update event so the watchers do not have to do their own parallel
bookkeeping.
Unify the event types under WatchEvent as representing the operation kind
in the type system has been inconvenient, not useful. The operation is
now implied by the nilness of the Value and Prev event fields.
Signed-off-by: Cory Snider <csnider@mirantis.com>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The bridge driver currently determines if hairpin mode is enabled by
checking whether the userland proxy is enabled, and if the binary path
is set to a non-empty string. It's used (amongst other things) by the
driver to decide whether 6-to-4 portmappings are supported, while it
normalizes port bindings.
As the userland proxy is going to be handled by the nat portmapper,
proxy-related params will be removed from the bridge driver, but the
port binding normalization will stay in the bridge driver.
So, introduce a new Hairpin config flag, and reimplement the original
logic in the daemon, when creating the bridge config.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The two unexported fields of portBindingReq (ChildHostIP and DisableNAT)
are temporarily exported. DisableNAT will be replaced in a future commit
by a 'Mapper' field indicating which portmapper should be used (e.g.
'nat' or 'routed').
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This code has various other issue, for which TODOs were added; this
commit only does some initial cleaning up, and improves docs and
test-coverage.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stdcopy package is used to produce and read multiplexed streams for
"attach" and "logs". It is used both by the API server (to produce), and
the client (to read / de-multiplex).
Move it to the api package, so that it can be included in the api module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests don't account well for submodules and are not needed when
importers are using go modules. The tests are still relevant in the 28
branch which does not use go modules.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The ContainerConfigWrapper type was deprecated and removed; refer
to the correct type (container.CreateCreateRequest).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bb899c654a,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `RequestPrivilegeFunc` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in b99b5422b0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `IDResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 1abc8f6158,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `ContainerJSONBase`, `ContainerJSON` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 05b0e653dd,
which shipped in the latest v28.x releases, so we can remove these.
This removes the Container type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 84ffc644ef,
which shipped in the latest v28.x releases, so we can remove these.
This removes the ContainerState type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in df22a511cb,
which shipped in the latest v28.x releases, so we can remove these.
This removes the NetworkSettings, NetworkSettingsBase, DefaultNetworkSettings,
and SummaryNetworkSettings types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in c130ce1f5d,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `Health` and `HealthcheckResult` types to the container package,
as well as the related `NoHealthcheck`, `Starting`, `Healthy`, and `Unhealthy`
consts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5517322cf9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.MountPoint`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in e12b7493b9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.Port`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in da039ca918,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.GraphDriverData`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 7053007f71,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ImageInspect` and
`RootFS`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 23117afca8,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.SecretCreateResponse` and
`SecretListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in a411a39be0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ConfigCreateResponse` and
`ConfigListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in f008d85edc,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.NodeListOptions` and
`NodeRemoveOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5ad0867236,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.TaskListOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 31d62930f7,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ServiceCreateOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 0b1c7a8306,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ServiceUpdateOptions`
- `RegistryAuthFromSpec`
- `RegistryAuthFromPreviousSpec`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in b13528522a,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.ServiceListOptions` and
`api/types.ServiceInspectOptions` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in 7e8f630bec,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.SwarmUnlockKeyResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in eefe68a37c,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `BuildCache`
- `BuildCachePruneOptions`
- `BuildCachePruneReport`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in bb7dbaafcd,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.BuildResult` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 3d1e4d9002,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ImageBuildOptions`
- `ImageBuildOutput`
- `ImageBuildResponse`
- `BuilderVersion`
- `BuilderV1`
- `BuilderBuildKit`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to maintain GoDoc in a single place, and for
"Kill" and "Alive" to have consistent error-handling (Windows
does not support negative process-IDs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Originally I've found this datarace on a project I'm working at. I'm not
able to consistently reproduce this. But by looking at the codebase I
took a chance to fix other 2 possible function that might produce such
data race.
Original stack trace produced when running `go test -race` on GH CI:
```
WARNING: DATA RACE
Write at 0x00c0005dc688 by goroutine 43:
github.com/docker/docker/client.(*Client).negotiateAPIVersionPing()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:389 +0x12f
github.com/docker/docker/client.(*Client).checkVersion()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:298 +0x249
github.com/docker/docker/client.(*Client).getAPIPath()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:307 +0x76
github.com/docker/docker/client.(*Client).sendRequest()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:111 +0x9b
github.com/docker/docker/client.(*Client).get()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:28 +0x736
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:47 +0x6f0
Previous read at 0x00c0005dc688 by goroutine 42:
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:39 +0x5ef
```
Co-authored-by: Luca Rinaldi <lucarin@protonmail.com>
Signed-off-by: Alessio Perugini <alessio@perugini.xyz>
- Get dependent containers before starting containers
- Dependent containers can be either from legacy link or container network
- Wait on a best effort basis for the dependent containers
Fixes: #50326
Signed-off-by: Adrien Pompée <adrien.pompee@atmosphere.aero>
This const is no longer used and will be removed in the next release.
Also fixed a var that shadowed a type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the daemon and API migrating to separate modules, users of the daemon
module may upgrade the API module to higher versions. Currently, the daemon
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Daemon
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the daemon/config package that is
used as default version of the API for the daemon to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
#27 94.97 executor/oci/internal/resolvconf/resolvconf.go:461:6: the error type name `systemErr` should conform to the `xxxError` format (errname)
#27 94.97 type systemErr struct{ error }
#27 94.97 ^
Also fix an unhandled error; we don't need a defer() for that one
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite this function to not use text/template, which is ~74× faster,
~25× less memory, and ~56× fewer allocations.
Before/After:
BenchmarkGenerate-10 42550 27439 ns/op 18083 B/op 394 allocs/op
BenchmarkGenerate-10 3148328 373 ns/op 712 B/op 7 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the client and API migrating to separate modules, users of the Client
module may upgrade the API module to higher versions. Currently, the Client
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Client
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the client package that is
used as default version of the API for the client to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image load is only used by integration tests but the specialimage
testutils package used by many different tests. The image load relies on
the client which creates a transitive client dependency from the daemon
packages.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Currently, EncodeAuthConfig always returns a base64url-encoded JSON
doc, even if an empty auth-config passed. As a result, it's more
complicated to detect if authentication was present.
This patch changes the behavior to return an empty string for these
cases so that teh client can skip setting the `X-Registry-Auth` header,
and the daemon can detect whether authentication is sent or not.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the special condition needed to run Windows integration tests
with the containerd integration enabled in addition to the graphdriver.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The property test for the mRandomNodes function revealed that it may
sometimes pick out a sample of fewer than m nodes even when the number
of nodes to pick from (excluding the local node) is >= m. Rewrite it
using a random shuffle or permutation so that it always picks a
uniformly-distributed sample of the requested size whenever the
population is large enough.
Signed-off-by: Cory Snider <csnider@mirantis.com>
TestNetworkDBAlwaysConverges will occasionally find a failure where one
entry is missing on one node even after waiting a full five minutes. One
possible explanation is that the selection of nodes to gossip with is
biased in some way. Test that the mRandomNodes function picks a
uniformly distributed sample of node IDs of sufficient length.
The new test reveals that mRandomNodes may sometimes pick out a sample
of fewer than m nodes even when the number of nodes to pick from
(excluding the local node) is >= m. Put the test behind an xfail tag so
it is opt-in to run, without interfering with CI or bisecting.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a property-based test which asserts that a cluster of NetworkDB
nodes always eventually converges to a consistent state. As this test
takes a long time to run it is build-tagged to be excluded from CI.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Integration tests should not be using daemon internals. Since this is
testing against regression and the relevant code has a feature freeze on
it, this test can be removed. The test is not relevant with containerd,
which has more protection against these cases through gc.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Before ea29dffaa5, the image create endpoint
had a [fallback for very old client versions][1] that would send authentication
as body instead of through the `X-Registry-Auth` header.
However, the implementation of this fallback did not handle empty bodies,
resulting in an `io.EOF` error to be returned when trying to parse the
body as JSON.
In practice, this problem didn't happen when using the CLI, because even
if no authentication was present, `registry.EncodeAuthConfig()` (used by
the CLI to set the `X-Registry-Auth` header) would produce an empty JSON
document (`{}`), which would be encoded in base64 (`e30=`), so we would
never set an empty `X-Registry-Auth` (but other clients may have hit this
situation). That behavior was unexpected, because not all registries require
authentication, and omitting the `X-Registry-Auth` should be valid. We
also want to have more flexibility in authentication (and being able to
distinguish unauthenticated requests, so that we can fallback to
alternative paths).
Unfortunately, we can't change existing daemons, so must account for the
faulty fallback. Currently, omitting the `X-Registry-Auth` produces an
error, but we can avoid this by unconditionally sending a body, which
may be an empty JSON document (`{}`).
I explored possible options for this; we can either construct our own
empty JSON (`json.RawMessage("{}")`) to be explicit that we're sending
empty JSON, but [`encodeBody()`][2] is currently hard-coded to expect
JSON requests, and unconditionally calls [`encodeData`][3], which
encodes to JSON, so we may as well take advantage of `http.NoBody`,
which gets marshaled to an empty JSON document;
https://go.dev/play/p/QCw9dJ6LGQu
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
body, _ := json.Marshal(http.NoBody)
fmt.Println(string(body))
}
Before this patch, a client omitting `X-Registry-Auth` (and no body)
would produce an error;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
Error response from daemon: bad parameters and missing X-Registry-Auth: invalid X-Registry-Auth header: EOF
With this patch applied, no error is produced;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
The push refers to repository [127.0.0.1:5001/myimage]
189fdd150837: Pushed
latest: digest: sha256:68a0d55a75c935e1101d16ded1c748babb7f96a9af43f7533ba83b87e2508b82 size: 610
[1]: 63fcf7d858/api/types/registry/authconfig_test.go (L109-L114)
[2]: 63fcf7d858/client/request.go (L67-L87)
[3]: 63fcf7d858/client/request.go (L296-L304)
[4]: ea29dffaa5
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This new struct allocates ports from the operating system by creating
sockets and binding them. It's based on the existing bindTCPOrUDP and
bindSCTP functions previously defined in the bridge driver. It tries to
detect conflicts on best effort basis, and doesn't guarantee that the
ports it allocates are not in use by other processes.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Use doc-links for references to other types.
- Fix reference to "types.HijackedConnection", which doesn't exist.
- Use a bullet-list for the different stream formats used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The registry package is used in docker/cli, and currently depends on
pkg/homedir. This package was anly used when running with rootlesskit,
which only is supported on Linux; on other platforms, homedir.GetConfigHome
would return an error;
abba330bbf/pkg/homedir/homedir_others.go (L24-L27)
Replace homedir.GetConfigHome with os.UserConfigDir from stdlib, which
is similar, with exception of not falling back to `getent` for
resolving the user's homedir, which would be a corner-case.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The previous implementation generated layer names based on container ID
and source image, which would cause conflicts when mounting the same
image to multiple destinations within a container.
This fixes the issue by changing the layer naming strategy to include
the destination path in the layer name, making it unique for each mount
point.
To avoid filesystem paths producing unexpected names, the combined
string is hex-encoded and used as a layer name.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change changes the default for noOverwriteDirNonDir to be true
internally, with the intent to change the default at the API to follow
accordingly.
The `AllowOverwriteDirWithFile` option in the Client was added when
reimplementing the CLI using the API Client lib in [moby@1b2b91b].
Before that refactor, the `noOverwriteDirNonDir` query argument
[would be set unconditionally][1] by the CLI, with no options to
control the behavior.
The `noOverwriteDirNonDir` query parameter was added in [moby@db9cc91] to
set the `NoOverwriteDirNonDir` option that was implemented in pkg/archive
in [moby@a74799b].
It was added in [PR13171-comment2], following a discussion on the risk
of replacing a directory with a file and vice-versa in [PR13171-comment].
> In my latest changes from yesterday:
>
> - Removed the `GET stat-path` endpoint and added a `HEAD` handler to
> the `archive-path` endpoint. Updated the api docs to reflect this.
> Also moved api docs changes from `v1.19` to `v1.20`.
> - Added a `NoOverwriteDirNonDir` flag to `archive.TarOptions` to indicate
> that we do not want to overwrite a directory with a non-directory (and
> vice versa) when unpacking an archive.
> - Added a corresponding but optional `noOverwriteDirNonDir` parameter
> to the `PUT extract-to-dir` endpoint to specify desired behavior.
>
> These changes combine to keep the behavior we want
It's unclear why these were added as an *option* and why it was implemented
as opt-in (not opt-out), as overwriting a file with a directory (or vice-versa)
would generally be unexpected behavior.
[1]: 8c9ad7b818/api/client/cp.go (L345-L346)
[moby@1b2b91b]: 1b2b91ba43
[moby@a74799b]: a74799b701
[moby@db9cc91]: db9cc91a9e
[PR13171-comment]: https://github.com/moby/moby/pull/13171#issuecomment-106559765
[PR13171-comment2]: https://github.com/moby/moby/pull/13171#issuecomment-108538643
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is failing frequently (50%) on Windows;
=== FAIL: github.com/docker/docker/integration/container TestExecResize/success (0.01s)
exec_test.go:144: assertion failed: error is not nil: Error response from daemon: NotFound: exec: '9c19c467436132df24d8b606b0c462b1110dacfbbd13b63e5b42579eda76d7fc' in task: '7d1f371218285a0c653ae77024a1ab3f5d61a5d097c651ddf7df97364fafb454' not found: not found
Let's keep the test, but log the failure and skip on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These functions were used internally to keep track of whether containerd
was enabled as runtime on Windows; move it to libcontainerd.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was failing frequently on Windows, waiting for the state
of the container to be "running" after restarting, however, this
would race because the command of the container was very short-lived;
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIRestartSuite/TestRestartStoppedContainer (37.00s)
docker_cli_restart_test.go:42: assertion failed: error is not nil: condition ""true" == "false"" not true in time (20s)
Ironically, that check was added in 48ccdd46ae
to make the test less flaky.
This patch takes the approach from TestRestartRunningContainer, which had
similar issues on Windows that were addressed in bae22d167c
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`Daemon.Stop()` is called in teardown of tests, resulting in a lot of noise;
docker_cli_network_unix_test.go:52: [d124e10f67e01] daemon is not started
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
docker_cli_external_volume_driver_test.go:59: [d50e371ba1d6f] daemon is not started
Let's ignore if the daemon is already stopped, as that's what we want to here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was testing a non-gracceful kill od the daemon, after which it
started it again, however `d.Stop()` would log that the daemon wasn't running,
which is expected, so let's reduce noise;
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test depended on the container to die after running the `true` command,
but this condition failed frequently on Windows 2025.
=== Failed
=== FAIL: github.com/docker/docker/integration/container TestRemoveContainerWithVolume (32.68s)
remove_test.go:61: timeout hit after 10s: waiting for container State.Status to be 'exited', currently 'running'
While this may be revealing an actual issue (and we should have a test for
that), it's irrelevant for this test, which;
- creates and starts a container with an anonymous volume
- verifies the anonymous volume was created
- removes the container
- verifies the anonymous volume was removed
We can force-remove the container to kill, and removed it; we probably
could've sufficed with "container create" (without starting), but it's
good to add extra coverage, in case running the container impacts whether
we're able to remove the volume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make sure we have basic coverage for this function; integration-cli may
have additional tests covering this as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Add test for privileged containers
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 44b653ef99, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in df662ebc59, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in 100102108b, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in a63ff8da46, but looks
like the only reason was to just have the var initialized, so let's
do so when we create the var.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These fields were deprecated in 1932091e21,
which is part of v28. They were kept in place for responses in older API
versions, but no longer used since 7d9c50db2b,
which implemented a fallback without requiring the fields to be present.
This patch:
- removes `ServiceConfig.AllowNondistributableArtifactsCIDRs`
- removes `ServiceConfig.AllowNondistributableArtifactsHostnames`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in b633c4cc33, which was
in v28, and no longer has any consumer, so we can remove it.
Now that we no longer have to synchronise `CertsDir` with `SetCertsDir`
we can also remove the synchronization (`homedir.GetConfigHome()` does
some additional lookups, but those usually are just looking up env-vars,
and `user.Current()` already has a `sync.Once` or equivalent). Also
unifying the platform-specific code to remove some abstraction and put
the logic in plain sight.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in dd7ab0e82b which was
in v28, and no longer has any consumer, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the only non-daemon import of the image package. The platform
type is also the better type to use.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The writeToStore() call was removed from CreateNetwork in
commit 0fa873c0fe. The comment about
undoing the write is no longer applicable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Legacy links were set up by ProgramExternalConnectivity, but
removed by Leave (rather than RevokeExternalConnectivity). The
options needed by legacy links are all available in Join, and
Join will only be called once per Endpoint. So, create legacy
links there.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Change the semantics of ProgramExternalConnectivity, libnet
can now call it whenever an endpoint is selected or deselected
as a container's gateway endpoint.
It's the driver's responsibility to remember what bindings it's
set up, and to work out what needs to change.
So, calling ProgramExternalConnectivity to tell the driver
an endpoint is no longer a gateway has the same effect as
RevokeExternalConnectivity - bindings need to be removed.
That means libnet no longer needs to work out whether to
Program/Revoke, it can just call ProgramExternalConnectivity.
RevokeExternalConnectivity has been removed.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The concurrency control in the overlay driver is logically unsound.
While the use of mutexes is sufficient to prevent data races --
violations of the Go memory model -- many operations which need to be
atomic are performed with unbounded concurrency.
Overhaul the use of locks in the overlay network driver. Implement sound
locking at the network granularity: operations may proceed concurrently
iff they are being applied to distinct networks. Push the responsibility
of locking up to the code which calls methods or accesses struct fields
to avoid deadlock situations like we had previously with
d.initSandboxPeerDB() and to make the code easier to reason about.
Each overlay network has a distinct peer db. The NetworkDB watch for the
overlay peer table for the network will only start after
(*driver).CreateNetwork returns and will be stopped before libnetwork
calls (*driver).DeleteNetwork, therefore the lifetime of the peer db for
a network is constrained to the lifetime of the network itself. Yet the
peer db for a network is tracked in a dedicated map, separately from the
network objects themselves. This has resulted in a parallel set of
mutexes to manage concurrency of the peer db distinct from the mutexes
for the driver and networks. Move the peer db for a network into a field
of the network struct and guard it from concurrent access using the
per-network lock. Move the methods for manipulating the peer db into the
network struct so that the methods can only be called if the caller has
a reference to the network object.
Network creation and deletion are synchronized using the driver-scope
mutex, but some of the kernel programming is performed outside of the
critical section. It is possible for network deletion to race with
recreating the network, interleaving the kernel programming for the
network creation and deletion, resulting in inconsistent kernel state.
Parallelize network creation and deletion soundly. Use a double-checked
locking scheme to soundly handle the case of concurrent CreateNetwork
and DeleteNetwork for the same network id without blocking operations
on other networks. Synchronize operations on a network so that
operations on the network such as adding a neighbor to the peer db are
performed atomically, not interleaved with deleting the network.
Signed-off-by: Cory Snider <csnider@mirantis.com>
There is a dedicated mutex for synchronizing access to the encrMap.
Separately, the main driver mutex is used for synchronizing access to
the encryption keys. Their use is sufficient to prevent data races (if
used correctly, which is not the case) but not logical race conditions.
Programming the encryption parameters for a peer can race with
encryption keys being updated, which could lead to inconsistencies
between the parameters programmed into the kernel and the desired state.
Introduce a new mutex for synchronizing encryption operations. Use that
mutex to synchronize access to both encrMap and keys. Handle encryption
key updates in a critical section so they can no longer be interleaved
with kernel programming of encryption parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
func (*driver) secMapWalk is a curious beast. It is named walk, yet it
also mutates the collection being iterated over. It returns an error,
but that error is always nil. It takes a callback that can break
iteration, yet the only caller makes no use of that affordance. Its
utility is limited and the abstraction hinders readability more than it
helps. Open-code the d.secMap.nodes loop into
func (*driver) updateKeys(), the only caller.
Signed-off-by: Cory Snider <csnider@mirantis.com>
bindHostPorts currently handles both NATed and routed port mappings.
Split this into two separate functions, one for each type of mapping.
This will help split portmappers.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Port bindings are currently sorted — to form groups that should be
mapped in one go — and then normalized by `configurePortBindingIPv[4|6]`.
However, gw_modes might not be the same for IPv4/v6, so the upcoming
split of NATed / routed portmappers will require that they're processed
independently.
With this commit, PBs are now normalized (by calling the `configure...`
funcs), and then sorted. The sort func is updated to group routed PBs.
`needSamePort` was comparing the container's IP address, but this field
was never set by the time it's called. Now it's set, and has a different
value when IPv4 / IPv6 portmappings are mixed, so remove it from the
comparison.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Since commit b3fabedec, the bridge driver maps ports following a 3-step
process: 1. create a socket, and bind it to the host port; 2. create
iptables rules; 3. start the userland proxy (if it's enabled). This
ensures that the port is really free before inserting iptables rules
that could otherwise disrupt host services.
However, this 3-step process wasn't implemented for SCTP, because we had
no way to instiantiate an SCTP listener from an fd. Since
github.com/ishidawataru/sctp@4719921f9, we can.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5
This minor releases include 1 security fixes following the security policy:
- cmd/go: unexpected command execution in untrusted VCS repositories
Various uses of the Go toolchain in untrusted VCS repositories can result in
unexpected code execution. When using the Go toolchain in directories fetched
using various VCS tools (such as directly cloning Git or Mercurial repositories)
can cause the toolchain to execute unexpected commands, if said directory
contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
repository). This is due to how the Go toolchain attempts to resolve which VCS
is being used in order to embed build information in binaries and determine
module versions.
The toolchain will now abort attempting to resolve which VCS is being used if it
detects multiple VCS configuration metadata in a module directory or nested VCS
configuration metadata (such as a '.git' directoy in a parent directory and a
'.hg' directory in a child directory). This will not prevent the toolchain from
building modules, but will result in binaries omitting VCS related build
information.
If this behavior is expected by the user, the old behavior can be re-enabled by
setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
repositories.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
this issue.
This is CVE-2025-4674 and https://go.dev/issue/74380.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.5
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The TestNatNetworkICC and TestFlakyPortMappedHairpinWindows (TestPortMappedHairpinWindows)
tests were frequently failing on Windows with a context timeout;
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC/User_defined_nat_network (9.67s)
nat_windows_test.go:62: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/4357bd24c9b77b955ee961530d1f552ce099b3dcbeb396db599971b2396d8b08/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network mynat has active endpoints (name:"ctr2" id:"dc8d597dafef")
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC (18.34s)
=== FAIL: github.com/docker/docker/integration/networking TestFlakyPortMappedHairpinWindows (13.02s)
nat_windows_test.go:110: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/65207ae3d6953d85cd2123feac45af60b059842d570d4f897ea53c813cba3cb4/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network clientnet has active endpoints (name:"amazing_visvesvaraya" id:"18add58d415e")
These timeouts were set in c1ab6eda4b and
2df4391473, and were shared between Linux
and Windows; likely Windows is slower to start, so these timeouts to be
expected.
Let's increase the context timeout to give it a bit more time.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
NetworkDB's JoinNetwork function enqueues a message onto a
TransmitLimitedQueue while holding the NetworkDB mutex locked for
writing. The TransmitLimitedQueue has its own synchronization;
it locks its mutex when enqueueing a message. Locking order:
1. (NetworkDB).RWMutex.Lock()
2. (TransmitLimitedQueue).mu.Lock()
NetworkDB's gossip periodic task calls GetBroadcasts on the same
TransmitLimitedQueue to retrieve the enqueued messages. GetBroadcasts
invokes the queue's NumNodes callback while the mutex is locked. The
NumNodes callback function that NetworkDB sets locks the NetworkDB mutex
for reading to take the length of the nodes map. Locking order:
1. (TransmitLimitedQueue).mu.Lock()
2. (NetworkDB).RWMutex.RLock()
If one goroutine calls GetBroadcasts on the queue concurrently with
another goroutine calling JoinNetwork on the NetworkDB, the goroutines
may deadlock due to the lock inversion.
Fix the deadlock by caching the number of nodes in an atomic variable so
that the NumNodes callback can load the value without blocking or
violating Go's memory model. And fix a similar deadlock situation with
the table-event broadcast queues.
Signed-off-by: Cory Snider <csnider@mirantis.com>
With rejoinClusterBootStrap fixed in tests, split clusters should
reliably self-heal in tests as well as production. Work around the other
source of flakiness in TestNetworkDBIslands: timing out waiting for a
failed node to transition to gracefully left. This flake happens when
one of the leaving nodes sends its NodeLeft message to the other leaving
node, and the second is shut down before it has a chance to rebroadcast
the message to the remaining nodes. The proper fix would be to leverage
memberlist's own bookkeeping instead of duplicating it poorly with user
messages, but doing so requires a change in the memberlist module.
Instead have the test check that the sum of failed+left nodes is
expected instead of waiting for all nodes to have failed==3 && left==0.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The rejoinClusterBootStrap periodic task rejoins with the bootstrap
nodes if none of them are members of the cluster. It correlates the
cluster nodes with the bootstrap list by comparing IP addresses,
ignoring ports. In normal operation this works out fine as every node
has a unique IP address, but in unit tests every node listens on a
distinct port of 127.0.0.1. This situation causes the check to
incorrectly filter out all nodes from the list, mistaking them for the
local node.
Filter out the local node using pointer equality of the *node to avoid
any ambiguity. Correlate the remote nodes by IP:port so that the check
behaves the same in tests and in production.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When a node leaves a network, all entries owned by that node are
implicitly deleted. The other NetworkDB nodes handle the leave by
setting the deleted flag on the entries owned by the left node in their
local stores. This behaviour is problematic as it results in two
conflicting entries with the same Lamport timestamp propagating
through the cluster.
Consider two NetworkDB nodes, A, and B, which are both joined to some
network. Node A in quick succession leaves the network, immediately
rejoins it, then creates an entry. If Node B processes the
entry-creation event first, it will add the entry to its local store
then set the deleted flag upon processing the network-leave. No matter
how many times B bulk-syncs with A, B will ignore the live entry for
having the same timestamp as its local tombstone entry. Once this
situation occurs, the only way to recover is for the entry to get
updated by A with a new timestamp.
There is no need for a node to store forged tombstones for another
node's entries. All nodes will purge the entries naturally when they
process the network-leave or node-leave event. Simply delete the
non-owned entries from the local store so there is no inconsistent state
to interfere with convergence when nodes rejoin a network. Have nodes
update their local store with tombstones for entries when leaving a
network so that after a rapid leave-then-rejoin the entry deletions
propagate to nodes which may have missed the leave event.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use the media-types defined in containerd, and create a local copy
of the media-type for plugins, which is not defined in either the
OCI or containerd package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The current detection based on mediaType only accounted for the non-signed
mediatype (`application/vnd.docker.distribution.manifest.v1+json`), but
most (if not all) v1 images used the "signed" manifest type; for example;
docker buildx imagetools inspect docker:1.0.1
Name: docker.io/library/docker:1.0.1
MediaType: application/vnd.docker.distribution.manifest.v1+prettyjws
Digest: sha256:666987df8e0c46670ea52bcd078547297a738fd6b421ec77aac910e1c0f688fd
Various code-paths would still detect the unsupported type through type-
matching the `*schema1.SignedManifest` type, but given that the only reason
for this is to detect whether the image is supported, we might as well just
match the mediaType.
Unfortunately, the [containerd images package][1] currently only defines a
const for the signed variant, and not for the unsigned ones, so to remove
the dependency on the `schema1` package, this patch introduces a (temporary)
local definition.
With this patch, the dependency on the "schema1" package is removed, and with
that also the use of "libtrust"; the dependency still shows up in vendor.mod
due to the docker/distribution dependency not being a go module, but should
dissolve once we remove that dependency in future.
This patch can also be verified using the `distribution` endpoint, which
returns an error when trying to get information for a "v1" image;
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:1.0.1/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:1.0.1/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:00:18 GMT
< Content-Length: 311
{"message":"Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0.1 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/"}
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:28/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:28/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:01:06 GMT
< Content-Length: 541
{"Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:0a2ee60851e1b61a54707476526c4ed48cc55641a17a5cba8a77fb78e7a4742c","size":5165},"Platforms":[{"architecture":"amd64","os":"linux"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v6"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v7"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm64","os":"linux","variant":"v8"},{"architecture":"unknown","os":"unknown"}]}
[1]: https://github.com/containerd/containerd/blob/v2.1.3/core/images/mediatypes.go#L54-L55
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is verifying that push/pull works; current versions of the registry
used should support both the legacy (docker distribution) and OCI media-types,
so let's use the OCI types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Trying to reduce the places where we depend on the legacy distribution
dependency. For this test, we used it to generate the JSON for a manifest-list,
which we can do with the OCI types as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the code where used to allow producing logs customized to the
code-path performing the cleanup.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This removes the tarexporter.legacyLoadImage method and related helpers.
This functionality was added in 01ba0a935b
(docker v1.10), which introduced the new content-addressable image
format; this code provided backward-compatibility with older archives
which contained v0/v1 images.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Contribute a Wireshark plugin for decrypting and dissecting
hashicorp/memberlist messages. And contribue a plugin for dissecting the
NetworkDB messages transported as memberlist User messages.
Add a feature to NetworkDB to log the encryption keys to a file for the
Wireshark memberlist plugin to consume, configured using an environment
variable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
As of Go 1.17, `Setenv` can be used to set environment variables
specific to a single test. This also removes a package which gets
vendored just for this.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The same env-var is used for action/setup-go as for overriding
the default Go version in Dockerfiles, however action/setup-go
only accepts SemVer (e.g. 1.25.0-rc.1) whereas the official golang
image follows the Go project's versioning, which doesn't use
a SemVer-compatible format (go1.25rc1 / 1.25rc1).
Trying to use the same "GO_VERSION" value for both will therefore
fail.
As we're already updating the default version in the Dockerfile to
the version we want to use, let's remove the --build-arg, and use
the default that's set in the Dockerfile.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This endpoint was useful when libnetwork was a standalone component that
could be integrated with other products, but now that libnetwork is part
of moby/moby, and considered an internal package, we're sure that the
Engine's SIGUSR1 handler is available to dump stack traces. No need
to keep a duplicate feature.
Moreover, this endpoint is only available over an HTTP server listening
on 127.0.0.1 (hardcoded), and the stackdump is always written to the
disk. So, to have use of it, you need access to the host anyway.
Finally, unlike the Engine's SIGUSR1 handler, this endpoint write stack
traces to `/tmp` and not to the daemon's `--data-root`.
This is a non-core feature, there's an alternative available, it's not
documented in libnetwork/cmd/diagnostic/README.md (which is the
only place that mentions the diag server AFAIK), and the diag client
doesn't support it, so drop it unceremoniously.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When ProgramExternalConnectvity is called, the bridge driver
works out whether it needs to add port bindings for an endpoint
based on whether it was selected as the container's gateway.
Remember whether IPv4/IPv6 bindings have been set up, as part
of the endpoint's state. When ProgramExternalConnectivity is
called again, use differences between that stored state and
the newly requested state to decide whether to add bindings.
Port binding state is not persisted, on live-restore port
bindings are re-created (so, the initial state should always
be that no port bindings are set up).
Signed-off-by: Rob Murray <rob.murray@docker.com>
In the remote network driver's ProgramExternalConnectivity,
remember whether endpoints have already been configured as
gateways - so that it's ok for libnetwork to call it more
than once with the same configuration (without passing on
those calls to the actual network driver in HTTP requests).
There's no need to persist this data, even on live-restore
ProgramExternalConnectivity will be called again.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Moving towards making it the network driver's responsibility
to work out whether it should set up port bindings, based on
libnet's gateway selection.
This first step lets the driver know whether an endpoint has
been selected as the container's gateway, allowing the driver
to work out whether mappings between IPv6 host addresses and
IPv4 container addresses are required (when supported).
Signed-off-by: Rob Murray <rob.murray@docker.com>
This special case was added in 540c8e9b20 to
handle situations where a Windows daemon would still have images in legacy
format on Disk.
For legal reasons, Windows base-images were not allowed to be distributed
through registries, and because of that had to be pre-loaded on the host.
Such images would have a RootFS with a special `layers+base` type.
This type is no longer used and [removed from the OCI image spec][1], which
now only allows a single type ("Layers"); from the [OCI image-spec][2]:
> - **rootfs** _object_, REQUIRED
>
> The rootfs key references the layer content addresses used by the image.
> This makes the image config hash depend on the filesystem hash.
>
> - **type** _string_, REQUIRED
>
> MUST be set to `layers`.
> Implementations MUST generate an error if they encounter a unknown value while verifying or unpacking an image.
The special handling was added in 2016 to help in the transition, but
it's very unlikely such images still exist, so we can remove the special
handling.
This reverts commit 540c8e9b20.
[1]: https://github.com/opencontainers/image-spec/pull/211
[2]: https://github.com/opencontainers/image-spec/blob/v1.1.1/config.md#properties
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All uses of this method would construct a RootFS from scratch, so we may as
well remove the argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Outline the DACL used on Windows.
- Extract constructing the SDDL to a utility, to allow re-using
for unix sockets in future.
- Improve documentation to mention that Windows allows multiple
groups and/or users to be given access.
Also removing an intermediate variable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The original intent of this directory was to provide weekly reports
for calls and project meetings, but these haven't been produced for
several Years now (with the most recent report being 8 Years ago).
Let's remove this directory as the information in these reports is
outdated and no longer relevant. If needed, they can still be found
in Git history.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make it a hidden file. From the [CodeCov docs][1]:
> Can I name the file .codecov.yml?
>
> Yes, you can name the file `codecov.yml` or `.codecov.yml`. However, the
> file must still be located in the repository root, `dev/`, or `.github/`
> directories
[1]: https://docs.codecov.com/docs/codecov-yaml#can-i-name-the-file-codecovyml
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The restartmanager is only used internally by the daemon, and has no external
users. Move it to the daemon/internal package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This document was added to outline our vendoring policies and to describe
versioning. It's obsoleted by Go module's definition, which follows SemVer
and MVS.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These scripts have not been actively maintained for several Years, are
un-tested, and there may be better alternatives / implementations to
use for this purpose. A search on GitHub only showed a single active
use of one of these scripts; let's remove them, as there are no plans
to maintain (and test) these scripts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Seeing some test-failures, which could be due to changes on Docker Hub
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite/TestPushToCentralRegistryUnauthorized (51.08s)
docker_cli_push_test.go:229: assertion failed: strings.Contains(out, "Retrying") is true
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite (101.49s)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function effectively is looping three times over the given commands
to apply to the image. The first two loops did not yet invoke the builder
instance, so we can combine those and execute then before constructing the
builder. We could even consider combining all of them to a single loop, but
keeping it closer to the existing logic or now.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility was added in 83b5729f64 to
replace httputils.ParseServerHeader, which was added to print a warning
on Windows in 126529c6d0. At the time, the
only available option to detect the daemon's OS was to parse the `Server`
header, which contained the version of Docker as well as the OS.
However, 7199522ea2 introduced an `OSType`
("Ostype") header that's included on all responses, and a later commit
e9dac5ef5e changed that to also be included
when producing an error for unsupported API versions.
Note that the casing in the midddleware was changed from `OSType` to
`Ostype` (normalized form) in 76a5ca1d4d,
but headers are case-insensitive, and `header.Get()` should handle either
case in the response.
In short; every API response contains an "Ostype" header, which already
contains the OS ("windows" or "linux") that doesn't require any parsing,
so let's put that header to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Avoid importing structs from the root package in favor of defining an
interface for the functions which are called.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Adding image tags that follow the semver major and minor versions (e.g., `28`
and `28.3`) for the moby-bin images.
This makes it easier for users to reference the latest build within a
major or minor version series without having to know the exact
minor/patch version.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The IPsec encryption parameters (Security Association Database and
Security Policy Database entries) for a particular overlay network peer
(VTEP) are shared global state as they have to be programmed into the
root network namespace. The same parameters are used when encrypting
VXLAN traffic to a particular VTEP for all overlay networks. Deleting
the entries for a VTEP will break encryption to that VTEP across all
encrypted overlay networks, therefore the decision of when to delete the
entries must take the state of all overlay networks into account.
Unfortunately this is not the case.
The overlay driver uses local per-network state to decide when to
program and delete the parameters for a VTEP. In practice, the
parameters for all VTEPs participating in an encrypted overlay network
are deleted when the network is deleted. Encryption to that VTEP over
all other active encrypted overlay networks would be broken until some
other incidental peerDB event triggered a re-programming of the
parameters for that VTEP.
Change the setupEncryption and removeEncryption functions to be
reference-counted. The removeEncryption function needs to be called the
same number of times as addEncryption before the parameters are deleted
from the kernel.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver assumes that the peer table in NetworkDB will always
converge to a 1:1:1 mapping from peer endpoint IP address to MAC address
to VTEP. While this currently holds true in practice most of the time,
it is not an invariant and there are ways that users can violate this
assumption.
The driver detects whether peer entries conflict with each other by
matching up (IP, MAC) tuples. In the common case this works out fine as
the MAC address for an endpoint is generally derived from the assigned
IP address. If an IP address gets reassigned to a container on another
node the MAC address will follow, so the driver's conflict resolution
logic will behave as intended. However users may explicitly configure
the MAC address for a container's network endpoints. If an IP address
gets reassigned from a container with an auto-generated MAC address to a
container with a manually-configured MAC, or vice versa, the driver
would not detect the conflict as the (IP, MAC) tuples won't match up. It
would attempt to program the kernel's neighbor table with two
conflicting MAC addresses for one IP, which will fail. And since it
does not realize that there is a conflict, the driver won't reprogram
the kernel from the remaining entry when the other entry is deleted.
The assumption that only one IP address may resolve to a given MAC
address is violated if multiple IP addresses are assigned to an
endpoint. This rarely comes up in practice today as the overlay driver
only supports IPv4 single-stack connectivity for endpoints. If multiple
distinct peer entries exist with the same MAC address, the driver will
delete the MAC->VTEP mapping from the kernel's forwarding database when
any entry is deleted, even if other entries remain active. This
limitation is one of the biggest obstacles in the way of supporting IPv6
and dual-stack connectivity for endpoints attached to overlay networks.
Modify the peer db logic to correctly handle the cases where peer
entries have non-unique MAC or VTEP values. Treat any set of entries
with non-unique IP addresses as a conflict, irrespective of the entries'
MAC addresses. Maintain a reference count of forwarding database entries
and only delete the MAC->VTEP mapping from the kernel when there are no
longer any neighbor entries which resolve to that MAC.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The peer db implementation is more complex than it needs to be.
Notably, the peerCRUD / peerCRUDOp function split is a vestige of its
evolution from a worker goroutine receiving commands over a channel.
Refactor the peer db operations to be easier to read, understand and
modify. Factor the kernel-programming operations out into dedicated
addNeighbor and deleteNeighbor functions. Inline the rest of the
peerCRUDOp functions into their respective peerCRUD wrappers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
- Assert that we're not using empty IDs
- stringid.TruncateID already truncates algorithm, so we can just feed
it the full id
- Fail early on error, and skip asserting the `resp.ID` to reduce some
noise;
=== FAIL: github.com/docker/docker/integration/container TestCreateByImageID/image_short-ID (60.33s)
create_test.go:134: assertion failed: resp.ID is ""
create_test.go:135: assertion failed: error is not nil: error during connect: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.48/containers/create": EOF
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit e98e4a7111 introduced functionality
to hide experimental commands, and hide commands based on API version
negotiation. Before that commit, the user-agent header was used to detect
version-mismatches between the daemon and client based on their binary
version;
3975d648b7/api/server/middleware/user_agent.go (L32-L44)
Because of the above, a check was added to prevent custom headers from
modifying the User-Agent, but given that the user-agent header changed
formatting, and api < 1.25 is long deprecated, it's not very meaningful
to add this check, so let's remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Starting with commit 0d6e7cd983
DeleteNeighbor() needs to be called with the same options as the
AddNeighbor() call that created the neighbor entry. The calls in peerdb
were modified incorrectly, resulting in the deletes failing and leaking
neighbor entries. Fix up the DeleteNeighbor calls so that the FDB entry
is deleted from the FDB instead of the neighbor table, and the neighbor
is deleted from the neighbor table instead of the FDB.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Validation of registry mirrors was performed during daemon startup,
but after the config-file was validated. As a result, the `--validate`
option would incorrectly print that the configuration was valid, but
the daemon would fail to start;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
With this patch applied, validation is also performed as part of the
daemon config validation;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
unable to configure the Docker daemon with file ./my-config.json: merged configuration validation from file and command line flags failed: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
# fix the invalid config
echo '{"registry-mirrors":["https://example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, a missing scheme would sometimes produce a confusing
error message. If no scheme was specified at all, an empty "" would be
included in the message;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "" in "example.com"
If a scheme was missing, but a port was included, the hostname would be
printed as the scheme;
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "example.com" in "example.com:8080"
With this patch applied, the error messages are slightly more user-friendly;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com:8080": must use either 'https://' or 'http://'
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When libnetwork receives a watch event for a driver table entry from
NetworkDB it passes the event along to the interested driver. This code
contains a subtle bug: update events from NetworkDB are passed along to
the driver as Delete events! This bug was lying dormant as driver-table
entries can only be added by the driver, not updated. Now that NetworkDB
broadcasts an UpdateEvent to watchers if the entry is already known to
the local NetworkDB, irrespective of whether the event received from the
remote peer was a CREATE or UPDATE event, the bug is causing problems.
Whenever a remote node replaces an entry in the overlay_peer_table but
the intermediate delete state was not received by the local node, the
new CREATE event would be translated to an UpdateEvent by NetworkDB and
subsequently handled by the overlay driver as if the entry was deleted!
Bubble table UPDATE events up to the network driver as Update events.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Commit 8e6cd44ce4 added synchronisation to
wait for the container's status to be updated in memory. However, since
952902efbc, a defer was used to produce
the container's "stop" event.
As a result of the sychronisation that was added, the "die" event would
now be produced before the "stop" event.
This patch moves the locking inside the defer to restore the previous
behavior.
Unfortunately the order of events is still not guaranteed, because events
are emited from multiple goroutines that don't have synchronisation between
them; this is something to look at for follow ups. This patch keeps the status
quo and should preserve the old behavior, which was "more" correct in most
cases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
As we're only expecting a single `/` prefix to be trimmed from the
container name, it's better to use `TrimPrefix` than `TrimLeft`, as
`TrimPrefix` takes a cut-set to remove any character in the set.
Benchmarking both;
BenchmarkTrimLeft-10 535364544 2.204 ns/op 0 B/op 0 allocs/op
BenchmarkTrimPrefix-10 1000000000 0.3148 ns/op 0 B/op 0 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was added in 5130fe5d38, which
added it for use as intermediate struct when parsing CLI flags (through
`runconfig.ParseExec`) in c786a8ee5e.
Commit 9d9dff3d0d rewrote the CLI to use
Cobra, and as part of this introduced a separate `execOptions` type in
`api/client/container`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use the tagged version instead of the v2.0.0-20250613170222-a45be3cac15c
pseudo-version. The referenced commit has not changed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a mention to stdcopy.StdCopy to the documentation, as the stream returned in the HijackedResponse is multiplexed when tty is disabled.
Signed-off-by: Medhy DOHOU <52136144+PowerPixel@users.noreply.github.com>
The IdentityMapping and Identity types are still used internally, but
should be considered transitional.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- `ParseKeyValueOpt` was deprecated in 5b18a7914c
and moved to the graphdriver package.
- `ParseUintListMaximum` and `ParseUintList` were deprecated in commit
064cdf475c after they were moved internal
to pkg/sysinfo in 2282279180.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package was deprecated in b034dc41a2,
which moved it internal. That commit was part of v28.0.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 4472e9b7f8, which
was part of docker v28.0.0, and to be removed in the next major
release.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Inter-Network Communication rules in the iptables chains
DOCKER-ISOLATION-STAGE-1 / DOCKER-ISOLATION-STAGE-2 (which are
called from filter-FORWARD) currently:
- Block access from containers in one bridge network, to ports
published to host addresses by containers in other bridge
networks, when the userland-proxy is disabled.
- But, that access is allowed when the proxy is enabled.
- Block access to all ports on container addresses in gateway
mode "nat-unprotected" networks.
- But, those ports can be accessed from anywhere else, including
other hosts. Just not other bridge networks.
- Allow access from containers in "nat" bridge networks to published
ports on container addresses in "routed" networks. But, to do that,
extra INC rules are added for the routed network.
The INC rules are no longer needed to block access from containers
in one network to unpublished ports on container addresses in
other networks. Direct routing to containers in NAT networks is
blocked by the "raw-PREROUTING" rules that block access from
untrusted interfaces (all interfaces apart from the network's
own bridge).
Drop these INC rules to resolve the inconsistencies listed above,
with this change:
- Published ports on host addresses can be accessed from containers
in other networks (even without the userland-proxy).
- The rules for direct routing between bridge networks are the same
as the rules for direct routing from outside the Docker host
(allowed for gw modes "routed" and "nat-unprotected", disallowed
for "nat").
Fewer rules, so it's simpler, and perhaps slightly faster.
Internal networks (with no access to networks outside the host)
are also implemented using rules in the DOCKER-ISOLATION chains.
This change moves those rules to a new chain, DOCKER-INTERNAL,
and drops the DOCKER-ISOLATION chains.
Signed-off-by: Rob Murray <rob.murray@docker.com>
A network node is responsible for both broadcasting table events for
entries it owns and for rebroadcasting table events from other nodes it
has received. Table events to be broadcast are added to a single queue
per network, including events for rebroadcasting. As the memberlist
TransmitLimitedQueue is (to a first approximation) LIFO, a flood of
events from other nodes could delay the broadcasting of
locally-generated events indefinitely. Prioritize broadcasting local
events by splitting up the queues and only pulling from the rebroadcast
queue if there is free space in the gossip packet after draining the
local-broadcast queue.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Log more details when assertions fail to provide a more complete picture
of what went wrong when TestCRUDTableEntries fails. Log the state of
each NetworkDB instance at various points in TestCRUDTableEntries to
provide an even more complete picture.
Increase the global logger verbosity in tests so warnings and debug logs
are printed to the test log.
Signed-off-by: Cory Snider <csnider@mirantis.com>
NetworkDB uses a muli-dimensional map of struct network to keep track of
network attachments for both remote nodes and the local node. Only a
subset of the struct fields are used for remote nodes' network
attachments. The tableBroadcasts pointer field in particular is
always initialized for network values representing local attachments
(read: nDB.networks[nDB.config.NodeID]) and always nil for remote
attachments. Consequently, unnecessary defensive nil-pointer checks are
peppered throughout the code despite the aforementioned invariant.
Enshrine the invariant that tableBroadcasts is initialized iff the
network attachment is for the local node in the type system. Pare down
struct network to only the fields needed for remote network attachments
and move the local-only fields into a new struct thisNodeNetwork. Elide
the unnecessary nil-checks.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When joining a network that was previously joined but not yet reaped,
NetworkDB replaces the network struct value with a zeroed-out one with
the entries count copied over. This is also the case when joining a
network that is currently joined! Consequently, joining a network has
the side effect of clearing the broadcast queue. If the queue is cleared
while messages are still pending broadcast, convergence may be delayed
until the next bulk sync cycle.
Make it an error to join a network twice without leaving. Retain the
existing broadcast queue when rejoining a network that has not yet been
reaped.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The map key for nDB.networks is the network ID. The struct field is not
actually used anywhere in practice.
Signed-off-by: Cory Snider <csnider@mirantis.com>
After pushing the multi-platform index fails due to missing content, we
retry with the single-platform manifest. While the target descriptor was
changed for the second push, the actual target digested reference still
pointed to the original multi-platform index. Obviously, with the
fallback that didn't really work correctly, because the multi-platform
index is not pushed.
This commit fixes the issue by updating the target reference to point to
the single-platform manifest.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
It checked for "Bind for 0.0.0.0:80 failed: port is already
allocated". But, since commit d662091 ("portallocator: always
check for ports allocated for 0.0.0.0/::"), the message is
sometimes about ":::80".
Signed-off-by: Rob Murray <rob.murray@docker.com>
This parameter was already supported for some time in the backend (for
purposes related to docker system prune). It was also already present in
the imagetypes.ListOptions but was never actually handled by the client.
Make it available by default in the response.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
It looks like the error returned by Windows changed in Windows 2025; before
Windows 2025, this produced a `ERROR_INVALID_NAME`;
The filename, directory name, or volume label syntax is incorrect.
But Windows 2025 produces a `ERROR_DIRECTORY` ("The directory name is invalid."):
CreateFile \\\\?\\Volume{d9f06b05-0405-418b-b3e5-4fede64f3cdc}\\windows\\system32\\drivers\\etc\\hosts\\: The directory name is invalid.
Docs; https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
commit 7c09fa25fd and
e8c269843c removed support for schema1, but
we still enabled the schema1 conversion in containerd, causing the error
produced by dockerd to be shadowed by the error from containerd;
Before this patch, we would get an error from containerd;
docker pull docker:1.0
Error response from daemon: failed to get converter for "docker.io/library/docker:1.0": Pulling Schema 1 images have been deprecated and disabled by default since containerd v2.0. As a workaround you may set an environment variable `CONTAINERD_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE=1`, but this will be completely removed in containerd v2.1.
After enabling that env-var, it would return the error from dockerd;
CONTAINERD_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE=1 dockerd --feature containerd-snapshotter
docker pull docker:1.0
Error response from daemon: Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/
With this patch, we immediately return the error from dockerd;
docker pull docker:1.0
Error response from daemon: Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We had some runs timeout after 120 minutes; expected duration is much
lower than that, so let's lower the timeout to make actions fail faster.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Mostly for readability, and to avoid linters suggesting to move the
default condition outside of the if/else.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some linters were complaining about the testing.T not being used; put
it to use to silence the linter.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- scope variables locally to the if/else if
- use if/else if to try to make it more clear it's a "best effort" before
falling through to other ways of resolving the image reference
- remove outdated TODO, now that containerd errdefs can be used for either
moby, or containerd error definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.3...go1.24.4
This release includes 3 security fixes following the security policy:
- net/http: sensitive headers not cleared on cross-origin redirect
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue.
This is CVE-2025-4673 and Go issue https://go.dev/issue/73816.
- os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location.
OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
Thanks to Junyoung Park and Dong-uk Kim of KAIST Hacking Lab for discovering this issue.
This is CVE-2025-0913 and Go issue https://go.dev/issue/73702.
- crypto/x509: usage of ExtKeyUsageAny disables policy validation
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
Thanks to Krzysztof Skrzętnicki (@Tener) of Teleport for reporting this issue.
This is CVE-2025-22874 and Go issue https://go.dev/issue/73612.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Added backend code to support the exact same interface
used today for Nvidia GPUs, allowing customers to use
the same docker commands for both Nvidia and AMD GPUs.
Signed-off-by: Sudheendra Gopinath <sudheendra.gopinath@amd.com>
Reused common functions from nvidia_linux.go.
Removed duplicate code in amd_linux.go by reusing
the init() and countToDevices() functions in
nvidia_linux.go. AMD driver is registered in init().
Signed-off-by: Sudheendra Gopinath <sudheendra.gopinath@amd.com>
Renamed amd-container-runtime constant
Signed-off-by: Sudheendra Gopinath <sudheendra.gopinath@amd.com>
Removed empty branch to keep linter happy.
Also renamed amd_linux.go to gpu_amd_linux.go.
Signed-off-by: Sudheendra Gopinath <sudheendra.gopinath@amd.com>
Renamed nvidia_linux.go and gpu_amd_linux.go.
Signed-off-by: Sudheendra Gopinath <sudheendra.gopinath@amd.com>
commit 4dc961d0e9 removed deprecated
fields from the image inspect response for API v1.50 and up. As
part of that change, it changed the type used for the Config field
to use the docker image spect structs, which embeds the OCI image
spec structs.
While the OCI image spect struct contains the same fields as we
used before, those fields also have "omitempty" set, which means
they are now omitted when empty.
We should probably consider deprecating that behavior in the API,
and call out that these fields are omitted if not set, but in the
meantime, we can add them back with their default (zero) value.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
More recent versions of go-swagger failed on this, because the value
is interpolated as JSON numberic value, which assumes int64 (signed).
Quote the value to prevent it being handled before validated against
uint64.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
More recent versions of go-swagger failed on this, because the value
is interpolated as JSON numberic value, which assumes int64 (signed).
Quote the value to prevent it being handled before validated against
uint64.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The go-connections package implementation is only a shallow wrapper
around go-winio for named pipes; use the go-winio implementation
directly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Also adding test-cases for;
- empty options for all fields
- invalid nameServer (domain instead of IP).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Gracefully leaving the memberlist cluster is a best-effort operation.
Failing to successfully broadcast the leave message to a peer should not
prevent NetworkDB from cleaning up the memberlist instance on close. But
that was not the case in practice. Log the error returned from
(*memberlist.Memberlist).Leave instead of returning it and proceed with
shutting down irrespective of whether Leave() returns an error.
Signed-off-by: Cory Snider <csnider@mirantis.com>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These comments were added to enforce using the correct import path for
our packages ("github.com/docker/docker", not "github.com/moby/moby").
However, when working in go module mode (not GOPATH / vendor), they have
no effect, so their impact is limited.
Remove these imports in preparation of migrating our code to become an
actual go module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change eliminates the automatic creation of image tags in the
format `moby/moby-bin:sha-ad132f5` for every push.
They're not too useful, produce noise and use a lot of space.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The (*driver).Join function does many things to set up overlay
networking. One of the first things it does is call
(*network).joinSandbox, which in turn calls (*driver).initSandboxPeerDB.
The initSandboxPeerDB function iterates through the peer db to add
entries to the VXLAN FDB, neighbor table and IPsec security association
database in the kernel for all known peers on the overlay network.
One of the last things the (*driver).Join function does is call
(*driver).initEncryption. The initEncryption function iterates through
the peer db to add entries to the IPsec security association database in
the kernel for all known peers on the overlay network. But the preceding
initSandboxPeerDB call already did that! The initEncryption function is
redundant and can safely be removed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
In addition to being three functions in a trenchcoat, the
checkEncryption function has a very subtle implementation which is
difficult to reason about. That is not a good property for security
relevant code to have.
Replace two of the three calls to checkEncryption with conditional calls
to setupEncryption and removeEncryption, lifting the conditional logic
which was hidden away in checkEncryption into the call sites to make it
easier to reason about the code. Replace the third call with a call to a
new initEncryption function.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The setupEncryption and removeEncryption functions take several
parameters, but all call sites pass the same values for all the
parameters aside from remoteIP: values taken from fields of the driver
struct. Refactor these functions to be methods of the driver struct and
drop the redundant parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Since it is not meaningful to add or remove encryption between the local
node and itself, the isLocal parameter is redundant. Setting up
encryption for all network peers is now invoked by calling
checkEncryption(nid, netip.Addr{}, true)
Calling checkEncryption with isLocal=true, add=false is now more
explicitly a no-op. It always was effectively a no-op, but that was not
easy to spot by inspection. In the world with the isLocal flag,
calls to checkEncryption where isLocal=true and add=false would have rIP
set to d.advertiseAddr. In other words, it was a request to remove
encryption parameters between the local peer and itself if peerDB had no
remote-peer entries for the network. So either the call would do
nothing, or it would remove encryption parameters that aren't used for
anything. Now the equivalent call always does nothing.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Drop the isLocal boolean parameters from the peerDB functions. Local
peers have vtep == netip.Addr{}.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The VTEP value for a peer in peerDB is only accurate for a remote peer.
The VTEP for a local peer would be the driver's advertise address, which
is not necessarily constant for the lifetime of the driver instance.
The VTEP values persisted in the peerDB entries for local peers could be
stale or missing if not kept in sync with the advertise address. And the
peerDB could get polluted with duplicate entries for local peers if the
advertise address was to change, as entries which differ only by VTEP
are considered distinct by SetMatrix. Persisting the advertise address
as the VTEP for local peers creates lots of problems that are not easy
to solve.
Stop persisting the VTEP for local peers in peerDB. Any code that needs
to know the VTEP for local peers can look that up from the source of
truth: the driver's advertise address. Use the lack of a VTEP in peerDB
entries to signify local peers, making the isLocal flag redundant.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver's checkEncryption function configures the IPSec
parameters for the VXLAN tunnels to peer nodes. When called with
isLocal=true, it configures encryption for all peer nodes with at least
one peerDB entry. Since the local peers are also included in the peerDB,
it needs to filter those entries out. It does so by filtering out any
peer entries whose VTEP address is equal to the current local advertise
address. Trouble is, the local advertise address is not necessarily
constant. The driver tries to handle this case by calling
peerDBUpdateSelf() when the advertise address changes. This function
iterates through the peerDB and tries to update the VTEP address for all
local peer entries, but it does not actually do anything: it mutates a
temporary copy of the entry which is not persisted back into the peerDB.
(It used to be functional, but was broken when the peerDB was extended
to use SetMatrix.) So there may be cases where local peer entries are
not filtered out properly, resulting in spurious encryption parameters
being programmed into the kernel.
Filter out local peers when walking the peerDB by filtering on whether
the entry has the isLocal flag set. Remove the no-op code which attempts
to update local entries in the peerDB. No other code takes any interest
in the VTEP value for isLocal peer entries.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use platform MatchComparer when checking for matching platforms.
Also, add unit test to ensure the merging of defined and host-supported
platforms works correctly.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
We set SO_REUSEADDR on sockets used for host port mappings by
docker-proxy - which means it's possible to bind the same port
on a specific address as well as 0.0.0.0/::.
For TCP sockets, an error is raised when listen() is called on
both sockets - and the port allocator will be called again to
avoid the clash (if the port was allocated from a range, otherwise
the container will just fail to start).
But, for UDP sockets, there's no listen() - so take more care
to avoid the clash in the portallocator.
The port allocator keeps a set of allocated ports for each of
the host IP addresses it's seen, including 0.0.0.0/::. So, if a
mapping to 0.0.0.0/:: is requested, find a port that's free in
the range for each of the known IP addresses (but still only
mark it as allocated against 0.0.0.0/::). And, if a port is
requested for specific host addresses, make sure it's also
free in the corresponding 0.0.0.0/:: set (but only mark it as
allocated against the specific addresses - because the same
port can be allocated against a different specific address).
Signed-off-by: Rob Murray <rob.murray@docker.com>
Instead of passing the dirs for buildkit to configure the same cache
instance, just pass the shared CDI cache instance.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Avoid logging warnings when default CDI directory does not exist:
```
WARN[2025-05-26T14:27:54.008196418Z] CDI setup error /var/run/cdi: failed to monitor for changes: no such file or directory
WARN[2025-05-26T14:27:54.008209168Z] CDI setup error /etc/cdi: failed to monitor for changes: no such file or directory
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Because we set SO_REUSEADDR on sockets for host ports, if there
are port mappings for INADDR_ANY (the default) as well as for
specific host ports - bind() cannot be used to detect clashes.
That means, for example, on daemon startup, if the port allocator
returns the first port in its ephemeral range for a specific host
adddress, and the next port mapping is for 0.0.0.0 - the same port
is returned and both bind() calls succeed. Then, the container
fails to start later when listen() spots the problem and it's too
late to find another port.
So, bind and listen to each set of ports as they're allocated
instead of just binding.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The legacy `docker.pkg.github.com` registry provided by GitHub was not
OCI compliant, and did not suport pull by digest (among others). Commit
495d623ae5 added fallback code to detect
"not found" errors when pulling by digest, in which case we would fall
back to pulling by `name:tag`.
GitHub deprecated the legacy registry, and it was [sunset on Feb 24th, 2025][1]
in favor of GitHub Container Registry (GHCR) (ghcr.io).
This reverts commit 495d623ae5, removing the
fallback logic.
[1]: https://github.blog/changelog/2025-01-23-legacy-docker-registry-closing-down/
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The netip types are really useful for tracking state in the overlay
driver as they are hashable, unlike net.IP and friends, making them
directly useable as map keys. Converting between netip and net types is
fairly trivial, but fewer conversions is more ergonomic.
The NetworkDB entries for the overlay peer table encode the IP addresses
as strings. We need to parse them to some representation before
processing them further. Parse directly into netip types and pass those
values around to cut down on the number of conversions needed.
The peerDB needs to marshal the keys and entries to structs of hashable
values to be able to insert them into the SetMatrix. Use netip.Addr in
peerEntry so that peerEntry values can be directly inserted into the
SetMatrix without conversions. Use a hashable struct type as the
SetMatrix key to avoid having to marshal the whole struct to a string
and parse it back out.
Use netip.Addr as the map key for the driver's encryption map so the
values do not need to be converted to and from strings. Change the
encryption configuration methods to take netip types so the peerDB code
can pass netip values directly.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Because nftables tables/chain aren't fixed, like they are
in iptables - this change makes an assumption about the
bridge driver's naming.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The Namespace keeps some state for each inserted neighbor-table entry
which is used to delete the entry (and any related entries) given only
the IP and MAC address of the entry to delete. This state is not
strictly required as the retained data is a pure function of the
parameters passed to AddNeighbor(), and the kernel can inform us whether
an attempt to add a neighbor entry would conflict with an existing
entry. Get rid of the neighbor state in Namespace. It's just one more
piece of state that can cause lots of grief if it falls out of sync with
ground truth. Require callers to call DeleteNeighbor() with the same
aguments as they had passed to AddNeighbor(). Push the responsibility
for detecting attempts to insert conflicting entries into the neighbor
table onto the kernel by using (*netlink.Handle).NeighAdd() instead of
NeighSet().
Modernize the error messages and logging in DeleteNeighbor() and
AddNeighbor().
Signed-off-by: Cory Snider <csnider@mirantis.com>
func (*Namespace) AddNeighbor is only ever called with the force
parameter set to false. Remove the parameter and eliminate dead code.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add checks in both containerd-based and distribution-based image pull
code paths to detect and AI model images early in the pull process.
These are not yet supported directly by the Engine and need to be
handled by the `docker model` CLI plugin.
For distribution-based pull, reject the AI models pulls.
For containerd image service only emit a warning.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
I'm horrible at vim, and use nano as my go-to editor for quick changes.
Let's install nano in the dev-container as alternative to vim for those
like me, who are not so vim-savvy ^O^C^C:wq:
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The (*Sandbox).joinLeaveStart() and .joinLeaveEnd() methods implement an
exclusive lock which is almost functionally identical to
(*sync.Mutex).Lock() and .Unlock(), respectively. The only notable
differences are that joinLeaveStart allocates, and calling
joinLeaveEnd() more times than joinLeaveStart() is a silent no-op
instead of a fatal error.
The construction of the joinLeaveStart/End methods is shaped like a
condition variable which uses channels for waiting and broadcasting.
The condition being waited for is that the joinLeaveDone struct field is
nil, i.e. that the lock has not been acquired by another goroutine.
As the condition is being checked and set while in a critical section,
it is a mutex implemented in terms of mutexes and channels. Replace the
home-grown mutex with a plain sync.Mutex.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When deleting specific platforms from a multi-platform image, there's
potential risk as platform-specific content might be shared across
images/containers.
For now, require `force` parameter to make the user aware.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change adds the ability to delete a specific platform from a
multi-platform image.
Previously, image deletion was an all-or-nothing operation - when
deleting a multi-platform image, all platforms would be removed
together. This change allows users to selectively remove individual
platforms from a multi-architecture image while keeping other platforms
intact.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
commit af0cdc36c7 marked these fields as
deprecated and to be removed in API v1.47 (which was targeted for v28.0).
We shipped v1.47 with the v27.2 release, but did not yet remove the erroneous
fields, so the version to deprecate was updated to v1.48 through
3df03d8e66
This patch removes fields that are not part of the image by replacing the
type with the Config struct from the docker image-spec.
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/images/alpine/json | jq .Config
{
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh"
]
}
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/images/alpine/json | jq .Config
{
"Hostname": "",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh"
],
"Image": "",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": null,
"OnBuild": null,
"Labels": null
}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were originally added in 7b9ecb9700.
The `StartLimitBurst` and `StartLimitInterval` options used to be
options for `[Service]`, but were moved to the `[Unit]` in systemd 229,
and systemd 230 respectively. The `StartLimitInterval` was renamed to
`StartLimitIntervalSec`, which either takes a number (using "seconds" as
default unit) or an optional unit;
- 6bf0f408e4
- f0367da7d1
We kept these deprecated options to provide compatibility with older distros
that not yet had systemd 230, but all distros we support are now on versions
of systemd that support the new options;
docker run --rm registry.access.redhat.com/ubi8/ubi systemctl --version
systemd 239 (239-82.el8_10.5)
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy
docker run -it --rm debian:
apt-get update && apt-get install -y systemd
...
systemctl --version
systemd 247 (247.3-7+deb11u6)
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +ZSTD +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=unified
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The "fluentd-async-connect" option was deprecated in 20.10 through
cc1f3c750e, and removed in 28.0 trough
49ec488036, which added migration code
on daemon startup.
However, the migration code _copied_ the deprecated option to the new
("fluentd-async") option, preserving the old field. Doing so could cause
an issue if a user would downgrade the daemon to a previous release, as
the changes in cc1f3c750e invalidate a config
that has both fields set (see [daemon/logger/fluentd/fluentd.go#L198-L200]);
if cfg[asyncKey] != "" && cfg[asyncConnectKey] != "" {
return config, errors.Errorf("conflicting options: cannot specify both '%s' and '%s", asyncKey, asyncConnectKey)
}
This patch updates the migration code to remove the deprecated option.
[daemon/logger/fluentd/fluentd.go#L198-L200]: cc1f3c750e/daemon/logger/fluentd/fluentd.go (L198-L200)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit 7b153b9e28 changed the daemon to
advertise the recommended builder to use to V2 (BuildKit) for Linux
daemons, and V1 (Legacy Builder) for Windows daemons. For Linux daemons
we allowed the default to be overridden through the "features" field
in the daemon config (daemon.json), but for Windows we hard-coded it
to be V1, and no option to override.
With work in progress on implementing support for Windows in BuildKit,
we should remove this hardcoded assumption, and allow the default to
be overridden to advertise that BuildKit is supported.
Note that BuildKit on Windows is still very much a "work in progress",
and enabling it in the daemon may not even work, so users should not
try to enable this feature; a warning-level log is added to make it
visible that the feature is enabled.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`opts.params.Platform` is always nil inside this branch so we can omit
it from the `GetImage` call to make it less confusing.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Previously, we were using our own `FromStatusCode` function to map HTTP
status codes to Docker error types. Switch to the containerd code.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
the core/remotes/docker/schema1 package is deprecated and removed
in containerd v2.1; remove its use as we already deprecated these
images for "docker pull" and elsewhere.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
WCOW support on Buildkit is now coming to maturity. As part
of making this generally available, integrating it in
Docker Engine is critical for it's adoption.
This commit adds the buildkit execuitor for WCOW as the
next-builder (backend) for building Windows containers.
This will be an opt-in feature, with the end users setting
DOCKER_BUILDKIT=1 environment variable to use it.
The integration tests bit has also been handled.
https://github.com/moby/buildkit/pull/5956,
BUILDKIT_REF has been set to `master` for now, so
that the tests can run successfully. On the next
release, we will revert this back to using releases.
Signed-off-by: Anthony Nandaa <profnandaa@gmail.com>
The `BridgeNfIptables` and `BridgeNfIp6tables` fields in the
`GET /info` response were deprecated in API v1.48, and are now omitted
in API v1.50.
With this patch, old API version continue to return the field:
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIp6tables
false
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIptables
false
Omitting the field in API v1.50 and above
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/info | jq .BridgeNfIp6tables
null
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.50/info | jq .BridgeNfIptables
null
This reverts commit eacbbdeec6, and re-applies
a variant of 5d2006256f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Manifest v2 schema1 was deprecated in 4866f5139a1 and this commit
removes the push code for v2 schema1.
This reverts commit f695e98cb7,
adjusted for changes that were made since
daemon: do not mkdir trust directory
Remove push tests and move UUID tests to integration
Partial revert of f23a51a860.
Only the schema1 push tests are removed but the schema1 pull tests
are still desired.
The UUID test is moved from integration-cli to integration.
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add ability for the device driver to implement a device discovery
mechanism and expose discovered devices in the `docker info` output.
Currently it's only implemented for CDI devices.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Prevent the daemon spawned for integration tests from sourcing the
daemon configuration intended interactive dev shell usage.
Before this change, integration tests would fail to create a daemon
with different configuration provided via cli flags (like `--feature`)
if they're already specified in the default daemon.json.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Refactor the system CPU usage testing approach for improved maintainability:
1. Extract the core CPU usage parsing logic into a new `readSystemCPUUsage`
function that accepts an io.Reader, making it more testable and modular.
2. Use go:embed directive to embed the test data file at compile time,
eliminating runtime file operations and making tests more reliable.
3. Simplify the test by removing global variable mocking in favor of a more
direct approach with the new reader-based function.
4. Maintain full test coverage for the long "intr" line edge case which was
crucial for the original bug fix, while making the test more maintainable.
This change preserves the original test behavior while improving code quality,
testability, and making the tests self-contained.
Signed-off-by: Lee Gaines <leetgaines@gmail.com>
- rename the error-return to prevent accidental shadowing
- remove some intermediate variables
- usee a struct-literal for specs.Process
- optimize logging-code to not use chained "WithField"
- remove punctuation from error-message
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit ec65f2d21b has a typo: it switches
indexes[byTable] with indexes[byNetwork]. The indexes are not
equivalent. Switch it back.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When a node leaves a network or the cluster, or memberlist considers the
node as failed, NetworkDB atomically deletes all table entries (for the
left network) owned by the node. This maintains the invariant that table
entries owned by a node are present in the local database indices iff
that node is an active cluster member which is participating in the
network the entries pertain to.
(*NetworkDB).handleTableEvent() is written in a way which attempts to
minimize the amount of time it is in a critical section with the mutex
locked for writing. It first checks under a read-lock whether both the
local node and the node where the event originated are participating in
the network which the event pertains to. If the check passes, the mutex
is unlocked for reading and locked for writing so the local database
state is mutated in a critical section. That leaves a window of time
between the participation check the write-lock being acquired for a
network or node event to arrive and be processed. If a table event for a
node+network races a node or network event which triggers the purge of
all table entries for the same node+network, the invariant could be
violated. The table entry described by the table event may be reinserted
into the local database state after being purged by the node's leaving,
resulting in an orphaned table entry which the local node will bulk-sync
to other nodes indefinitely.
It's not completely wrong to perform a pre-flight check outside of the
critical section. It allows for an early return in the no-op case
without having to bear the cost of synchronization. But such optimistic
concurrency control is only sound if the condition is double-checked
inside the critical section. It is tricky to get right, and this
instance of optimistic concurrency control smells like a case of
premature optimization. Move the pre-flight check into the critical
section to ensure that the invariant is maintained.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use the errdefs resolver to ensure the status code is chosen from the
first outermost error. Remove duplicate containerd errdefs checks.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The `Cause()` function is not part of the standard library and should
not be used or relied on. `pkg/errors` already has compatibility with
the standard library.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The present content size is included in the image size usage and should
be included in the total size that the layer takes up on disk.
This prevents an issue where the reclaimable amount reported by the CLI
was a negative number.
This also updates the `/system/df` endpoint to use a new type that
computes information that was previously computed by the CLI. Computing
these in the server should require less work from the CLI and ensure
the calculations are more accurate because the CLI doesn't have to
reconstruct the numbers.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
daemon/network.go:156:3: S1000: should use for range instead of for { select {} } (staticcheck)
for {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
container.HealthStatus is a pseudo-type (alias for string) that was
introduced in 1e4bb14bcd.
Changing this field to use that type as a potential stepping-stone
towards making that type a distinct type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
ContainerState is currently an alias for string, so this should not
be a disruptive change, but is a stepping-stone to make it a distinct
type in future.
Relates to b811829595
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is failing frequently on Windows;
=== FAIL: github.com/docker/docker/integration/networking TestPortMappedHairpinWindows (12.37s)
nat_windows_test.go:108: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.49/containers/1181d6510a2f55c742b7b183aa7324eddbc213cd15797428c4062dcb031fb825/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network clientnet has active endpoints (name:"laughing_lederberg" id:"8605ebbc2c7c")
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(*NetworkDB).SetPrimaryKey() acquires a read lock on the NetworkDB
instance. That seems sound on the surface as it is only reading from the
NetworkDB struct, not mutating it. However, concurrent calls to
(*memberlist.Keyring).UseKey() would get flagged by Go's race detector
due to some questionable locking in its implementation. Acquire an
exclusive lock in SetPrimaryKey so concurrent calls don't race each
other.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The bridge driver should figure out whether it's running in
a mirrored WSL2 setup, and tell the firewaller.
So, move the WSL2-deciding code back into the bridge driver
and unit test it there. Use TestIptabler to check the rules
are constructed properly.
Signed-off-by: Rob Murray <rob.murray@docker.com>
integration/internal/network/ops.go:137:1: ST1020: comment on exported function WithIPAMRange should be of the form "WithIPAMRange ..." (staticcheck)
// WithIPAM adds an IPAM with the specified Subnet, IPRange and Gateway to the network
^
libnetwork/bitmap/sequence.go:50:1: ST1020: comment on exported function New should be of the form "New ..." (staticcheck)
// NewHandle returns a new Bitmap of ordinals in the interval [0, n).
^
libnetwork/diagnostic/server.go:61:1: ST1020: comment on exported method HandleFunc should be of the form "HandleFunc ..." (staticcheck)
// Handle registers the handler function for the given pattern,
^
libnetwork/endpoint.go:388:1: ST1020: comment on exported method Key should be of the form "Key ..." (staticcheck)
// endpoint Key structure : endpoint/network-id/endpoint-id
^
libnetwork/network.go:574:1: ST1020: comment on exported method MarshalJSON should be of the form "MarshalJSON ..." (staticcheck)
// TODO : Can be made much more generic with the help of reflection (but has some golang limitations)
^
libnetwork/network.go:633:1: ST1020: comment on exported method UnmarshalJSON should be of the form "UnmarshalJSON ..." (staticcheck)
// TODO : Can be made much more generic with the help of reflection (but has some golang limitations)
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
NetworkDB's Watch() facility is problematic to use in practice. The
stream of events begins when the watch is started, so the watch cannot
be used to process table entries that existed beforehand. Either option
to process existing table entries is racy: walking the table before
starting the watch leaves a race window where events could be missed,
and walking the table after starting the watch leaves a race window
where created/updated entries could be processed twice.
Modify Watch() to initialize the channel with synthetic CREATE events
for all existing entries owned by remote nodes before hooking it up to
the live event stream. This way watchers observe an equivalent sequence
of events irrespective of whether the watch was started before or after
entries from remote nodes are added to the database. Remove the bespoke
and racy synthetic event replay logic for driver watches from the
libnetwork agent.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The gossip protocol which powers NetworkDB does not guarantee in-order
reception of events. This poses a problem with deleting entries: without
some mechanism to discard stale CREATE or UPDATE events received after a
DELETE, out-of-order reception of events could result in a deleted entry
being spuriously resurrected in the local NetworkDB state! NetworkDB
handles this situation by storing "tombstone" entries for a period of
time with the Lamport timestamps of the entries' respective DELETE
events. Out-of-order CREATE or UPDATE events will be ignored by virtue
of having older timestmaps than the tombstone entry, just like how it
works for entries that have not yet been deleted.
NetworkDB was only storing a tombstone if the entry was already present
in the local database at the time of the DELETE event. If the first
event received for an entry is a DELETE, no tombstone is stored. If a
stale CREATE/UPDATE event for the entry (with an older timestamp than
the DELETE) is subsequently received, NetworkDB erroneously creates a
live entry in the local state with stale data. Modify NetworkDB to store
tombstones for DELETE events irrespective of whether the entry was known
to NetworkDB beforehand so that it correctly discards out-of-order
CREATEs and UPDATEs in all cases.
Signed-off-by: Cory Snider <csnider@mirantis.com>
NetworkDB gossips changes to table entries to other nodes using distinct
CREATE, UPDATE and DELETE events. It is unfortunate that the wire
protocol distinguishes CREATEs from UPDATEs as nothing useful can be
done with this information. Newer events for an entry invalidate older
ones, so there is no guarantee that a CREATE event is broadcast to any
node before an UPDATE is broadcast. And due to the nature of gossip
protocols, even if the CREATE event is broadcast from the originating
node, there is no guarantee that any particular node will receive the
CREATE before an UPDATE. Any code which handles an UPDATE event
differently from a CREATE event is therefore going to behave in
unexpected ways in less than perfect conditions.
NetworkDB table watchers also receive CREATE, UPDATE and DELETE events.
Since the watched tables are local to the node, the events could all
have well-defined meanings that are actually useful. Unfortunately
NetworkDB is just bubbling up the wire-protocol event types to the
watchers. Redefine the table-watch events such that a CREATE event is
broadcast when an entry pops into existence in the local NetworkDB, an
UPDATE event is broadcast when an entry which was already present in the
NetworkDB state is modified, and a DELETE event is broadcast when an
entry which was already present in the NetworkDB state is marked for
deletion. DELETE events are broadcast with the same value as the most
recent CREATE or UPDATE event for the entry.
The handler for endpoint table events in the libnetwork agent assumed
incorrectly that CREATE events always correspond to adding a new active
endpoint and that UPDATE events always correspond to disabling an
endpoint. Fix up the handler to handle CREATE and UPDATE events using
the same code path, checking the table entry's ServiceDisabled flag to
determine which action to take.
Signed-off-by: Cory Snider <csnider@mirantis.com>
State.RemovalInProgress was originally non-exported when it was added in
[40945fc186][1], adding a comment that the
field should not be persisted to disk.
But when moved to a separate package in [6bb0d1816a][2],
it was was exported, without adding `json:"-"`. As a result, it's now persisted
to disk;
cat /var/lib/docker/containers/e493924a99cad918cda8048f967032729105ee072d563d734125cec46e1b5885/config.v2.json | jq .State
{
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"RemovalInProgress": false,
"Dead": false,
"Pid": 5053,
"ExitCode": 0,
"Error": "",
"StartedAt": "2025-05-13T12:12:15.115512564Z",
"FinishedAt": "0001-01-01T00:00:00Z",
"Health": null
}
Note that this type is used internally, and (while similar) is not used for
API responses;
docker inspect e493924a99cad918cda8048f967032729105ee072d563d734125cec46e1b5885 | jq .[].State
{
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 5053,
"ExitCode": 0,
"Error": "",
"StartedAt": "2025-05-13T12:12:15.115512564Z",
"FinishedAt": "0001-01-01T00:00:00Z"
}
However, interestingly, [`daemon.restore`][3] does take this field into account
while restoring containers, which seems that it depends on the field being
persisted to disk. That logic was added in [ce72473197][4].
That logic may be redundant if we no longer persist to disk, as the `State.Dead`
is already set when cleaning up a container in [`daemon.cleanupContainer`][5].
[1]: 40945fc186
[2]: 6bb0d1816a (diff-60173e67d15f3085dd09956b3ffa83566ae25fec61cfe08ddd2e1c37223e3be7R24)
[3]: d42d79dceb/daemon/daemon.go (L498-L514)
[4]: ce72473197
[5]: 294f0c36e4/daemon/delete.go (L124-L126)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The swarmPlugin type does not implement the Swarm plugin.AddrPlugin
interface because it embeds an interface value which does not include
that method in its method set. (You can type-assert an interface value
to another interface which the concrete type implements, but a struct
embedding an interface value is not itself an interface value.) Wrap the
plugin with a different adapter type which exposes the Addr() method if
the concrete plugin implements it.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Makes the code slightly more idiomatic. These paths avoided uses of
defer because they came with an overhead in older versions of Go,
but this overhead should now be neglectible.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Currently, it's needed to set `BIND_DIR=.` when starting the dev-container
in order to bind-mount the current source-code into the container. Omitting
that option only bind-mounts the "bundles" directory and copies the source
into the image before starting.
While there are some cases where (e.g.) a remote server is used for development,
and bind-mounting is not possible, those scenarios should be considered more
advanced, so let's make the common scenario easier to use.
With this patch, running `make shell` should build and run the dev-container
with the source-code mounted.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was decorating errors with the container name, but within its
own context wouldn't be aware how the delete was referenced. This could
result in a container deleted by "ID" to produce an error with the container
Name. Some errors were also decorated before storing as "removalError" on
the container object itself.
The removalError was originally added in f963500c54,
before which the error was returned. Now that it's part of the container's
state itself, adding the container's ID is probably not very useful.
This patch reduces the scope of decorating the errors to the error-condition
itself, leaving it to the caller to decorate them further with the container
ID or Name (if any).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This code only needed to know whether the container was paused; for other
states ("restarting", "running"), it's still used to be included in the
error string.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Currently, there's no mechanism to specify a write timeout value for
fluentd connections. This means that writes can forever be blocked if
the downstream connections is unhealthy. This commit makes this value
configurable via a new fluentd log option called "fluentd-write-timeout".
Signed-off-by: Anirudh Aithal <aithal@amazon.com>
Logic was added to the Swarm executor in commit 0d9b0ed678
to clean up managed networks whenever the node's load-balancer IP
address is removed or changed in order to free up the address in the
case where the container fails to start entirely. Unfortunately, due to
an oversight the function returns early if the Swarm is lacking
an ingress network. Remove the early return so that load-balancer IP
addresses for all the other networks are freed as appropriate,
irrespective of whether an ingress network exists in the Swarm.
Signed-off-by: Cory Snider <csnider@mirantis.com>
If kernel module br_netfilter isn't loaded on the test host
before rootless test-integration tests that need it, the
rootless daemon hits a permission error when trying to do
the load. So, try to load the module before going rootless.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The container.WaitCondition type was deprecated in
100102108b, but this use of the
deprecated alias was left behind.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Part of https://github.com/docker/docker-ce-packaging/issues/1186
Adds the required systemd-sysusers configuration to the
moby/moby repo. This will be used by downstream package
maintainers (RPM, DEB etc) as a replacement to the
`groupadd` postinstall commands.
It's generally recommended to use sysusers since it is
more of a declarative method of defining these service
accounts and groups.
This configuration file specifies a group ("g") named
"docker" should be created with an automatic GID
allocation ("-").
Signed-off-by: Robert Sturla <robertsturla@outlook.com>
Introduce a ValidateHealthStatus utility in api/types/container to
validate if a given HealthState is valid.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rename the ouput variable to prevent accidental shadowing, and simplify how
we check for the `syscall.ENOTDIR` error; `errors.Is()` will already unwrap
the error, so no type-casting is needed;
package main
import (
"errors"
"fmt"
"os"
"syscall"
)
func main() {
err := &os.PathError{Op: "mkdir", Path: "/hello/world", Err: syscall.ENOTDIR}
if errors.Is(err, syscall.ENOTDIR) {
fmt.Println(err)
}
}
While at it, also improve the code-comment that outlines the intent.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing these errors, which are used in defers, and
while at it, also fixed some linting warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The function used a `cmdErr` error, but it was discarded when returning an
error. Also removing the named "err" return variable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove named err-returns to prevent accidental shadowing
- fix some minor linting issues (unhandled errors)
- update code depending on "errors.Wrap" behavior. which ignores
nil-errors, which can be easily overlooked when rewriting to
native go error-wrapping (fmt.Errorf()).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test normally fails due to a known issue, but it
has recently started passing in CI ... not sure why, it
still fails locally - so, allow it to unexpeectedly
pass, but collect some debug info to try to undertand
why.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Skip tests that have recently started failing in rootless
mode with error:
failed to start daemon: Error initializing network controller:
error creating default "bridge" network:
cannot restrict inter-container communication or run
without the userland proxy:
stat /proc/sys/net/bridge/bridge-nf-call-iptables:
no such file or directory:
set environment variable DOCKER_IGNORE_BR_NETFILTER_ERROR=1 to ignore
(Perhaps we can ensure the module is loaded before starting
the rootless env - or work out why the failures have only
recently started, and put-back whatever changed. But, for
now, I think we need to skip.)
Signed-off-by: Rob Murray <rob.murray@docker.com>
NetworkDB uses a hierarchy of queues to prioritize messages for
broadcast. Unfortunately the logic to pull from multiple queues is
flawed. The length of the messages pulled from the first queue is not
taken into account when pulling messages from the second queue. A list
of messages up to tiwce as long as the limit could be returned! Messages
beyond the limit will be truncated unceremoniously by memberlist.
Memberlist broadcast queues assume that all messages returned from a
GetBroadcasts call will be broadcasted to other nodes in the cluster.
Messages are popped from the queue once they have hit their retransmit
limit. On a busy system messages may be broadcast fewer times than
intended, possibly even being dropped without ever being broadcast!
Subtract the length of messages pulled from the first queue from the
broadcast size limit so the limit is not exceeded when pulling from the
second queue.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The loopback-test fixes seem to be sufficient to resolve the flakiness
of all the tests aside from TestFlakyNetworkDBIslands.
Signed-off-by: Cory Snider <csnider@mirantis.com>
NetworkDB defaults to binding to the unspecified address for gossip
communications, with no advertise address set. In this configuration,
the memberlist instance listens on all network interfaces and picks one
of the host's public IP addresses as the advertise address.
The NetworkDB unit tests don't override this default, leaving them
vulnerable to flaking out as a result of rogue network traffic
perturbing the test, or the inferred advertise address not being useable
for loopback testing. And macOS prompts for permission to allow the test
executable to listen on public interfaces every time it is rebuilt.
Modify the NetworkDB tests to explicitly bind to, advertise, and join
ports on 127.0.0.1 to make the tests more robust to flakes in CI and
more convenient to run locally.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The NetworkDB unit tests instantiate clusters which communicate over
loopback where every "node" listens on a distinct localhost port. The
tests make use of a NetworkDB configuration knob to set the port. When
the NetworkDB configuration's BindPort field is set to a nonzero value,
its memberlist instance is configured to bind to the specified port
number. However, the advertise port is left at the
memberlist.DefaultLANConfig() default value of 7946. Because of this,
nodes would be unable to contact any of the other nodes in the cluster
learned by gossip as the gossiped addresseses specify the wrong ports!
The flaky tests passed as often as they did thanks to the robustness of
the memberlist module: NetworkDB gossip and and memberlist node
liveness-probe pings to unreachable nodes can all be relayed through
the reachable nodes, the nodes on the bootstrap join list.
Make the NetworkDB unit tests less flaky by setting each node's
advertise port to the bind port.
The daemon is unaffected by this oversight as it unconditionally uses
the default listen port of 7946, which aligns with the advertise port.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The function was accessing the index map without holding the mutex, so
it would race any mutation to the database indexes. Fetch the reference
to the tree's root while holding a read lock. Since the radix tree is
immutable, taking a reference to the root is equivalent to starting a
read-only database transaction, providing a consistent view of the data
at a snapshot in time, even as the live state is mutated concurrently.
Also optimize the WalkTable function by leveraging the immutability of
the radix tree.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The image api already defines the backend used and does
not directly use the reference store backend. It also should not
directly use the reference store backend.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Per-network option com.docker.network.bridge.trusted-host-interfaces
accepts a list of interfaces that are allowed to route
directly to a container's published ports in a bridge
network with nat enabled.
This daemon level option disables direct access filtering,
enabling direct access to published ports on container
addresses in all bridge networks, via all host interfaces.
It overlaps with short-term env-var workaround:
DOCKER_INSECURE_NO_IPTABLES_RAW=1
- it does not allow packets sent from outside the host to reach
ports published only to 127.0.0.1
- it will outlive iptables (the workaround was initially intended
for hosts that do not have kernel support for the "raw" iptables
table).
Signed-off-by: Rob Murray <rob.murray@docker.com>
trusted_host_interface have access to published ports on container
addresses - enabling direct routing to the container via those
interfaces.
Signed-off-by: Rob Murray <rob.murray@docker.com>
On Sandbox restore if an Endpoint (or Network) can't be loaded from
the store and the container is to be preserved (live-restore), stub
Network and Endpoint objects are created and added to the cache. But
then the Endpoint is just dropped - leaving the stub objects in
cache.
If not-live-restore, the Sandbox is reconstructed do that it can be
deleted by sb.delete(force=true). But, the only thing sb.delete does
with the Endpoint in this case is call ep.Delete. And, ep.Delete
doesn't do anything if the Network and Endpoint can't both be loaded
from the store. So, again, the stub objects are left in the in-memory
cache and nothing that might have needed tidying up got tidied up.
So, whether live-restoring or not, just log an error and ignore an
Endpoint if it can't be loaded from disk.
Signed-off-by: Rob Murray <rob.murray@docker.com>
- Use structured logging.
- Which means ids are logged consistently.
- Use variable 'isRestore' instead of extra map lookups.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This will use the default settings for buildkit gc unless explicitly
disabled by setting `enabled: false` in the gc configuration.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
- remove named error-returns
- make error-handling slightly more idiomatic (check for non-nil errors)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
builder/builder-next/adapters/containerimage/pull.go:912:3: shadow: declaration of "now" shadows declaration at line 905 (govet)
now := time.Now()
^
builder/builder-next/adapters/snapshot/layer.go:52:4: shadow: declaration of "diffIDs" shadows declaration at line 28 (govet)
diffIDs, err := s.EnsureLayer(gctx, info.Parent)
^
builder/builder-next/worker/worker.go:577:3: shadow: declaration of "now" shadows declaration at line 570 (govet)
now := time.Now()
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/plugins/plugins.go:325:4: shadow: declaration of "pl" shadows declaration at line 315 (govet)
pl, err := loadWithRetry(name, false)
^
pkg/plugins/pluginrpc-gen/parser.go:153:4: shadow: declaration of "iface" shadows declaration at line 135 (govet)
iface, ok := spec.Type.(*ast.InterfaceType)
^
pkg/plugins/pluginrpc-gen/parser_test.go:61:2: shadow: declaration of "arg" shadows declaration at line 40 (govet)
arg := f.Args[0]
^
pkg/plugins/pluginrpc-gen/parser_test.go:165:2: shadow: declaration of "arg" shadows declaration at line 40 (govet)
arg := f.Args[0]
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/logger/loggertest/logreader.go:548:14: shadow: declaration of "open" shadows declaration at line 545 (govet)
case err, open := <-lw.Err:
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
api/server/router/network/network_routes.go:148:14: shadow: declaration of "nwv" shadows declaration at line 146 (govet)
} else if nwv, ok := listByFullName[nwk.ID]; ok {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/network.go:637:6: shadow: declaration of "v" shadows declaration at line 634 (govet)
if v, ok := n.generic[netlabel.GenericData]; ok {
^
libnetwork/service_linux.go:125:7: shadow: declaration of "ep" shadows declaration at line 86 (govet)
if ep := sb.getGatewayEndpoint(); ep != nil {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/portallocator/portallocator_test.go:151:7: shadow: declaration of "i" shadows declaration at line 150 (govet)
for i := 0; i <= p.end-p.begin; i++ {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
also moved the variables closer to where they're used
libnetwork/networkdb/cluster.go:414:4: shadow: declaration of "nid" shadows declaration at line 397 (govet)
nid := params[0]
^
libnetwork/networkdb/networkdb.go:514:4: shadow: declaration of "nid" shadows declaration at line 506 (govet)
nid := params[0]
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing these errors, which are used in defers, and
while at it, also fixed some linting warnings about unhandled errors, and
defers created in a loop.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing the error, which is used in a defer, and
while at it, also fixed some linting warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing these errors, which are used in defers, and
while at it, also fixed some linting warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing these errors, which are used in defers, and
while at it, also fixed some linting warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update referencesin hack/README.md from outdated docker URLs to the correct location at /docs/contributing/test.md.
Signed-off-by: ChengyuZhu6 <hudson@cyzhu.com>
Alias and deprecate the status types and constants from the root
container package. The root container package is intended for use
within the daemon and no the api package.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Prevent accidentally shadowing these errors, which are used in defers, and
while at it, also fixed some linting warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Also renamed some vars for clarity, renamed a error-returns to prevent
shadowing, and fixed some linter warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Also renamed some vars for clarity, renamed a error-returns to prevent
shadowing, and fixed some linter warnings about unhandled errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent accidentally shadowing the error, which is used in a defers, and
while at it, also fixed some linting warnings about unhandled errors and
shadowed vars.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The build exporter now clears the image tags and always exported to a
dangling image. It then uses the image tagger to perform the tagging
which causes the dangling image to be removed and the naming message to
be sent correctly.
An additional progress message is sent to indicate the renaming.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Before this patch, and error would be produced when starting the exec,
but the CLI would wait for the exec to complete, timing out after 10
seconds (default). With this change, an error is returned immediately
when creating the exec.
Note that "technically" this check may have some TOCTOU issues, because
'/etc/passwd' and '/etc/groups' may be mutated by the container in between
creating the exec and starting it.
This is very likely a corner-case, but something we can consider changing
in future (either allow creating an invalid exec, and checking before
starting, or checking both before create and before start).
With this patch:
printf 'FROM alpine\nRUN rm -f /etc/group' | docker build -t nogroup -
ID=$(docker run -dit nogroup)
time docker exec -u 0:root $ID echo hello
Error response from daemon: unable to find group root: no matching entries in group file
real 0m0.014s
user 0m0.010s
sys 0m0.003s
# numericc uid/gid (should not require lookup);
time docker exec -u 0:0 $ID echo hello
hello
real 0m0.059s
user 0m0.007s
sys 0m0.008s
# no user specified (should not require lookup);
time docker exec $ID echo hello
hello
real 0m0.057s
user 0m0.013s
sys 0m0.008s
docker rm -fv $ID
# container that does have a valid /etc/groups
ID=$(docker run -dit alpine)
time docker exec -u 0:root $ID echo hello
hello
real 0m0.063s
user 0m0.010s
sys 0m0.009s
# non-existing user or group
time docker exec -u 0:blabla $ID echo hello
Error response from daemon: unable to find group blabla: no matching entries in group file
real 0m0.013s
user 0m0.004s
sys 0m0.009s
docker rm -fv $ID
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When a network is created with "-o com.docker.network.enable_ipv4'
(including via "default-network-opts" in daemon config), and
EnableIPv4 is present in the API request (including when CLI option
"--ipv4" is used) - the top-level API value is used and the '-o'
is ignored.
But, the "-o" still shows up in Options in inspect output, which is
confusing if the values are different.
So, drop the "-o" if the top-level API option is set. Ditto IPv6.
Signed-off-by: Rob Murray <rob.murray@docker.com>
`moby/vpnkit` now officially pushes a binary image to `moby/vpnkit-bin`
repository on Docker Hub.
Use it to fetch the vpnkit binary.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Commit 27adcd5 ("libnet/d/bridge: drop connections to lo mappings, and
direct remote connections") introduced an iptables rule to drop 'direct'
remote connections made to the container's IP address - for each
published port on the container.
The normal filter-FORWARD rules would then drop packets sent directly to
unpublished ports. This rule was only created along with the rest of port
publishing (when a container's endpoint was selected as its gateway). Until
then, all packets addressed directly to the container's ports were dropped
by the filter-FORWARD rules.
But, the rule doesn't need to be per-port. Just drop packets sent
directly to a container's address unless they originate on the host.
That means fewer rules, that can be created along with the endpoint (then
directly-routed get dropped at the same point whether or not the endpoint
is currently the gateway - very slightly earlier than when it's not the
gateway).
Signed-off-by: Rob Murray <rob.murray@docker.com>
gotest.tools v3.0.1 and up support Go's native test.Cleanup(), which
means that manually calling the cleanup functions in a defer is no
longer needed.
Some of these could probably be replaced by Go's native `t.TempDir()`,
but keeping that for a follow-up exercise.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was added in 684633f734, because
Go stdlib's filepath.Rel did not support Windows UUID paths (and UNC paths).
UNC paths were fixed in https://golang.org/cl/253197 (go1.17), and I think
UUID paths were also supported now.
To verify the behavior I temporarily added a unit-test to compare between
stdlib and this implementation, and it all looks to work, so we can deprecate
and remove this function. Deprecating first, but there's no (known) external
users of this, so we can likely remove in an upcoming minor (or patch) release.
func TestRel(t *testing.T) {
testCases := []struct {
doc string
base string
target string
expected string
}{
{
doc: "UNC path",
base: `\\server\share`,
target: `\\server\share\folder\file.txt`,
expected: `folder\file.txt`,
},
{
doc: "UUID path",
base: `\\?\Volume{b75e2c83-0000-0000-0000-602f00000000}\data`,
target: `\\?\Volume{b75e2c83-0000-0000-0000-602f00000000}\data\file.txt`,
expected: `file.txt`,
},
{
doc: "subdirectory",
base: `C:\Projects`,
target: `C:\Projects\Go\main.go`,
expected: `Go\main.go`,
},
{
doc: "same directory",
base: `C:\Projects`,
target: `C:\Projects`,
expected: `.`,
},
{
doc: "parent directory",
base: `C:\Projects\Go`,
target: `C:\Projects`,
expected: `..`,
},
}
for _, tc := range testCases {
t.Run(tc.doc, func(t *testing.T) {
actual, err := remotecontext.Rel(tc.base, tc.target)
if err != nil {
t.Fatal(err)
}
if actual != tc.expected {
t.Errorf("expected: %q, got: %q", tc.expected, actual)
}
// Try with stdlib
actual, err = filepath.Rel(tc.base, tc.target)
if err != nil {
t.Fatal(err)
}
if actual != tc.expected {
t.Errorf("expected: %q, got: %q", tc.expected, actual)
}
})
}
}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The syntax was pinned for 1.7 in f696e0d2a7
possibly because it was not yet promoted as "latest stable" at the
time.
I don't think we need to pin to an old version, and just go with
the latest, so that we can use the latest features provided.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- We now only use winresources for the dockerd binary, so we can
reduce some uses of wildcards
- Use explicit ("/") to indicate these should only be ignored
relative to the root of the repository and build-context
- Remove remnant ignore for rpm builds
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Fix a logical error in the rootless setup tool where the iptables error
handling was incorrectly placed. The code was setting
`faced_iptables_error=1` even when iptables was available, causing
unnecessary error messages and setup suggestions.
This patch correctly moves the error handling into the `else` branch so
that we only report iptables errors when the command is actually
unavailable.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Go maintainers started to unconditionally update the minimum go version
for golang.org/x/ dependencies to go1.23, which means that we'll no longer
be able to support any version below that when updating those dependencies;
> all: upgrade go directive to at least 1.23.0 [generated]
>
> By now Go 1.24.0 has been released, and Go 1.22 is no longer supported
> per the Go Release Policy (https://go.dev/doc/devel/release#policy).
>
> For golang/go#69095.
This updates our minimum version to go1.23, as we won't be able to maintain
compatibility with older versions because of the above.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since commit 925b484 ("No fallback nameservers for internal
resolver"), if the host's resolv.conf has no nameservers and
no servers are supplied via config, the internal resolver will
not use Google's DNS - so the container will not be able to
resolve external DNS requests.
That can happen when container's are "restart-always" and the
docker daemon starts before the host's DNS is configured.
So, to highlight the issue (which may not be an error, but
probably is), include a warning in the container's resolv.conf
file.
Also, log a warning - logs currently say "No non-localhost DNS
nameservers are left in resolv.conf. Using default external
servers". But, that's misleading because it's from an initial
resolv.conf setup, before the internal resolver configured without
those fallbacks - we'll drop the fallbacks completely once the
default bridge has an internal resolver).
Signed-off-by: Rob Murray <rob.murray@docker.com>
CI runs a docker daemon, and some tests run their own. That tramples
the CI daemon's default bridge.
If a test leaves the bridge with only a link-local IPv6 address (for
example), subsequent tests are likely to fail - even if they also
start their own daemon because, by default the default bridge
network's config is based on an existing bridge device.
So, remember the bridge's addresses at the start of each test, and
restore them afterwards.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Since commit 51d7f95 ("libnet: remove struct endpointCnt") an
endpoint count for networks has not been persisted.
But, on downgrade to a version older than that commit, the
missing field caused daemon startup to fail.
So, create the count in the store - it only needs to exist, it's
no longer maintained as a count of endpoints. On downgrade, the
count is probably zero anyway (the daemon is stopped), but the
older daemon fixes it up on startup if necessary.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The existing code was more complicated than needed. By default, the daemon
runs "unconfined", but we try to detect the current profile that's set.
When failing to do so (error, or detected profile is empty), we assume
the default ("unconfined").
This patch simplifies the logic;
- Set the default ("unconfined")
- Only update the default when we successfully found the current profile
(no error occurred, and the profile is not empty).
While updating, also;
- Replaced use of `strings.SplitN` for `strings.Cut`, which is more
efficient, and doesn't allocate.
- Move constructing the profileData closer to where it's used.
- Remove intermediate var.
- Combine defers and change the order (close file first, before removing),
and suppress errors to keep linters happy.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`exec.Cmd.Path` already contains the command that was executed, so we
were printing the command twice. However, `exec.Cmd` implements a stringer
interface, which provides a readable version of the command that was
executed, so use that instead. While updating, lso change backticks in
the error for regular quotes.
Before:
running `/usr/sbin/apparmor_parser apparmor_parser -Kr /no/such/file` failed with output: Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.
error: exit status 1
After:
running '/usr/sbin/apparmor_parser -Kr /no/such/file' failed with output: Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.
error: exit status 1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We are considering moving the apparmor profile to a separate module,
so removing these comments in preparation. These comments are ignored
already when building in go module mode, so have little benefits.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We are considering moving the seccomp profile to a separate module,
so removing these comments in preparation. These comments are ignored
already when building in go module mode, so have little benefits.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We are considering moving the seccomp profile to a separate module,
so reducing the list of dependencies for this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 5d2006256f, which
caused some issues in the docker/cli formatting code that needs some
investigating.
Let's (temporarily) revert this while we look what's wrong.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Copy the swagger / OpenAPI file to the documentation. This is the API
version used by the upcoming v28.1.0 release.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Like for containerCreate, filter the list of container labels based on
`DOCKER_OTEL_INCLUDE_CONTAINER_LABEL_ATTRS` and put that list in the
OTel span.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This commit adds a new OTel span to `(*Daemon).containerCreate()` and
puts filtered container labels in the span attributes.
The filter is based on a comma-separated list of labels provided through
the `DOCKER_OTEL_INCLUDE_CONTAINER_LABEL_ATTRS` environment variable.
This label might be removed at any point in time if we figure out a
better way to filter labels, or if that span becomes unecessary.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
It's possible to remove a legacy link from running containers.
When that happens, the Sandbox's Endpoints are removed and
re-added.
Since commit 65120d5 ("Create bridge veth in container netns")
the veth device has been created in the container's netns. When
that happens, a flag is set on the Endpoint to note that it
does not need to be moved into the netns.
But, during the Leave/Join (Sandbox.Refresh) the veth is moved
out of the netns. So, clear the flag during the Leave, to note
that it needs to be moved back in during the Join.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The `BridgeNfIptables` and `BridgeNfIp6tables` fields in the
`GET /info` response were deprecated in API v1.48, and are now omitted
in API v1.49.
With this patch, old API version continue to return the field:
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIp6tables
false
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.48/info | jq .BridgeNfIptables
false
Omitting the field in API v1.49 and above
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/info | jq .BridgeNfIp6tables
null
curl -s --unix-socket /var/run/docker.sock http://localhost/v1.49/info | jq .BridgeNfIptables
null
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was introduced in c817ea2159, but overlooked
that the logs were now produced before (for POST requests) the form-data was
handled and added to the "fields" variable.
This patch changes the logic to wrap the handler and make sure logs are
created before, and after the handler is called (the "form-data" is always
added before the handler is called).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This updates the Docker CLI version used for integration-cli tests from
v17.06.2-ce to v18.06.3-ce.
v18.06 is the first one that supports enabling BuildKit.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This option was deprecated in 1932091e21, and
is no longer used. It was only kept to allow priniting a deprecation warning
if the config would happen to have the field set.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
There have been numerous reports of the "has active endpoints" error
over the years. Historically, there were some faulty code paths that
could lead to this error, but we believe they all have been fixed by
now.
However, users are still facing this error from time to time. Either
because they forgot that some containers are still running, or because
we still have bugs lying around.
To help users figure whether this error is legitimate, and what triggers
it, add endpoint names (which are just container names) to the error
message.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Add an OTel span processor copying the 'trigger' baggage member
propagated through contexts to all children spans. It's used to identify
what triggered a trace / span (API call, libnet init, etc...)
All code paths that call libnet's `NewNetwork` set this baggage member
with a unique value.
For instance, this can be used to distinguish bridge's `createNetwork`
spans triggered by daemon / libnet initialization from custom network
creation triggerd by an API call.
Two util functions are added to wrap `baggage.New` and
`baggage.NewMemberRaw` to make it easier to deal with baggage and
members by panicking on error. These should not be used with dynamic
values.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Plumb context from the API down to libnet driver method `CreateNetwork`,
and add an OTel span to the bridge driver's `createNetwork` method.
Include a few attributes describing the network configuration (e.g.
IPv4/IPv6, ICC, internal and MTU).
A new util function, `RecordStatus`, is added to the `otelutil` package
to easily record any error, and update the span status accordingly.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Since commit `eaa84bc`, when a container joins a network, we broadcast
unsolicited ARP/NAs to other containers connected to that network. The
initial advertisement is sent synchronously, and then remaining
advertisements (by default, 2) are sent asynchronously at a regular
interval (by default, 1 second).
An OTel span records the time spent sending subsequent advertisements,
but it's attached to the parent span `libnetwork.osl.AddInterface` so it
affects the overall latency reported by the trace.
The real latency (i.e. excluding the latency of that asynchronous
process), is pretty much what CLI users perceive, so it's an important
measure. It's available on the top-most span in the trace, but limiting
the trace to the real time taken by the Engine to process the HTTP
request seems better.
With this change, the initial advertisement is now tracked by a
dedicated span, and a new independent trace (containing a single span)
is created and linked to the 'initial' span / HTTP trace.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- pkg/archive: deprecate, and add aliases
Keeping the tests in this commit; also moves various utilities
into a _test.go file, as they were now only used in tests.
- pkg/chrootarchive: deprecate and add aliase
deprecate pkg/archive and add aliases
keeping the tests in this commit
- Add temporary exceptions for deprecation linting errors, because
this commit is to verify everything works with the aliases.
- remove tests that depend on un-exported types
=== RUN TestDisablePigz
--- FAIL: TestDisablePigz (0.00s)
panic: interface conversion: io.Reader is *archive.readCloserWrapper, not *archive.readCloserWrapper (types from different packages) [recovered]
- pkg/archive, pkg/chrootarchive: remove test files
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Derek McGowan <derek@mcg.dev>
Using iptables.OnReloaded to restore individual per-network rules
on firewalld reload means rules for deleted networks pop back in
to existence (because there was no way to delete the callbacks on
network-delete).
So, on firewalld reload, walk over current networks and ask them
to restore their iptables rules.
Signed-off-by: Rob Murray <rob.murray@docker.com>
- registry.ServiceConfig: add a "ExtraFields" for outputting deprecated
fields.
- remove uses of AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Report FirewallBackend in "docker info".
It's currently "iptables" or "iptables+firewalld" on Linux, and
omitted on Windows.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This fix address issues where the scanner was unable to properly parse longer outputs from /proc/stat. This could happen on an ARM machine with large amount of CPU cores (and interrupts). By switching to reader we have more control over data parsing and dump unnecessary data
Signed-off-by: Patrik Leifert <patrikleifert@hotmail.com>
Removes all tests, except for TestGetRootUIDGID and TestToContainer, which
are the only once that have a local implementation that's not covered.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update idtools to use Mkdir funcs from moby sys/user package
Add deprecation exception to golanci until move off idtools is complete
Signed-off-by: Derek McGowan <derek@mcg.dev>
- Split the implementation from the exported function (exported
function is still used by the CLI for Docker Content Trust).
- Pass through context to allow handling context-cancellation
once wired up in callers.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
endpointCnt is a refcounter used to track how many endpoints use a
network, and how many networks references a config-only network. It's
stored separately from the network.
This is only used to determine if a network can be removed.
This commit removes the `endpointCnt` struct and all its references. The
refcounter is replaced by two lookups in the newly introduced `networks`
and `endpoints` caches added to the `Controller`.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The `Controller`'s store is used by:
- `deleteFromStore`
- `getNetworks`
- `getNetworksFromStore`
- `updateToStore`
- … and other methods that can't store / delete / retrieve a Network
Calls to `updateToStore` and `deleteFromStore` have been replaced with
`upsertNetwork` and `deleteNetwork`.
Both `getNetworks` and `getNetworksFromStore` call `cacheNetwork` to
ensure networks loaded from the datastore are kept in-memory.
Finally, `sandboxRestore` was instantiating `Network` itself. These are
cached too.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The `Controller`'s store is used by:
- `deleteFromStore`
- `getEndpointFromStore`
- `getEndpointsFromStore`
- `updateToStore`
- … and other methods that can't store / delete / retrieve an Endpoint
Calls to `updateToStore` and `deleteFromStore` have been replaced with
`upsertEndpoint` and `deleteEndpoint`.
Both `getEndpointFromStore` and `getEndpointsFromStore` call
`cacheEndpoint` to ensure endpoints loaded from the datastore are kept
in-memory.
Finally, `sandboxRestore` was instantiating `Endpoint` itself. These are
cached too.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Rewrite `validateDestination` to first check if the destination path
exists. This slightly simplifies the logic (allowing returning
early in each step of the validation) and slightly improves the
error produced.
Before this, the error confusingly would mention the full path
not being a directory. While this _does_ match what `os.Writefile`
would return, it's .. confusing:
failed to stat output path: lstat ./not-a-dir/new-file.txt: not a directory
After this, the error would mention the directory that doesn't exist:
invalid output path: stat ./not-a-dir: not a directory
A slight optimization is made as well, now checking for _both_ "."
and ".." as special case, as either path should exist given any current
working directory (unless the working directory has been deleted, but we'd
fail further down the line).
With this change in order, we can also merge `validateFileMode` into
`validateDestination`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While the target-file does not have to exist, its parent must, and must
be a directory. This adds a test-case to verify the behavior if the
parent is not a directory.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, we were silently discarding this situation and hoping that
it would work; let's produce an error instead (we can add additional
filemodes when they arrive and if we need them)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The implementation uses "os.Rename" to move the temporary file to
the destination, which does not follow symlinks, and because of this
would replace a symlink with a file.
We can consider adding support for symlinked files in future, so that
WriteFile can be used as a drop-in replacement for `os.WriteFile()`
but in the meantime, let's produce an error so that nobody can depend
on this.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
CentOS 10 uses iptables-nft by default, and doesn't have
kernel module ip_tables - so dockerd-rootless-setuptool.sh
reports that the module is missing. It suggests installing
it (which isn't needed), or using --skip-iptables (which
disables iptables in daemon config).
So, unless "iptables --version" command reports "legacy",
check for kernel module "nf_tables" instead of "ip_tables".
Signed-off-by: Rob Murray <rob.murray@docker.com>
`GET /image/{name}/json` now supports `platform` parameter allowing to
specify which platform variant of a multi-platform image to inspect.
For servers that do not use containerd image store integration, this
option will cause an error if the requested platform doesn't match the
image's actual platform
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
full diff: https://github.com/golang/go/compare/go1.23.7...go1.23.8
release notes: https://go.dev/doc/devel/release#go1.24.2
go1.23.8 (released 2025-04-01) includes security fixes to the net/http package,
as well as bug fixes to the runtime and the go command. See the Go 1.23.8
milestone on our issue tracker for details;
https://github.com/golang/go/issues?q=milestone%3AGo1.23.8+label%3ACherryPickApproved
From the mailing list:
Hello gophers,
We have just released Go versions 1.24.2 and 1.23.8, minor point releases.
These minor releases include 1 security fixes following the security policy:
- net/http: request smuggling through invalid chunked data
The net/http package accepted data in the chunked transfer encoding
containing an invalid chunk-size line terminated by a bare LF.
When used in conjunction with a server or proxy which incorrectly
interprets a bare LF in a chunk extension as part of the extension,
this could permit request smuggling.
The net/http package now rejects chunk-size lines containing a bare LF.
Thanks to Jeppe Bonde Weikop for reporting this issue.
This is CVE-2025-22871 and Go issue https://go.dev/issue/71988.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since commit f2a183a99, `getEndpointPortMapInfo` is called for all the
endpoints of a container to get its complete list of port mappings. This
is required as multiple endpoints might publish different ports (e.g.
IPv4-only and IPv6-only endpoints mapping an IPv4 and an IPv6 port).
`getEndpointPortMapInfo` calls `(*Endpoint).DriverInfo()` which has a
dodgy behavior: if the endpoint is part of a sandbox that also has an
endpoint for the `docker_gwbridge` network, then `(*Endpoint).DriverInfo()`
returns the DriverInfo of that `docker_gwbridge` endpoint in place of
the current Endpoint's DriverInfo.
On overlay networks, host port-mappings are made through the
`docker_gwbridge` network (which is automatically attached to all Swarm
tasks). This results in duplicated port mappings reported for all Swarm
containers.
Since `getEndpointPortMapInfo` is the only place where
`(*Endpoint).DriverInfo()` is called, just remove that dodgy behavior.
`(*Endpoint).DriverInfo()` has an OS-specific implementation. Unlike the
Linux implementation, on Windows, `DriverInfo()` returns the DriverInfo
of the gateway endpoint _in addition_ to the current Endpoint's
DriverInfo. So it shouldn't be affected by this bug -- don't touch it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Tests will run in the host's namspace not the rootlesskit
namespace. So, just duplicating the non-rootless unit tests.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Unlike the equivalent for pulling images, [Service.LookupPushEndpoints]
never returns mirror endpoints, as it calls [Service.lookupV2Endpoints]
with "includeMirrors=false", so we should not use this field, and
unconditionally handle errors without the additional fallbacks that
we consider for pulling images from a mirror.
[Service.LookupPushEndpoints]: cea56c1d9c/registry/service.go (L134-L139)
[Service.lookupV2Endpoints]: cea56c1d9c/registry/service_v2.go (L10-L40)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The github action running bake expected FIREWALLD to be set, but
DOCKER_FIREWALLD was set instead, so firewalld wasn't installed
in the dev image.
The dind-systemd script expected DOCKER_FIREWALLD to be set if it
needed to run firewalld, and it was. But it had no effect.
In CI, bake builds the image then make runs it - and the use the
same env. So, align on FIREWALLD (as it's not a docker feature).
Signed-off-by: Rob Murray <rob.murray@docker.com>
Create an iptablesNetwork containing all the info needed to
set up per-network iptables rules, give it methods to do
create the rules, and use it instead of per-rule-type calls
from driver.createNetwork().
Signed-off-by: Rob Murray <rob.murray@docker.com>
While it's generally better to define interfaces locally, this one
now duplicated distribution.RegistryResolver, and it's passed on
to other types which expect that interface.
Remove this (un-exported) interface to make it easier to discover
what's used where.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
inline a simplified version of "newIndexInfo" without handling of
insecure registries and mirrors, as we don't need that information
to resolve the auth-config.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Simplify how we lookup auth-config, as we don't need the
additional information provided by RepositoryInfo. There's
still more layers to peel off, which will be done in follow-ups.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
[Service.ResolveRepository] is a shallow wrapper around [newRepositoryInfo],
from which we only consume the `Name` field. That field is a direct result
of `reference.TrimNamed`, so we can replace this with that.
[Service.ResolveRepository]: ecb03c4cda/registry/service.go (L106-L111)
[newRepositoryInfo]: ecb03c4cda/registry/config.go (L392-L408)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
[Service.ResolveRepository] is a shallow wrapper around [newRepositoryInfo],
from which we only consume the `Name` field. That field is a direct result
of `reference.TrimNamed`, so we can replace this with that.
[Service.ResolveRepository]: ecb03c4cda/registry/service.go (L106-L111)
[newRepositoryInfo]: ecb03c4cda/registry/config.go (L392-L408)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This constructor only uses the name / reference, and doesn't
use any of the other properties provided in RepositoryInfo.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
[Service.ResolveRepository] is a shallow wrapper around [newRepositoryInfo],
from which we only consume the `Name` field. That field is a direct result
of `reference.TrimNamed`, so we can replace this with that.
[Service.ResolveRepository]: ecb03c4cda/registry/service.go (L106-L111)
[newRepositoryInfo]: ecb03c4cda/registry/config.go (L392-L408)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This constructor only uses the name / reference, and doesn't
use any of the other properties provided in RepositoryInfo.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This type only uses the name / reference, and doesn't use any of the
other properties provided in RepositoryInfo.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This constructor only uses the name / reference, and doesn't
use any of the other properties provided in RepositoryInfo.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was introduced in 19515a7ad8 when
the registry code was replaced for code vendored from docker/distribution.
It was used for v1 registries to update the "TrustStore" for signed manifests;
19515a7ad8/graph/pull.go (L89-L93)
Before that, it used the IndexInfo.Official field;
276c640be4/graph/pull.go (L94-L97)
And related to "v2" registries;
88fdcfef02
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Doesn't look like it would ever have worked, but:
- init the dbus connection to avoid a segv
- include the chain name when creating the rule
- remove the test rule if it's created
Signed-off-by: Rob Murray <rob.murray@docker.com>
Firewalld runs in the host netns. So, tests running in
their own netns can't check firewalld's iptables rules.
Signed-off-by: Rob Murray <rob.murray@docker.com>
With firewalld enabled in CI, TestAccessPublishedPortFromHost/userland-proxy=true/IPv6=true
consistently fails when trying to use a link-local address on
eth0 (it's ok for the ULL added by the test).
In a local moby dev container, it passes - although it sometimes
fails when making its request to the host's ::1.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The daemon runs in a separate netns, but when it wants to create
an iptables rule it sends a dbus message to firewalld - which is
running in the host's netns.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Since commit cfc049c the dev container has been using iptables-nft,
but the Dockerfile configured firewalld to use its iptables backend
(if firewalld is enabled, which it accidentally hasn't been in CI).
The integration tests run ok for a while, then some things start
failing with the less than obvious message:
Error: COMMAND_FAILED: UNKNOWN_ERROR: nonexistent or underflow of priority count
So, let firewalld use its default nftables backend.
Signed-off-by: Rob Murray <rob.murray@docker.com>
During a load, ensure any existing images are left as dangling images.
This affects the `docker load` command with the containerd snapshotter
backend.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The pkg/archive/archive_linux_test.go tests create a test archive
content in a temporary directory. This also includes device nodes (using
mknod).
Running these tests in Docker-in-Docker (dind) with systemd was failing
with "operation not permitted" because the rootfs is remounted with
`nodev`.
This change aligns `hack/dind-systemd` with `hack/dind` by
conditionally mounting a `tmpfs` on `/tmp` (with dev enabled),
to make the mknod work.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Commit 9a6e96f ("Before sending ARPs/NAs, check the bridge is ready")
introduced a check that, if a container's veth is connected to a bridge,
the port is forwarding before sending unsolicited ARP/NA messages to
advertise the container's MAC/IP addresses.
It waited for up-to 200ms, but it seems that's not always enough.
If the port isn't forwarding, the ARP/NA messages will be silently
dropped. But, if it comes up within two seconds, one or both of the
resends will succeed.
So - keep the wait for 200ms but, if anything goes wrong with checking
the bridge port's state, or it's not forwarding after that time, just
log an info/warning level message and continue.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This package imports all "importable" packages, i.e., packages that:
- are not applications ("main")
- are not internal
- and that have non-test go-files
We do this to verify that our code can be consumed as a dependency
in "module mode". When using a dependency that does not have a go.mod
(i.e.; is not a "module"), go implicitly generates a go.mod. Lacking
information from the dependency itself, it assumes "go1.16" language
(see [DefaultGoModVersion]). Starting with Go1.21, go downgrades the
language version used for such dependencies, which means that any
language feature used that is not supported by go1.16 results in a
compile error;
# github.com/docker/cli/cli/context/store
/go/pkg/mod/github.com/docker/cli@v25.0.0-beta.2+incompatible/cli/context/store/storeconfig.go:6:24: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
/go/pkg/mod/github.com/docker/cli@v25.0.0-beta.2+incompatible/cli/context/store/store.go:74:12: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
These errors do NOT occur when using GOPATH mode, nor do they occur
when using "pseudo module mode" (the "-mod=mod -modfile=vendor.mod"
approach used in this repository).
As a workaround for this situation, we must include "//go:build" comments
in any file that uses newer go-language features (such as the "any" type
or the "min()", "max()" builtins).
From the go toolchain docs (https://go.dev/doc/toolchain):
> The go line for each module sets the language version the compiler enforces
> when compiling packages in that module. The language version can be changed
> on a per-file basis by using a build constraint.
>
> For example, a module containing code that uses the Go 1.21 language version
> should have a go.mod file with a go line such as go 1.21 or go 1.21.3.
> If a specific source file should be compiled only when using a newer Go
> toolchain, adding //go:build go1.22 to that source file both ensures that
> only Go 1.22 and newer toolchains will compile the file and also changes
> the language version in that file to Go 1.22.
This file is a generated module that imports all packages provided in
the repository, which replicates an external consumer using our code
as a dependency in go-module mode, and verifies all files in those
packages have the correct "//go:build <go language version>" set.
To test this package:
make -C ./internal/gocompat/
GO111MODULE=off go generate .
go mod tidy
go test -v
# github.com/docker/docker/libnetwork/options
../../libnetwork/options/options.go:45:25: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
# github.com/docker/docker/libnetwork/internal/setmatrix
../../libnetwork/internal/setmatrix/setmatrix.go:13:16: type parameter requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:13:18: predeclared comparable requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:14:20: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:20:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:31:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:43:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:59:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:80:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:93:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:104:10: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/internal/setmatrix/setmatrix.go:104:10: too many errors
# github.com/docker/docker/libnetwork/config
../../libnetwork/config/config.go:35:47: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/config/config.go:47:41: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/config/config.go:63:55: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../libnetwork/config/config.go:95:63: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
# github.com/docker/docker/testutil
../../testutil/helpers.go:80:9: predeclared any requires go1.18 or later (-lang was set to go1.16; check go.mod)
# github.com/docker/docker/builder/builder-next/adapters/containerimage
../../builder/builder-next/adapters/containerimage/pull.go:72:4: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
../../builder/builder-next/adapters/containerimage/pull.go:200:19: type instantiation requires go1.18 or later (-lang was set to go1.16; check go.mod)
FAIL gocompat [build failed]
make: *** [Makefile:5: verify] Error 1
[DefaultGoModVersion]: 58c28ba286/src/cmd/go/internal/gover/version.go (L15-L24)
[2]: https://go.dev/doc/toolchain
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The builder `Named` callback was not called with the containerd image
store integration enabled and BuildKit due to wrong imageexporter output
key being used.
We have a test `TestBuildEmitsEvents` that should have detected the bug,
but it wasn't actually working because the CLI version used in the
`integration-cli` didn't support BuildKit yet.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The runc libcontainer/cgroups package was moved to a separate
module; switch our use of the runc module to use the new
location.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release removes deprecated functions from the `label` package,
and improves documentation and error reporting of `SetCreateKey`.
Relevant changes:
-label: remove deprecated stuff
-Improve SetKeyCreate error reporting
full diff: https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove intermediate variable that was only used once
- move "follow" variable to where it's used; keeping an intermediate
variable for now, as the logic related to "follow" and "created"
could use some comment / documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both these defers were defined in the closure, and would be executed
at the end of the goroutine; inline them to prevent them being confused
for being executed after the function starting the goroutine.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- rename var that shadowed argument
- use consistent name for container arg; We use `ctr` as short name in most
places; use the same name to make the code slightly more readable.
- rename "logs" argument to prevent it being confused with a logs import
and to more clearly indicate its a bool
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the sixth patch release in the 1.2.z series of runc.
It primarily fixes an issue with runc exec vs time namespace,
and a compatibility issue with older kernels.
* Fix a stall issue that would happen if setting `O_CLOEXEC` with
`CloseExecFrom` failed.
* `runc` now properly handles joining time namespaces (such as with
`runc exec`). Previously we would attempt to set the time offsets
when joining, which would fail.
* Handle `EINTR` retries correctly for socket-related direct
`golang.org/x/sys/unix` system calls.
* We no longer use `F_SEAL_FUTURE_WRITE` when sealing the runc binary, as it
turns out this had some unfortunate bugs in older kernel versions and was
never necessary in the first place.
* Remove `Fexecve` helper from `libcontainer/system`. Runc 1.2.1 removed
runc-dmz, but we forgot to remove this helper added only for that.
* Use Go 1.23 for official builds, run CI with Go 1.24 and drop Ubuntu 20.04
from CI. We need to drop Ubuntu 20.04 from CI because Github Actions
announced it's already deprecated and it will be discontinued soon.
full diff: https://github.com/opencontainers/runc/compare/v1.2.5...v1.2.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the sixth patch release in the 1.2.z series of runc.
It primarily fixes an issue with runc exec vs time namespace,
and a compatibility issue with older kernels.
* Fix a stall issue that would happen if setting `O_CLOEXEC` with
`CloseExecFrom` failed.
* `runc` now properly handles joining time namespaces (such as with
`runc exec`). Previously we would attempt to set the time offsets
when joining, which would fail.
* Handle `EINTR` retries correctly for socket-related direct
`golang.org/x/sys/unix` system calls.
* We no longer use `F_SEAL_FUTURE_WRITE` when sealing the runc binary, as it
turns out this had some unfortunate bugs in older kernel versions and was
never necessary in the first place.
* Remove `Fexecve` helper from `libcontainer/system`. Runc 1.2.1 removed
runc-dmz, but we forgot to remove this helper added only for that.
* Use Go 1.23 for official builds, run CI with Go 1.24 and drop Ubuntu 20.04
from CI. We need to drop Ubuntu 20.04 from CI because Github Actions
announced it's already deprecated and it will be discontinued soon.
full diff: https://github.com/opencontainers/runc/compare/v1.2.5...v1.2.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When listing images, prioritize the tagged version. When computing the
unique images, the last returned image would be used as a base and repo
tags would be merged into it.
This makes it so `RepoDigests` has the correct value when there is both
a dangling and non-dangling version of the same image.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
JSON errors were introduced in API 1.24, and daemons running older versions of
the API would return errors as plain-text. However, such API versions would
also send the corresponding content-type header (text/plain), so we don't
really need to make the code version-dependent; there's already fallbacks
in place to handle JSON-responses that don't use the expected format, in
which case we produce a generic status-code error.
Before this patch, the client would print JSON-responses as-is when the
daemon returned an "API version too old" error;
DOCKER_API_VERSION=v1.10 docker info --format '{{.ID}}'
Error response from daemon: {"message":"client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version"}
With this patch, the client detects that the response is JSON, and prints
a friendlier error-message to help the user discover their client is too
old;
DOCKER_API_VERSION=v1.10 docker info --format '{{.ID}}'
Error response from daemon: client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Docker 25.0 (08e4e88482) deprecated API versions
older than v1.24, and support was removed in Docker 26.0.
As part of this deprecation, support for plain-text errors was also removed
in commit ffd877f948.
So while we no longer support API versions older 1.24 [api.MinSupportedAPIVersion],
a client may try to connect using an older version and expect a plain-text error
instead of a JSON error. This would result in an "API version too old" error
formatted in JSON being printed as-is.
DOCKER_API_VERSION=v1.10 docker info --format '{{.ID}}'
Error response from daemon: {"message":"client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version"}
curl --unix-socket /var/run/docker.sock http://localhost/v1.10/info
{"message":"client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version"}
Note that this was only a problem for old API versions; unsupported API versions
that were higher than the maximum version were already handled as JSON;
DOCKER_API_VERSION=v1.99 docker info --format '{{.ID}}'
Error response from daemon: client version 1.99 is too new. Maximum supported API version is 1.48
curl --unix-socket /var/run/docker.sock http://localhost/v1.99/info
{"message":"client version 1.99 is too new. Maximum supported API version is 1.48"}
Let's be nice, and return errors in plain-text to provide a more readable error
to help the user understand the API version they're using is no longer supported.
With this patch applied:
DOCKER_API_VERSION=v1.10 docker info --format '{{.ID}}'
Error response from daemon: client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version
curl --unix-socket /var/run/docker.sock http://localhost/v1.10/info
client version 1.10 is too old. Minimum supported API version is 1.24, please upgrade your client to a newer version
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
request.ReadBody already closes the body;
time="2025-03-20T19:08:25Z" level=error msg="subsequent attempt to close ReadCloserWrapper"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With improved IPv6 support, a dual-stack container can map a port using
two different networks -- one IPv4-only, the other IPv6-only.
The daemon was updating containers' `EndpointSettings.Ports` by looking
for the first network providing port-mappings. This was incorrect.
Instead, iterate over the whole list of endpoints, and merge everything
together.
The function doing that, ie. `getEndpointPortMapInfo`, is also
considered exposed ports, and nil the PortMap entry if an exposed port
is found. However, exposed ports are always set on a bridge network, so
this was erasing port-mappings found for other networks.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Instead, log the error returned by `nat.NewPort` and move on to the
next port mapping / exposed port.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The function `getEndpointPortMapInfo` is called by `updateJoinInfo` to
update the field `NetworkSettings.Ports` of a container.
However, `updateJoinInfo` is only called by `connectToNetwork` which is
also calling `getPortMapInfo` (which in turn calls
`getEndpointPortMapInfo`).
So, remove the call to `getEndpointPortMapInfo` from `updateJoinInfo`.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The UDP proxy is setting a deadline of 90 seconds when reading from the
backend. If no data is received within this interval, it reclaims the
connection.
This means, the backend would see a different connection every 90
seconds if the backend never sends back any reply to a client.
This change prevents the proxy from eagerly GC'ing such connections by
taking into account the last time a datagram was proxyed to the backend.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The UDP proxy used by cmd/docker-proxy is executing Write and Close in
two separate goroutines, such that a Close could interrupt an in-flight
Write.
Introduce a `connTrackEntry` that wraps a `net.Conn` and a `sync.Mutex`
to ensure that Write and Close are serialized.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
It seems to help with the flakiness in the CI.
However, I can't reproduce the flakiness locally.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Improve performance of function daemon.Containers() (used by docker ps) to
mitigate a latency increase when running large number of containers using the
containerd image store.
We do this by refactoring daemon.Containers() to collect info for containers in
parallel, rather than sequentially, using up to log2(N) worker threads. This
improves the performance from O(N) to O(log2(N)), where N is the number of
containers.
To verify correctness, this commits adds unit and integration tests.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
When a macvlan's parent interface is down it's not possible
to send NA messages. So, ignore the error.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The container platform migration tries to deduce the platform data from
the containerd content store if it's available.
However, on Windows we currently default to a non-containerd runtime
setup, so the containerd client is nil and accessing its content store
paniced:
```
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x0 pc=0x11b48e4]
goroutine 87 [running]:
github.com/containerd/containerd/v2/client.(*Client).ContentStore(0xc0003a0008?)
/go/src/github.com/docker/docker/vendor/github.com/containerd/containerd/v2/client/client.go:645 +0x24
github.com/docker/docker/daemon.(*Daemon).load(0xc00026e488, {0xc000c13d40, 0x40})
/go/src/github.com/docker/docker/daemon/container.go:84 +0x289
github.com/docker/docker/daemon.(*Daemon).restore.func1({0xc000c13d40, 0x40})
/go/src/github.com/docker/docker/daemon/daemon.go:236 +0x207
created by github.com/docker/docker/daemon.(*Daemon).restore in goroutine 1
/go/src/github.com/docker/docker/daemon/daemon.go:229 +0x1a7
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x0 pc=0x11b48e4]
goroutine 90 [running]:
github.com/containerd/containerd/v2/client.(*Client).ContentStore(0xc000313608?)
/go/src/github.com/docker/docker/vendor/github.com/containerd/containerd/v2/client/client.go:645 +0x24
github.com/docker/docker/daemon.(*Daemon).load(0xc00026e488, {0xc000c13e00, 0x40})
/go/src/github.com/docker/docker/daemon/container.go:84 +0x289
github.com/docker/docker/daemon.(*Daemon).restore.func1({0xc000c13e00, 0x40})
/go/src/github.com/docker/docker/daemon/daemon.go:236 +0x207
created by github.com/docker/docker/daemon.(*Daemon).restore in goroutine 1
/go/src/github.com/docker/docker/daemon/daemon.go:229 +0x1a7
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x0 pc=0x11b48e4]
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Split the `ErrConflictHostNetwork` error into two distinct errors:
1. `ErrConflictConnectToHostNetwork` when attempting to change the
network mode of a running container from a different mode to `host`
2. `ErrConflictDisconnectFromHostNetwork` when the network mode of a
running container is `host` and attempting to disconnect from `host`
This commit clarifies error messaging by differentiating between the two
errors, making it clearer which operation failed and how to fix it.
Signed-off-by: Brendon Smith <bws@bws.bio>
On Linux, mask "/proc/interrupts" and "/sys/devices/system/cpu/cpu<x>/thermal_throttle"
inside containers by default. Privileged containers or containers started
with --security-opt="systempaths=unconfined" are not affected.
Mitigates potential Thermal Side-Channel Vulnerability Exploit
(https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm).
Also: improve integration test TestCreateWithCustomMaskedPaths() to ensure
default masked paths don't apply to privileged containers.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
For kernels that don't have CONFIG_IP_NF_RAW, if the env
var DOCKER_INSECURE_NO_IPTABLES_RAW is set to "1", don't
try to create raw rules.
This means direct routing to published ports is possible
from other hosts on the local network, even if the port
is published to a loopback address.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This function was only used internally, but it still has at least one
external consumer, so adding a "deprecated" comment.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
[homedir.GetConfigHome] only returns an error if the value is empty,
so we can check for a non-empty value instead of an error, which also
means that this value would never be empty.
[homedir.GetConfigHome]: b4bdf12dae/pkg/homedir/homedir_linux.go (L86-L95)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function had to be called both in the daemon startup, as well as
the CLI startup. Which, in case of the cli, meant that the registry
package became a required dependency for all CLI-plugins.
Make the package itself aware of situations where it's running with
rootlessKit enabled. Altogether we should get rid of this package-level
variable, and instead store this in our configuration, and pass through
where it's used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Disallow empty filenames
- Don't allow writing to a directory
- Return early if parent dir doesn't exist
- TBD: do we want to allow symlinks to be followed, or disallow?
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
If the userland-proxy is running, packets from one bridge network
addressed to the host port are not DNAT'd - so that docker-proxy
can pick them up, and therefore the packet bypasses the network
isolation rules.
Without the userland-proxy, there's no way for a packet from one
bridge network to bypass the network isolation rules. So, in this
case, DNAT is not skipped - and that at-least allows packets
originating from the network that published the port to access
the host port.
Commit 0546d90 improved support for routed mode networks (allowing
nat-mode networks access to containers in routed-mode networks, as
well as just remote access).
That commit changed the "SKIP DNAT" logic, making sure DNAT was
skipped for a routed-mode network if the userland-proxy was enabled
(so, containers in routed mode networks could access ports published
by other networks).
But, it still skipped DNAT for a routed mode network if the userland
proxy was disabled - packets from the routed mode network aimed at
any other network would be dropped by the network isolation rules
anyway, and containers in a routed mode network don't need access to
ports published from that network (because, by definition, there
can't be any).
However, network isolation rules can be worked-around with a rule
in the DOCKER-USER chain, but the SKIP DNAT rule is harder to deal
with.
So, for routed-mode, only skip DNAT if the userland-proxy is
enabled (just like nat-mode networks).
Signed-off-by: Rob Murray <rob.murray@docker.com>
- test errors returned for non-existing destination
- test that files are cleaned up after
- test writing to a symlinked file (to be fixed)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Creating a writer (`atomicwriter.New()`) and closing it without a write
ever happening, would replace the destination file with an empty file.
This patch adds a check whether a write was performed (either successful
or unsuccessful); if no write happened, we cleanup the tempfile without
replacing the destination file.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We were testing this function implicitly through `TestWriteFile`, but
not verifying the behavior of `New` in isolation. Add separate tests
for this function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- rename tests to match the function tested
- remove init func in favor or a test-helper
- rename some vars to prevent shadowing
- update example values to be more descriptive
- add a utility for asserting file content and mode
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The test had 2 almost identical separate implementations (Linux and
Windows). The Windows one was skipped anyway.
Make one test that covers all test cases.
The test still needs to be fixed for Windows, so don't unskip it yet.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Split singlePlatformSize into a separate methods of the `ImageManifest`
that calculate the corresponding usage.
This also allows us to simplify a part of the `multiPlatformSummary`
because we don't calculate the content size twice now.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
[docker/cli@fc6976d] added support for recursive readonly mounts in the
CLI, adding a ValidateMountWithAPIVersion utility to verify if options
used were supported by the API version.
We usually keep API-version dependent checks in the client, so that
docker/cli (and other users of the client) don't have to implement
their own validation for these.
This patch moves the functionality of ValidateMountWithAPIVersion to
the client.
Once the docker/cli vendoring was updated, we can remove the utility
there.
[docker/cli@fc6976d]: fc6976db45
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Using "familiarname" (e.g. "ubuntu") should be mostly done for presenting
image refernces to the user, but internally, we should use the canonical
format where possible ("docker.io/library/ubuntu").
There's still many places where we use the familiar (short) form, but
let's start with not converting references in the client.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was implemented to use various parts of the registry package
that were designed for the daemon code, which was written with the assumption
that it had registry-config available from the daemon's configuration.
However, `ParseSearchIndexInfo` is used by the client / CLI, which does
not have this information.
To work around this problem, the code used a dummy "emptyServiceConfig"
to allow the `Insecure` and `Mirrors` fields to be propagated based on
the same defaults as used by the daemon. The `Mirrors` field would always
be empty, as there are no default mirrors, and (lacking access to the
daemon's config) the `Insecure` field would always default to registries
running on a loopback address (`::1/128`, `127.0.0.1/8`). It's worth noting
that neither the `Mirrors`, nor the `Insecure` field is used by the CLI.
This patch rewrites `ParseSearchIndexInfo` to be self-contained, and not
depend on these constructs (and the `emptyServiceConfig`). For now, the
existing logic for `Insecure` is kept, but replaced by a simplified function
(`isInsecure`) with some optimizations for well-known loopback addresses
(`localhost`, `::1`, `127.0.0.1`) to prevent redundant DNS lookups or
parsing.
Note that similar changes should be made for [ParseRepositoryInfo], which
has a similar fate and is also only used by the client / CLI.
[ResolveRepositoryName]: 11e47996dc/registry/registry.go (L199-L222)
[ParseRepositoryInfo]: d86dd75948/registry/config.go (L375-L381)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The temp-file was created before trying to make the given filename an
absolute path. Reverse the order of code so that we don't create
a temp-file if an error happens.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was introduced in 568f86eb18
to replace [ResolveRepositoryName]. The function was implemented to use
various parts of the registry package that were designed for the daemon
code, which was written with the assumption that it had registry-config
available from the daemon's configuration. However, `ParseRepositoryInfo`
was used in the client / CLI, which does not have this information.
To work around this problem, the code used a dummy "emptyServiceConfig"
to allow the `Insecure` and `Mirrors` fields to be propagated based on
the same defaults as used by the daemon. The `Mirrors` field would always
be empty, as there are no default mirrors, and (lacking access to the
daemon's config) the `Insecure` field would always default to registries
running on a loopback address (`::1/128`, `127.0.0.1/8`). It's worth noting
that neither the `Mirrors`, nor the `Insecure` field is used by the CLI.
This patch rewrites `ParseRepositoryInfo` to be self-contained, and not
depend on these constructs (and the `emptyServiceConfig`). For now, the
existing logic for `Insecure` is kept, but replaced by a simplified function
(`isInsecure`) with some optimizations for well-known loopback addresses
(`localhost`, `::1`, `127.0.0.1`) to prevent redundant DNS lookups or
parsing.
Note that similar changes should be made for [ParseSearchIndexInfo], which
has a similar fate and is also only used by the client / CLI.
[ResolveRepositoryName]: 11e47996dc/registry/registry.go (L199-L222)
[ParseSearchIndexInfo]: d86dd75948/registry/search.go (L153-L162)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was setting some fields to their zero / default-value, which
was redundant, and added additional imports. Remove them as they are
not needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I noticed that the only reason we kept this was so that we could produce
a more targeted error for the deprecated storage-driver plugins, but it's
very unlikely someone used those, and if they did, we already had the
"DOCKERD_DEPRECATED_GRAPHDRIVER_PLUGINS" added as requirement. Let's
just produce an error if that option is set (and remove that altogether in
a later release, but just that check doesn't add significant complexity).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Explicitly set the gRPC connection params to take the timeout into
account to workaround the containerd v2 client not passing down the
stack.
containerd v2 replaced usages of deprecated gRPC functions but didn't
pass the timeout to the actual dial connection options.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
full diff: https://github.com/golang/net/compare/v0.35.0...v0.36.0
Version v0.36.0 of golang.org/x/net fixes a vulnerability in the
golang.org/x/net/proxy and golang.org/x/net/http/httpproxy packages
which could cause the proxy to be bypassed.
Matching of hosts against proxy patterns could improperly treat an IPv6
zone ID as a hostname component. For example, when the NO_PROXY
environment variable was set to "*.example.com", a request to
"[::1%25.example.com]:80` would incorrectly match and not be proxied.
Thanks to Juho Forsén of Mattermost for reporting this issue.
This is CVE-2025-22870 and Go issue https://go.dev/issue/71984.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- full diff: https://github.com/containerd/containerd/compare/v1.7.25...v1.7.26
- release notes: https://github.com/containerd/containerd/releases/tag/v1.7.26
Welcome to the v1.7.26 release of containerd!
The twenty-sixth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
- Add support for syncfs after unpack
- Update runc binary to v1.2.55
- Fix race between serve and immediate shutdown on the server
- Reject oversized messages from the sender
Container Runtime Interface (CRI)
- Fix fatal concurrency error in port forwarding
Node Resource Interface (NRI)
- Fix initial sync race when registering NRI plugins
- Add API support for reading Pod IPs
- Fix plugin sync to use multiple messages if ttrpc max message limit is hit
- Update API to pass configured timeouts to plugins.
- Fix mount removal in adjustments
- Close plugin if initial synchronization fails
- Add support for adjusting OOM score
- Add API support for NRI-native CDI injection
- Add support for pids cgroup
Runtime
- Fix console TTY leak in runc shim
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We return errors in this function, except for this one, which was logged
as Fatal. If we want errors to be logged, we should probably do so in
the function calling daemonCLI.start.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function could produce various logs ("Running in rootless mode") at
the start, but further steps could still fail (such as running with
RootlessKit, but not being configured as rootless).
This patch moves the informational / warning logs further down, so that
we don't produce logs before failing.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Explicitly access config field through the Config field, instead
of the top-level "cli". This allows spotting locations where we don't
depend on the CLI, but really just the Config.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method only depended on the CLI config; rewrite it to a
regular function, returning the opts to use for the containerd
daemon.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function took the whole daemon CLI as argument, but only needed
the config; change the signature to accept that.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method only required the config to be passed; rewrite it to a
regular func that accepts the config.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests don't actually run the integration-cli suite, but
the global hack/xxx script errors because it's not set;
---> Making bundle: test-docker-py (in bundles/test-docker-py)
---> Making bundle: .integration-daemon-start (in bundles/test-docker-py)
Using test binary /usr/local/cli-integration/docker
# DOCKER_EXPERIMENTAL is set: starting daemon with experimental features enabled!
# cgroup v2 requires TEST_SKIP_INTEGRATION_CLI to be set
make: *** [Makefile:220: test-docker-py] Error 1
Error: Process completed with exit code 2.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This fixes unnecessary errors being written to the daemon log after
copying container streams failed due the streams being closed explicitly:
time="2025-03-06T13:20:53.473232423Z" level=error msg="copy stream failed" error="io: read/write on closed pipe" stream=stdin
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
We have tagged version v0.27.0 of golang.org/x/oauth2 in order to address
a security issue.
jws: unexpected memory consumption during token parsing
Version v0.27.0 of golang.org/x/oauth2 fixes a vulnerability in the
golang.org/x/oauth2/jws package which could cause a denial of service.
An attacker can pass a malicious malformed token which causes unexpected
memory to be consumed during parsing.
Thanks to jub0bs for reporting this issue.
This is CVE-2025-22868 and Go issue https://go.dev/issue/71490.
full diff: https://github.com/golang/oauth2/compare/v0.26.0...v0.27.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
No code changes, only comments (warnings) added;
- google: add warning about externally-provided credentials
> Important: If you accept a credential configuration (credential JSON/File/Stream) from an
> external source for authentication to Google Cloud Platform, you must validate it before
> providing it to any Google API or library. Providing an unvalidated credential configuration to
> Google APIs can compromise the security of your systems and data. For more information, refer to
> [Validate credential configurations from external sources](https://cloud.google.com/docs/authentication/external/externally-sourced-credentials).
full diff: https://github.com/golang/oauth2/compare/v0.23.0...v0.26.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We have tagged version v0.35.0 of golang.org/x/crypto in order to address
a security issue. Version v0.35.0 of golang.org/x/crypto fixes a vulnerability
in the golang.org/x/crypto/ssh package which could cause a denial of service.
SSH servers which implement file transfer protocols are vulnerable to a denial
of service attack from clients which complete the key exchange slowly, or not
at all, causing pending content to be read into memory, but never transmitted.
Thanks to Yuichi Watanabe for reporting this issue.
This is CVE-2025-22869 and Go issue https://go.dev/issue/71931.
full diff: https://github.com/golang/crypto/compare/v0.31.0...v0.35.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Go maintainers started to unconditionally update the minimum go version
for golang.org/x/ dependencies to go1.23, which means that we'll no longer
be able to support any version below that when updating those dependencies;
> all: upgrade go directive to at least 1.23.0 [generated]
>
> By now Go 1.24.0 has been released, and Go 1.22 is no longer supported
> per the Go Release Policy (https://go.dev/doc/devel/release#policy).
>
> For golang/go#69095.
This updates our minimum version to go1.23, as we won't be able to maintain
compatibility with older versions because of the above.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These chains were added in commit 76417bf ("Don't use ipset"), but
not included in the list of chains that get flushed and deleted
on daemon startup.
Signed-off-by: Rob Murray <rob.murray@docker.com>
api/types/registry/registry.go:60:2: naked return in func `UnmarshalJSON` with 9 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
api/server/router/build/build_routes.go:359:2: naked return in func `Write` with 5 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
image/tarexport/load.go:429:2: naked return in func `validatedParentLinks` with 12 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/logger/awslogs/cloudwatchlogs.go:684:2: naked return in func `findValidSplit` with 10 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/logger/proxy.go:35:3: naked return in func `StartLogging` with 17 lines of code (nakedret)
return
^
daemon/logger/proxy.go:42:2: naked return in func `StartLogging` with 17 lines of code (nakedret)
return
^
daemon/logger/proxy.go:61:3: naked return in func `StopLogging` with 16 lines of code (nakedret)
return
^
daemon/logger/proxy.go:68:2: naked return in func `StopLogging` with 16 lines of code (nakedret)
return
^
daemon/logger/proxy.go:80:3: naked return in func `Capabilities` with 14 lines of code (nakedret)
return
^
daemon/logger/proxy.go:89:2: naked return in func `Capabilities` with 14 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go:527:2: naked return in func `fusermountU` with 25 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/graphdriver/fsdiff.go:140:3: naked return in func `ApplyDiff` with 20 lines of code (nakedret)
return
^
daemon/graphdriver/fsdiff.go:149:3: naked return in func `ApplyDiff` with 20 lines of code (nakedret)
return
^
daemon/graphdriver/fsdiff.go:153:2: naked return in func `ApplyDiff` with 20 lines of code (nakedret)
return
^
daemon/graphdriver/fsdiff.go:164:3: naked return in func `DiffSize` with 15 lines of code (nakedret)
return
^
daemon/graphdriver/fsdiff.go:169:3: naked return in func `DiffSize` with 15 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/cluster/cluster.go:423:2: naked return in func `managerStats` with 24 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon/daemon.go:1570:2: naked return in func `RemapContainerdNamespaces` with 21 lines of code (nakedret)
return
^
daemon/daemon_linux.go:128:2: naked return in func `getCleanPatterns` with 14 lines of code (nakedret)
return
^
daemon/logs.go:180:2: naked return in func `getLogger` with 11 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove output variables, and use explicit returns
daemon/stats_unix.go:359:2: naked return in func `getSystemCPUUsage` with 38 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/service.go:83:4: naked return in func `Auth` with 38 lines of code (nakedret)
return
^
registry/search_session.go:91:2: naked return in func `Read` with 6 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
plugin/backend_linux.go:722:3: naked return in func `CreateFromContext` with 112 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/tarsum/versioning.go:150:2: naked return in func `v1TarHeaderSelect` with 35 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stdcopy/stdcopy.go:68:2: naked return in func `Write` with 23 lines of code (nakedret)
return
^
pkg/stdcopy/stdcopy_test.go:93:3: naked return in func `getSrcBuffer` with 10 lines of code (nakedret)
return
^
pkg/stdcopy/stdcopy_test.go:97:2: naked return in func `getSrcBuffer` with 10 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/archive/copy_unix_test.go:54:3: naked return in func `fileContentsEqual` with 35 lines of code (nakedret)
return
^
pkg/archive/copy_unix_test.go:60:3: naked return in func `fileContentsEqual` with 35 lines of code (nakedret)
return
^
pkg/archive/copy_unix_test.go:67:3: naked return in func `fileContentsEqual` with 35 lines of code (nakedret)
return
^
pkg/archive/copy_unix_test.go:74:3: naked return in func `fileContentsEqual` with 35 lines of code (nakedret)
return
^
pkg/archive/copy_unix_test.go:83:2: naked return in func `fileContentsEqual` with 35 lines of code (nakedret)
return
^
pkg/archive/diff_test.go:314:3: naked return in func `makeTestLayer` with 35 lines of code (nakedret)
return
^
pkg/archive/diff_test.go:326:5: naked return in func `makeTestLayer` with 35 lines of code (nakedret)
return
^
pkg/archive/diff_test.go:330:5: naked return in func `makeTestLayer` with 35 lines of code (nakedret)
return
^
pkg/archive/diff_test.go:336:3: naked return in func `makeTestLayer` with 35 lines of code (nakedret)
return
^
pkg/archive/copy_unix_test.go:36:2: naked return in func `getTestTempDirs` with 10 lines of code (nakedret)
return
^
pkg/stdcopy/stdcopy_test.go:93:3: naked return in func `getSrcBuffer` with 10 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/archive/archive_linux.go:65:2: naked return in func `ConvertWrite` with 43 lines of code (nakedret)
return
^
pkg/archive/archive.go:265:2: naked return in func `Read` with 11 lines of code (nakedret)
return
^
pkg/archive/copy.go:32:2: naked return in func `copyWithBuffer` with 5 lines of code (nakedret)
return
^
pkg/archive/copy.go:114:3: naked return in func `TarResourceRebase` with 16 lines of code (nakedret)
return
^
pkg/archive/copy.go:449:4: naked return in func `ResolveHostSourcePath` with 26 lines of code (nakedret)
return
^
pkg/archive/copy.go:460:4: naked return in func `ResolveHostSourcePath` with 26 lines of code (nakedret)
return
^
pkg/archive/wrap.go:58:2: naked return in func `parseStringPairs` with 11 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/drivers/remote/driver_test.go:29:2: naked return in func `decodeToMap` with 3 lines of code (nakedret)
return
^
libnetwork/ipams/remote/remote_test.go:23:2: naked return in func `decodeToMap` with 3 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/types/types.go:330:2: naked return in func `ParseCIDR` with 6 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/osl/namespace_linux.go:324:2: naked return in func `DisableARPForVIP` with 28 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/drivers/overlay/encryption.go:370:2: naked return in func `programSA` with 64 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
libnetwork/cmd/networkdb-test/dbclient/ndbClient.go:251:5: naked return in func `checkTable` with 42 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
layer/layer_store.go:524:4: naked return in func `CreateRWLayer` with 72 lines of code (nakedret)
return
^
layer/layer_store.go:534:3: naked return in func `CreateRWLayer` with 72 lines of code (nakedret)
return
^
layer/layer_store.go:537:3: naked return in func `CreateRWLayer` with 72 lines of code (nakedret)
return
^
layer/migration.go:19:3: naked return in func `ChecksumForGraphID` with 28 lines of code (nakedret)
return
^
layer/migration.go:25:3: naked return in func `ChecksumForGraphID` with 28 lines of code (nakedret)
return
^
layer/migration.go:36:3: naked return in func `ChecksumForGraphID` with 28 lines of code (nakedret)
return
^
layer/migration.go:40:3: naked return in func `ChecksumForGraphID` with 28 lines of code (nakedret)
return
^
layer/migration.go:43:2: naked return in func `ChecksumForGraphID` with 28 lines of code (nakedret)
return
^
layer/ro_layer.go:176:2: naked return in func `Read` with 13 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
In fairness, these could possibly be an exception to the rule, but adding
explicit returns isn't too bad either, and allows running the nakedret
linter without //nolint tags or exceptions in .golangci-lint.yaml
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
internal/mod/mod.go:22:3: naked return in func `moduleVersion` with 38 lines of code (nakedret)
return
^
internal/mod/mod.go:36:4: naked return in func `moduleVersion` with 38 lines of code (nakedret)
return
^
internal/mod/mod.go:57:2: naked return in func `moduleVersion` with 38 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove output variables, and use explicit returns
integration-cli/check_test.go:86:3: naked return in func `testRun` with 43 lines of code (nakedret)
return
^
integration-cli/check_test.go:97:3: naked return in func `testRun` with 43 lines of code (nakedret)
return
^
integration-cli/docker_cli_cp_utils_test.go:167:2: naked return in func `makeTestContainer` with 44 lines of code (nakedret)
return
^
integration-cli/docker_api_attach_test.go:299:3: naked return in func `readTimeout` with 12 lines of code (nakedret)
return
^
integration-cli/docker_cli_cp_utils_test.go:215:2: naked return in func `startContainerGetOutput` with 11 lines of code (nakedret)
return
^
integration-cli/docker_cli_logs_test.go:276:4: naked return in func `ConsumeWithSpeed` with 18 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove output variables, and use explicit returns
container/stream/bytespipe/bytespipe.go:165:2: naked return in func `Read` with 37 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
builder/remotecontext/detect.go:47:2: naked return in func `Detect` with 17 lines of code (nakedret)
return
^
builder/remotecontext/archive.go:127:2: naked return in func `normalize` with 7 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- use explicit returns
- rename error-return that's used in a defer
- move closing the tmpFile on error to a defer
- add debug logs for cases where either closing the file, or failing to
remove the temp-directory
builder/dockerfile/copy.go:369:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
builder/dockerfile/copy.go:374:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
builder/dockerfile/copy.go:382:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
builder/dockerfile/copy.go:398:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
builder/dockerfile/copy.go:407:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
builder/dockerfile/copy.go:428:3: naked return in func `downloadSource` with 67 lines of code (nakedret)
return
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Re-implement the Build function using the new implementation from
libnetwork/internal/resolvconf.
BuildKit is the only consumer of the Build function currently, and we
should consider either moving the internal package out of internal, or
to provide a more customized variant of Build that fits BuildKit's
needs (i.e., only patch content, but not write to a file).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The new resolvconf implementation in libnetwork/internal/resolvconf
uses a different order for "search" and puts it after the resolvers.
While this changes the checksum of the file, and thus would be potentially
detected as "user modified", we no longer use this function ourselves,
and BuildKit (which uses this function) only consumes the Content field,
and discards the Hash; https://github.com/moby/buildkit/blob/v0.20.0/executor/oci/resolvconf.go#L99-L103
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The tests were depending on the implementation ignoring invalid
nameservers, as these should always be an IP-address, not a hostname.
Update the tests to use correct values, instead of codifying the
bad behavior.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- rename the "client" argument to "apiClient" to prevent shadowing the client import.
- remove intermediate "mount" var, which shadowed an import
- remove debug logs for stdOut/stdErr
- update the defer to use the container test-utils package to fix unhandled error warnings.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Add test-cases for IPv6 refs
- Add test-cases for validating the insecure-registries passed in the test
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Using DeepEquals showed that the test was missing differences between
nil-mirrors and empty-slice, in addition to mirrors being normalized
(the test only checked for the length).
While we should consider if we need an explicit empty slice (or if a
nil value would be appropriate), at least we now have a test to verify
the behavior.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was a very thin wrapper around newServiceConfig, and didn't save
any code needed; possibly even the reverse, as it was abstracting
what it did under the hood.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We already have been following this convention - add a linter rule that
will help us follow that convention in future changes.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This was not revealed in our tests, which only checked for the length
of the Mirror-slice, but when testing with DeepEquals, tests were failing
when all tests were run (but succeeded on individual tests). The problem
here is that some code can mutate the list of Mirrors and set it to `nil`
or an empty slice, resulting in other tests to fail.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
ValidateIndexName is used by the docker daemon CLI to validate options
passed through CLI flags and daemon.json. However, it also handled
normalizing the registry name ("index.docker.io" -> "docker.io").
This patch splits the normalization code to a separate function. It
is currently not exported, but could be considered in the future;
if we do so, we may want to look for a better place for that function
to not have it in the same package as the registry code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
emptyServiceConfig is a default service-config for situations where
no config-file is available (e.g. when used in the CLI). If won't
have mirrors configured, but does have the default insecure registry
CIDRs for loopback interfaces configured.
Before this patch, this config was constructeed using the same code
that handled constructing the config with a config present, but this
involved parsing CIDR masks, and much more.
With this patch, the service config is constructed as a literal, making
it more transparent that it does not depend on any config or state.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
RepositoryInfo.Official indicates whether the image repository
is an official (docker library official images) repository.
We only need to check this if the image-repository is on Docker Hub.
This patch renames the variable to make it more transparent that this
boolean is for the repository, and not to be confused for IndexInfo.Official,
which indicates if the _registry_ is the "Official" (Docker Hub) registry.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field indicates whether a repository is an official image (Docker
Library / Docker Official Images). This information is deducted from the
image reference, and not used anywhere, other than in tests.
The `RepositoryInfo` and `IndexInfo` types were originally introduced in
568f86eb18, with their fields documented in
4fcb9ac40c.
At the time, the `Official` field was only used for `docker push` to produce
a custom error message if someone would attempt to push an official image
to docker hub (assuming nobody would be able to do so);
6870bde584/api/client/commands.go (L1184-L1194)
Before that commit, the condition for this error message was based on the
given image reference directly; b370acd679b370acd679/commands.go (L421-L428)
This patch deprecates the field, because it's not used, and removes
tests related to it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Relevant changes:
- Update remote content to break up writes to avoid grpc message size limits
- Move CDI device spec out of the OCI package
- Remove deprecated WithCDIDevices in oci spec opts
full diff: https://github.com/containerd/containerd/compare/v2.0.2...v2.0.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's either "not windows" or "windows" (and something else), so the second
condition doesn't have to check if it's windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The "local" client does not use containerd, but implements the same interface,
many args are not used though, so remove these to make it more clear what's
actually in use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The "local" client does not use containerd, but implements the same interface,
many args are not used though, so remove these to make it more clear what's
actually in use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Also remove an intermediate var, and remove a "WithError" in favor of
adding the error field to the "WithFields".
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All the tests in it had skips for Windows. The move makes it possible
to add a test that uses L3Segment.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This matches the name used by Swarm in swarmnode.Config. While updating,
also remove code from Cluster.Start that replicated the logic to construct
the path, in favor of using the `stateDir` field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The WatchStream field was set as configuration option in cmd/dockerd,
but not configurable. Move creating the stream to the constructor,
and remove the configuration option. This field was introduced in
59d45c384a, at which time the cmd/dockerd
code needed direct access to the stream, but a later refactor in
05346355db introduced an accessor
(GetWatchStream) for this.
The cluster.Config struct is only used internally, it's unlikely
for any external project to use this, so skipping deprecation.
With this change, the cmd/dockerd package no longer has a direct
import of swarmkit.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Noticed this log in CI on Windows, which wasn't clear if it was an error
in Windows or in Docker;
2025-02-25T03:21:35.9273942Z [Error] Handler for POST /v1.48/containers/1713bc845f9bde79aa0017c16613fbfc8810b3272b31dbb2535d3fb1a3550f9c/pause returned error: cannot pause container 1713bc845f9bde79aa0017c16613fbfc8810b3272b31dbb2535d3fb1a3550f9c: Unimplemented: not implemented
Looks like it's a feature that's not implemented when using process-isolation,
so updating the error-message to make it more identifiable as an error
produced by us.
I kept the type to be a "not implemented", which will be converted to a
501 HTTP status (so still logged as error); alternatively, we could make
this a "invalid parameter".
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While going through some logs from CI, I noticed this log-entry on Windows,
produced as part of a test;
2025-02-25T03:23:17.6584227Z [Error] Handler for POST /v1.48/containers/b47b1e632188426d6d42a4be04f9a3cc1eca40cfed9536d277011052af0b04f5/update returned error: Cannot update container b47b1e632188426d6d42a4be04f9a3cc1eca40cfed9536d277011052af0b04f5: Restart policy cannot be updated because AutoRemove is enabled for the container
While updating is an error for the user, it's not an error in the daemon,
so we should return the correct error-type (and avoid logging it as an
error in daemon logs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `ErrPortAlreadyAllocated` error was introduced in ffd68badc0,
and at the time used as sentinel error in the bridge driver. It was later
integrated into libnetwork ([libnetwork@672ced7]), and brought back when
libnetwork was integrated in v1.7.0; 272f8cd4bc
After libnetwork was integrated, the error was unused as sentinel error,
except for locally inside the package as part of a test;
git rev-parse --verify HEAD
496bc46c88
git grep '\.ErrPortAlreadyAllocated'
Which is still the case Today;
git describe --tags --match="v[0-9]*" HEAD
v28.0.0
git rev-parse --verify HEAD
af898abe44
git grep '\.ErrPortAlreadyAllocated'
Same for the `ErrAllPortsAllocated` (added in 739d124480)
and `ErrUnknownProtocol` (added in 303ed3c830)
errors, which were never used as sentinel errors, and still aren't;
git grep '\.ErrAllPortsAllocated'
git grep '\.ErrUnknownProtocol'
vendor/github.com/moby/buildkit/client/llb/source.go: if errors.Is(err, gitutil.ErrUnknownProtocol) {
This patch;
- un-exports these errors as they are not used as sentinel errors
- strips down the `ErrPortAlreadyAllocated`, removing the methods that
were added, but never used.
- removes the `newErrPortAlreadyAllocated` constructor
- renames `ErrPortAlreadyAllocated` to `alreadyAllocatedErr` to follow
go conventions.
[libnetwork@672ced7]: c0474b6438
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Changes in runc code are not impacting code we use;
- libcontainer/utils.MkdirAllInRootOpen is not used
- libcontainer/utils.MkdirAllInRoot is not used
Similarly, while filepath-securejoin is imported, the functions using it
in runc (cgroups.FindCgroupMountpoint, are not used in our codebase, so
these changes don't affect our code; `tryDefaultPath` uses securejoin,
which is used by `FindCgroupMountpoint`, but not used in our codebase.
diffs:
- https://github.com/opencontainers/runc/compare/v1.2.4...v1.2.5
- https://github.com/cyphar/filepath-securejoin/compare/v0.3.5...v0.4.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-02-14 13:04:45 +01:00
4652 changed files with 218937 additions and 70697 deletions
- G204 # G204:Subprocess launched with variable; too many false positives.
- G301 # G301:Expect directory permissions to be 0750 or less (also EXC0009); too restrictive
- G302 # G302:Expect file permissions to be 0600 or less (also EXC0009); too restrictive
- G304 # G304:Potential file inclusion via variable.
- G306 # G306:Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions)
- G307 # G307:Deferring unsafe method "*os.File" on type "Close" (also EXC0008); (TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close")
- G504 # G504: Blocklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack:(CVE-2016-5386); (only affects go < 1.6.3)
govet:
enable-all:true
disable:
- fieldalignment # TODO:evaluate which ones should be updated.
importas:
# Do not allow unaliased imports of aliased packages.
no-unaliased:true
alias:
# Enforce alias to prevent it accidentally being used instead of our
- G204 # G204:Subprocess launched with variable; too many false positives.
- G301 # G301:Expect directory permissions to be 0750 or less (also EXC0009); too restrictive
- G302 # G302:Expect file permissions to be 0600 or less (also EXC0009); too restrictive
- G304 # G304:Potential file inclusion via variable.
- G306 # G306:Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions)
- G307 # G307:Deferring unsafe method "*os.File" on type "Close" (also EXC0008); (TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close")
- G504 # G504: Blocklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack:(CVE-2016-5386); (only affects go < 1.6.3)
govet:
enable-all:true
disable:
- fieldalignment # TODO:evaluate which ones should be updated.
importas:
# Do not allow unaliased imports of aliased packages.
no-unaliased:true
alias:
# Enforce alias to prevent it accidentally being used instead of our
# This allows the test suite to be able to run without worrying about the underlying fs used by the container running the daemon (e.g. aufs-on-aufs), so long as the host running the container is running a supported fs.
The Engine API is an HTTP API used by the command-line client to communicate with the daemon. It can also be used by third-party software to control the daemon.
It consists of various components in this repository:
-`api/swagger.yaml` A Swagger definition of the API.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/docker/docker/issues/27919) for progress on this.
-`cli/` The command-line client.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/moby/moby/issues/27919) for progress on this.
-`client/` The Go client used by the command-line client. It can also be used by third-party Go programs.
-`daemon/` The daemon, which serves the API.
@@ -21,6 +20,7 @@ The API is defined by the [Swagger](http://swagger.io/specification/) definition
## Updating the API documentation
The API documentation is generated entirely from `api/swagger.yaml`. If you make updates to the API, edit this file to represent the change in the documentation.
Documentation for each API version can be found in the [docs directory](docs/README.md), which also provides a [CHANGELOG.md](docs/CHANGELOG.md).
The file is split into two main sections:
@@ -29,7 +29,7 @@ The file is split into two main sections:
To make an edit, first look for the endpoint you want to edit under `paths`, then make the required edits. Endpoints may reference reusable objects with `$ref`, which can be found in the `definitions` section.
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/docker/docker/issues/27919).
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/moby/moby/issues/27919).
`swagger.yaml` is validated by `hack/validate/swagger` to ensure it is a valid Swagger definition. This is useful when making edits to ensure you are doing the right thing.
@@ -39,4 +39,4 @@ When you make edits to `swagger.yaml`, you may want to check the generated API d
Run `make swagger-docs` and a preview will be running at `http://localhost:9000`. Some of the styling may be incorrect, but you'll be able to ensure that it is generating the correct documentation.
The production documentation is generated by vendoring `swagger.yaml` into [docker/docker.github.io](https://github.com/docker/docker.github.io).
The production documentation is generated by vendoring `swagger.yaml` into [docker/docs](https://github.com/docker/docs).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -9643,13 +9647,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`:currently `1.0` - the file format version
- `json`:detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`:A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -9623,13 +9627,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`:currently `1.0` - the file format version
- `json`:detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`:A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -9757,13 +9761,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`:currently `1.0` - the file format version
- `json`:detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`:A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -9898,13 +9902,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`:currently `1.0` - the file format version
- `json`:detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`:A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -5984,7 +5989,7 @@ definitions:
type:"integer"
format:"uint64"
x-nullable:true
example:18446744073709551615
example:"18446744073709551615"
ContainerThrottlingData:
description:|
@@ -10487,13 +10492,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`:currently `1.0` - the file format version
- `json`:detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`:A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
@@ -10533,6 +10534,7 @@ paths:
If not provided, the full multi-platform image will be saved.
StdinStdType=0// Stdin represents standard input stream. It is present for completeness and should NOT be used. When reading the stream with [StdCopy] it is output on [Stdout].
StdoutStdType=1// Stdout represents standard output stream.
StderrStdType=2// Stderr represents standard error steam.
SystemerrStdType=3// Systemerr represents errors originating from the system. When reading the stream with [StdCopy] it is returned as an error.
The maximum allowed size is 1000KB, as defined in [MaxConfigSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize).
type:"string"
Templating:
description:|
@@ -5984,7 +5838,7 @@ definitions:
type:"integer"
format:"uint64"
x-nullable:true
example:18446744073709551615
example:"18446744073709551615"
ContainerThrottlingData:
description:|
@@ -6852,6 +6706,17 @@ definitions:
description:"The network pool size"
type:"integer"
example:"24"
FirewallBackend:
$ref:"#/definitions/FirewallInfo"
DiscoveredDevices:
description:|
List of devices discovered by device drivers.
Each device includes information about its source driver, kind, name,
and additional driver-specific attributes.
type:"array"
items:
$ref:"#/definitions/DeviceInfo"
Warnings:
description:|
List of warnings / informational messages about missing features, or
@@ -6935,6 +6800,37 @@ definitions:
default:"plugins.moby"
example:"plugins.moby"
FirewallInfo:
description:|
Information about the daemon's firewalling configuration.
This field is currently only used on Linux, and omitted on other platforms.
type:"object"
x-nullable:true
properties:
Driver:
description:|
The name of the firewall backend driver.
type:"string"
example:"nftables"
Info:
description:|
Information about the firewall backend, provided as
"label" / "value" pairs.
<p><br /></p>
> **Note**: The information returned in this field, including the
> formatting of values and labels, should not be considered stable,
> and may change without notice.
type:"array"
items:
type:"array"
items:
type:"string"
example:
- ["ReloadedAt","2025-01-01T00:00:00Z"]
# PluginsInfo is a temp struct holding Plugins name
# registered with docker daemon. It is used by Info struct
PluginsInfo:
@@ -6980,32 +6876,6 @@ definitions:
type:"object"
x-nullable:true
properties:
AllowNondistributableArtifactsCIDRs:
description:|
List of IP ranges to which nondistributable artifacts can be pushed,
using the CIDR syntax [RFC 4632](https://tools.ietf.org/html/4632).
<p><br /></p>
> **Deprecated**: Pushing nondistributable artifacts is now always enabled
> and this field is always `null`. This field will be removed in a API v1.49.
type:"array"
items:
type:"string"
example:[]
AllowNondistributableArtifactsHostnames:
description:|
List of registry hostnames to which nondistributable artifacts can be
pushed, using the format `<hostname>[:<port>]` or `<IP address>[:<port>]`.
<p><br /></p>
> **Deprecated**: Pushing nondistributable artifacts is now always enabled
> and this field is always `null`. This field will be removed in a API v1.49.
type:"array"
items:
type:"string"
example:[]
InsecureRegistryCIDRs:
description:|
List of IP ranges of insecure registries, using the CIDR syntax
description:"Do not delete untagged parent images"
type:"boolean"
default:false
- name:"platforms"
in:"query"
description:|
Select platform-specific content to delete.
Multiple values are accepted.
Each platform is a OCI platform encoded as a JSON string.
type:"array"
items:
# This should be OCIPlatform
# but $ref is not supported for array in query in Swagger 2.0
# $ref: "#/definitions/OCIPlatform"
type:"string"
tags:["Image"]
/images/search:
get:
@@ -10487,13 +10362,9 @@ paths:
### Image tarball format
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
An image tarball contains [Content as defined in the OCI Image Layout Specification](https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#content).
- `VERSION`: currently `1.0` - the file format version
- `json`: detailed layer information, similar to `docker inspect layer_id`
- `layer.tar`: A tarfile containing the filesystem changes in this layer
The `layer.tar` file contains `aufs` style `.wh..wh.aufs` files and directories for storing attribute changes and deletions.
Additionally, includes the manifest.json file associated with a backwards compatible docker save format.
If the tarball defines a repository, the tarball should also include a `repositories` file at the root that contains a list of repository and tag names mapped to layer IDs.
@@ -10524,7 +10395,10 @@ paths:
type:"string"
required:true
- name:"platform"
type:"string"
type:"array"
items:
type:"string"
collectionFormat:"multi"
in:"query"
description:|
JSON encoded OCI platform describing a platform which will be used
@@ -10533,6 +10407,7 @@ paths:
If not provided, the full multi-platform image will be saved.
type {{pascalize.Name}}{{template"typeSchemaType".}}{{/* For types declared as $ref on some other type, just declare the type as a golang _aliased_ type, e.g. type A = B. No method shall be redeclared. */}}
{{-if.IsBaseType}}
{{template"baseTypeSerializer".}}{{/* When the alias redeclares a polymorphic type, define factory methods with this alias. */}}
{{-end}}
{{-elseif.IsEmbedded}}
{{-template"schemaEmbedded".}}
{{-else}}
{{-ifor.IsComplexObject.IsTuple.IsAdditionalProperties}}{{/* TODO(fred): handle case of subtype inheriting from base type with AdditionalProperties, issue #2220 */}}
// ContextValidate validates this {{humanize.Name}} based on context it is used {{/* this schema implements the runtime.ContextValidatable interface but has no validations to check */}}
// AdditionalProperties in base type shoud be handled just like regular properties{{/* TODO(fred): add full support for AdditionalProperties in base type */}}
// At this moment, the base type property is pushed down to the subtype
// ContainerUpdateOKBody OK response to ContainerUpdate operation
//
// Deprecated: use [UpdateResponse]. This alias will be removed in the next release.
typeContainerUpdateOKBody=UpdateResponse
// ContainerTopOKBody OK response to ContainerTop operation
//
// Deprecated: use [TopResponse]. This alias will be removed in the next release.
typeContainerTopOKBody=TopResponse
// PruneReport contains the response for Engine API:
// POST "/containers/prune"
typePruneReportstruct{
@@ -45,23 +34,10 @@ type CopyToContainerOptions struct {
CopyUIDGIDbool
}
// StatsResponseReader wraps an io.ReadCloser to read (a stream of) stats
// for a container, as produced by the GET "/stats" endpoint.
//
// The OSType field is set to the server's platform to allow
// platform-specific handling of the response.
//
// TODO(thaJeztah): remove this wrapper, and make OSType part of [StatsResponse].
typeStatsResponseReaderstruct{
Bodyio.ReadCloser`json:"body"`
OSTypestring`json:"ostype"`
}
// MountPoint represents a mount point configuration inside the container.
// This is used for reporting the mountpoints in use by a container.
typeMountPointstruct{
// Type is the type of mount, see `Type<foo>` definitions in
// github.com/docker/docker/api/types/mount.Type
// Type is the type of mount, see [mount.Type] definitions for details.
Typemount.Type`json:",omitempty"`
// Name is the name reference to the underlying data defined by `Source`
@@ -104,7 +80,7 @@ type MountPoint struct {
// State stores container's running state
// it's part of ContainerJSONBase and returned by "inspect" command
typeStatestruct{
Statusstring// String representation of the container state. Can be one of "created", "running", "paused", "restarting", "removing", "exited", or "dead"
StatusContainerState// String representation of the container state. Can be one of "created", "running", "paused", "restarting", "removing", "exited", or "dead"
// CreateRequest is the request message sent to the server for container
// create calls. It is a config wrapper that holds the container [Config]
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
