Ensure that the JSON response for the `GET /containers/{name}/json`
outputs an empty object instead of a nil config.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Now that we're raising the minimum API version, we can also update
the CLI used in our integration-cli tests.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This type was used as Aux message for docker push, was not documented,
and only present for Docker Content Trust (which is deprecated).
This patch removes it from the API module, and moves the type internal.
We can stop sending this Aux message once DCT is fully phased out.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make invalid states unrepresentable by moving away from stringly-typed
MAC address values in API structs. As go.dev/issue/29678 has not yet
been implemented, provide our own HardwareAddr byte-slice type which
implements TextMarshaler and TextUnmarshaler to retain compatibility
with the API wire format.
When stdlib's net.HardwareAddr type implements TextMarshaler and
TextUnmarshaler and GODEBUG=netmarshal becomes the default, we should be
able to make the type a straight alias for stdlib net.HardwareAddr as a
non-breaking change.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use a more idiomatic name so that it can be used as `client.New()`.
We should look if we want `New()` to have different / updated defaults
i.e., enable `WithEnv` as default, and have an opt-out and have API-
version negotiation enabled by default (with an opt-out option).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some methods currently support a single platform only, but we may
be able to support multiple platforms.
This patch prepares the option-structs for multi-platform support,
but (for now) returning an error if multiple options are provided.
We need a similar check on the daemon-side, but still need to check
on the client, as older daemons will ignore multiple platforms, which
may be unexpected.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Improve validation for empty name; while the daemon already handled empty
strings, it didn't account for the "canonical" name with "/" prefix, for
which it would produce an obscure error:
Error response from daemon: Error when allocating new name: Invalid container name (/ ), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed
Before this change:
curl -XPOST --unix-socket /var/run/docker.sock 'http://localhost/v1.51/containers/old/rename?name='
{"message":"Neither old nor new names may be empty"}
curl -XPOST --unix-socket /var/run/docker.sock 'http://localhost/v1.51/containers/old/rename?name=/'
{"message":"Error when allocating new name: Invalid container name (/), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed"}
curl -XPOST --unix-socket /var/run/docker.sock 'http://localhost/v1.51/containers/old/rename?name=/hello'
# OK
A check was added in the client as well for situations where an older daemon
is used; the same code currently was implemented in the CLI.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Add a VolumeUpdateResult output struct
- Move the swarm version argument to the options, to align
with other swarm-related methods.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The API now includes this information per record, and clients can
get this information using the `Ping` method if needed as fallback.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Adds a per-stats OSType field to allow handle the platform-specific fields.
Before this change, the client had to get the OSType field from the server's
API response header and copy it to each record.
Older daemon versions don't have this field, so the client still needs to
handle fallbacks.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We have no need for it, and keeps the response more readable in case
it would ever contain any values that need escaping; it also would save
some cycles to check for such characters.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When streaming stats, the `OneShot` option is implied; streaming results
never populate the Pre* fields on the first result, so instead of producing
an error, we may as well ignore the option.
While updating this, also combine some of the conditions for non-streaming
results in an attempt to make the logic (early return on non-streaming,
one-shot requests) slightly clearer.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the code that handles preserving the previous read and putting
it in the next read, and rename some variables for clarity.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the go-routines and just fetch the result for non-streaming stats.
Also check for the result to be valid for some tests.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The JSON field was added in [moby@9fd2c0f], to address [moby#19177], which
reported an incompatibility with Classic (V1) Swarm, which produced a non-
standard response;
> Make docker load to output json when the response content type is json
> Swarm hijacks the response from docker load and returns JSON rather
> than plain text like the Engine does. This makes the API library to return
> information to figure that out.
A later change in [moby@96d7db6] added additional logic to make sure the
correct content-type was returned, depending on whether the `quiet` option
was set (which produced a non-JSON response). This caused inconsistency in
the API response, and [moby@2f27632] changed the endpoint to always produce
JSON (only skipping the "progress" output if `quiet` was set).
This means that the "load" endpoint ([`imageRouter.postImagesLoad`]) now
unconditionally returns JSON, making the `JSON` field fully redundant.
We should consider deprecating the "quiet" option, as it's really the client's
responsibility to show or hide progress-bars, but we can do this separately.
This patch removes the JSON field, as it's redundant, and the way it handles
the content-type is incorrect because it would not handle correct, but different
formatted response-headers (`application/json; charset=utf-8`), which could
result in malformed output on the client.
[moby@9fd2c0f]: 9fd2c0feb0
[moby#19177]: https://github.com/moby/moby/issues/19177
[moby@96d7db6]: 96d7db665b
[moby@2f27632]: 2f27632cde
[`imageRouter.postImagesLoad`]: 7b9d2ef6e5/api/server/router/image/image_routes.go (L248-L255)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite this method to return a function to cancel / unsubscribe, so that
callers are encouraged to handle this.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
For methods using the decodeWithRaw utility, we were handling closing
of the body twice. The ensureReaderClosed utility also drains the
response to let the transport reuse the connnection. Let's use that
utility in decodeWithRaw as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These fields store the raw JSON data that we received, and should
never container bytes that are non-JSON (as we'd error out when
failing to unmarshal).
Change the type to a json.RawMessage, which:
- Is more explicit on intent
- Can still be used as a regular []byte in all cases
And, while it's not expected to be marshaled to JSON, doing so will also
print the output in a readable format instead of base64 encoding;
package main
import (
"encoding/json"
"fmt"
)
func main() {
foo := struct {
Bytes []byte
Raw json.RawMessage
}{
Bytes: []byte(`{"hello": "world"}`),
Raw: json.RawMessage(`{"hello": "world"}`),
}
out, _ := json.MarshalIndent(foo, "", " ")
fmt.Println(string(out))
}
Will print:
{
"Bytes": "eyJoZWxsbyI6ICJ3b3JsZCJ9",
"Raw": {
"hello": "world"
}
}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `ExecInspectResult` type was embedding `ExecInspect`, which is also
defined by the client, so there's no need to abstract it.
While updating, also;
- Rename `ExecID` to `ID`, to match the field-name returned by the API.
- Rename `Pid` to `PID`, to be in the right casing.
- Remove `json` labels, as option-types are not (un)marshaled to JSON.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This panicked when creating a stub; we need to look for better ways to
allow stubbing these (perhaps we need to expose the rc / body)?
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `ExecCreateResult` was embedding the `container.ExecCreateRespons`,
which in itself was an alias for `common.IDResponse`. This type has a
single field (`ID`) currently, but the embedding made it awkward to use,
for example, when mocking a `ExecCreateResult` using struct-literals:
func execCreateWithID(_ string, _ client.ExecCreateOptions) (client.ExecCreateResult, error) {
return client.ExecCreateResult{ExecCreateResponse: container.ExecCreateResponse{ID: "execid"}}, nil
}
This patch defines it as a local type with the `ID` as field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `VolumeListResult.Items` field was a `volume.ListResponse`, which
in itself also had two slices (for volumes, and warnings). The Volumes
field contained a slice of pointers to Volumes.
This patch:
- Re-defines `ImageRemoveResult` as a distinct type, containing the
content of the `volume.ListResponse.Volumes` and `.Warnings`.
- The `VolumeListResult` doesn't use a pointer for the volumes to make
it slightly easier to deal with (possibly the API type could be
changed as well, which could allow us to simplify the client code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The schema of a JSON-stream message is very pertinent to the api module.
Provide a canonical definition in the api module and refactor the daemon
code to use it. Drop the long-deprecated ErrorMessage field from the API
definition, but have the daemon continue to emit it for compatibility
with docker-py v7.1.0.
Co-authored-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Move the progress package up into the client as a temporary shared location for
common clients like CLI and compose.
The progress package is used by the daemon to write progress updates to
some sink, typically a streamformatter. This package is of little use to
API clients as this package does not provide any facilities to consume
the progress updates.
Co-authored-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Move the streamformatter package up into the client for a temporary
shared location between common clients like CLI and compose.
The streamformatter package is used by the daemon to write streams of
status and progress messages to API clients. It is completely out of
scope of the api module and not used outside the daemon. Remove the
unused rawSteamFormatter, whose purpose is to render the progress as a
TUI.
Co-authored-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
These tests were added in ea59a8d74e, but it
was merged out of order, not yet picking up changes made in the client.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change moves the api/types/versions package out into client and daemon versions.
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
- Use the `mockResponse` instead
- `bytesBufferClose` was our own implementation of `io.NopCloser`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Add a `mockResponse` utility, and slightly enhance it to also include
the request Headers and Status message, to be more closely to actual
responses.
- Add a `mockJSONResponse` utility, implemented using `mockResponse`
- Remove `plainTextErrorMock` in favor of `mockResponse`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rename it so that it's clearer that it's intended for test-purposes,
and adding a `skipConfigureTransport()` method to the signature to
prevent IDEs considering is a redundant convert, and to be more explicit
on intent.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
For API < v1.52:
- In container inspect:
- Restore GraphDriver when a snapshotter is used.
- Remove field Storage
- Related to commit efa077848f
- In image inspect:
- Restore GraphDriver when a snapshotter is used.
- Related to commit c441b2ef19
Co-authored-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Rob Murray <rob.murray@docker.com>
The API does not produce these as a response; the fields in the Ping
struct, including the Swarm status are propagated from headers returned
by the /_ping endpoint.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were just shallow wrappers around the api-client, and some
were not used; inline them to help transition these tests to the
integration-suite in future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
In this method, the network was controlling the controller, and its
driver-registry. That really felt like two steps too far; let's just
move this method to the controller, so that it can stay, at least
_somewhat_ in control of its own, non-exported, properties.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
commit 081987b647 updated the Dockerfile
to disable go's telemetry in our dev / test-environment; as collecting
this data doesn't serve much purpose.
However, the configuration to disable telemetry is tied to the user's
home-directory (HOME); and disabling telemetry writs a config-file to the
user's home-directory (`~/.config/go/telemetry/mode`). While go provides
env-vars about the mode and location (`GOTELEMETRY` and `GOTELEMETRYDIR`),
those env-vars are read-only and cannot be used to either disable telemetry
or to set the location;
> Information about telemetry configuration is also available via read-only Go environment variables:
>
> go env GOTELEMETRY reports the telemetry mode.
> go env GOTELEMETRYDIR reports the directory holding telemetry configuration and data.
Some steps in our CI set up a different home-directory, which is not configured
to disable telemetry, which means that CI currently leaves behind a bunch of
files related to this;
make TEST_FILTER=TestPruneDontDeleteUsedDangling test-integration
tree -a bundles/test-integration/fake-HOME/
bundles/test-integration/fake-HOME/
└── .config
└── go
└── telemetry
├── local
│ ├── asm@go1.25.3-go1.25.3-linux-arm64-2025-10-21.v1.count
│ ├── compile@go1.25.3-go1.25.3-linux-arm64-2025-10-21.v1.count
│ ├── go@go1.25.3-go1.25.3-linux-arm64-2025-10-21.v1.count
│ ├── link@go1.25.3-go1.25.3-linux-arm64-2025-10-21.v1.count
│ ├── test2json@go1.25.3-go1.25.3-linux-arm64-2025-10-21.v1.count
│ ├── upload.token
│ └── weekends
└── upload
6 directories, 7 files
This patch disables go telemetry also for this home-directory to prevent
those files from being created, and to prevent go from producing the
telemetry.
With this patch, only the file to disable telemetry is produced:
make TEST_FILTER=TestPruneDontDeleteUsedDangling test-integration
tree -a bundles/test-integration/fake-HOME/
bundles/test-integration/fake-HOME/
└── .config
└── go
└── telemetry
└── mode
4 directories, 1 file
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define an intermediate struct for marshaling/unmarshaling; this
struct already uses netip types (in case we want to migrate the
actual struct to use these types as well).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
There also appeared to be duplication between daemon.getInspectData,
and the containerRouter.postContainersCreate methods, as both were
back-filling the field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite the router to use a local struct to unmarshal the deprecated
field for requests that send it, and adjust the adoption code.
There also appeared to be duplication between daemon.getInspectData,
and the containerRouter.postContainersCreate methods, as both were
back-filling the field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prevent applying `area/dependencies` when the `client` and `api` modules
are changed.
Due to the replace rule present for these modules, we have to revendor
them with each change which would trigger the previous rule.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Defer the logic to fill in the container platform information from the
image service until container restore. During container restore the
image backend is fully initialized and can be used to fill in the
missing platform fields for older containers.
Signed-off-by: Derek McGowan <derek@mcg.dev>
- Use an intermediate struct for (un)marshaling dummyObject
- Remove dummyObject.SkipSave as it would always be set to "false"
(i.e., persisted to disk).
- Minor cleanups in handling locks and some unused vars
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Inline some vars and align between drivers
- Remove nested if's where possible
- Use `WithError` for some logs, and use the context if available
- Scope variables locally where only used locally and, the reverse,
make it clear where a (function-)global variable is used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was calling driver.getNetworks, which copies the networks map
into a new slice. As we're not mutating the networks, we can just use the
networks map itself to check if there's any networks configured with the
same parent.
While changing;
- Also change the signature to accept the parent to compare to as a string
- Return early once we determined there's more than one user
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both were added as part of the initial implementation in commit [moby@ea30113]
([libnetwork@1d6f2c5]), but never used.
[moby@ea30113]: ea30113303
[libnetwork@1d6f2c5]: 1d6f2c59c4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility was only called with two constant values;
const (
defaultV4RouteCidr = "0.0.0.0/0"
defaultV6RouteCidr = "::/0"
)
However;
- calling it would always execute a `net.ParseCIDR`
- verify if it would produce an error (which would be very unlikely)
- it used a `staticRoute` struct that was ONLY used for this function
- and immediately deconstructed into its components
- furthermore, the `NextHop` field would be discarded by jinfo.AddStaticRoute,
which only used the third argument for `routeType == types.NEXTHOP`
This patch:
- removes the `ifaceGateway` and associated `staticRoute` and consts
- defines two package-level vars for `defaultV4Net` and `defaultV6Net`,
which can be reused (no need to parse / construct them for every join)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These drivers did not do anything meaningful in the `Leave` method; they
would check if the network and/or endpoint were missing, in which case
they produced an error, but the network and endpoint (if present) would
not be used, so it was only validation.
Such validation could still be relevant elsewhere, but looking at where
this method is called; the `Driver.Leave()` is called in two places, both
of which don't handle the error, other than logging it as a warning / error;
It's called by `Endpoint.sbJoin()`, as part of the rollback;
d5c838dc5e/daemon/libnetwork/endpoint.go (L539-L545)
And `Endpoint.sbLeave()`, which also discards the error;
d5c838dc5e/daemon/libnetwork/endpoint.go (L772-L776)
Based on he above, this code looks to be redundant, so replacing it with
a stub; returning `nil`.
As replacing the code removed the use of network.getEndpoint, which was effectively
a copy of network.endpoint (which didn't have error handling), I merged the two
methods, and removed custom error-handling elsewhere.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These methods were just wrappers around getSubnetforIP; let's peel away the
abstraction and call it directly; we're already checking for n.config.Ipv4Subnet
and n.config.Ipv6Subnets on the call-site, so may as well just pass it in.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
There were some missing checks whether ep.addr, ep.addrv6 were nil,
which could panic in getSubnetForIP.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The function was fetching a reference to the endpoint twice; while this
did give the option for an early return, in practice it didn't mean much,
because it could still fail if the endpoint was removed in between.
This code still has a race condition, because while a reference to the
endpoint is retrieved while acquiring a lock, the result is mutated without.
This probably needs to either have some accessor, or the function should
keep a lock for the whole operation (possibly switching to an RWMutex).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was deprecated in [engine-api@5c4b684], which got vendored into
Moby in [moby@8f7a8c7] (API v1.25), and wired up in [moby@99a98cc].
[engine-api@5c4b684]: 5c4b684b2f
[moby@8f7a8c7]: 8f7a8c75ae
[moby@99a98cc]: 99a98ccc14
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Abstract away that the "all" option is currently implemented as
a filter (which may change in future).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The MacAddress field currently reflects _either_ the user-specified
(DesiredMacAddress) _or_ the actual / assigned MacAddress (when running).
Internal structs already have a separate DesiredMacAddres field, but
this field is not (yet) reflected in the API response. The intent is
to move towards better separation of config ("desired state") and
operational ("actual state") data.
Let's move the MacAddress field under "operational" data; the field's
description still describes its dual-personality, but potentially we
can move towards separate fields in future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was always logging build output and output of the events stream;
=== RUN TestDockerCLIBuildSuite/TestBuildEmitsEvents/buildkit=false/no_tag
docker_cli_build_test.go:6246: Sending build context to Docker daemon 2.048kB
Step 1/2 : FROM busybox
---> c004456a6868
Step 2/2 : RUN echo hi >/hello
---> Running in dd4f3ec8bd9e
---> Removed intermediate container dd4f3ec8bd9e
---> 25ee0d9e2b4a
Successfully built 25ee0d9e2b4a
docker_cli_build_test.go:6247:
docker_cli_build_test.go:6259: 2025-10-16T12:28:34.113785300Z image create sha256:25ee0d9e2b4af90101abc6f2f3339807e7bcd0bfe5af6113c3a71c9edff6e858 (name=sha256:25ee0d9e2b4af90101abc6f2f3339807e7bcd0bfe5af6113c3a71c9edff6e858)
--- PASS: TestDockerCLIBuildSuite/TestBuildEmitsEvents/buildkit=false/no_tag (6.56s)
This patch:
- Uses a manual assert to check if the build succeeded; on failure, it
prints the combined output (stdout, stderr)
- Removes the log for the events output; the `assert` function used in
the test already asserts the output, which would print the output when
the assertion fails.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The TestMacAddressIsAppliedToMainNetworkWithShortID was starting its
own daemon, but the apiClient was created with the defaults, so was
connecting to the global test-daemon.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was introduced in fc1ff44bc2, which
back-filled the top-level network-properties for the bridge network,
but the fields ended up at the top-level of the response, not the top-level
of the NetworkSettings.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `LogLevel` and `LogFormat` options were defined in two locations;
- in the `daemon/commands.daemonOptions` struct.
- in the `daemon/config.Config` (`CommonConfig`) struct.
While we may need some options-struct to initialize the daemon, we currently
don't and the separate structs means they have to be kept in sync, and for
flags to be distributed across multiple places.
Note that some flags will not be configurable in the config-file (such as
the path of the config-file itself), so those options will need to have a
separate struct (which may still live in the `daemon/config` package).
This patch;
- Removes the `LogLevel` and `LogFormat` from `daemon/commands.daemonOptions`
to `daemon/config.CommonConfig`.
- Adds a bare-bones `stringVar` implementation using generics to allow using
strong-typed string values to be used for flags.
- Moves the flags together with the other flags in `installCommonConfigFlags`.
- Sets the default options in the `Config` struct.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's no longer functional since 7435e4a1be22a5a44f945d6b45e1e81273fd868d;
(v28.1.0) this flag was purely to print the deprecation message. The
daemon.json handling still has an exception to ignore the field (if
present).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to f8d3c4e4a7,
this change removes the `Parent` and `DockerVersion` fields from the swagger documentation.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
I noticed these errors logged inside the dev-container;
ERRO[2025-10-14T16:15:46.603781797Z] error reading the kernel parameter net.ipv4.neigh.default.gc_thresh1 error="open /proc/sys/net/ipv4/neigh/default/gc_thresh1: no such file or directory"
ERRO[2025-10-14T16:15:46.603808089Z] error reading the kernel parameter net.ipv4.neigh.default.gc_thresh2 error="open /proc/sys/net/ipv4/neigh/default/gc_thresh2: no such file or directory"
ERRO[2025-10-14T16:15:46.603819922Z] error reading the kernel parameter net.ipv4.neigh.default.gc_thresh3 error="open /proc/sys/net/ipv4/neigh/default/gc_thresh3: no such file or directory"
Given that these happen during an initial check, we can probably ignore them
if there's nothing to tweak.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `VirtualSize` field became redundant with the introduction of content-
addressable images in docker v1.10 (4352da7803),
after which the field was identical to the `Size` field. The field was marked
to be deprecated, which happened in 1261fe69a3
(API v1.43) and removed in API v1.44 (913b0f51ca).
Now that we stop supporting API versions older than v1.44, we can drop this
field; it's a minor breakage of old API versions, but the same information
is available in the "Size" field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We don't run these tests against older daemons, but if we would,
we no longer have to consider API < v1.44 as versions of the daemon
below v25.0 reached EOL.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- relates to 96b29f5a1f
- similar to 08e4e88482
The daemon currently provides support for API versions all the way back
to v1.24, which is the version of the API that shipped with docker 1.12.0
(released in 2016).
Such old versions of the client are rare, and supporting older API versions
has accumulated significant amounts of code to remain backward-compatible
(which is largely untested, and a "best-effort" at most).
This patch updates the minimum API version to v1.44, matching the minimum
version of the client, and matching the API version of docker v25.0, which
is the oldest supported version (through Mirantis MCR).
The intent is to start deprecating older API versions when daemons implementing
them reach EOL. This patch does not yet remove backward-compatibility code
for older API versions, and the DOCKER_MIN_API_VERSION environment variable
allows overriding the minimum version (to allow restoring the behavior from
before this patch), however, API versions below v1.44 should be considered
"best effort", and we may remove compatibility code to provide "degraded"
support.
With this patch the daemon defaults to API v1.44 as minimum:
docker version
Client:
Version: 28.5.0
API version: 1.51
Go version: go1.24.7
Git commit: 887030f
Built: Thu Oct 2 14:54:39 2025
OS/Arch: linux/arm64
Context: default
Server:
Engine:
Version: dev
API version: 1.52 (minimum version 1.44)
....
Trying to use an older version of the API produces an error:
DOCKER_API_VERSION=1.43 docker version
Client:
Version: 28.5.0
API version: 1.43 (downgraded from 1.51)
Go version: go1.24.7
Git commit: 887030f
Built: Thu Oct 2 14:54:39 2025
OS/Arch: linux/arm64
Context: default
Error response from daemon: client version 1.43 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version
To restore the previous minimum, users can start the daemon with the
DOCKER_MIN_API_VERSION environment variable set:
DOCKER_MIN_API_VERSION=1.24 dockerd
API 1.24 is the oldest supported API version;
docker version
Client:
Version: 28.5.0
API version: 1.24 (downgraded from 1.51)
Go version: go1.24.7
Git commit: 887030f
Built: Thu Oct 2 14:54:39 2025
OS/Arch: linux/arm64
Context: default
Server:
Engine:
Version: dev
API version: 1.52 (minimum version 1.24)
....
When using the `DOCKER_MIN_API_VERSION` with a version of the API that
is not supported, an error is produced when starting the daemon;
DOCKER_MIN_API_VERSION=1.23 dockerd --validate
invalid DOCKER_MIN_API_VERSION: minimum supported API version is 1.24: 1.23
DOCKER_MIN_API_VERSION=1.99 dockerd --validate
invalid DOCKER_MIN_API_VERSION: maximum supported API version is 1.52: 1.99
Specifying a malformed API version also produces the same error;
DOCKER_MIN_API_VERSION=hello dockerd --validate
invalid DOCKER_MIN_API_VERSION: minimum supported API version is 1.24: hello
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The BuildCache.Parent field was removed in API v1.42 in [moby@e0db820].
While we had to keep the Go struct field around to backfill the field for
older API versions, it's no longer part of API v1.42 and up (using the
"omitempty" is just an implementation detail).
Older clients unconditionally use the `Parents` field if set, and usage
of this field is very limited, so let's remove the field without back-
filling, and have clients use the replacement field;
https://github.com/docker/cli/blob/v28.5.1/cli/command/formatter/buildcache.go
[moby@e0db820]: e0db8207f3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `DiskUsage.BuilderSize` field was added as part of the, then experimental,
BuildKit builder in [moby@5c3d2d5] (API v1.31). It was deprecated in API v1.32
(through [moby@b225258]) but that change still returned the field. Commit
[moby@31348af] removed it in API v1.42. This field was never documented,
and part of an experimental feature, so we can remove it altogether.
[moby@5c3d2d5]: 5c3d2d552b
[moby@b225258]: b225258496
[moby@31348af]: 31348afa19
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The BuildCache.Parent field was removed in API v1.42 in [moby@e0db820].
While we had to keep the Go struct field around to backfil the field for
older API versions, it's no longer part of API v1.42 and up (using the
"omitempty" is just an implementation detail).
This patch corrects the swagger files to match this.
[moby@e0db820]: e0db8207f3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Buildkit fails when userns remapping is enabled and c8d snapshotter is
used. As a temporary workaround, disable c8d snapshotter when userns
remapping is enabled. This will need a proper fix in the future.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This release addresses breakage caused by a security patch included in
Go 1.25.2 and 1.24.8, which enforced overly restrictive validation on
the parsing of X.509 certificates. We've removed those restrictions
while maintaining the security fix that the initial release addressed.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The sync-labels option was causing the labeler action to remove labels
that were manually added by humans.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Align our custom templates with the one from upstream;
https://github.com/go-swagger/go-swagger/tree/v0.32.3/generator/templates
- Add "TODO" comments in places where we applied patches to make it
easier to compare with upstream, and to see where differences are
intentional.
- Update the server/operations.gotmpl template;
- Add the "generated" header in the right place, so that it's
recognized as generated file.
- Add back the upstream template code; instead of removing the
code, put a "if false" block around it; this allows comparing
our forked templates with upstream when updating the version
of go-swagger (to make sure we're not missing fixes).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method returns a deep-copy of the filter, which can be used
in situations where the original filter must not be mutated, but
additional filters need to be added for a specific request.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When DOCKERD_ROOTLESS_ROOTLESSKIT_MTU is not set, and ...
- DOCKERD_ROOTLESS_ROOTLESSKIT_NET is not set and slirp4netns
is selected, MTU defaults to 65520.
- DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns, MTU defaults
to 1500.
Change the logic so that, however slirp4netns is selected, MTU
defaults to 65520.
Signed-off-by: Rob Murray <rob.murray@docker.com>
When stubbing a client for tests, and there's no reader set, we
just return an io.EOF, instead of panic.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When the bridge driver encounters an error during network
creation, delete the bridge device if one has been added.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Add a new type to use for building filter predicates for API requests,
replacing "./api/types/filters".Args in the client. Remove the now
unused api/types/filters package.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Most of the code in the filters package relates to the unmarshaling,
validation and application of filters from client requests. None of this
is necessary or particularly useful for Go SDK users. Move the full-fat
filters package into daemon/internal and switch all the daemon code to
import that package so we are free to iterate upon the code without
worrying about source-code interface compatibility.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Docker versions below 25.0 have reached EOL; 25.0 is currently maintained
as an LTS version by Mirantis, and we want to allow current versions of the
CLI to be able to connect to such setups.
This patch raises the fallback API version to API v1.44; when negotiating an API
version with a daemon, this will be the lowest version negotiated.
Currently, it still allows manually overriding the version to versions that
are not supported (`WithVersion`, `WithVersionFromEnv`), and no code has
been removed yet that adjusts the client for old API versions, but this
can be done in a follow-up.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/golang/net/compare/v0.44.0...v0.45.0
From the security announcement:
[security] Vulnerabilities in golang.org/x/net
Hello gophers,
We have tagged version v0.45.0 of golang.org/x/net in order to address two
security issues.
This version fixes two vulnerabilities in the golang.org/x/net/html package
which could result in calls to Parse (and associated functions) executing
unexpectedly slowly relative to the size of the input or never returning when
encountering specific inputs.
These vulnerabilities affect programs which parse untrusted HTML documents.
- The parser implements the HTML specification, which contains a number of
algorithms which are quadratic in complexity by design. This causes the
processing time to scale non-linearly with respect to the size of the input for
some HTML documents. We have imposed a depth limit of 512 for nested HTML tags,
which should be high enough for the vast majority of valid HTML documents, to
address this.
Thanks to Jakub Guido Vranken and Jakub Ciolek for both independently reporting
this issue.
This is CVE-2025-47911 and Go issue https://go.dev/issue/75682.
- The parser also misimplemented a portion of the HTML specification for table
related tags. This could cause the parser to enter an infinite loop when
encountering specific combinations of tags.
Thanks to Guido Vranken for reporting this issue.
This is CVE-2025-58190 and Go issue https://go.dev/issue/70179.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This minor release includes 10 security fixes following the security policy:
- net/mail: excessive CPU consumption in ParseAddress
The ParseAddress function constructed domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is CVE-2025-61725 and Go issue https://go.dev/issue/75680.
- crypto/x509: quadratic complexity when checking name constraints
Due to the design of the name constraint checking algorithm, the processing time
of some inputs scales non-linearly with respect to the size of the certificate.
This affects programs which validate arbitrary certificate chains.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-58187 and Go issue https://go.dev/issue/75681.
- crypto/tls: ALPN negotiation errors can contain arbitrary text
The crypto/tls conn.Handshake method returns an error on the server-side when
ALPN negotation fails which can contain arbitrary attacker controlled
information provided by the client-side of the connection which is not escaped.
This affects programs which log these errors without any additional form of
sanitization, and may allow injection of attacker controlled information into
logs.
Thanks to National Cyber Security Centre Finland for reporting this issue.
This is CVE-2025-58189 and Go issue https://go.dev/issue/75652.
- encoding/pem: quadratic complexity when parsing some invalid inputs
Due to the design of the PEM parsing function, the processing time for some
inputs scales non-linearly with respect to the size of the input.
This affects programs which parse untrusted PEM inputs.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-61723 and Go issue https://go.dev/issue/75676.
- net/url: insufficient validation of bracketed IPv6 hostnames
The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Thanks to Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University for reporting this issue.
This is CVE-2025-47912 and Go issue https://go.dev/issue/75678.
- encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
When parsing DER payloads, memories were being allocated prior to fully validating the payloads.
This permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-58185 and Go issue https://go.dev/issue/75671.
- net/http: lack of limit when parsing cookies can cause memory exhaustion
Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have a limit.
By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
net/http now limits the number of cookies accepted to 3000, which can be adjusted using the httpcookiemaxnum GODEBUG option.
Thanks to jub0bs for reporting this issue.
This is CVE-2025-58186 and Go issue https://go.dev/issue/75672.
- crypto/x509: panic when validating certificates with DSA public keys
Validating certificate chains which contain DSA public keys can cause programs
to panic, due to a interface cast that assumes they implement the Equal method.
This affects programs which validate arbitrary certificate chains.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-58188 and Go issue https://go.dev/issue/75675.
- archive/tar: unbounded allocation when parsing GNU sparse map
tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input could result in large allocations.
Thanks to Harshit Gupta (Mr HAX) - https://www.linkedin.com/in/iam-harshit-gupta/ for reporting this issue.
This is CVE-2025-58183 and Go issue https://go.dev/issue/75677.
- net/textproto: excessive CPU consumption in Reader.ReadResponse
The Reader.ReadResponse function constructed a response string through
repeated string concatenation of lines. When the number of lines in a response is large,
this could cause excessive CPU consumption.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-61724 and Go issue https://go.dev/issue/75716.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When a network-create request does not specify any IPAM config, on
daemon restart the network needs to be restored with the previously
allocated subnet and gateway.
Those fields were copied from "ipamInfo" (state from the old network)
into "ipamConfig" (user-requested config).
Avoid that by checking for this situation in the IPAM allocation
function - if no subnet/gateway is specified, and there's a value
in "ipamInfo", use it.
Also eliminate some pointer shenanigans (so now my IDE can find the
assignment to Network.ipamInfo).
Signed-off-by: Rob Murray <rob.murray@docker.com>
This field was deprecated API v1.48 in [moby@ff191c5], and removed in
API v1.49 in [moby@564abf9].
This patch:
- Removes the field from the API Go types.
- Reimplements the `/info` endpoint with the `compat` package to replace
the local `infoResponse` implementation.
- Removes the `ServiceConfig.ExtraFields` field in api/types/registry
introduced in [moby@7d9c50d] to backfill the `AllowNondistributableArtifactsCIDRs`
and `AllowNondistributableArtifactsHostnames` fields for API < v1.47.
We should also consider deprecating the `ContainerdCommit`, `RuncCommit`
and `InitCommit` fields on the `/info` response (as we also include this
information as part of the components returned in `/version`), but those
can still be useful currently for situations where a user only provides
`docker info` output.
[moby@ff191c5]: ff191c58f7
[moby@564abf9]: 564abf9157
[moby@7d9c50d]: 7d9c50db2b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The default gc policy calculations based on percentage were calculated
improperly. These were calculated correctly in buildkit, but the
calculation method was not copied over correctly when updating the
values.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The InspectResponse type contains various fields that are deprecated
and removed from current API versions, but that were kept for the API
server to produce the fields when downgrading to older API versions.
- The `Parent` field is only used for the legacy builder, and only set for
images that are built locally (i.e., not persisted when pulling an image).
- The `DockerVersion` field is only set when building images with the legacy
builder, and empty in most cases.
Both fields were implicitly deprecated with the deprecation of the legacy
builder, and deprecated for the API in [moby@bd8a99b], which was backported
to the 28.x release.
This patch:
- Removes the deprecated fields from the `InspectResposne` struct; this
means that [`client.ImageInspect`] won't unmarshal those fields, but
the [`docker image inspect`] CLI command defaults to printing the raw
output as returned by the API, so can continue to show any field returned
in the API response. As a side-note; we should change the CLI to default
to show the unmarshalled response, and introduce a `--format=jsonraw`
(or `--raw`) option to make printing the raw response opt-in.
- Updates the API server to backfill the fields if they are set.
[moby@bd8a99b]: bd8a99b400
[`client.ImageInspect`]: f739c61c69/client/image_inspect.go (L14-L64)
[`docker image inspect`]: 74e3520724/cli/command/image/inspect.go (L59-L81)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The InspectResponse type contains various fields that are deprecated
and removed from current API versions, but that were kept for the API
server to produce the fields when downgrading to older API versions.
This patch:
- Introduces a `imagebackend.InspectData` type for the daemon to use for
returning the data needed to propagate the API response. It currently
embeds the API response type and combines it with the legacy fields,
but this could be changed to return the internal Image type, and
mapping the fields to the API response type in the router.
- Removes the deprecated fields from the `InspectResposne` struct; this
means that [`client.ImageInspect`] won't unmarshal those fields, but
the [`docker image inspect`] CLI command defaults to printing the raw
output as returned by the API, so can continue to show any field returned
in the API response. As a side-note; we should change the CLI to default
to show the unmarshalled response, and introduce a `--format=jsonraw`
(or `--raw`) option to make printing the raw response opt-in.
This patch removes the following fields from the `InspectResponse` type;
- `VirtualSize`: this field became obsolete with the migration to content-
addressable images in docker v1.10 ([moby@4352da7]), but was still returned
with a copy of the `Size` field. It was deprecated in API v1.43 ([moby@1261fe6]),
and removed in API v1.44 ([moby@913b0f5]).
- `Container` and `ContainerConfig`: both fields were deprecated in
API v1.44 ([moby@1602e2f]), and removed in API v1.45 ([moby@03cddc6]).
remove deprecated Container, ContainerConfig, VirtualSize
[moby@4352da7]: 4352da7803
[moby@1261fe6]: 1261fe69a3
[moby@913b0f5]: 913b0f51ca
[moby@1602e2f]: 1602e2f4f1
[moby@03cddc6]: 03cddc62f4
[`client.ImageInspect`]: f739c61c69/client/image_inspect.go (L14-L64)
[`docker image inspect`]: 74e3520724/cli/command/image/inspect.go (L59-L81)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The DockerVersion field was present for informational purposes, but was
not used anywhere. This patch stops propagating the field, which also
reduces the number of places where the `dockerversion` package is used,
which still needs a new home.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The DockerVersion field was used by the legacy builder, and set when
importing an image; when importing an image, this would potentially
result in less reproducible images, as the docker version used to import
the image would be encoded in the image's "v1" fields.
For the legacy builder, including the version of docker used to build
the image could still be useful information (but could be set as comment,
similar to what BuildKit does), however, many code paths were also shared
with other parts of the code; e.g., when listing images or inspecting images,
the `DockerVersion` field would always be set to the current version of
the docker daemon, and not taken from the information available in the
image (if any).
This patch removes locations where the `DockerVersion` field was set to
the current version of the daemon binary. When inspecting an image, the
field is still set with the information in the image itself (which may
be empty in most cases).
This also reduces the number of places where the `dockerversion` package
is used, which still needs a new home.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change reworks the Go mod tidy/vendor checks to run for all tracked Go modules by the project and fail for any uncommitted changes.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
This was a mistake I made in eafca64a6b,
which was extracted from a set of changes that I had in progress, but
I forgot that patch was unfinished (whoops!); before that commit, the
legacy "Config" fields were handled through the `inspectCompatResponse`,
which applied the legacy fields to the `Config` struct within the image
inspect response.
When changing the implementation to use the `compat` package, those
fields were applied at the top-level of the response, instead of the
`Config`; additional changes were needed for the `compat` package to
support pathing nested structs, and to prevent "extra" fields from
overwriting fields that already existed in the response; these changes
were implemented in e204ba1dca.
This patch:
- Removes the old `inspectCompatResponse` implementation, which was
no longer used.
- Updates the router to patch the `Config` fields, using the fixes
and enhancements that were implemented in e204ba1dca.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package was aliased as "imagespec" in some places, and "dockerspec"
in other places, which made it easy to confuse.
Change all uses of this package to be aliased as "dockerspec" and configure
an "importas" linting check to enforce it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image inspect response has various fields that were deprecated as
part of the legacy builder, or Dockerfile syntax;
- The `Parent` field is only used for the legacy builder, and only set for
images that are built locally (i.e., not persisted when pulling an image).
- The `DockerVersion` field is only set when building images with the legacy
builder, and empty in most cases.
This patch deprecates the fields in the `InspectResponse` go struct, as
these fields will no longer be set in future once the legacy builder is
removed (`Parent`, `DockerVersion`). The legacy builder's deprecation in
[cli@4d8e457] / [cli@fd22746] (docker 23.0, API v1.42), however the related
API fields were kept so that information of legacy images would not be
discarded.
The API continues to return these fields if set, allowing the client to
print the fields for informational purposes when printing the raw response,
but these fields should be considered "transitional", and not be depended
on; deprecating the fields helps raise awareness.
[cli@4d8e457]: 4d8e45782b
[cli@fd22746]: fd2274692f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Minor issues to make my IDE happy:
- rename var that shadowed import
- rename vars to use the correct camelCase format
- fix minor grammar / formatting in comments
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was a bit of an oversight; when setting additional fields to add,
the compat package currently replaces fields unconditionally. This may
have sounded like an OK idea, but it makes it more complicated to augment
responses where current versions use an "omitempty", but older API versions
should return default / zero-values.
This patch:
- Changes the meaning of "extra fields"; extra fields are only used if
the field is not present in the response.
- Makes the merging of "extra fields" recursive; this makes it easier
to patch responses where extra fields must be added to nested structs.
Previously, this would require the nested struct to be wrapped with a
`compat.Wrap` and replaced as a whole; lacking a "replace" option made
that more complicated, so making the extra fields recursive.
- Comment-out a test that tested the old behavior of replacing fields;
we currently have no cases where we must _replace_ fields or structs,
so I did not yet implement such an option, but we can implement a
`WithReplaceFields` (e.g.) once there's a need.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image inspect response has various fields that are either optional,
or only used if the image was built using the deprecated legacy builder.
This patch marks them as "omitempty" to omit them from the response if
not set:
- The `Parent` field is only used for the legacy builder, and only set for
images that are built locally (i.e., not persisted when pulling an image).
- The `Comment` field is optional, and may not be set, depending on how the
image is produced.
- The `DockerVersion` field is only set when building images with the legacy
builder, and empty in most cases.
- The `Author` field can be set through the `MAINTAINER` instruction in
Dockerfiles, and through the `--author` option on `docker commit`, but
is optional, and won't be set in most situations.
With this patch:
On API v1.52
DOCKER_API_VERSION=v1.52 docker inspect busybox
[
{
"Id": "sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e",
"RepoTags": ["busybox:latest"],
"RepoDigests": ["busybox@sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e"],
"Created": "2024-09-26T21:31:42Z",
"Config": {
"Env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],
"Cmd": ["sh"]
},
"Architecture": "arm64",
"Variant": "v8",
"Os": "linux",
"Size": 1913388,
"RootFS": {
"Type": "layers",
"Layers": ["sha256:6aba5e0d32d91e3e923854dcb30588dc4112bfa1dae82b89535ad31d322a7b19"]
},
"Metadata": {
"LastTagTime": "2025-10-03T22:24:18.440035424Z"
},
"Descriptor": {
"mediaType": "application/vnd.oci.image.index.v1+json",
"digest": "sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e",
"size": 9535
}
}
]
On API v1.51 or lower:
DOCKER_API_VERSION=v1.51 docker inspect busybox
[
{
"Architecture": "arm64",
"Author": "",
"Cmd": null,
"Comment": "",
"Config": {
"Cmd": ["sh"],
"Env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
},
"Created": "2024-09-26T21:31:42Z",
"Descriptor": {
"digest": "sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e",
"mediaType": "application/vnd.oci.image.index.v1+json",
"size": 9535
},
"DockerVersion": "",
"Entrypoint": null,
"Env": null,
"Id": "sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e",
"Labels": null,
"Metadata": {
"LastTagTime": "2025-10-03T22:24:18.440035424Z"
},
"OnBuild": null,
"Os": "linux",
"Parent": "",
"RepoDigests": ["busybox@sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e"],
"RepoTags": ["busybox:latest"],
"RootFS": {
"Layers": ["sha256:6aba5e0d32d91e3e923854dcb30588dc4112bfa1dae82b89535ad31d322a7b19"],
"Type": "layers"
},
"Size": 1913388,
"User": "",
"Variant": "v8",
"Volumes": null,
"WorkingDir": ""
}
]
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These utilities are very handy to use in integration tests, too. Move
the package so it can be imported by them.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Clients should not make assumptions about the validity of an API struct
as the set of well-formed values may differ across daemon versions.
Remove it from the API module so client-application authors are not
tempted to apply it, which would restrict the forward compatibility of
the client.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Clients should not make assumptions about the validity of an API struct
as the set of well-formed values may differ across daemon versions.
Remove it from the API module so client-application authors are not
tempted to apply it, which would restrict the forward compatibility of
the client.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Change the types for IP address and prefix struct fields to netip.Addr
and netip.Prefix for convenience. Fields such as
swarm.InitRequest.ListenAddr which may encode non-numeric values such as
a network interface name have not been modified.
Signed-off-by: Cory Snider <csnider@mirantis.com>
These utilities are going to be needed elsewhere in the daemon to handle
netip values from API requests.
Signed-off-by: Cory Snider <csnider@mirantis.com>
As there is a meaningful distinction between a nil slice and an empty
but non-nil slice in some contexts, having sliceutil.Map return an empty
slice when passed a nil slice can introduce subtle bugs. Modify Map to
return a nil slice when passed a nil slice.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Support for daemon-side auto-remove was added in API v1.25; on older
versions of the daemon, the client was responsible for removing the
container after it exited (see [moby@6dd8e10])
On API versions < 1.30, it used the events API for this purpose, and
would wait for a "die", "detach" or "detroy" events to know the container
exited, and could be removed or (when attached, but without a TTY) to
get the container's exit-status. (see [cli@38591f2]).
API version 1.24 (docker 1.12) is 9 Years old (July 29, 2016), and API
1.30 (docker 17.06) is 8 Years old (Jun 20, 2017), and long EOL. While
technically, a CLI could negotiate API 1.30 or older, this would only
be in cases where either API version negotiation failed, or the version
was explicitly overridden through `DOCKER_API_VERSION` for testing.
This patch removes the version-gate for daemon-side AutoRemove; version-
specific handling is removed from the client (and a related patch in
the CLI).
[moby@6dd8e10]: 6dd8e10d6e
[cli@38591f2]: 38591f20d0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
TestGetAPIPath: don't use obsolete API versions in test
This test was using API v1.22 as "old" version to verify the given
version overrode the default. Update it to use a previous API version
that's still supported by the client.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Trying to remove uses of deprecated fields that are only set for backward-
compatibility with older API versions. This is not a full replacement yet,
as there's still other fields ("Container", "ContainerConfig") that are
harder to replace without an (internal / backend) type to define them,
but this patch removes the dependency of the daemon on the `VirtualSize`
field on image inspect.
The "image ls" endpoint needs a similar patch, because "image.Summary" also
has a `VirtualSize` field that's removed in API v1.44 and up.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `VirtualSize` field was deprecated in [moby@1261fe6], and omitted / removed
in API v1.44 in [moby@913b0f5]. We should not document the field as part of
those API versions as it no longer exists for those.
[moby@1261fe6]: 1261fe69a3
[moby@913b0f5]: 913b0f51ca
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Starting with kernel v6.12, kernel memory TCP accounting is deprecated for cgroups v1.
Note: kernel memory TCP accounting is not supported by cgroups v2.
See d046ff46ee
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `ErrBackendNotSupported` error was no longer used since [moby@37cbdeb].
[moby@37cbdeb]: 37cbdeb1f2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `BOLTDB` const and related `Backend` type are no longer used since
[moby@ed08486].
[moby@ed08486]: ed08486ec7
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit 380ded6 restored a now-unused endpoint count to the
store, so that when the daemon is downgraded it exists for
the old code to find.
But, on network deletion, the endpoint count was not loaded
from the store - so the delete code saw the wrong "index",
and logged a warning before deleting it anyway.
Use DeleteObject instead of DeleteObjectAtomic, so the old
index isn't checked.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This field was no longer used since Docker 1.11 (API version 1.23)
through [moby@aee260d] and [engine-api@9a9e468] but kept and deprecated
in [engine-api@167efc7], however the docs still used it in an example.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was no longer used since Docker 1.11 (API version 1.23)
through [moby@aee260d] and [engine-api@9a9e468] but kept, and deprecated
in [engine-api@167efc7] with a fix-up in [moby@6cfff7e8803a7].
This patch removes the field so that we don't have to carry it in the
new moby/api module.
[moby@aee260d]: aee260d4eb
[engine-api@9a9e468]: 9a9e468f50
[engine-api@167efc7]: 167efc72bb
[moby@6cfff7e8803a7]: 6cfff7e880
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Go 1.25 / TLS 1.3 may produce a generic "handshake failure" whereas
TLS 1.2 may produce a "bad certificate" TLS alert.
See https://github.com/golang/go/issues/56371
> https://tip.golang.org/doc/go1.12#tls_1_3
>
> In TLS 1.3 the client is the last one to speak in the handshake, so if
> it causes an error to occur on the server, it will be returned on the
> client by the first Read, not by Handshake. For example, that will be
> the case if the server rejects the client certificate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Go 1.25 / TLS 1.3 may produce a generic "handshake failure"
whereas TLS 1.2 may produce a "bad certificate" TLS alert.
See https://github.com/golang/go/issues/56371
> https://tip.golang.org/doc/go1.12#tls_1_3
>
> In TLS 1.3 the client is the last one to speak in the handshake, so if
> it causes an error to occur on the server, it will be returned on the
> client by the first Read, not by Handshake. For example, that will be
> the case if the server rejects the client certificate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change defines the generic `Storage` type for use in container inspect responses when using containerd snapshotter backend.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
When running the docker daemon with `--selinux-enabled`, access to the docker
socket is prevented by SELinux. To access the socket, the container must be
started with `--privileged`, with SELinux disabled (`--security-opt label=disable`),
or with (e.g.) `--security-opt label=type:container_runtime_t`, which gives
it access to files restricted to the runtime ( `dockerd` daemon) itself.
While having access to the docker socket grants full `root` permissions on
the host (e.g. through starting a privileged container using the socket),
it may be preferable to restrict the container to just the socket.
This patch adds a `docker_client.process` SELinux CIL policy module that
defines a container domain (process type). It inherits the base container
template and grants the permissions needed to use the docker socket.
Without this (and the daemon running with `--selinux-enabled`);
docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock docker:cli -H unix:///var/run/docker.sock version
Client:
Version: 28.4.0
API version: 1.51
Go version: go1.24.7
Git commit: d8eb465
Built: Wed Sep 3 20:56:28 2025
OS/Arch: linux/amd64
Context: default
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version": dial unix /var/run/docker.sock: connect: permission denied
With this:
semodule -i /usr/share/udica/templates/base_container.cil
semodule -i ./contrib/selinux/docker_client.cil
docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock --security-opt label=type:docker_client.process docker:cli -H unix:///var/run/docker.sock version
Client:
Version: 28.4.0
API version: 1.51
Go version: go1.24.7
Git commit: d8eb465
Built: Wed Sep 3 20:56:28 2025
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 28.4.0
API version: 1.51 (minimum version 1.24)
Go version: go1.24.7
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The CheckpointList method previously returned a raw slice of
checkpoint.Summary, which made it difficult to extend the API response
with additional metadata or fields in the future without breaking
backward compatibility.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This fixes a bug where no checkpoints would produce a `null` response
instead of an empty array:
```
$ docker run -d --name foo nginx:alpine
17fbeff7185733f101c38cb8208359dd0ef141116a1345da2d3c3f58c11f3e14
$ curl --unix-socket /var/run/docker.sock http://local/containers/foo/checkpoints
null
```
With this patch, this becomes:
```
$ curl --unix-socket /var/run/docker.sock http://local/containers/foo/checkpoints
[]
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
With this tag, a dynamically linked binary will exec
the nft tool instead of using cgo to call libnftables
directly.
Signed-off-by: Rob Murray <rob.murray@docker.com>
full diff: 2e043c6bd6...0ea5ed0382
Notable changes:
- Revert "Change /dev to be mounted by default with /noexec". Mounting /dev
with 'noexec' option triggers problems when containers try to create Intel
SGX enclaves: [runtime-tools@0524bb2]
- Switch to github.com/moby/sys/capability [runtime-tools@c2dadba]
[runtime-tools@0524bb2]: 0524bb2cf6
[runtime-tools@c2dadba]: c2dadba13f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allow tests to run in parallel with separate network namespaces,
without modifying the global-state namespace/netlink handles in
the "ns" package ... only useful for tests that don't depend on
package "ns".
Use the new option in iptabler/nftabler tests.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The `BridgeNfIptables` and `BridgeNfIp6tables` were removed in API v1.50
in commit 6505d3877c, and only returned in
lower API versions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
SetupTestOSContextEx calls 'ns.Init' (which, outside tests, is protected
by a sync.Once), and it's called again by the returned OSContext.Cleanup
method. That overwrites the ns package's namespace and netlink handles
(initNs and initNl) without closing them.
Because SetupTestOSContextEx changes that shared state, it should not
be used in parallel tests. So, rather than trying to close the handles
in ns.Init if already open - un-export Init so it's always called via
its sync.Once, and add a reset function for tests to use. Have
SetupTestOSContextEx claim a mutex to avoid crashy surprises or
hard to catch issues where the ns package isn't using the expected
namespace if it is used in parallel tests.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The PushImage method for the ImageService used positional arguments for its
options, which made it more difficult to introduce new options. This patch
introduces a `PushOptions` struct to specify the options. As part of these
changes, the `platform` option was already adjusted to accept a slice of
platforms, which currently is not supported, but may be in the near future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The PullImage method for the ImageService used positional arguments for its
options, which made it more difficult to introduce new options. This patch
introduces a `PullOptions` struct to specify the options. As part of these
changes, the `platform` option was already adjusted to accept a slice of
platforms, which currently is not supported, but may be in the near future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Mirantis Container Runtime 23.0 reached EOL on May 19, and the 23.0
branch is no longer maintained.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use "apiClient" for the client (most places use either `apiClient`
or `c`) to prevent shadowing the `client` import.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit [moby@17d870b] (API v1.13, docker v1.1.0) changed the default to pause
containers during commit, keeping the behavior opt-in for older API versions.
This version-gate was removed in [moby@1b1147e] because API versions lower
than v1.23 were no longer supported.
However, the `CreateImageConfig` struct still used `Pause`, and required opting-
in to enable pausing. This patch changes the struct to reflect the default.
after this change, we should also consider changing the API make disabling
pause a more explicit option, and to change the "pause" argument to a
"no-pause".
[moby@17d870b]: 17d870bed5
[moby@1b1147e]: 1b1147e46b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit [moby@17d870b] (API v1.13, docker v1.1.0) changed the default to pause
containers during commit, keeping the behavior opt-in for older API versions.
This version-gate was removed in [moby@1b1147e] because API versions lower
than v1.23 were no longer supported.
However, the client still required opting-in to pausing containers, which
is handled by setting the `Pause` field to true by default. This patch changes
the client option to reflect the default; after this change, we should also
consider changing the API make disabling pause a more explicit option, and
to change the "pause" argument to a "no-pause".
[moby@17d870b]: 17d870bed5
[moby@1b1147e]: 1b1147e46b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Trim any v-prefix passed to this function to make sure we detect empty
API versions.
In most cases, the ping-response will originate from the API server, but
the exported `Client.NegotiateAPIVersionPing` allows a ping-response to
be passed manually.
While updating, also update the signature to only accept the version, as
only the `PingResponse.APIVersion` is used by this function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Validate that the client is connecting with the expected endpoint path and
method(s). Also fix the Api-Version response to align with the actual format
returned, which doesn't include a "v" prefix;
curl -sI --unix-socket /var/run/docker.sock 'http://localhost/_ping' | grep 'Api-Version'
Api-Version: 1.51
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method was introduced in [moby@5a84124] related to the (now removed)
support for "compose on kubernetes" in the CLI. This functionality extended
the CLI with endpoints that are not part of the engine API, but re-using
the HTTP-client with the same (TLS) config as the CLI itself.
While such scenarios may be something to consider in future (i.e. more easily
extend the API with custom endpoints), this method is not currently used,
but defined as part of the CLI's interface. This patch removes the method
for now, so that we can design from a clean slate in case we need this
extensibility, instead of keeping methods that were added ad-hoc around.
[moby@5a84124]: 5a84124739
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method did not provide any special handling for accessing the
field, and did not handle locking. Let's remove it for now to
not pretend we're doing anything more safe than directly accessing
the field.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This constructor did not do anything other than creating an empty struct
for an exported type. While we should look at initializing with a proper
state, we currently do not, so let's not pretend we do some magic here,
and leave it for a future exercise to create a proper constructor if we
need one.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The State.Health struct has a mutex, but in various places
we access the embedded Health struct directly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Container.State struct holds the container's state, and most of
its fields are expected to change dynamically. Some o these state-changes
are explicit, for example, setting the container to be "stopped". Other
state changes can be more explicit, for example due to the containers'
process exiting or being "OOM" killed by the kernel.
The distinction between explicit ("desired") state changes and "state"
("actual state") is sometimes vague; for some properties, we clearly
separated them, for example if a user requested the container to be
stopped or restarted, we store state in the Container object itself;
HasBeenManuallyStopped bool // used for unless-stopped restart policy
HasBeenManuallyRestarted bool `json:"-"` // used to distinguish restart caused by restart policy from the manual one
Other properties are more ambiguous. such as "HasBeenStartedBefore" and
"RestartCount", which are stored on the Container (and persisted to
disk), but may be more related to "actual" state, and likely should
not be persisted;
RestartCount int
HasBeenStartedBefore bool
Given that (per the above) concurrency must be taken into account, most
changes to the `container.State` struct should be protected; here's where
things get blurry. While the `State` type provides various accessor methods,
only some of them take concurrency into account; for example, [State.IsRunning]
and [State.GetPID] acquire a lock, whereas [State.ExitCodeValue] does not.
Even the (commonly used) [State.StateString] has no locking at all.
The way to handle this is error-prone; [container.State] contains a mutex,
and it's exported. Given that its embedded in the [container.Container]
struct, it's also exposed as an exported mutex for the container. The
assumption here is that by "merging" the two, the caller to acquire a lock
when either the container _or_ its state must be mutated. However, because
some methods on `container.State` handle their own locking, consumers must
be deeply familiar with the internals; if both changes to the `Container`
AND `Container.State` must be made. This gets amplified more as some
(exported!) methods, such as [container.SetRunning] mutate multiple fields,
but don't acquire a lock (so expect the caller to hold one), but their
(also exported) counterpart (e.g. [State.IsRunning]) do.
It should be clear from the above, that this needs some architectural
changes; a clearer separation between "desired" and "actual" state (opening
the potential to update the container's config without manually touching
its `State`), possibly a method to obtain a read-only copy of the current
state (for those querying state), and reviewing which fields belong where
(and should be persisted to disk, or only remain in memory).
This PR preserves the status quo; it makes no structural changes, other
than exposing where we access the container's state. Where previously the
State fields and methods were referred to as "part of the container"
(e.g. `ctr.IsRunning()` or `ctr.Running`), we now explicitly reference
the embedded `State` (`ctr.State.IsRunning`, `ctr.State.Running`).
The exception (for now) is the mutex, which is still referenced through
the embedded struct (`ctr.Lock()` instead of `ctr.State.Lock()`), as this
is (mostly) by design to protect the container, and what's in it (including
its `State`).
[State.IsRunning]: c4afa77157/daemon/container/state.go (L205-L209)
[State.GetPID]: c4afa77157/daemon/container/state.go (L211-L216)
[State.ExitCodeValue]: c4afa77157/daemon/container/state.go (L218-L228)
[State.StateString]: c4afa77157/daemon/container/state.go (L102-L131)
[container.State]: c4afa77157/daemon/container/state.go (L15-L23)
[container.Container]: c4afa77157/daemon/container/container.go (L67-L75)
[container.SetRunning]: c4afa77157/daemon/container/state.go (L230-L277)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was deprecated in [moby@cfcbfab] when this struct still lived
in the API. The field is no longer used, and we don't have to carry it
forward as part of the new client module.
[moby@cfcbfab]: cfcbfabb0f
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since moving from `net.IP` to `netip.Addr`, we can support more proper
nameserver values. This commit adds some tests related to IPv6 scoping.
Signed-off-by: Nam Nguyen <namnguyen@google.com>
the "reference" filter was introduced in [moby@820b809] (docker 1.13.0-rc1)
to replace the "filter" query argument. That commit initially included a
version-gate anticipating the API version to be used for v17.12, but as
this was yet unknown, the version-gate was removed in [moby@0f9d22c].
A later PR re-introduced a version-gate in [moby@4a19009], reflecting the
API version in which the deprecation was (finally) completed.
For the client, [moby@c6e3145] added a fallback was added for older daemons
(docker 1.12.0 and older, using API < v1.25) that did not support the new
filter.
Looking at the above, any version of docker 1.13.0 or above handles the
"reference" filter, but (depending on the docker version) may also handle
the old filter on API < 1.28 or API < 1.41. Removing this option will only
impact daemon versions older than 1.13.0, which are long obsolete.
Given that current clients forcibly remove the "reference" filter and replace
it with the old "filter" when using API v1.24, we keep support on the daemon
side, but update the version to v1.24, and only if no reference filter is
set.
[moby@820b809]: 820b809e70
[moby@c6e3145]: c6e31454ba
[moby@0f9d22c]: 0f9d22cd66
[moby@4a19009]: 4a1900915a
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
commit [moby@5d6b566] migrated this validation from the CLI to the client,
but for some reason picked the wrong API version inside ServiceCreate.
The CLI code was added to an existing validation, which only handled
validation when creating a service, but not when updating, which meant
that adding this option to an existing service would not invalidate it.
This patch:
- moves the version-gate to the validation code
- merges validateServiceSpecForAPIVersion into validateServiceSpec, to
keep the validation combined, and to make sure validation happens both
on create and update.
[moby@5d6b566]: 5d6b56699d
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The version header is no longer used since [moby@a9d2091] (v20.10.0-beta1)
which was not gated by API version, as handling of the header was broken
(using the client version, instead of the API version used for the request).
Given that any current version of the daemon, regardless of API version will
ignore the header, this code was only in place to allow connecting to a
daemon older than (v20.10.0-beta1), which would be long EOL now.
[moby@a9d2091]: a9d20916c3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `force` option on volume remove was added in [moby@6c5c34d] (docker
1.13.0-rc1, API v1.25), but did not gate the feature to API version, so
effectively introduced it to all existing API versions. After this,
[moby@e98e4a7] enabled experimental features by default, and added API
version gates, but only did so on the client side, so the daemon / API
server would continue to accept the `force` option on any API version.
Let's remove this code, given that:
- API v1.24 is the oldest API version we still handle, and only as fallback.
- This code silently discards the user's option (no warning / error)
- Every current version of the daemon handles the option, regardless
of API version (only a 9+ year old daemon wouldn't handle it).
[moby@6c5c34d]: 6c5c34d50d
[moby@e98e4a7]: e98e4a7111
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The WithMockClient option was explicitly resetting the client's API
version (see [1]), which differs from the regular client, which is
initialized with the current API version used by the client (see [2]).
This patch:
- reduces the `WithMockClient` to only set the custom HTTP client, leaving
other fields un-touched.
- adds a test utility and updates tests to handle the API-version prefix
- removes redundant uses of `WithVersion()` in tests; for most test-cases
it was used to make sure a current API version is used that supports the
feature being tested, but there was no test to verify the behavior for
lower API versions, so we may as well test against "latest".
[1]: 5a582729d8/client/client_mock_test.go (L22-L36)
[2]: 5a582729d8/client/client.go (L167-L190)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function is used to validate a service-spec for a specific API
version; renaming it to be less ambiguous.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The config is a required argument (to create a container, at least
an image is needed), but the function was missing a check for this,
which would result in a panic if the client was using API v1.44 or
up due to the changes from ee9f0ed895
attempting to [reset the deprecated `MacAddress` field][1].
In practice, this would unlikely be hit, and we didn't hit this in
unit-tests, due to a bug in `WithMockClient`, which initializes the
client with an [empty API version][2], which is different from the
actual client, which [initializes the client with the MaxAPIVersion][3]
This patch updates the function to return an error if a nil config is
passed.
[1]: 5a582729d8/client/container_create.go (L72-L75)
[2]: 5a582729d8/client/client_mock_test.go (L22-L36)
[3]: 5a582729d8/client/client.go (L167-L190)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
CheckDuplicate is removed in API v1.44, and no longer used by
daemons supporting that API version (v25.0.0-beta.1 and up)
regardless of the API version used, but it must be set to true
when sent to older daemons (see [moby@78479b1]).
This patch moves adding the field to the client through an ad-hoc struct
so that we don't have to carry the field in the API module.
We can remove this once daemon versions v24.0 and lower are no longer
expected to be used (when Mirantis Container Runtime v23 is EOL).
https://github.com/moby/moby/blob/v2.0.0-beta.0/project/BRANCHES-AND-TAGS.md.
This field was removed from API v1.44 and no longer used by daemons supporting
that API version (v25.0.0-beta.1 and up) regardless of the API version used,
but for older version of the daemon required this option to be set.
[moby@78479b1]: 78479b1915
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pass the Route as a whole, instead of some of its properties; this
allows the method to act on additional information provided by the
route.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was used in the CLI to produce a warning added in [moby@4a8b3ca]
to print a warning when building Linux images from a Windows client.
Window's filesystem does not have an "executable" bit, which mean that,
for example, copying a shell script to an image during build would lose
the executable bit. So for Windows clients, the executable bit would be
set on all files, unconditionally.
Originally this was detected in the client, which had direct access to
the API response headers, but when refactoring the client to use a common
library in [moby@535c4c9], this was refactored into a `ImageBuildResponse`
wrapper, deconstructing the API response into an `io.Reader` and a string
field containing only the `OSType` header.
The warning was removed in [cli@af65ee4], so we don't have to carry this
field in the new client module going forward.
With the field removed, we can consider the client to return the full
HTTP response again, but leaving that for a follow-up, as we may want
to rewrite these streaming functions altogether.
[moby@4a8b3ca]: 4a8b3cad60
[moby@535c4c9]: 535c4c9a59
[cli@af65ee4]: af65ee4584
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Type type was defined before the API had a definition fro the exec-inspect
response. When a type definition was added in [moby@2a34207], the definition
was moved from the backend to the API, and the backend type implemented as
an alias.
Technically, we could keep a _concrete_ type for the backend, and handle
conversion to the corresponding API type in the router, but currently,
this would likely only add extra complexity.
We could still opt for doing so when the backend requires additional fields
or changes that should not be reflected in the API response.
[moby@2a34207]: 2a342079c6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This type was introduced in [moby@3f9f231], at which type no API response
types were defined, and the [`containerRouter.getExecByID`] would return
the daemon's internal [`exec.Config`] type from [`backend.ContainerExecInspect`].
Tracing back history about the discrepancy between the type used by the client
and the actual response type; commit [moby@2a34207] added the missing type in
the API, which was documented as part of the API swagger definition since the
start ([moby@0243936]), and updated in [moby@74cb739], so we can't use the
reduced struct as response type.
[moby@3f9f231]: 3f9f23114f
[moby@2a34207]: 2a342079c6
[`containerRouter.getExecByID`]: 3f9f23114f/api/server/router/container/exec.go (L18-L25)
[`backend.ContainerExecInspect`]: 3f9f23114f/api/server/router/container/backend.go (L18)
[`exec.Config`]: 3f9f23114f/daemon/exec/exec.go (L13-L31)
[moby@0243936]: 0243936d92
[moby@74cb739]: 74cb739766
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This option is no longer supported by runc, and is deprecated in the kernel.
We removed support for this feature from all API versions, so it's better
to also amend the docs for older API versions.
[kernel v5.4]: https://github.com/torvalds/linux/commit/0158115f702b0ba208ab0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
kernel-memory limits are not supported in cgroups v2, and were obsoleted in
[kernel v5.4], producing a `ENOTSUP` in kernel v5.16. Support for this option
was removed in runc and other runtimes, as various LTS kernels contained a
broken implementation, resulting in unpredictable behavior.
We deprecated this option in [moby@b8ca7de], producing a warning when used,
and actively ignore the option since [moby@0798f5f].
Given that setting this option had no effect in most situations, we should
just remove this option instead of continuing to handle it with the expectation
that a runtime may still support it.
Note that we still support RHEL 8 (kernel 4.18) and RHEL 9 (kernel 5.14). We
no longer build packages for Ubuntu 20.04 (kernel 5.4) and Debian Bullseye 11
(kernel 5.10), which still have an LTS / ESM programme, but for those it would
only impact situations where a runtime is used that still supports it, and
an old API version was used.
[kernel v5.4]: https://github.com/torvalds/linux/commit/0158115f702b0ba208ab0
[moby@b8ca7de]: b8ca7de823
[moby@0798f5f]: 0798f5f5cf
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This introduces a `WithMinimumAPIVersion` RouteWrapper to configure the
minimum API version required for a route. It produces a 400 (Invalid Request)
error when accessing the endpoint on API versions lower than the given version.
Note that technically, it should produce a 404 ("not found") error,
as the endpoint should be considered "non-existing" on such API versions,
but 404 status-codes are used in business logic for various endpoints.
This patch allows removal of corresponding API-version checks from the client,
and other implementation of clients for the API. While the produced error message
is slightly more "technical", these situations should be rare and only happen
when the API version of the client is explicitly overridden, or a client was
implemented with a fixed API version (potentially missing version checks).
Before this patch, these errors were produced by the client:
DOCKER_API_VERSION=v1.24 docker container prune -f
docker container prune requires API version 1.25, but the Docker daemon API version is 1.24
With this patch applied, the error is returned by the daemon:
DOCKER_API_VERSION=v1.24 docker container prune -f
Error response from daemon: POST /containers/prune requires minimum API version 1.25
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Windows test workflow jobs were missing the dependency on the
`validate-dco` job so they ran regardless whether the DCO check passed
or not.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The format for filters changed in 93d1dd8036
(docker v1.10 / API v1.22). As part of that implementation, the daemon
would parse the new format, and fall back to parsing the old format if
this failed. This fallback was not based on API version, so any version
of the API released since would continue to accept both the legacy and
curent format.
For the client, the change in format caused a regression when connecting
to an older daemon; a `ToParamWithVersion` utility was introduced in
[docker/engine-api@81388f0] to produce the old format when the client was
connected to a docker v1.9 or older daemon, using an old API version.
Given that any version of docker 1.10 or above would support both formats,
regardless of the API version used, and API v1.22 is no longer supported,
it should be safe to assume we can drop the version-specific format in the
client. Even if the client would be using API v1.22 (or older), the format
would only be necessary for an actual docker v1.9 daemon, which would be
very unlikely, and a daemon that's 9 Years old.
[docker/engine-api@81388f0]: 81388f00dd
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
On docker 1.12 (API v1.24) and older, the `SecurityOptions` field of the
`/info` response would only list names of the security options that are
enabled in the daemon. API v1.25 added additional information to this
information. Initially, this included a change to return the information
in structured format (b237189e6c), which
was a backward-incompatible change, so an alternative format was introduced
in 514ca09426 to used a string-slice, but
prefixing options with `name=`, followed by the name of the security-options
and any config options related to it as `key[=<value>]` pairs.
On current API versions:
curl -s --unix-socket /var/run/docker.sock 'http://localhost/v1.51/info' | jq .SecurityOptions
[
"name=seccomp,profile=builtin",
"name=cgroupns"
]
On API version v1.24:
curl -s --unix-socket /var/run/docker.sock 'http://localhost/v1.24/info' | jq .SecurityOptions
[
"seccomp",
"cgroupns"
]
The Docker CLI unconditionally handles either format when presenting the
information; for backward-compatibility, it contains fallback code to handle
cases where no `name=` prefix is present, but this logic is not based on
API version.
Given that any current version of the CLI is handling either format, and
versions of the CLI that did not have this handling are at least 9 Years
old (and long EOL), removing the old format is unlikely to be causing
issues and we can remove this special handling, and return the information
in the current format.
If we consider this information to be relevant for clients, we should
ultimately consider making it available in a more structured format as
was the original intent of b237189e6c.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- move api/types/container.ExecOptions to the client
- rename api/types/container.ExecOptions to ExecCreateRequest
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- move api/types/container.ExecStartOptions to the client
- move api/types/container.ExecAttachOptions to the client
- rename api/types/container.ExecStartOptions to ExecStartRequest
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
daemon versions before v18.09 (API v1.39) returned a magic `<unknown>` value
for the `KernelVersion` and `OperatingSystem` if these values were not set.
Commit e6e8ab50fa removed this magic values,
but kept a fallback for old versions of the CLI that expected this value to
be pre-formatted this way. Given that this change was over 7 Years ago, and
never was a strict contract of the API, we can remove this fallback. Current
versions of the CLI properly handle presentation, so this would only impact
EOL versions of the CLI.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Update changelog to include mention of the new fields added
in 3f86797d3f.
- Update changelog to mention removal of the deprecated fields
in b092c8ca64
- Sync v1.52 swagger docs with the current version.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When running:
docker network create --ipv6 b46
docker run --rm -ti \
--network name=b46,driver-opt=com.docker.network.endpoint.sysctls=net.ipv6.conf.IFNAME.disable_ipv6=1 \
busybox
IPv6 is enabled in the container and the network, so an IPv6 address
will be allocated for the endpoint.
But, when the sysctl is applied, the IPv6 address will be removed
from the interface ... so, no unsolicited neighbour advertisement
should be (or can be) sent and, the endpoint should not be treated
as dual-stack when selecting a gateway endpoint and, if it is
selected as the gateway endpoint, setting up an IPv6 route via the
network will fail.
So, if the IPv6 address disappears after sysctls have been applied,
release the address and remove it from the endpoint's config.
Signed-off-by: Rob Murray <rob.murray@docker.com>
And move the Endpoint.populateNetworkResources code into the
all-platforms part of the Sandbox method.
Signed-off-by: Rob Murray <rob.murray@docker.com>
DNS is set up when the endpoint is joined to a network.
It was added in commit 4850c5f (Avoid duplicate entries in
/etc/hosts) then simplified in bcca214 (libnetwork: open-code
updating svc records) and seems to be related to setting up a
name on a swarm node that isn't running the container with the
endpoint.
But, all callers of Network.createEndpoint follow up with an
Endpoint.Join, which also sets up the DNS entry. Those callers are:
Network.createLoadBalancerSandbox
Network.CreateEndpoint
- called by Daemon.connectToNetwork
- called by Sandbox.setupDefaultGateway
- called by builder-net/executor.go: iface.init
None of them bail out before the Join for a Swarm case.
So, it looks like enough has changed that the createEndpoint code is
no longer needed (it predates the internal DNS server) ... remove it.
Signed-off-by: Rob Murray <rob.murray@docker.com>
When the SetKey hook is used (by a build container) it's called after
Endpoint.sbJoin, which will have called Sandbox.populateNetworkResources
to set up address, routes, sysctls and so on - but it's not able to do
any config until the osSbox exists. So, Sandbox.populateNetworkResources
is called again by SetKey to finish that config.
But, that means the rest of Endpoint.sbJoin has already happened before
the osSbox existed - it will have configured DNS, /etc/hosts, gateways
and so on before anything was set up for the OS.
So, if the osSbox configuration isn't applied as expected (for example,
a sysctl disables IPv6 on the endpoint), that sbJoin configuration is
incorrect.
To avoid unnecessary config+cleanup in thoses cases - delay the config
currently done by sbJoin until the osSbox exists.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This option was deprecated in Docker 27.0 through 7ea9acc97f,
and removed in 28.0 through ae96ce866f.
The field was kept to provide a user-friendly error when used; this
patch removes the field altogether.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When Windows reboots, it removes HNS networks. They're restored
from Docker's store (unlike after a daemon restart, where Docker
networks are restored from HNS networks).
When that happens, preserve the driver-opt that reports the HNS
network name when that happens.
Signed-off-by: Rob Murray <rob.murray@docker.com>
After creating a new network, inspect shows that there's no value
for option "com.docker.network.windowsshim.networkname". After
restarting the daemon, it shows up with the docker network name
(not the HNS network name, which defaults to the docker network's
id).
Creating the network with "-o com.docker.network.windowsshim.networkname"
sets the HNS network name, and it shows up in inspect. Until the
daemon is restarted, then it shows the docker network name.
So - set the option value to the HNS network name on creation (the id
if no name is given), and on restore after restart use the name
reported by HNS.
Signed-off-by: Rob Murray <rob.murray@docker.com>
When ipvlan in "l2" mode is given no '--gateway' option, an
address is allocated from IPAM and a default route is set up
via that gateway. But, the gateway address is not assigned to
anything in the Docker ipvlan network - it must be external,
and IPAM shouldn't try to guess it.
So ...
- always disable IPAM gateway address allocation for ipvlan-l2
- tell libnet to assume the endpoint has a gateway instead
- update the Join code to allow for no configured gateway
- always disable 'docker_gwbridge' connection for ipvlan
networks, so it's not hooked up when there is no gateway
address.
Signed-off-by: Rob Murray <rob.murray@docker.com>
When macvlan is given no '--gateway' option, an address is
allocated from IPAM and a default route is set up via that
gateway. But, the gateway address is not assigned to anything
in the Docker macvlan network - it must be external, and
IPAM shouldn't try to guess it.
When IPv6 auto-configuration is enabled in the network the
macvlan is connected to, the macvlan driver races against it
to set up the gateway. When autoconfig wins, container creation
fails because the default route already exists.
So ...
- disable IPAM gateway address allocation for macvlan
- update the Join code to allow for no configured gateway
- always disable 'docker_gwbridge' connection for macvlan
networks, so it's not hooked up when there is no gateway
address.
Libnet assumes an endpoint with no statically configured default
gateway or route does not provide external connectivity. So, it
disables external DNS access, and will not select the endpoint
as gateway for containers. So, where an IPAM allocated gateway
address would have been assigned before, tell libnet to assume
there will be an auto-configured gateway.
Signed-off-by: Rob Murray <rob.murray@docker.com>
This field was deprecated in 0c182d4d57,
which should be included in a 28.x release, but we don't need to carry
it in the new module.
We should also considering duplicating the `ExecOptions` type as a client
option, and renaming it to `ExecCreateRequest`, so that we can decouple
client options from the shape of the request.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in 83f8f4efd7,
and the package is internal to the daemon, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in 54a556a5ef,
and the package is now internal to the daemon, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Complete the removal of the deprecated network structs by dropping the
remaining references in daemon code.
Signed-off-by: Cory Snider <csnider@mirantis.com>
As the Engine API requests may be directed at a non-leader Swarm
manager, the information needs to be tunneled through the Swarm API.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Except Bridge, all fields of NetworkSettingsBase were deprecated in
v1.44, and are actually never set at all.
The Bridge field was deprecated in v1.51 but it's only set when the
container is connected to the default bridge, and when the daemon is
started with the --bridge option set.
So, remove all those fields and do not backfill them for older API
versions.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
All the fields in DefaultNetworkSettings were deprecated in Engine v1.9
and scheduled for removal in v17.12. However, they're still return in
all supported API versions.
As we still need to keep backward compatibility for older API versions,
this change leverages the newly added 'compat' package to return these
fields despite being removed from the Go struct.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The compat package marshals the base value into JSON to convert it into
a map[string]any, then applies the compat options, and finally
re-encodes the map into JSON.
`json.Marshal` is used for both marshalling operations. However, this
function encodes special HTML characters by default. The API responses
aren't meant to be embedded into HTML, so this behavior is not desired.
Replace `json.Marshal` with a `json.Encoder` with HTML escaping
disabled. Extra care is taken to drop the trailing LF added by
`(*json.Encoder).Encode()` (see [1]).
[1]: https://pkg.go.dev/encoding/json#Encoder.Encode
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The old deferred error handling cleared ep.sandboxID, but only
in a copy of the Endpoint loaded from the store, not stored or
returned - so the modification was immediately lost.
It also tried to remove the endpoint from the Sandbox's 'endpoints',
but the remove function compared pointers rather than ids, so
nothing was removed. Removing it would have broken rollback anyway.
Signed-off-by: Rob Murray <rob.murray@docker.com>
If an endpoint is still attached to a Sandbox when
Endpoint.Delete is called with force=true, sbLeave is
called. It may change the Sandbox's gateway, which may
conflict with a concurrent Join.
So, acquire the Sandbox's joinLeaveMu to do that, and
clarify the purpose of that mutex in struct Sandbox
comments.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Because it loaded the Endpoint object from store and operated
on that copy rather than its own receiver, sbJoin couldn't
successfully roll back on error if the Endpoint was not included
in the Sandbox's list of endpoints, or its current state had
not been written to store after the error occurred.
So, for example, releaseOSSboxResources() would not be called
to delete interfaces created in the container's netns.
Signed-off-by: Rob Murray <rob.murray@docker.com>
These fields were deprecated in [moby@72f188] (docker v1.10, API v1.22),
with the deprecation message updated to be in the correct format in
[moby@247f47] (docker v23.0).
[moby@72f188]: 72f1881df1
[moby@247f47]: 247f4796d2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Don't include the deprecated `status`, `id`, and `from` fields in event
responses.
These fields were deprecated in [moby@72f188] (docker v1.10, API v1.22),
but the daemon still included them in the response.
Unfortunately, the Docker CLI (and compose indirectly), continued using
these fields up until v25.0.0, and panic if the fields are omitted, or
left empty (due to a bug), see: https://github.com/moby/moby/pull/50832#issuecomment-3276600925
so we need to continue producing these fields on API < v1.52.
[moby@72f188]: 72f1881df1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These fields were deprecated in [moby@72f188] (docker v1.10, API v1.22),
and we shouldn't test for them.
[moby@72f188]: 72f1881df1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a package to help augmenting API responses with additional fields,
replacing fields, or to remove fields from the response to allow for
legacy API responses to be produced without having to keep deprecated
fields in the API type definitions.
Co-authored-by: Albin Kerouanton <albinker@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
On API v1.52 and newer, the GET /networks/{id} endpoint returns
statistics about the IPAM state for the subnets assigned to the network.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The uint128 type is very convenient for manipulating 128 bit-wide
quantities, as tends to come up in several contexts when working with
IPv6. Move it into a libnetwork/internal/ package so it can be reused
elsewhere within libnetwork.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Don't include the deprecated `id`, `status`, and `from` fields
in the response; they're no longer part of the API since v1.22
([moby@72f188]).
[moby@72f188]: 72f1881df1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`vm` is quite lengthy which makes it impossible to restart other failed
(flaky) jobs from the `test` workflow before the `vm` finishes.
This patch moves it to a separate workflow to allow retrying other jobs
independently.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
`tar` utility is included in Windows 10 (17063+) and Windows Server
2019+ so we can use it directly.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Sets up the labeler workflow to automatically label PRs affecting the
`client` and `api` modules.
This allows to distinguish PRs targetting different modules.
TODO: Figure out how to handle PRs that would end up with both labels.
However, I think it's good to see what PRs would that affect.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This function was providing a way to set all API options directly,
however the api type was moved to client in 853aed1 so this option no
longer makes sense as it's exposing a part of the private struct at this
point.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The only viable way to allocate a port is to bind and listen to it. So,
the windows PortMapper was really a PortAllocator in disguise.
Rename it to OSAllocator and move it to the portallocator package.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This package was originally internal, but was moved out when BuildKit
used it for its integration tests. That's no longer the case, so we
can make it internal again.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The windows port mapper is needlessly complex while its job is pretty
straightforward: reserve a port through the port allocator, and start a
dummy proxy to allocate it from the OS.
The biggest source of complexity is the use of the `net.Addr` interface
to pass the host IP, port and proto. `MapRange` now has a proto arg, and
returns the allocated port.
`MapRange` is also instantiating a `mapping` struct whose fields are
all unused, except for its `stopUserlandProxy`. Instead, store
`stopProxy` callbacks directly into the `PortMapper`.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This function is only called by New, and it takes the singleton
PortAllocator exposed by the portallocator package.
Remove this function and instantiate the PortMapper directly from New
constructor.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The portmapper struct provided by libnet/portmapper is only available
on Windows. Merge both files to reflect that.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Prior to commit 4f09af626, DeleteForwardingTableEntry had a Linux
implementation. That's not the case anymore, and it's a no-op on
Windows. Remove it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Prior to commit 4f09af626, AppendForwardingTableEntry had a Linux
implementation. That's not the case anymore, and it's a no-op on
Windows. Remove it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Use the errdefs utilities to make sure we correctly detect the type
of error if a containerd errdefs type is returned.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in f1bb44aeee, and
the IsContext is no longer used. They are not carried forward in the
new module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
If neither of the DOCKER_INTEGRATION_DAEMON_DEST or DEST environment
variables are set, integration tests panic with a nil-dereference panic
in os.(*File).Name(...). This is a very unhelpful behaviour for someone
trying to run integration tests interactively. Fix up the logic to avoid
dereferencing nil os.File pointers and instead fail the test immediately
with an actionable error message.
Signed-off-by: Cory Snider <csnider@mirantis.com>
An inverted condition resulted in integration tests disabling the
userland proxy if the DOCKER_USERLANDPROXY environment variable is set
to a value that strconv.ParseBool cannot parse, leading to the confusing
behaviour of DOCKER_USERLANDPROXY=0 enabling the userland proxy and
DOCKER_USERLANDPROXY=foo disabling it. Fix up the logic so that
DOCKER_USERLANDPROXY=0 disables the userland proxy and
DOCKER_USERLANDPROXY=foo is an error.
Signed-off-by: Cory Snider <csnider@mirantis.com>
This example was added in 5e0e34fafd so that
the deprecated fields could be omitted from the example. Those fields were
removed from the swagger in 4dc961d0e9, but
the temporary example was not removed.
This patch removes the example, in favor of the per-field examples, which
were already in place.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This example was added in 5e0e34fafd so that
the deprecated fields could be omitted from the example. Those fields were
removed from the swagger in 4dc961d0e9, but
the temporary example was not removed.
This patch removes the example, in favor of the per-field examples, which
were already in place.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's not the response coming from the API, but a wrapper for a response
reader. We should ultimately remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the option-types to the client and in some cases create a
copy for the backend. These types are used to construct query-
args, and not marshaled to JSON, and can be replaced with functional
options in the client.
The CreateOptions type was used both as options-struct for the client,
and as struct to marshal/unmarshal the request. For this type, a copy
is created in the Client and a new `checkpoint.CreateRequest` is added
in the API.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the hand-rolled Network, Summary and Inspect struct types in
api/types/network with types generated from the Swagger definition.
Disable the generation of all unwanted marshalers and unmarshalers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
commit f0c069ffc9 added support for a
`ci/validate-only` label to skip tests and only run the validation checks.
Commit 09ecd74cf3 was merged later, but was
authored before that feature was merged, so did not account for the label,
so the "vm" checks would always run.
This applies the additional conditions to skip the "vm" checks if the
`ci/validate-only` label is set.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the option-types to the client and in some cases create a
copy for the backend. These types are used to construct query-
args, and not marshaled to JSON, and can be replaced with functional
options in the client.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change makes the `GraphDriver` field in `image.InspectResponse` optional. This field will only be returned when using moby engine graph drivers as a backend storage implementation. It will be omitted when using the containerd image backend.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
While the network Summary and Inspect types have been aliases in Go's
type system, in practice there is a difference: the Containers and
Services fields are only populated when inspecting a network. Split out
the common fields into a base network.Network struct which is embedded
in the network.Summary and network.Inspect types.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Filter-term validation does not belong in the API module. Clients should
not be making any assumptions about which terms the daemon understands.
Users should not need to upgrade their clients to use filter terms
introduced in a newer daemon. Move the network filter validation from
the api module into the daemon.
Split network.NewFilter into network.NewListFilter and
network.NewPruneFilter constructors which validate the filter terms,
enforcing the invariant that any network.Filter is a well-formed filter
for networks.
The network route handlers have been leveraging a hidden 'idOrName'
filter term that is not listed in the set of accepted filters and
therefore not accepted in API client requests. And it's a good thing
that it was never part of the API: it is completely broken and not fit
for purpose! When a filter contains an idOrName term, the term values
are ignored and instead the filter tests whether either the 'id' or
'name' terms match the Name of the network. Unless the filter contains
both 'id' and 'name' terms, the match will evaluate to true for all
networks! None of the daemon-internal users of 'idOrName' set either
of those terms, therefore it has the same effect as if the filter did
not contain the 'idOrName' term in the first place.
Filtering networks by id-or-name is a quirky thing that the daemon needs
to do to uphold its end of the Engine API contract, not something that
would be of use to clients. Fixing up the idOrName filter would
necessitate adding it to the list of accepted terms so the filter passes
validaton, which would have the side effect of also making the filter
available to API clients. Instead, add an exported field to the Filter
struct so that daemon code can opt into the internal-only behaviour of
having the 'id' term match on either the network Name or ID.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Construct a network.Filter from the filters.Args only once per API
request so we don't waste cycles re-validating an already validated
filter. Since (*Daemon).NetworksPrune is implemented in terms of
(Cluster).GetNetworks, that method now accepts a network.Filter instead
of a filter.Args. Change the signature of (*Daemon).GetNetworks for
consistency as both of the GetNetworks methods are used by network API
route handlers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Internally a network is represented by either a libnetwork.Network or a
swarmapi.Network. The daemon functions backing the API server map
these values to the Engine API network.Inspect type on demand. Since
they have to convert, the functions to get a list of networks have to
loop over the slice of Networks and append them to a slice of
network.Inspect values.
The function used to filter the list of networks by a user-supplied
predicate takes a []network.Inspect and returns a shorter slice.
Therefore the daemon functions backing the API server have to loop
through the list twice: once to convert, and again inside the
FilterNetworks function to delete networks from the slice which do not
match the filter predicate. Each time an item is deleted from a slice,
all items at higher indices need to be copied to lower indices in the
backing array to close the hole.
Replace FilterNetworks with a function that accepts a single
interface-valued network and returns a boolean. Amend libnetwork.Network
and write a thin adapter for swarmapi.Network so both implement the
aforementioned interface. The daemon functions can thus filter networks
before projecting the values into API structs, and can completely skip
over non-matching networks, which cuts down on a nontrivial amount of
copying.
Split the validation of the filter predicate from filter evaluation to
both make it more ergonomic to use inside loops, and to make invalid
states (a filter with an ill-formed predicate) unrepresentable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
These consts are no longer used, and separate consts were added in both
the client and daemon packages;
- client: 41da5700a4
- daemon: a632b8495b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This includes 1 security fix:
- net/http: CrossOriginProtection bypass patterns are over-broad
When passing patterns to CrossOriginProtection.AddInsecureBypassPattern,
requests that would have redirected to those patterns (e.g. without a trailing
slash) were also exempted, which might be unexpected.
Thanks to Marco Gazerro for reporting this issue.
This is CVE-2025-47910 and Go issue https://go.dev/issue/75054.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.7
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change moves the `system.SecurityOpt` type and `system.DecodeSecurityOptions` function to the client and adds a set of unit tests to capture current implementation. This change also create a set of daemon backend copies for usage.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
The moby codebase is now able to handle containerd errdefs errors directly
so there's no need to wrap a c8d "NotFound" error. We still need to look
if we can remove this function altogether; it's unclear what conditions
could result in the string-matching being needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
newDriver, which creates a new instance of the bridge driver, is the
only place where the driver config field is set. So there's no need to
gate access to it with a mutex.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Libnetwork passes a map[string]any to the bridge driver's Register
function. This forces the daemon to convert its configuration into a
map, and the driver to convert that map back into a struct.
This is unnecessary complexity, and makes it harder to track down where
and how bridge driver configuration fields are set.
Refactor libnetwork to let the daemon register the bridge.Configuration
directly through a new option `OptionBridgeConfig`.
The bridge driver now takes a `Configuration` param that needs no
special treatment.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
makeDriverConfig is written in such a way that it seems to support
label-based driver configuration. That is, you could hypothetically use
labels starting with `com.docker.network.driver.<driver-name>.` to
define the configuration of a driver.
These labels come from the Controller's `cfg.Labels` which are set by
the daemon through libnet's OptionLabels which takes the list of labels
set on the daemon through dockerd's --label flag, or the equivalent
daemon.json field.
However, the daemon forbids setting labels that start with
`com.docker.*`. For instance:
label com.docker.network.driver.bridge.EnableProxy=false is not allowed: the namespaces com.docker.*, io.docker.*, and org.dockerproject.* are reserved for internal use
Hence, this is dead code — remove it.
Also, makeDriverConfig is checking if the Controller's cfg field is
nil... But the Controller struct is instantiated in a single place (i.e.
NewController) and it always set that field. Drop that nil check too.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Commit 0ca7ac325 was merged before a review comment was addressed.
Update the warning message returned by handlePortBindingsBC to handle
the case where multiple empty port bindings slices are sent to the API.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Not exactly sure what errors we can expect here if the process failed
to start, but logging as a warning instead of discarding won't do harm.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This argument is set from ExecConfig.ID, which we refer to as "execID"
in most places; rename the argument to match that terminology.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use a named output variable to more clearly indicate what error is being
checked, and scope `err` variables used in this function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit dbb47f63ab, which
added these rules to hide loopback devices from udisks. These rules
were for devicemapper, which we no longer support, and use hard-coded
paths, making them not practical for other purposes.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
So far, on ContainerStart, the daemon was silently backfilling empty
PortBindings slices with a PortBinding with unspecified HostIP and
HostPort. This was done by github.com/docker/go-connections/nat.SortPortMap.
This backfilling doesn't make much sense, and we're trying to remove
that package. So, move the backfilling to the API server, keep it for
older API versions, deprecate it for API 1.52, and drop it for API 1.53
and above.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This method is only used by the cnmallocator to allocate Swarm-scoped
network resources. Its only concrete implementation is in the ovmanager.
Other network drivers are implementing it too to adhere to the
driverapi.Driver interface, but they all return a 'not implemented'
error.
Extract this method into a separate interface, and add a dedicated
RegisterNetworkAllocator to the driver registry. Update the cnmallocator
to load 'network allocators' instead of 'drivers'.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The cnmallocator package has a map of supported network drivers which
are registered using a pkg-local driver registry. This registry is then
used to load drivers, and if they have a 'local' DataScope, they aren't
used for anything. Drivers with a 'global' DataScope are called to
allocate cluster-wide network resources.
Instantiating builtin network drivers may have unintended side-effects
(e.g. the bridge driver registers a callback that should run when
firewalld is reloaded), so libnetwork has dummy '*manager' drivers that
do nothing but carry the same Capability than the original driver they
masquerade.
Put 'local drivers' (e.g. those with DataScope 'local') into a separate
list that just contains drivers' name, and don't register them into the
cnmallocator's driver registry.
Remove all the dummy '*manager' drivers as they're not needed anymore.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This tests, when failing, only produced a non-informative "exit status 1",
which limits investigating why it failed.
This patch:
- Rewrites the parallel pushes to use an error-group, and asserts each
push to get the failure output of the command.
- Simplifies the Dockerfile that's used for building the test-image,
removing steps that were not needed for the test.
- Adds a cleanup step to make sure the images are deleted after the
test, or if the test fails (although the test-suite should already
handle this).
Before this, a failure looked like:
make BIND_DIR=. TEST_FILTER='TestConcurrentPush' test-integration-cli
=== FAIL: arm64.integration-cli TestDockerRegistrySuite/TestConcurrentPush (5.49s)
docker_cli_push_test.go:159: assertion failed: error is not nil: exit status 1: concurrent push failed with error: exit status 1
check_test.go:476: [dfa779e71fdf8] daemon is not started
--- FAIL: TestDockerRegistrySuite/TestConcurrentPush (5.49s)
With this patch applied:
make BIND_DIR=. TEST_FILTER='TestConcurrentPush' test-integration-cli
=== FAIL: arm64.integration-cli TestDockerRegistrySuite/TestConcurrentPush (2.47s)
docker_cli_push_test.go:156: assertion failed:
Command: /usr/local/cli-integration/docker push 127.0.0.1:5000/dockercli/busybox:push2nosuch
ExitCode: 1
Error: exit status 1
Stdout: The push refers to repository 127.0.0.1:5000/dockercli/busybox
Stderr: tag does not exist: 127.0.0.1:5000/dockercli/busybox:push2nosuch
Failures:
ExitCode was 1 expected 0
Expected no error
docker_cli_push_test.go:160: assertion failed: error is not nil: exit status 1
check_test.go:476: [db77ef03a8fd8] daemon is not started
--- FAIL: TestDockerRegistrySuite/TestConcurrentPush (2.47s)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When building a non-native platform, it's not unpacked by default.
History tries to read the disk usage of all the layer and it doesn't
handle missing snapshots gracefully.
This patch fixes this.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
BuildKit emits some additional events during build and they are not
`build.Result` so don't fail if we encounter one.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Use `winio.RunWithPrivileges` to get the privileges.
It's better because it also locks the Go runtime thread so if the Go
scheduler decides to run this code on a different thread, it will still
have the expected privileges.
A naive attempt at fixing an error experienced by Docker Desktop user
when using Windows containers:
```
failed to register layer: re-exec error: exit status 1: output: hcsshim::ProcessUtilityVMImage \\?\C:\ProgramData\Docker\windowsfilter\<hash1>\UtilityVM: Access is denied.
failed to register layer: re-exec error: exit status 1: output: hcsshim::ProcessBaseLayer \\?\C:\ProgramData\Docker\windowsfilter\<hash2>: Access is denied.
failed to register layer: re-exec error: exit status 1: output: hcsshim::ProcessBaseLayer \\?\C:\ProgramData\Docker\windowsfilter\<hash3>: Access is denied.
```
Unfortunately I can't reproduce the issue on a Windows VM, but this
definitely won't hurt.
At least, I verified that the daemon still works on Windows.
Inspired by: https://github.com/containerd/containerd/issues/8206
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a systemd service 'collect-firewalld-logs.service' that copies
firewalld log file into bundles/ on container shutdown. This won't
provide much value for developers who run `make shell`, but it'll be
useful on CI to include firewalld logs in the exported artifacts.
The CI is already configured to pick every *.log file from bundles/, so
no further change is needed on that side.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Refactor hack/generate-swagger-api.sh to be more friendly to automatic
merges by sorting names to generate alphabetically and by listing each
name to generate on its own line without backslash line continuations.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add methods to count the number of addresses in the set which have a
particular prefix. The returned counts are 128 bits wide to accommodate
sets containing more than 2**64 addresses.
Signed-off-by: Cory Snider <csnider@mirantis.com>
This struct is only used to report the networking state for the default
bridge network when the container is connected to it.
It was deprecated in v1.09 (API v1.21), and scheduled for removal in
v1.11. Unfortunately, the deprecation warning was wrongly formatted in
the Go code. However, deprecation warnings are already present in
swagger.yaml, so don't touch it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This change moves the logic that is used to marshal the legacy extra fields for `registry.ServiceConfig` type to the daemon backend.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Most fields in NetworkSettingsBase are deprecated, so deprecate the
whole struct. The few fields which aren't deprecated will move to the
NetworkSettings struct in v29.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This field provides little value as it's only set when the daemon is
started with --bridge flag specified, and the inspected container is
connected to the default bridge network.
Unfortunately, there's no equivalent field in NetworkSettings.Networks.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Change functional options for the client so that they operate on an
intermediate struct instead of the public `Client` instance directly.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Lima is used for running a VM of `template://oraclelinux-8`.
My initial attempt was to use almalinux-8, but some port forwarding tests
do not seem to work on almalinux-8.
https://lima-vm.io/docs/examples/gha/
Fix issue 49576
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
When generating the rules for an nftables chain, rather than collecting
rules into a slice and iterating over that, use an iterator.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Prior to commit b5bf89c31, all socket fds passed to the docker-proxy
were getting the O_NONBLOCK flag set. However, that commit added support
for SCTP socket-passing, and had to conditionally guard this behavior to
not use it on SCTP sockets due to ishidawataru/sctp not clearing the
flag.
A fix was made in ishidawataru/sctp (see [1]), so we can remove that
condition.
[1]: https://github.com/ishidawataru/sctp/commit/4b890084db30
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Add nftables.Modifier, to hold a queue of commands that can be applied
using Modifier.Apply. No updates are made to the underlying Table
until Apply is called, errors in the queue if commands are deferred
until Apply.
This has the advantages that:
- less error handling is needed in code that generates update commands
- it's transactional, without needing explicit transactions
Minor disadvantages are that it's slightly more difficult to debug updates,
as it's no longer possible to step through the call making an update to
the Table manipulation in a debugger - and errors in the command, and
errors like trying to update a nonexistent chain/set/vmap, deleting an
object that doesn't exist or creating a duplicate are not reported
until the updates are applied (but, the file/line where the rule was
added is reported).
Signed-off-by: Rob Murray <rob.murray@docker.com>
A few of the cluster methods contained open-coded copies of
lockedManagerAction. Refactor them to use lockedManagerAction and hoist
the parameter and result processing outside the critical sections.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Every Swarm Cluster API method takes a context parameter. The
lockedManagerAction helper function does not take a context parameter
itself, yet it passes a context parameter into the closure. Add a
context parameter to lockedManagerAction and derive the closure's
context from it to afford deriving the Cluster API method calls'
contexts from some non-background parent context.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Debian 13 ships iptables-nft v1.8.11 which returns a different error
than previous versions when doing `iptables -S` for a nonexistent chain.
Older versions:
ip6tables v1.8.9 (nf_tables): chain `<chain>' in table `filter' is incompatible, use 'nft' tool.
Newer versions:
ip6tables: No chain/target/match by that name.
Bisecting iptables-nft, this change was introduced by [1] which was
released in v1.8.10.
Pick the expected error message based on iptables-nft version.
[1]: https://git.netfilter.org/iptables/commit/?id=82ccfb488eeac5507471099b9b4e6d136cc06e3b
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When nftablesdoc tests dump the state of nftables, the argument '-y' /
'--numeric-priority' isn't used, so all priorities should be
stringified. However, there's a bug in older versions of nftables that
prevents the stringification of the 'dstnat' priority — it's currently
dumped as '-100'.
New versions fix that, and thus running these tests on Debian 13 fails
because of this discrepancy with golden files.
So, look for 'type nat hook output priority -100' and stringify the
priority to ensure compatibility across versions of nft.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Instead of setting up firewall rules directly in the routed port mapper,
we now rely on the bridge driver to handle firewall reconfiguration.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Since commit 4e246efcd, individual portmappers are responsible for
setting up firewall rules and proxying according to their needs.
This change moves the responsibility back to the bridge driver, removing
unnecessary code duplication across portmappers. For now, only the nat
portmapper takes advantage of this.
This partially reverts commit 4e246efcd.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Add two new fields to portmapperapi.PortBinding: NAT and Forwarding.
These can be used by portmappers to specify how they want their callers
(e.g. bridge driver) to reconfigure the host firewall to NAT a host
port, or allow forwarding to the container port.
If portmappers don't want to opt-in to these, they can implement their
own firewall rules, and not fill these fields.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When a endpoint's net.IPNet is loaded from store and converted
to a netip.Addr, unmap it so that iptables rules don't contain
IPv4-mapped IPv6 addresses.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The daemon started by the test-integration script needs to run without
firewalld integration to make sure that daemons started by networking
tests will handle firewalld reload without any interference (i.e.
without another daemon racing against them to recreate the iptables
chains).
Most tests are already running their own daemons, but the few that don't
and need firewalld integration are updated to start their own.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Now that the types are merged, we can also set the config in this
function while the container state is locked.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Merge the two types instead of embedding the ContainerJSONBase.
This should have no impact on the API response, but users constructing
a response through struct literals will need to update their code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove mention of `BIND_DIR` as it's no longer needed
- Update some links to files that were moved
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Adds a new configuration to specify a read timeout for acks. Fluentd can
be configured to expect acks from the server. In such scenarios, this
configuration enables clients to timeout the read operation if the
server or the connection is unresponsive. The default behavior of
waiting forever remains unchanged.
Signed-off-by: Anirudh Aithal <aithal@amazon.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The containerd errors and related containerd/errdefs should now
be interchangeable with moby/errdefs, so there's no longer a need
to convert these errors.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Email field was originally used to create a new Docker Hub account
through the `docker login` command. The `docker login` command could be
used both to log in to an existing account (providing only username and
password), or to create a new account (providing desired username and
password, and an e-mail address to use for the new account).
This functionality was confusing, because it was implemented when Docker
Hub was the only registry, but the same functionality could not be used
for other registries. This functionality was removed in Docker 1.11 (API
version 1.23) through [moby@aee260d], which also removed the Email field
([engine-api@9a9e468]) as it was no longer used.
However, this caused issues when using a new CLI connecting with an old
daemon, as the field would no longer be serialized, and the deprecation
may not yet be picked up by custom registries, so [engine-api@167efc7]
added the field back, deprecated it, and added an "omitempty". There
was no official "deprecated" format yet at the time, so let's make sure
the deprecation follows the proper format to make sure it gets noticed.
[moby@aee260d]: aee260d4eb
[engine-api@9a9e468]: 9a9e468f50
[engine-api@167efc7]: 167efc72bb
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previous commit changed the OSAllocator to listen after binding a port,
such that we're 100% sure that the port is free. We can now make the
OSAllocator responsible for retrying port allocations when it tries to
find an ephemeral port, or a free port in a range.
Move the retry logic from the 'nat' portmapper to the OSAllocator.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Move the listen syscall to the `OSAllocator` such that when
`RequestPortsInRange` returns, callers are guaranteed that the allocated
port isn't used by another process.
Bind and listen syscalls were previously split because listening before
inserting DNAT rules could cause connections to be accepted by the
kernel, so packets would never be forwarded to the container.
But, pulling them apart has an undesirable drawback: if another process
is racing against the Engine, and starts listening on the same port,
the conflict wouldn't be detected until OSAllocator's callers issue a
'listen' syscall. This means that callers need to implement their own
retry logic.
To overcome both drawbacks, set a cBPF socket filter on the socket
before it's bound, and let callers call `DetachSocketFilter` to remove
it. Now, callers are guaranteed that the port is free to use, and no
connections will be accepted prematurely.
For TCP / SCTP clients, this means that they'll send the first handshake
packet (e.g. SYN), but the kernel won't reply (e.g. SYN-ACK), and they
will retry until DNAT rules are configured or the socket filter is
removed.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Fix a bug causing containers not being loaded when storage driver wasn't
chosen explicitly.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When no explicit driver was specified, the containerd store by default
was also applied to existing graphdriver setups.
Fix this and add a test.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The JSONMessage struct contained fields that were previously used to produce the
`/events` response. However, commit 72f1881df1
introduced an events.Message type that replaced the use of JSONMessage for
that purpose, and clients no longer use the JSONMessage struct to unmarshal
those responses.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was added in 72f1881df1, which
introduced a dedicated `events.Message` struct for the events endpoints.
Before that change, events would produce a generic `JSONMessage`, and
the test is to verify that an `events.Message` could be successfully
unmarshalled to a `JSONMessage`.
The change above was part of docker 1.10 (API version 1.22), which we
no longer support, so we can remove this test.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This adds the "non-blocking" part of the TestEventsBackwardsCompatible
as a separate test, as it's not related to the backward-compatibility
part of that test.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can't add it to the templates, because those are not generated,
so adding it in the code that uses the templates, and prepend the
header before handling the template.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use a subdirectory for all files used in the test
- Add a .golden file-extension for easier discovery of generated files
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit 8013d80c2 updated the hack/test/unit script to ensure that tests
are run against the right module when TESTDIRS is specified. But there's
an issue with this commit: the script has `set -u` (i.e. 'nounset'), and
some variables are set conditionally, but checked unconditionally, so it
fails.
Fix it by defining those vars to empty strings.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Ensure events for containerd backend are properly sent when deleted via
image prune. Fix prune output to only show deleted images rather than
the deletion of each blob.
Signed-off-by: Derek McGowan <derek@mcg.dev>
This change copies the daemon/internal/timestamp package (previously api/types/time) to an internal client package and updates the client usage for GetTimestamp functionality.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
This change adds conditional logic to skip build and test jobs when a
pull request is labeled with 'ci/validate-only'.
The `govulncheck` job in the CI workflow is intentionally excluded from
this conditional logic, ensuring security vulnerability checks always
run regardless of the label.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Since 'api/' and 'client/' are separate Go modules, tests need to be run
separately in each module. Commit 900a0516d changed the hack/test/unit
script to account for that.
But since that commit, if that script is invoked with TESTDIRS set, it
will try every module instead of locating the one containing TESTDIRS.
When trying to run tests that are within one of the modules (`api`, `client`),
Go may find the test while listing (`go -C api list ./pkg/...`);
go -C api list ./pkg/...
github.com/moby/moby/api/pkg/progress
github.com/moby/moby/api/pkg/stdcopy
github.com/moby/moby/api/pkg/streamformatter
But when running tests from outside the module directory, it may use the
vendor directory, and find no tests to run;
go test -count 1 -run TestValidateRestartPolicy github.com/moby/moby/api/types/container
? github.com/moby/moby/api/types/container [no test files]
To fix this, there's two options; we can first change to the respective
module's directory so that `go test` is run from within the module's context;
go -C api test -count 1 -run TestValidateRestartPolicy github.com/moby/moby/api/types/container
ok github.com/moby/moby/api/types/container 0.003s
Or, to avoid having to change the directory, we can use `-mod=readonly` or
`-mod=mod`. From the Go documentation https://golang.org/ref/mod:
> - `-mod=mod` tells the go command to ignore the vendor directory and to
> automatically update `go.mod`, for example, when an imported package
> is not provided by any known module.
> - `-mod=readonly` tells the go command to ignore the vendor directory
> and to report an error if `go.mod` needs to be updated.
With that option set, the tests are run;
go test -mod=readonly -count 1 -run TestValidateRestartPolicy github.com/moby/moby/api/types/container
ok github.com/moby/moby/api/types/container 0.003s
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The PR validation workflow now enforces that every PR with an 'impact/*'
label must also have a corresponding 'kind/*' label, in addition to the
existing 'area/*' label requirement.
This change helps ensure proper categorization of pull requests by
requiring contributors to specify both the impact area and the kind of
change being made.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The environment variables set by legacy links are not particularly
useful because you need to know the name of the linked container to use
them, or you need to scan all enviornment variables to find them.
Legacy links are deprecated / marked "legacy" since a long time, and we
want to replace them with non-legacy links. This will help make the
default bridge work like custom networks.
For now, stop setting these environment variables inside of linking
containers by default, but provide an escape hatch to allow users who
still rely on these to re-enable them.
The integration-cli tests `TestExecEnvLinksHost` and `TestLinksEnvs` are
removed as they need to run against a daemon with legacy links env vars
enabled, and a new integration test`TestLegacyLinksEnvVars` is added to
fill the gap. Similarly, the docker-py test `test_create_with_links` is
skipped.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
We should generally keep dependency versions low, but let's
update this one to match the other modules, and to allow
taking advantage of some of the modern features of go-cmp.
full diff: https://github.com/google/go-cmp/compare/v0.5.9...v0.7.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The only references to blockLen type-assert the uint32 constant to other
widths. Make it an untyped int to cut down on unnecessary boilerplate.
Rewrite the genNumBlocks utility function to use the well-known
algorithm for rounding-up integer division instead of branching. Inline
it into the only call site.
Signed-off-by: Cory Snider <csnider@mirantis.com>
It better describes its purpose, and allows "Port" to be used for
other purposes (e.g. to replace "nat.Port").
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Co-authored-by: Austin Vazquez <austin.vazquez@docker.com>
This change ignores requested capabilities when a driver is explicitly
requested. This simplifies the logic for selecting a driver and means
that users need not spefify redundant capabilities.
With the exception of the catch-all "gpu" capability the remaining
capabilities are only relevant for the "nvidia" driver.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
The input is a string, and we're producing an error if those strings
are in the wrong format, so we may as well just use a map[string]bool
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Fix the compilation issue on aix, android and solaris due to wrong use of maxMapSize
- Add protection on meta page when it's being written
- Correct the incorrect usage of debug method
- Add clarification on the option InitialMmapSize
- Fix the crash when writing huge values
full diff: https://github.com/etcd-io/bbolt/compare/v1.4.0...v1.4.2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
ensureReaderClosed was designed to be usable regardless if a response
was nil (error) or non-nil (success). Some code-paths were optimized to
avoid using a defer (which used to have an overhead), but the overhead
of defer is neglectable in current versions of Go, and some of these
optimizations made the logic more complicated (and err-prone).
This patch switches to use a defer for all places.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Only use checkResponseErr if `client.doRequest` did not return an error;
any error returned by `client.doRequest` means there was an error connecting,
so there's no response to handle (including errors in the response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Outline that any error returned is a connectivity error and a nil-error
requires the response to be handled (including errors returned in the
response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Ping function first tries to do a HEAD request, but the parsePingResponse
was written with the assumption that a Body could be present in the response
that may include errors returned by the API server.
HEAD responses don't include a body, so there's no response to handle, and
no errors to return by the API, other than a HTTP status code.
This patch:
- Rewrites `parsePingResponse` to a `newPingResponse`, removing the error-
handling for the response-body. It's also simplified, because a non-nil
response is guaranteed to have a non-nil Header (but it may not have
any of the headers set that are used for the Ping).
- Rewrites the `Client.Ping` to only return a Ping-response from the HEAD
request if no error was returned (i.e., we connected with the API) and
a successful status-code, otherwise it will fallback to a GET request,
which allows (for non "OK" (200) status-codes) returning errors from
the daemon (for example, if the daemon is in an unhealthy state).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change restores the environment variable configuration of daemon storage driver through the DOCKER_DRIVER environment variable.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
It was implemented as a method on Client, but the receiver was not used;
make it a regular function to prevent passing around the Client where
not needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `TransporPort` type is comparable; it doesn't have fields that
require special handling. It's defined as;
// TransportPort represents a local Layer 4 endpoint
type TransportPort struct {
Proto Protocol
Port uint16
}
where `Protocol` is an int (with a stringer interface);
type Protocol uint8
So we can remove the `Equal` method, and simplify places where it's
compared.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `GetCopy()` function doesn't de-reference anything, as it's
all a straight copy. We can remove it as it's only making things
more complicated than needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Modernize using maps.Clone, slices.Clone. This method is needed to
satisfy the datastore.KVObject interface, so also assert it does.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The endpointJoinInfo.CopyTo function expected the caller to construct an
EndpointInterface to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error return
was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The EndpointInterface.CopyTo function expected the caller to construct an
EndpointInterface to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error return
was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Change `PortBinding.Equal` to use a value receiver and parameter, this
allows us to use it directly with `slices.IndexFunc`, `DeleteFunc`,
without having to add a wrapper func.
The only exception currently is the `UnmapPorts` function (stub), which
takes portmapperapi.PortBinding as argument; the portmapperapi.PortBinding
type embeds `types.PortBinding`, and it's the only field that's compared
as part of `UnmapPorts`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Rename `PortBinding.GetCopy()` to `PortBinding.Copy()`, which is more
idiomatic, and aligns with other similar methods.
- Change it to a non-pointer receiver; `Copy` does not mutate state, and
the type should still be reasonably small.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite both to use slices.Clone, and GetIPNetCanonical to not depend
on GetIPNetCopy. GetIPNetCopy only has a single consumer, so we should
consider moving it local to where it's used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The IpamInfo.CopyTo function expected the caller to construct an
IpamInfo to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error
return was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The IpamConf.CopyTo function expected the caller to construct an
IpamConf to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error
return was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
During the arm64 tests, the rootfs directory does not seem to exist when
this test is run and will cause a failure when using snapshotter.
Signed-off-by: Derek McGowan <derek@mcg.dev>
- Use slices.Clone where suitable.
- Handle `nil` values so that callers don't have to check for `nil`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- construct the `ports` copy before `networkSettings` so that it
can be used as part of the struct-literal. This copy was added
in 7917a36cc7 to prevent a race-
condition.
- `mountPoints` is not used until the very end, but (likely) still
needs to happen while we hold the lock, so move it before it's
released.
- add a comment referencing the reason to unlock early before the
size calculation, in case it become irrelevant in future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Repository has been archived, and we only use a single package, so we
could even consider forking. For now, let's at least update it to the
latest code, which added a go.mod.
full diff: 72a348e765...20d68f94ee
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add layer migration on startup
Use image size threshold rather than image count
Add daemon integration test
Add test for migrating to containerd snapshotters
Add vfs migration
Add tar export for containerd migration
Add containerd migration test with save and load
Signed-off-by: Derek McGowan <derek@mcg.dev>
For nftables only, never enable IP forwarding on the host. Instead,
return an error on network creation if forwarding is not enabled,
required by a bridge network, and --ip-forward=true.
If IPv4 forwarding is not enabled when the daemon is started with
nftables enabled and other config at defaults, the daemon will
exit when it tries to create the default bridge.
Otherwise, network creation will fail with an error if IPv4/IPv6
forwarding is not enabled when a network is created with IPv4/IPv6.
It's the user's responsibility to configure and secure their host
when they run Docker with nftables.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The userland proxy uses unconnected UDP sockets to receive packets from
anywhere, so enabling SO_REUSEADDR means that multiple sockets can bind
the same port. This defeats the purpose of the portallocator, which is
supposed to ensure that the port is free and not already in use (either
by us, or by another process). So, do not enable SO_REUSEADDR for UDP
sockets.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When creating development containers currently, `Makefile` doesn't use
the GIT_BRANCH variable to tag `docker-dev` image. But in some
documentation files for contributing, references remain for image tags
with the `git branch` name.
This commit simply removes those references. Correct image tag names are
important for newcomers, especially for copy-pasteable commands.
Related PR: 42652
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
Test was flaky because it was not waiting for an image load
operation to complete before proceeding to check if the load
succeeded. Fix this.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
The strslice.StrSlice type is a string-slice with a custom JSON Unmarshal
function to provide backward-compatibility with older API requests from
before docker 1.7 (see [moby@17d6f00] and [moby@ea4a067]), which used a
string instead of an array of strings for some fields (Cmd, Entrypoint).
We no longer support those API versions, and we no longer support pulling
v1 images that may contain such a config, so we can deprecate the type
and remove its use.
[moby@17d6f00]: 17d6f00ec2
[moby@ea4a067]: ea4a06740b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- deprecate sockets.GetProxyEnv, sockets.DialerFromEnvironment
- add support for unix sockets on Windows
- remove legacy CBC cipher suites from client config
- align client and server defaults to be the same.
- remove support for encrypted TLS private keys.
- nat: optimize ParsePortSpec
full diff: https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's 12 lines of code total; we may as well write it as part of building;
it looks to be the only place this is used, so we can remove the contrib
directory, which should not be used by anyone.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- always build the go binary, instead of trying to find if it exists
and then trying to copy it.
- write the Dockerfile ourselves, instead of trying to copy the one
from contrib.
- update the Dockerfile to be built "FROM scratch"; we don't need
busybox here.
- start the container with "PublishAllPorts: true", otherwise no
ports would be mapped.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Passing the Auth to the redirected location was fixed in curl 7.58:
https://curl.se/changes.html#7_58_0 so we no longer need the extra
handling and can just use `-L` to let curl handle redirects.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Correctly parse HTTP response that doesn't contain an HTTP version with a decimal place:
```
< HTTP/2 307
```
The previous version would only match strings like `HTTP/2.0 307`.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
If unmarshaling the peer record fails, there is no need to check if it's
a record for a local peer. Attempting to do so anyway will result in a
nil-dereference panic. Don't do that.
The Windows overlay driver has a typo: prevPeer is being checked twice
for whether it was a local-peer record. Check prevPeer once and newPeer
once each, as intended.
Signed-off-by: Cory Snider <csnider@mirantis.com>
- release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.0
- full diff: https://github.com/opencontainers/runc/compare/v1.2.6..v1.3.0
-----
This is the first release of the 1.3.z release branch of runc. It
contains a few minor fixes for issues found in 1.3.0-rc.2.
This is the first release of runc that will follow our new release and
support policy (see RELEASES.md for more details). This means that, as
of this release:
* As of this release, the runc 1.2.z release branch will now only
receive security and "significant" bugfixes.
* Users are encouraged to plan migrating to runc 1.3.0 as soon as
possible.
* Due to its particular situation, runc 1.1.z is officially no longer
supported and will no longer receive any updates (not even for
critical security issues). Users are urged (in the strongest possible
terms) to upgrade to a supported version of runc.
* Barring any future changes to our release policy, users should expect
a runc 1.4.0 release in late October 2025.
Fixed
* Removed pre-emptive "full access to cgroups" warning when calling
`runc pause` or `runc unpause` as an unprivileged user without
`--systemd-cgroups`. Now the warning is only emitted if an actual permission
error was encountered.
* Several fixes to our CI, mainly related to AlmaLinux and CRIU.
Changed
* In runc 1.2, we changed our mount behaviour to correctly handle clearing
flags. However, the error messages we returned did not provide as much
information to users about what clearing flags were conflicting with locked
mount flags. We now provide more diagnostic information if there is an error
when in the fallback path to handle locked mount flags.
* Upgrade our CI to use golangci-lint v2.0.
* `runc version` information is now filled in using `//go:embed` rather than
being set through `Makefile`. This allows `go install` or other non-`make`
builds to contain the correct version information. Note that
`make EXTRA_VERSION=...` still works.
* Remove `exclude` directives from our `go.mod` for broken `cilium/ebpf`
versions. `v0.17.3` resolved the issue we had, and `exclude` directives are
incompatible with `go install`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This includes the changes from c13266d2c0
in the versioned swagger, as those changes were made after the
v1.52 versioned document was created.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The github.com/docker/docker/reference package was moved to
github.com/moby/moby/v2/daemon/internal/refstore, so this
check no longer did anything (and no aliasing needed).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The buildSandboxPlatformOptions function was given a pointer to the
sboxOptions and modified it in-place.
Similarly, a pointer to the container was passed and `container.HostsPath`
and `container.ResolvConfPath` mutated. In cases where either of those
failed, we would return an error, but the container (and sboxOptions)
would already be modified.
This patch;
- updates the signature of buildSandboxPlatformOptions to return a fresh
slice of sandbox options, which can be appended to the sboxOptions by
the caller.
- uses intermediate variables for `hostsPath` and `resolvConfPath`, and
only mutates the container if both were obtained successfully.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove/rename named error-return
- remove redundant defer
- use "continue" to reduce nesting
- use structured logs
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Markdown subheading name was changed in `CONTRIBUTING.md` in the past,
so this commit fixes the link by changing it from `docker` to `moby`.
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
handleFirewalldReloadNw locks `d.mu` and then `d.configNetworks`.
However, the rest of the driver locks `d.configNetworks` first and then
`d.mu`.
This could result in deadlocks if `handleFirewalldReloadNw` is called
while the bridge driver is already holding `d.configNetworks` lock.
Other code paths were checked to ensure that they all follow the same
locking order.
This bug was introduced by commit a527e5a.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The bridge driver was embedding `sync.Mutex` which is unconventional and
makes it harder to analyze locks ordering.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Outline the purpose of the Stdin and Systemerr streams and how
they're used.
- Update docs for StdCopy function
- Touch-up error for unknown stream types
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
iota can be convenient for internal use for cases where the value
doesn't matter. It can be a footgun when using it to define public
values; it's easy to accidentally change values (e.g. by re-ordering
or adding a value), which may go undetected within our code because
both producer and consumer would be updated.
This patch updates these consts to have a concrete value, because it's
part of the API contract and must not be changed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Not perfect yet, but addressing some godoc "doc" links that needed
to be updated, and touching up some references.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allow overriding the go-swagger version to install.
With this patch:
docker build -q --call=outline --target=swagger .
TARGET: swagger
BUILD ARG VALUE DESCRIPTION
GO_VERSION 1.24.5
BASE_DEBIAN_DISTRO bookworm
GOLANG_IMAGE golang:1.24.5-bookworm
XX_VERSION 1.6.1
GO_SWAGGER_VERSION v0.32.3 specifies the version of the go-swagger binary to install.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This file was added in 962f347923, at which
time there already were doubts about it being useful. For Go, `gofmt`
already dictates formatting (and proper editors would integrat with
that). For other languages, most editors would already have a config,
and our CI validates formatting for various files.
Give that the file was never updated since it was added, it's fair
to say that it's unmaintained. Let's remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This script was added in 6860c101ad
to allow testing a custom daemon in Docker Desktop, but has not
been maintained since, and likely no longer functional, so let's
remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Dockerfile syntax is now maintained as part of BuildKit in the
https://github.com/moby/buildkit repository, but our contrib still
had syntax highlighting files for various editors;
- The TextMate (`.tmbundle`) syntax was last update 9 months ago
in c2029cb257, but this was a stale
pull request from 2018, so at least 7 Years behind on updates to
the syntax.
- The vim syntax is now integrated in upstream, and our copy was
remove 6 Years ago in 5511f45767.
- The Nano syntax was added 10 Years ago in 76bc44fb91,
and received an update 9 Years ago in 4cb71f8082,
and received no contributions since.
- The kate syntax was already unmaintained, and removed 9 Years ago
in a2f695d7fa.
I think it's fair to state that these are unmaintained and severely outdated.
I _do_ think it would be good to have maintained versions of such files,
as it can improve the experience for users. However, this would be more
suitable for the BuildKit project, and I'm not sure if the current copies
of these files are a good starting point (if needed, they can still be
obtained from git history).
This patch removes the files.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image spec was moved to the github.com/moby/docker-image-spec repository,
and 03a17a2887 removed the files from the
moby repository, but left markdown files in place to point people to
the new location.
As these files were now moved internally, they no longer serve that purpose,
so we can remove them.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a `RouteType` type, type the related consts, and update the
`JoinInfo.AddStaticRoute` signature in the interface.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These use the Linux-specific values as convention, so unfortunately,
the syscall package doesn't define consts for these on Windows, so
keeping our own definition (values are not really relevant here).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a type to help discovery, and update the signatures of
`ResolveName`, `Network.ResolveName`, and `Sandbox.ResolveName`
accordingly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The wire type of Plugin.Config.Interface.Types is an array of strings,
not of objects with three properties. We just so happen to have a Go
struct type to represent a plugin-interface-type value in memory with
all the fields parsed out for convenience, but that is not part of the
REST API contract documented by the Swager spec.U pdate the Swagger spec
to correctly document that the Types property is an array of strings in
the API, while still generating Go definitions that unmarshal into the
convenient struct type.
Move the definition and marshal/unmarshal methods for
PluginInterfaceType into a more appropriate location than api/types.
Rename the type to one that does not stutter or overload already
heavily overloaded terminology.
Modernize the parser and use property-based testing to assert that it
behaves the same as the old parser for all well-formed inputs.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Modernize the field and allow using it as-is in some places, or
convert it to a string (which won't produce an error down the line).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's now only used to back the `Service.ResolveAuthConfig` method, and
not used outside of the package currently.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `session` struct was just bundling a http.Client with a v1Endpoint.
It was never a long-lived service; every use initialized the session,
only to call the `searchRepositories` method on it.
Dismantle it, and make it a regular function that gets a http.Client and
a v1Endpoint passed as argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We want to get rid of the use of using "registry.IndexInfo". Make the
function un-exported to discourage additional use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The distributionRouter receiver was not used; make it a regular function
to make clear it doesn't require the router.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove redundant if/else
- Move vars closer to where used now that we don't have the if/else.
- Touch-up error-message to remove engine version and update doc link to DeprecatedSchema1ImageError.
- Touch-up TODOs and add reference to help trace back what's meant.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is a wrapper for the libnetwork/internal/resolvconf package,
which is a modernized, more performant rewrite of the original parsing
code.
The libnetwork/resolvconf package was still maintained because it was
used by BuildKit, but since [moby/buildkit@3d43066], BuildKit maintains
its own copy of the internal package.
The only remaining uses of this package was as part of some tests (which
would also benefit of using the internal pacakge's implementation directly),
and a _single_ use of `resolvconf.Path` in the daemon, which cannot use
the internal package currently because it's internal to libnetwork.
This patch:
- Removes all functions that were not used.
- Rewrites some tests in libnetwork to use the internal/resolvconf package
directly, instead of depending on the wrapper.
- Add TODOs to consider moving the "Path" function separate (which could
be in daemon/config if we consider it to be the default for the daemon's
resolvconf path configuration).
[moby/buildkit@3d43066]: 3d43066f2e
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was introduced in 1af76ef597
and based on the previous code in the daemon, which had platform-specific
handling for exec inspect in [setPlatformSpecificExecProcessConfig], which
was added in 5fa2e4d4f2 to account for
Windows not having "Privileged" and not setting the "User".
Given that "User" would be empty and "Privileged" not set, we may as well
combine both platforms, and just return the info we have.
[setPlatformSpecificExecProcessConfig]: 1af76ef597/daemon/exec_unix.go (L11-L21)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Looks like I accidentally added these 5 Years ago in
9f0b3f5609, and never
noticed.
Let's clean this up.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 3a447bc079.
Some daemon versions don't handle empty values well, which resulted in
an io.EOF error when sending an empty X-Registry-Auth during decoding
or unmarshaling.
We should investigate what code-paths are hit to trigger this, but
in the meantime, let's revert this patch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Staticcheck is suggesting to cast the type or to directly copy, but
doesn't account for nat.SortPortMap mutating the second argument, so
mutating the HostConfig.PortBindings. From the code, it looks like the
intent here was to prevent that (creating a deep copy), so let's keep
that.
daemon/container_operations.go:109:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
daemon/network.go:952:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to 494677f93f, which added
the aliases, but did not yet replace our own use of the nat types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to update code to not be attached to go-connections
directly (in future we may be able to move the types to be concrete
types).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was an adaptor around DisplayJSONMessagesStream for CLI-specific
primitives that was used in the CLI, but can be implemented by users
of this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The API still returns it for backward-compatibility (but probably
shouldn't), but we should no longer print it. This removes the
use of these fields for printing, but keeps them for streamformatter
to use.
- ErrorMessage was deprecated in 3043c26419
- ProgressMessage was deprecated in 597e0e69b4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package depends on jsonformatter.JSONProgress and jsonmessage.JSONMessage,
and it looks like it requires some of those for their stringer interface.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the type to the API, but embed it, so that we keep the
methods on the struct in this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can probably use [aec.EmptyBuilder] for managing the output, but
currently we're doing it all manually, so defining some consts for
the basics we use.
[aec.EmptyBuilder]: https://pkg.go.dev/github.com/morikuni/aec#EmptyBuilder
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's only used by the client to support API versions older than v1.22.
Make it an internal utility that doesn't depend on internal fields of
`filter.Args`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external users, and this package still has too many different
responsibilities, some of which may be available elsewhere, so moving it
internal so that we can decide to dismantle it further.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the stub implementation for non-Windows platforms, and remove the
os.FileMode argument, which is ignored on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior, making
it not a good candidate to carry in the module.
This moves it to the daemon as a non-exported `resolveSymlinkedDirectory`
utility, so that it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior (including
some potentially surprising behavior), making it not a good candidate to
carry in the module.
This moves it internal to the daemon as a non-exported utility, so that
it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that it's part of the daemon, we can use the internal
package again to help discovery of rootless-specific codepaths
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both locations checked an error from `filepath.Rel` in stdlib, which
would never return a `system.XattrError`, so this was just dead code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The logdriver package should be moved to another external repository for
building plugins. While transitioning, move to internal package using
the same structure.
Signed-off-by: Derek McGowan <derek@mcg.dev>
CONFIG_MEMCG_SWAP has been deprecated since kernel v5.8-rc1 (commit 2d1c498) and removed since kernel v6.1-rc1 (commit e55b9f9).
Since kernel v5.8-rc1, swap tracking has been an integral part of memory control. CONFIG_MEMCG_SWAP becomes invisible to user and simply means CONFIG_MEMCG && CONFIG_SWAP.
Disable the check for kernel v5.8+.
Signed-off-by: 纯真 <38834411+chunzhennn@users.noreply.github.com>
This package is used internally by the daemon, and was only used out
side of the daemon by pkg/plugins (for which we still need to look
where it should be kept).
Making it internal because it's trivial to implement if needed by
anyone. The only reason it's a package is to keep it central, and
to make it easier to discover where we have rootlesskit-specific
codepaths in our codebase.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stdcopy moved to github.com/moby/moby/api/stdcopy, and the 28.4
transitional releasee will provide an alias for those that use
github.com/docker/docker as dependency, so we can remove the alias
for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stringid moved to github.com/moby/moby/client/pkg/stringid, and
the 28.4 transitional releasee will provide an alias for those that
use github.com/docker/docker as dependency, so we can remove the
alias for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is used by the daemon to produce a stack-dump, It has no
external consumers, so we can move it to daemon/internal.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The runconfig package is used by the "container" router to unmarshal, normalize,
and validate a container.CreateRequest. The router converts the result to a
backend.ContainerCreateConfig to be passed on to the backend (daemon).
This package could possibly be part of the router itself, or moved to an
internal package in the server, but we don't have an internal package
there yet.
Put it in daemon/internal for now, which still leaves our options open.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that we no longer need the ContainerDecoder interface, we can
simplify this to just a function; effectively the ContainerDecoder
had three tasks;
- decode a container.CreateRequest
- validate the hostConfig
- split the container.CreateRequest to Config, HostConfig, and NetworkingConfig
Rewrite this to a DecodeCreateRequest function that returns
a DecodeCreateRequest.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These types used to be internal to the container package, but were
moved to the API in 100102108b.
However, the `StateStatus` type is only used internally; it's used
as an intermediate type because [`container.State`] contains a sync.Mutex
field which would make copying it unsafe (see [moby@2998945]).
This moves the type and re-introduces an internal type
in the original location, effectively reverting
100102108b
[`container.State`]: 19e79906cb/container/state.go (L15-L23)
[moby@2998945]: 2998945a54
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These errors were not used as sentinel error, and used as any other
"invalid parameter" / "invalid argument" error, so remove them, and
just produce errors where used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since 28.0.0, an iptables rule related to SCTP has only been
included if escape hatch variable DOCKER_IPTABLES_SCTP_CHECKSUM=1
Nobody's reported that the escape hatch was needed, and the rule
it guards doesn't make sense. So, remove.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The "backend" types in API were designed to decouple the API server
implementation from the daemon, or other parts of the code that
back the API server. This would allow the daemon to evolve (e.g.
functionality moved to different subsystems) without that impacting
the API server's implementation.
Now that the API server is no longer part of the API package (module),
there is no benefit to having it in the API module. The API server
may evolve (and require changes in the backend), which has no direct
relation with the API module (types, responses); the backend definition
is, however, coupled to the API server implementation.
It's worth noting that, while "technically" possible to use the API
server package, and implement an alternative backend implementation,
this has never been a prime objective. The backend definition was
never considered "stable", and we don't expect external users to
(attempt) to use it as such.
This patch moves the backend types to the daemon/server package,
so that they can evolve with the daemon and API server implementation
without that impacting the API module (which we intend to be stable,
following SemVer).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The postCommit used the container-decoder from runconfig to unmarshal
the body. However, this function was written to decode a container
CreateRequest. Commit only accepts a container Config, so we can
just unmarshal to that type.
A local `commitRequest` type was added because the client posts a bare
`*container.Config` but it may be empty / nil (see [Client.ContainerCommit]
and [container.CommitOptions]), in which case it must be ignored, and no
overrides to be applied.
[Client.ContainerCommit]: c4afa77157/client/container_commit.go (L52)
[container.CommitOptions]: c4afa77157/api/types/container/options.go (L30)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some of these tests were making assumptions about the daemon's internals
by using `config.DefaultShmSize` from the daemon config package.
Rewrite them to start a daemon with a custom default, and verify the
tests to use that default.
This migrates the following tests from integration-cli to integration;
- `DockerAPISuite.TestPostContainersCreateShmSizeNegative`
- `DockerAPISuite.TestPostContainersCreateShmSizeHostConfigOmitted`
- `DockerAPISuite.TestPostContainersCreateShmSizeOmitted`
- `DockerAPISuite.TestPostContainersCreateWithShmSize`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The replacement is also deprecated, but at least returns a strong type,
which may help transitioning to using an api-client for these, and
removing one abstraction at a time.
Also rewriting the TestContainerAPIDeleteRemoveVolume to use the API
client (as it's part of the API suite), and touched-up the
TestRunMountShmMqueueFromHost test a bit.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was a very shallow wrapper around reading the response
headers, and querying those directly is more transparent.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It took me some time to find these commands because they were not named
after their canonical name, unlike (most) other commands.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that the types for the backend were moved to api/types/backend,
we can move the actual response-type and related options to
api/types/system.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While it is imported by both the client and the daemon, values of the
PluginCreateOptions struct are not marshaled or unmarshaled. The only
field is mapped to and from an HTTP query parameter. Furthermore, this
options type is the odd one out: the daemon uses types in
api/types/backend to pass options around for the other plugin lifecycle
operations. Move the PluginCreateOptions type into client, and define a
new PluginCreateConfig struct in api/types/backend for the daemon to use
alongside PluginRmConfig, PluginEnableConfig and PluginDisableConfig.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stringid package is used in many places; while it's trivial
to implement a similar utility, let's just provide it as a utility
package in the client, removing the daemon-specific logic.
For integration tests, I opted to use the implementation in the
client, as those should not ideally not make assumptions about
the daemon implementation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Because:
- it's the last thing outside 'daemon/' that uses libnetwork's
resolvconf package
- there's better coverage of the host resolv.conf transformations
in the resolvconf package's unit tests
- there are integration tests that don't modify the test host's
resolv.conf file in 'integration/networking/resolvconf_test.go'
Signed-off-by: Rob Murray <rob.murray@docker.com>
It's not really a helper, and it's trivial to inline it;
registry/registry_test.go:366:19: test helper function should start from t.Helper() (thelper)
testIndexInfo := func(t *testing.T, config *serviceConfig, expectedIndexInfos map[string]*registry.IndexInfo) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/auth.go:43:31: import-shadowing: The name 'auth' shadows an import name (revive)
func NewStaticCredentialStore(auth *registry.AuthConfig) auth.CredentialStore {
^
registry/auth.go:63:7: unused-receiver: method receiver 'scs' is not referenced in method's body, consider removing or renaming it as _ (revive)
func (scs staticCredentialStore) SetRefreshToken(*url.URL, string, string) {
^
registry/auth.go:143:40: import-shadowing: The name 'transport' shadows an import name (revive)
func PingV2Registry(endpoint *url.URL, transport http.RoundTripper) (challenge.Manager, error) {
^
registry/registry_mock_test.go:85:22: response body must be closed (bodyclose)
res, err := http.Get(makeURL("/v1/_ping"))
^
registry/search_session.go:222:96: integer-format: fmt.Sprintf can be replaced with faster strconv.Itoa (perfsprint)
u := r.indexEndpoint.String() + "search?q=" + url.QueryEscape(term) + "&n=" + url.QueryEscape(fmt.Sprintf("%d", limit))
^
registry/auth.go:134:24: import-shadowing: The name 'url' shadows an import name (revive)
func ConvertToHostname(url string) string {
^
registry/search_endpoint_v1.go:61: line-length-limit: line is 437 characters, out of limit 200 (revive)
return nil, invalidParamf("invalid registry endpoint %s: %v. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry %s` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/%s/ca.crt", endpoint, err, endpoint.URL.Host, endpoint.URL.Host)
registry/search_endpoint_v1.go:166:17: import-shadowing: The name 'transport' shadows an import name (revive)
func httpClient(transport http.RoundTripper) *http.Client {
^
registry/search_session.go:239:26: ST1005: error strings should not be capitalized (staticcheck)
return nil, errUnknown{fmt.Errorf("Unexpected status code %d", res.StatusCode)}
^
registry/search_test.go:18:6: test helper function should start from t.Helper() (thelper)
func spawnTestRegistrySession(t *testing.T) *session {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/errors.go:11:2: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e := err.(type) {
^
registry/errors.go:13:3: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2 := e.Err.(type) {
^
registry/errors.go:15:4: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2.Code {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/config.go:267:46: captLocal: `URLHost' should not be capitalized (gocritic)
func isCIDRMatch(cidrs []*registry.NetIPNet, URLHost string) bool {
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 5f91c769f5, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 08654b0b30, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bf6d52bba1, but don't
think it was ever used; at least it's severely outdated, so let's
remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- refactor programIngressPorts to use Rule.Insert/Append/Delete for improved rule management
- split programIngress() and dependent functions on Add and Del functions
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
- Extract plumpIngressProxy steps in a separate function
- Don't create a new listener if there's already one in ingressProxyTbl
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
Make sure iptables rules are restored properly once firewalld
has deleted them.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
This type was deprecated in ca06b222e3,
and is no longer used. Now that the API is in a new module, we can
remove the alias.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to fcc8209e12, which didn't
make the window for API v1.51, so had to be adjusted for the API
version it requires.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The strslice.StrSlice type is a string-slice with a custom JSON Unmarshal
function to provide backward-compatibility with older API requests from
before docker 1.7 (see [moby@17d6f00] and [moby@ea4a067]), which used a
string instead of an array of strings for some fields (Cmd, Entrypoint).
We no longer support those API versions, and we no longer support pulling
v1 images that may contain such a config, so we can remove these tests that
validate the behavior as they're invalid API requests.
This;
- removes DockerAPISuite.TestPostContainerAPICreateWithStringOrSliceEntrypoint
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCmd
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCapAddDrop
- updates DockerAPISuite.TestContainerAPIPostCreateNull, which used an invalid example
[moby@17d6f00]: 17d6f00ec2
[moby@ea4a067]: ea4a06740b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This interface was marked deprecated in 2997c0ddc0.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in 639a1214fa.
Now that the client is in a new module, we can remove the old.
This;
- Removes the `Client.ImageInspectWithRaw` implementation.
- Removes `ImageAPIClient.ImageInspectWithRaw` from the `ImageAPIClient` interface.
- Removes `APIClient.ImageInspectWithRaw` from the `APIClient` interface.
- Removes `ImageAPIClientDeprecated.ImageInspectWithRaw` from the `ImageAPIClientDeprecated`.
- Removes the `ImageAPIClientDeprecated` interface.
Note that the `ImageAPIClientDeprecated` interface itself was not marked
as deprecated, but it has no known external users, and it has no remaining
definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was marked deprecated in 7aa7369f1f,
and is no longer used.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was only used internally, and marked deprecated in
846b2272e6.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `NewClient` and `NewEnvClient` function were deprecated in 2018
through 772edd020c, with the deprecation
message updated in a68ae4a2d9 and
6b9968e8b1 to make sure it's properly
identified as deprecated.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 20d594fb79, but was
written before the API module was added. Now that the API is a separate
module, the check will no longer flag packages importing the API.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Merge the matchAllWithPreference matcher into the matchAnyWithPreference
matcher to reduce code duplication and simplify the code.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Currently the image export and load APIs can be used to export or load all
platforms for the image, or a single specified platform.
This commit updates the API so that it accepts a list of platforms to export or
load, thereby giving clients the ability to export only selected platforms of an
image into a tar file, or load selected platforms from a tar file.
Unit and integration tests were updated accordingly.
As this requires a daemon API change, the API version was bumped.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Before this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
error during connect: Get "http://example.invalid:2375/docker/v1.51/version": dial tcp: lookup example.invalid: no such host
With this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
failed to connect to the docker API at tcp://example.invalid:2375/docker: lookup example.invalid: no such host
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this change, a generic "Cannot connect to the docker daemon" error
was produced which, while helpful, instructed the user to check if the daemon
was running, but didn't provide context on the reason we failed (i.e., the
socket was not found).
This patch adds a dedicated check for cases where the socket was not found,
and preserves the original error.
Before this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
Cannot connect to the Docker daemon at unix:///var/run/no.sock. Is the docker daemon running?
With this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
failed to connect to the docker API at unix:///var/run/no.sock; check if the path is correct and the daemon is running: dial unix /var/run/no.sock: connect: no such file or directory
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, we were using os.IsPermission, which doesn't unwrap errors;
change to use `errors.Is` to detect permission errors, and unwrap the
error to remove information about the request, which is irrelevant if
we weren't able to connect in the first place.
Also tweak the error slightly to not assume "docker socket", instead
mentioning "docker API".
Before this;
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version": dial unix /var/run/docker.sock: connect: permission denied
With this patch applied:
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock: dial unix /var/run/docker.sock: connect: permission denied
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Packets with the given firewall mark are accepted by the bridge
driver's filter-FORWARD rules.
The value can either be an integer mark, or it can include a
mask in the format "<mark>/<mask>".
Signed-off-by: Rob Murray <rob.murray@docker.com>
While the container package had a type for `ExecInspect`, this type only
contained the information currently used by the client, which was a subset
of the information returned by the API endpoint;
curl --unix-socket /var/run/docker.sock http://localhost/v1.51/exec/2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9/json | jq .
{
"ID": "2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9",
"Running": true,
"ExitCode": null,
"ProcessConfig": {
"tty": true,
"entrypoint": "bash",
"arguments": [],
"privileged": false
},
"OpenStdin": true,
"OpenStderr": true,
"OpenStdout": true,
"CanRemove": false,
"ContainerID": "8b7cd6b151613ccc20ebe9fc24d72cc7865b04c592848ab1415a80da9b315479",
"DetachKeys": "EBE=",
"Pid": 19964
}
The API documentation for the endpoint documented the full response, but
we did not have a type for this, other than a type used by the backend.
This patch adds a type for the response. It currently aliases the backend
type to this type to preserve backward compatibility (and allow the API
module to be used in older branches). We can probably switch the backend
to use this type directly though (unless we want the backend to be
decoupled from the API response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When an endpoint in a gateway mode "nat" network is selected
as a container's default gateway, the bridge driver sets up
bindings between host and container ports (NAT, userland proxy
etc).
When gateway mode "routed" was added as an alternative to
the default "nat" mode - port bindings followed the same rules.
But, unlike "nat" mode, there's no host port binding to set
up - there's routing between remote client and the container,
so it doesn't matter what the default gateway is.
So, in "routed" mode, set up the rules to make a container's
published ports accessible when the endpoint is added, and
remove those rules when the endpoint is removed (when the
container is disconnected from the endpoint's network).
Port mappings are only provided by ProgramExternalConnectivity,
they can't be set up during the Join. So, include routed
bindings in the port bindings mode that's stored as part of
endpoint state - and use that to work out whether to add or
remove bindings.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The libnetwork controller naively handled events for endpoint_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, adding a new
service binding without removing the old one. This would
have various side effects, such as having the "transient state" of
having multiple conflicting service bindings where more than one
endpoint is assigned an IP address never settling.
Modify the libnetwork controller to handle an UPDATE by removing the
previous service binding then adding the new one.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The overlay driver naively handled events for overlay_peer_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, inserting a new
entry into peerDB without removing the old one. This would
have various side effects, such as having the "transient state" of
multiple entries in peerDB with the same peer IP never settle.
Update driverapi to pass both the previous and new value of a table
entry into the driver. Modify the overlay driver to handle an UPDATE by
removing the previous peer entry from peerDB then adding the new one.
Modify the Windows overlay driver to match.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Windows and Linux overlay driver instances are interoperable, working
from the same NetworkDB table for peer discovery. As both drivers
produce and consume serialized data through the table, they both need to
have a shared understanding of the shape and semantics of that data.
The Windows overlay driver contains a duplicate copy of the protobuf
definitions used for marshaling and unmarshaling the NetworkDB peer
entries for dubious reasons. It gives us the flexibility to have the
definitions diverge, which is only really useful for shooting ourselves
in the foot.
Make daemon/libnetwork/drivers/overlay the source of truth for the peer
record definitions and the name of the NetworkDB table for distributing
peer records.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The macAddr and ipmac types are generally useful within libnetwork. Move
them to a dedicated package and overhaul the API to be more like that of
the net/netip package.
Update the overlay driver to utilize these types, adapting to the new
API.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Overlay is the only driver which makes use of the EventNotify facility,
yet all other driver implementations are forced to provide a stub
implementation. Move the EventNotify and DecodeTableEntry methods into a
new optional TableWatcher interface and remove the stubs from all the
other drivers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When handling updates to existing entries, it is often necessary to know
what the previous value was. NetworkDB knows the previous and new values
when it broadcasts an update event for an entry. Include both values in
the update event so the watchers do not have to do their own parallel
bookkeeping.
Unify the event types under WatchEvent as representing the operation kind
in the type system has been inconvenient, not useful. The operation is
now implied by the nilness of the Value and Prev event fields.
Signed-off-by: Cory Snider <csnider@mirantis.com>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The bridge driver currently determines if hairpin mode is enabled by
checking whether the userland proxy is enabled, and if the binary path
is set to a non-empty string. It's used (amongst other things) by the
driver to decide whether 6-to-4 portmappings are supported, while it
normalizes port bindings.
As the userland proxy is going to be handled by the nat portmapper,
proxy-related params will be removed from the bridge driver, but the
port binding normalization will stay in the bridge driver.
So, introduce a new Hairpin config flag, and reimplement the original
logic in the daemon, when creating the bridge config.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The two unexported fields of portBindingReq (ChildHostIP and DisableNAT)
are temporarily exported. DisableNAT will be replaced in a future commit
by a 'Mapper' field indicating which portmapper should be used (e.g.
'nat' or 'routed').
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This code has various other issue, for which TODOs were added; this
commit only does some initial cleaning up, and improves docs and
test-coverage.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stdcopy package is used to produce and read multiplexed streams for
"attach" and "logs". It is used both by the API server (to produce), and
the client (to read / de-multiplex).
Move it to the api package, so that it can be included in the api module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests don't account well for submodules and are not needed when
importers are using go modules. The tests are still relevant in the 28
branch which does not use go modules.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The ContainerConfigWrapper type was deprecated and removed; refer
to the correct type (container.CreateCreateRequest).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bb899c654a,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `RequestPrivilegeFunc` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in b99b5422b0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `IDResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 1abc8f6158,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `ContainerJSONBase`, `ContainerJSON` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 05b0e653dd,
which shipped in the latest v28.x releases, so we can remove these.
This removes the Container type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 84ffc644ef,
which shipped in the latest v28.x releases, so we can remove these.
This removes the ContainerState type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in df22a511cb,
which shipped in the latest v28.x releases, so we can remove these.
This removes the NetworkSettings, NetworkSettingsBase, DefaultNetworkSettings,
and SummaryNetworkSettings types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in c130ce1f5d,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `Health` and `HealthcheckResult` types to the container package,
as well as the related `NoHealthcheck`, `Starting`, `Healthy`, and `Unhealthy`
consts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5517322cf9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.MountPoint`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in e12b7493b9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.Port`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in da039ca918,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.GraphDriverData`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 7053007f71,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ImageInspect` and
`RootFS`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 23117afca8,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.SecretCreateResponse` and
`SecretListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in a411a39be0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ConfigCreateResponse` and
`ConfigListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in f008d85edc,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.NodeListOptions` and
`NodeRemoveOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5ad0867236,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.TaskListOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 31d62930f7,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ServiceCreateOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 0b1c7a8306,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ServiceUpdateOptions`
- `RegistryAuthFromSpec`
- `RegistryAuthFromPreviousSpec`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in b13528522a,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.ServiceListOptions` and
`api/types.ServiceInspectOptions` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in 7e8f630bec,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.SwarmUnlockKeyResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in eefe68a37c,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `BuildCache`
- `BuildCachePruneOptions`
- `BuildCachePruneReport`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in bb7dbaafcd,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.BuildResult` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 3d1e4d9002,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ImageBuildOptions`
- `ImageBuildOutput`
- `ImageBuildResponse`
- `BuilderVersion`
- `BuilderV1`
- `BuilderBuildKit`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to maintain GoDoc in a single place, and for
"Kill" and "Alive" to have consistent error-handling (Windows
does not support negative process-IDs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Originally I've found this datarace on a project I'm working at. I'm not
able to consistently reproduce this. But by looking at the codebase I
took a chance to fix other 2 possible function that might produce such
data race.
Original stack trace produced when running `go test -race` on GH CI:
```
WARNING: DATA RACE
Write at 0x00c0005dc688 by goroutine 43:
github.com/docker/docker/client.(*Client).negotiateAPIVersionPing()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:389 +0x12f
github.com/docker/docker/client.(*Client).checkVersion()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:298 +0x249
github.com/docker/docker/client.(*Client).getAPIPath()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:307 +0x76
github.com/docker/docker/client.(*Client).sendRequest()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:111 +0x9b
github.com/docker/docker/client.(*Client).get()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:28 +0x736
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:47 +0x6f0
Previous read at 0x00c0005dc688 by goroutine 42:
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:39 +0x5ef
```
Co-authored-by: Luca Rinaldi <lucarin@protonmail.com>
Signed-off-by: Alessio Perugini <alessio@perugini.xyz>
- Get dependent containers before starting containers
- Dependent containers can be either from legacy link or container network
- Wait on a best effort basis for the dependent containers
Fixes: #50326
Signed-off-by: Adrien Pompée <adrien.pompee@atmosphere.aero>
This const is no longer used and will be removed in the next release.
Also fixed a var that shadowed a type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the daemon and API migrating to separate modules, users of the daemon
module may upgrade the API module to higher versions. Currently, the daemon
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Daemon
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the daemon/config package that is
used as default version of the API for the daemon to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
#27 94.97 executor/oci/internal/resolvconf/resolvconf.go:461:6: the error type name `systemErr` should conform to the `xxxError` format (errname)
#27 94.97 type systemErr struct{ error }
#27 94.97 ^
Also fix an unhandled error; we don't need a defer() for that one
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite this function to not use text/template, which is ~74× faster,
~25× less memory, and ~56× fewer allocations.
Before/After:
BenchmarkGenerate-10 42550 27439 ns/op 18083 B/op 394 allocs/op
BenchmarkGenerate-10 3148328 373 ns/op 712 B/op 7 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the client and API migrating to separate modules, users of the Client
module may upgrade the API module to higher versions. Currently, the Client
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Client
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the client package that is
used as default version of the API for the client to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image load is only used by integration tests but the specialimage
testutils package used by many different tests. The image load relies on
the client which creates a transitive client dependency from the daemon
packages.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Currently, EncodeAuthConfig always returns a base64url-encoded JSON
doc, even if an empty auth-config passed. As a result, it's more
complicated to detect if authentication was present.
This patch changes the behavior to return an empty string for these
cases so that teh client can skip setting the `X-Registry-Auth` header,
and the daemon can detect whether authentication is sent or not.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the special condition needed to run Windows integration tests
with the containerd integration enabled in addition to the graphdriver.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The property test for the mRandomNodes function revealed that it may
sometimes pick out a sample of fewer than m nodes even when the number
of nodes to pick from (excluding the local node) is >= m. Rewrite it
using a random shuffle or permutation so that it always picks a
uniformly-distributed sample of the requested size whenever the
population is large enough.
Signed-off-by: Cory Snider <csnider@mirantis.com>
TestNetworkDBAlwaysConverges will occasionally find a failure where one
entry is missing on one node even after waiting a full five minutes. One
possible explanation is that the selection of nodes to gossip with is
biased in some way. Test that the mRandomNodes function picks a
uniformly distributed sample of node IDs of sufficient length.
The new test reveals that mRandomNodes may sometimes pick out a sample
of fewer than m nodes even when the number of nodes to pick from
(excluding the local node) is >= m. Put the test behind an xfail tag so
it is opt-in to run, without interfering with CI or bisecting.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a property-based test which asserts that a cluster of NetworkDB
nodes always eventually converges to a consistent state. As this test
takes a long time to run it is build-tagged to be excluded from CI.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Integration tests should not be using daemon internals. Since this is
testing against regression and the relevant code has a feature freeze on
it, this test can be removed. The test is not relevant with containerd,
which has more protection against these cases through gc.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Before ea29dffaa5, the image create endpoint
had a [fallback for very old client versions][1] that would send authentication
as body instead of through the `X-Registry-Auth` header.
However, the implementation of this fallback did not handle empty bodies,
resulting in an `io.EOF` error to be returned when trying to parse the
body as JSON.
In practice, this problem didn't happen when using the CLI, because even
if no authentication was present, `registry.EncodeAuthConfig()` (used by
the CLI to set the `X-Registry-Auth` header) would produce an empty JSON
document (`{}`), which would be encoded in base64 (`e30=`), so we would
never set an empty `X-Registry-Auth` (but other clients may have hit this
situation). That behavior was unexpected, because not all registries require
authentication, and omitting the `X-Registry-Auth` should be valid. We
also want to have more flexibility in authentication (and being able to
distinguish unauthenticated requests, so that we can fallback to
alternative paths).
Unfortunately, we can't change existing daemons, so must account for the
faulty fallback. Currently, omitting the `X-Registry-Auth` produces an
error, but we can avoid this by unconditionally sending a body, which
may be an empty JSON document (`{}`).
I explored possible options for this; we can either construct our own
empty JSON (`json.RawMessage("{}")`) to be explicit that we're sending
empty JSON, but [`encodeBody()`][2] is currently hard-coded to expect
JSON requests, and unconditionally calls [`encodeData`][3], which
encodes to JSON, so we may as well take advantage of `http.NoBody`,
which gets marshaled to an empty JSON document;
https://go.dev/play/p/QCw9dJ6LGQu
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
body, _ := json.Marshal(http.NoBody)
fmt.Println(string(body))
}
Before this patch, a client omitting `X-Registry-Auth` (and no body)
would produce an error;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
Error response from daemon: bad parameters and missing X-Registry-Auth: invalid X-Registry-Auth header: EOF
With this patch applied, no error is produced;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
The push refers to repository [127.0.0.1:5001/myimage]
189fdd150837: Pushed
latest: digest: sha256:68a0d55a75c935e1101d16ded1c748babb7f96a9af43f7533ba83b87e2508b82 size: 610
[1]: 63fcf7d858/api/types/registry/authconfig_test.go (L109-L114)
[2]: 63fcf7d858/client/request.go (L67-L87)
[3]: 63fcf7d858/client/request.go (L296-L304)
[4]: ea29dffaa5
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This new struct allocates ports from the operating system by creating
sockets and binding them. It's based on the existing bindTCPOrUDP and
bindSCTP functions previously defined in the bridge driver. It tries to
detect conflicts on best effort basis, and doesn't guarantee that the
ports it allocates are not in use by other processes.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Use doc-links for references to other types.
- Fix reference to "types.HijackedConnection", which doesn't exist.
- Use a bullet-list for the different stream formats used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The registry package is used in docker/cli, and currently depends on
pkg/homedir. This package was anly used when running with rootlesskit,
which only is supported on Linux; on other platforms, homedir.GetConfigHome
would return an error;
abba330bbf/pkg/homedir/homedir_others.go (L24-L27)
Replace homedir.GetConfigHome with os.UserConfigDir from stdlib, which
is similar, with exception of not falling back to `getent` for
resolving the user's homedir, which would be a corner-case.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The previous implementation generated layer names based on container ID
and source image, which would cause conflicts when mounting the same
image to multiple destinations within a container.
This fixes the issue by changing the layer naming strategy to include
the destination path in the layer name, making it unique for each mount
point.
To avoid filesystem paths producing unexpected names, the combined
string is hex-encoded and used as a layer name.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change changes the default for noOverwriteDirNonDir to be true
internally, with the intent to change the default at the API to follow
accordingly.
The `AllowOverwriteDirWithFile` option in the Client was added when
reimplementing the CLI using the API Client lib in [moby@1b2b91b].
Before that refactor, the `noOverwriteDirNonDir` query argument
[would be set unconditionally][1] by the CLI, with no options to
control the behavior.
The `noOverwriteDirNonDir` query parameter was added in [moby@db9cc91] to
set the `NoOverwriteDirNonDir` option that was implemented in pkg/archive
in [moby@a74799b].
It was added in [PR13171-comment2], following a discussion on the risk
of replacing a directory with a file and vice-versa in [PR13171-comment].
> In my latest changes from yesterday:
>
> - Removed the `GET stat-path` endpoint and added a `HEAD` handler to
> the `archive-path` endpoint. Updated the api docs to reflect this.
> Also moved api docs changes from `v1.19` to `v1.20`.
> - Added a `NoOverwriteDirNonDir` flag to `archive.TarOptions` to indicate
> that we do not want to overwrite a directory with a non-directory (and
> vice versa) when unpacking an archive.
> - Added a corresponding but optional `noOverwriteDirNonDir` parameter
> to the `PUT extract-to-dir` endpoint to specify desired behavior.
>
> These changes combine to keep the behavior we want
It's unclear why these were added as an *option* and why it was implemented
as opt-in (not opt-out), as overwriting a file with a directory (or vice-versa)
would generally be unexpected behavior.
[1]: 8c9ad7b818/api/client/cp.go (L345-L346)
[moby@1b2b91b]: 1b2b91ba43
[moby@a74799b]: a74799b701
[moby@db9cc91]: db9cc91a9e
[PR13171-comment]: https://github.com/moby/moby/pull/13171#issuecomment-106559765
[PR13171-comment2]: https://github.com/moby/moby/pull/13171#issuecomment-108538643
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is failing frequently (50%) on Windows;
=== FAIL: github.com/docker/docker/integration/container TestExecResize/success (0.01s)
exec_test.go:144: assertion failed: error is not nil: Error response from daemon: NotFound: exec: '9c19c467436132df24d8b606b0c462b1110dacfbbd13b63e5b42579eda76d7fc' in task: '7d1f371218285a0c653ae77024a1ab3f5d61a5d097c651ddf7df97364fafb454' not found: not found
Let's keep the test, but log the failure and skip on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These functions were used internally to keep track of whether containerd
was enabled as runtime on Windows; move it to libcontainerd.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was failing frequently on Windows, waiting for the state
of the container to be "running" after restarting, however, this
would race because the command of the container was very short-lived;
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIRestartSuite/TestRestartStoppedContainer (37.00s)
docker_cli_restart_test.go:42: assertion failed: error is not nil: condition ""true" == "false"" not true in time (20s)
Ironically, that check was added in 48ccdd46ae
to make the test less flaky.
This patch takes the approach from TestRestartRunningContainer, which had
similar issues on Windows that were addressed in bae22d167c
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`Daemon.Stop()` is called in teardown of tests, resulting in a lot of noise;
docker_cli_network_unix_test.go:52: [d124e10f67e01] daemon is not started
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
docker_cli_external_volume_driver_test.go:59: [d50e371ba1d6f] daemon is not started
Let's ignore if the daemon is already stopped, as that's what we want to here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was testing a non-gracceful kill od the daemon, after which it
started it again, however `d.Stop()` would log that the daemon wasn't running,
which is expected, so let's reduce noise;
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test depended on the container to die after running the `true` command,
but this condition failed frequently on Windows 2025.
=== Failed
=== FAIL: github.com/docker/docker/integration/container TestRemoveContainerWithVolume (32.68s)
remove_test.go:61: timeout hit after 10s: waiting for container State.Status to be 'exited', currently 'running'
While this may be revealing an actual issue (and we should have a test for
that), it's irrelevant for this test, which;
- creates and starts a container with an anonymous volume
- verifies the anonymous volume was created
- removes the container
- verifies the anonymous volume was removed
We can force-remove the container to kill, and removed it; we probably
could've sufficed with "container create" (without starting), but it's
good to add extra coverage, in case running the container impacts whether
we're able to remove the volume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make sure we have basic coverage for this function; integration-cli may
have additional tests covering this as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Add test for privileged containers
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 44b653ef99, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in df662ebc59, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in 100102108b, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in a63ff8da46, but looks
like the only reason was to just have the var initialized, so let's
do so when we create the var.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These fields were deprecated in 1932091e21,
which is part of v28. They were kept in place for responses in older API
versions, but no longer used since 7d9c50db2b,
which implemented a fallback without requiring the fields to be present.
This patch:
- removes `ServiceConfig.AllowNondistributableArtifactsCIDRs`
- removes `ServiceConfig.AllowNondistributableArtifactsHostnames`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in b633c4cc33, which was
in v28, and no longer has any consumer, so we can remove it.
Now that we no longer have to synchronise `CertsDir` with `SetCertsDir`
we can also remove the synchronization (`homedir.GetConfigHome()` does
some additional lookups, but those usually are just looking up env-vars,
and `user.Current()` already has a `sync.Once` or equivalent). Also
unifying the platform-specific code to remove some abstraction and put
the logic in plain sight.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in dd7ab0e82b which was
in v28, and no longer has any consumer, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the only non-daemon import of the image package. The platform
type is also the better type to use.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The writeToStore() call was removed from CreateNetwork in
commit 0fa873c0fe. The comment about
undoing the write is no longer applicable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Legacy links were set up by ProgramExternalConnectivity, but
removed by Leave (rather than RevokeExternalConnectivity). The
options needed by legacy links are all available in Join, and
Join will only be called once per Endpoint. So, create legacy
links there.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Change the semantics of ProgramExternalConnectivity, libnet
can now call it whenever an endpoint is selected or deselected
as a container's gateway endpoint.
It's the driver's responsibility to remember what bindings it's
set up, and to work out what needs to change.
So, calling ProgramExternalConnectivity to tell the driver
an endpoint is no longer a gateway has the same effect as
RevokeExternalConnectivity - bindings need to be removed.
That means libnet no longer needs to work out whether to
Program/Revoke, it can just call ProgramExternalConnectivity.
RevokeExternalConnectivity has been removed.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The concurrency control in the overlay driver is logically unsound.
While the use of mutexes is sufficient to prevent data races --
violations of the Go memory model -- many operations which need to be
atomic are performed with unbounded concurrency.
Overhaul the use of locks in the overlay network driver. Implement sound
locking at the network granularity: operations may proceed concurrently
iff they are being applied to distinct networks. Push the responsibility
of locking up to the code which calls methods or accesses struct fields
to avoid deadlock situations like we had previously with
d.initSandboxPeerDB() and to make the code easier to reason about.
Each overlay network has a distinct peer db. The NetworkDB watch for the
overlay peer table for the network will only start after
(*driver).CreateNetwork returns and will be stopped before libnetwork
calls (*driver).DeleteNetwork, therefore the lifetime of the peer db for
a network is constrained to the lifetime of the network itself. Yet the
peer db for a network is tracked in a dedicated map, separately from the
network objects themselves. This has resulted in a parallel set of
mutexes to manage concurrency of the peer db distinct from the mutexes
for the driver and networks. Move the peer db for a network into a field
of the network struct and guard it from concurrent access using the
per-network lock. Move the methods for manipulating the peer db into the
network struct so that the methods can only be called if the caller has
a reference to the network object.
Network creation and deletion are synchronized using the driver-scope
mutex, but some of the kernel programming is performed outside of the
critical section. It is possible for network deletion to race with
recreating the network, interleaving the kernel programming for the
network creation and deletion, resulting in inconsistent kernel state.
Parallelize network creation and deletion soundly. Use a double-checked
locking scheme to soundly handle the case of concurrent CreateNetwork
and DeleteNetwork for the same network id without blocking operations
on other networks. Synchronize operations on a network so that
operations on the network such as adding a neighbor to the peer db are
performed atomically, not interleaved with deleting the network.
Signed-off-by: Cory Snider <csnider@mirantis.com>
There is a dedicated mutex for synchronizing access to the encrMap.
Separately, the main driver mutex is used for synchronizing access to
the encryption keys. Their use is sufficient to prevent data races (if
used correctly, which is not the case) but not logical race conditions.
Programming the encryption parameters for a peer can race with
encryption keys being updated, which could lead to inconsistencies
between the parameters programmed into the kernel and the desired state.
Introduce a new mutex for synchronizing encryption operations. Use that
mutex to synchronize access to both encrMap and keys. Handle encryption
key updates in a critical section so they can no longer be interleaved
with kernel programming of encryption parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
func (*driver) secMapWalk is a curious beast. It is named walk, yet it
also mutates the collection being iterated over. It returns an error,
but that error is always nil. It takes a callback that can break
iteration, yet the only caller makes no use of that affordance. Its
utility is limited and the abstraction hinders readability more than it
helps. Open-code the d.secMap.nodes loop into
func (*driver) updateKeys(), the only caller.
Signed-off-by: Cory Snider <csnider@mirantis.com>
bindHostPorts currently handles both NATed and routed port mappings.
Split this into two separate functions, one for each type of mapping.
This will help split portmappers.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Port bindings are currently sorted — to form groups that should be
mapped in one go — and then normalized by `configurePortBindingIPv[4|6]`.
However, gw_modes might not be the same for IPv4/v6, so the upcoming
split of NATed / routed portmappers will require that they're processed
independently.
With this commit, PBs are now normalized (by calling the `configure...`
funcs), and then sorted. The sort func is updated to group routed PBs.
`needSamePort` was comparing the container's IP address, but this field
was never set by the time it's called. Now it's set, and has a different
value when IPv4 / IPv6 portmappings are mixed, so remove it from the
comparison.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Since commit b3fabedec, the bridge driver maps ports following a 3-step
process: 1. create a socket, and bind it to the host port; 2. create
iptables rules; 3. start the userland proxy (if it's enabled). This
ensures that the port is really free before inserting iptables rules
that could otherwise disrupt host services.
However, this 3-step process wasn't implemented for SCTP, because we had
no way to instiantiate an SCTP listener from an fd. Since
github.com/ishidawataru/sctp@4719921f9, we can.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5
This minor releases include 1 security fixes following the security policy:
- cmd/go: unexpected command execution in untrusted VCS repositories
Various uses of the Go toolchain in untrusted VCS repositories can result in
unexpected code execution. When using the Go toolchain in directories fetched
using various VCS tools (such as directly cloning Git or Mercurial repositories)
can cause the toolchain to execute unexpected commands, if said directory
contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
repository). This is due to how the Go toolchain attempts to resolve which VCS
is being used in order to embed build information in binaries and determine
module versions.
The toolchain will now abort attempting to resolve which VCS is being used if it
detects multiple VCS configuration metadata in a module directory or nested VCS
configuration metadata (such as a '.git' directoy in a parent directory and a
'.hg' directory in a child directory). This will not prevent the toolchain from
building modules, but will result in binaries omitting VCS related build
information.
If this behavior is expected by the user, the old behavior can be re-enabled by
setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
repositories.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
this issue.
This is CVE-2025-4674 and https://go.dev/issue/74380.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.5
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The TestNatNetworkICC and TestFlakyPortMappedHairpinWindows (TestPortMappedHairpinWindows)
tests were frequently failing on Windows with a context timeout;
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC/User_defined_nat_network (9.67s)
nat_windows_test.go:62: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/4357bd24c9b77b955ee961530d1f552ce099b3dcbeb396db599971b2396d8b08/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network mynat has active endpoints (name:"ctr2" id:"dc8d597dafef")
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC (18.34s)
=== FAIL: github.com/docker/docker/integration/networking TestFlakyPortMappedHairpinWindows (13.02s)
nat_windows_test.go:110: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/65207ae3d6953d85cd2123feac45af60b059842d570d4f897ea53c813cba3cb4/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network clientnet has active endpoints (name:"amazing_visvesvaraya" id:"18add58d415e")
These timeouts were set in c1ab6eda4b and
2df4391473, and were shared between Linux
and Windows; likely Windows is slower to start, so these timeouts to be
expected.
Let's increase the context timeout to give it a bit more time.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
NetworkDB's JoinNetwork function enqueues a message onto a
TransmitLimitedQueue while holding the NetworkDB mutex locked for
writing. The TransmitLimitedQueue has its own synchronization;
it locks its mutex when enqueueing a message. Locking order:
1. (NetworkDB).RWMutex.Lock()
2. (TransmitLimitedQueue).mu.Lock()
NetworkDB's gossip periodic task calls GetBroadcasts on the same
TransmitLimitedQueue to retrieve the enqueued messages. GetBroadcasts
invokes the queue's NumNodes callback while the mutex is locked. The
NumNodes callback function that NetworkDB sets locks the NetworkDB mutex
for reading to take the length of the nodes map. Locking order:
1. (TransmitLimitedQueue).mu.Lock()
2. (NetworkDB).RWMutex.RLock()
If one goroutine calls GetBroadcasts on the queue concurrently with
another goroutine calling JoinNetwork on the NetworkDB, the goroutines
may deadlock due to the lock inversion.
Fix the deadlock by caching the number of nodes in an atomic variable so
that the NumNodes callback can load the value without blocking or
violating Go's memory model. And fix a similar deadlock situation with
the table-event broadcast queues.
Signed-off-by: Cory Snider <csnider@mirantis.com>
With rejoinClusterBootStrap fixed in tests, split clusters should
reliably self-heal in tests as well as production. Work around the other
source of flakiness in TestNetworkDBIslands: timing out waiting for a
failed node to transition to gracefully left. This flake happens when
one of the leaving nodes sends its NodeLeft message to the other leaving
node, and the second is shut down before it has a chance to rebroadcast
the message to the remaining nodes. The proper fix would be to leverage
memberlist's own bookkeeping instead of duplicating it poorly with user
messages, but doing so requires a change in the memberlist module.
Instead have the test check that the sum of failed+left nodes is
expected instead of waiting for all nodes to have failed==3 && left==0.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The rejoinClusterBootStrap periodic task rejoins with the bootstrap
nodes if none of them are members of the cluster. It correlates the
cluster nodes with the bootstrap list by comparing IP addresses,
ignoring ports. In normal operation this works out fine as every node
has a unique IP address, but in unit tests every node listens on a
distinct port of 127.0.0.1. This situation causes the check to
incorrectly filter out all nodes from the list, mistaking them for the
local node.
Filter out the local node using pointer equality of the *node to avoid
any ambiguity. Correlate the remote nodes by IP:port so that the check
behaves the same in tests and in production.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When a node leaves a network, all entries owned by that node are
implicitly deleted. The other NetworkDB nodes handle the leave by
setting the deleted flag on the entries owned by the left node in their
local stores. This behaviour is problematic as it results in two
conflicting entries with the same Lamport timestamp propagating
through the cluster.
Consider two NetworkDB nodes, A, and B, which are both joined to some
network. Node A in quick succession leaves the network, immediately
rejoins it, then creates an entry. If Node B processes the
entry-creation event first, it will add the entry to its local store
then set the deleted flag upon processing the network-leave. No matter
how many times B bulk-syncs with A, B will ignore the live entry for
having the same timestamp as its local tombstone entry. Once this
situation occurs, the only way to recover is for the entry to get
updated by A with a new timestamp.
There is no need for a node to store forged tombstones for another
node's entries. All nodes will purge the entries naturally when they
process the network-leave or node-leave event. Simply delete the
non-owned entries from the local store so there is no inconsistent state
to interfere with convergence when nodes rejoin a network. Have nodes
update their local store with tombstones for entries when leaving a
network so that after a rapid leave-then-rejoin the entry deletions
propagate to nodes which may have missed the leave event.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use the media-types defined in containerd, and create a local copy
of the media-type for plugins, which is not defined in either the
OCI or containerd package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The current detection based on mediaType only accounted for the non-signed
mediatype (`application/vnd.docker.distribution.manifest.v1+json`), but
most (if not all) v1 images used the "signed" manifest type; for example;
docker buildx imagetools inspect docker:1.0.1
Name: docker.io/library/docker:1.0.1
MediaType: application/vnd.docker.distribution.manifest.v1+prettyjws
Digest: sha256:666987df8e0c46670ea52bcd078547297a738fd6b421ec77aac910e1c0f688fd
Various code-paths would still detect the unsupported type through type-
matching the `*schema1.SignedManifest` type, but given that the only reason
for this is to detect whether the image is supported, we might as well just
match the mediaType.
Unfortunately, the [containerd images package][1] currently only defines a
const for the signed variant, and not for the unsigned ones, so to remove
the dependency on the `schema1` package, this patch introduces a (temporary)
local definition.
With this patch, the dependency on the "schema1" package is removed, and with
that also the use of "libtrust"; the dependency still shows up in vendor.mod
due to the docker/distribution dependency not being a go module, but should
dissolve once we remove that dependency in future.
This patch can also be verified using the `distribution` endpoint, which
returns an error when trying to get information for a "v1" image;
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:1.0.1/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:1.0.1/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:00:18 GMT
< Content-Length: 311
{"message":"Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0.1 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/"}
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:28/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:28/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:01:06 GMT
< Content-Length: 541
{"Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:0a2ee60851e1b61a54707476526c4ed48cc55641a17a5cba8a77fb78e7a4742c","size":5165},"Platforms":[{"architecture":"amd64","os":"linux"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v6"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v7"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm64","os":"linux","variant":"v8"},{"architecture":"unknown","os":"unknown"}]}
[1]: https://github.com/containerd/containerd/blob/v2.1.3/core/images/mediatypes.go#L54-L55
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is verifying that push/pull works; current versions of the registry
used should support both the legacy (docker distribution) and OCI media-types,
so let's use the OCI types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Trying to reduce the places where we depend on the legacy distribution
dependency. For this test, we used it to generate the JSON for a manifest-list,
which we can do with the OCI types as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the code where used to allow producing logs customized to the
code-path performing the cleanup.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This removes the tarexporter.legacyLoadImage method and related helpers.
This functionality was added in 01ba0a935b
(docker v1.10), which introduced the new content-addressable image
format; this code provided backward-compatibility with older archives
which contained v0/v1 images.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Contribute a Wireshark plugin for decrypting and dissecting
hashicorp/memberlist messages. And contribue a plugin for dissecting the
NetworkDB messages transported as memberlist User messages.
Add a feature to NetworkDB to log the encryption keys to a file for the
Wireshark memberlist plugin to consume, configured using an environment
variable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
As of Go 1.17, `Setenv` can be used to set environment variables
specific to a single test. This also removes a package which gets
vendored just for this.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The same env-var is used for action/setup-go as for overriding
the default Go version in Dockerfiles, however action/setup-go
only accepts SemVer (e.g. 1.25.0-rc.1) whereas the official golang
image follows the Go project's versioning, which doesn't use
a SemVer-compatible format (go1.25rc1 / 1.25rc1).
Trying to use the same "GO_VERSION" value for both will therefore
fail.
As we're already updating the default version in the Dockerfile to
the version we want to use, let's remove the --build-arg, and use
the default that's set in the Dockerfile.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This endpoint was useful when libnetwork was a standalone component that
could be integrated with other products, but now that libnetwork is part
of moby/moby, and considered an internal package, we're sure that the
Engine's SIGUSR1 handler is available to dump stack traces. No need
to keep a duplicate feature.
Moreover, this endpoint is only available over an HTTP server listening
on 127.0.0.1 (hardcoded), and the stackdump is always written to the
disk. So, to have use of it, you need access to the host anyway.
Finally, unlike the Engine's SIGUSR1 handler, this endpoint write stack
traces to `/tmp` and not to the daemon's `--data-root`.
This is a non-core feature, there's an alternative available, it's not
documented in libnetwork/cmd/diagnostic/README.md (which is the
only place that mentions the diag server AFAIK), and the diag client
doesn't support it, so drop it unceremoniously.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When ProgramExternalConnectvity is called, the bridge driver
works out whether it needs to add port bindings for an endpoint
based on whether it was selected as the container's gateway.
Remember whether IPv4/IPv6 bindings have been set up, as part
of the endpoint's state. When ProgramExternalConnectivity is
called again, use differences between that stored state and
the newly requested state to decide whether to add bindings.
Port binding state is not persisted, on live-restore port
bindings are re-created (so, the initial state should always
be that no port bindings are set up).
Signed-off-by: Rob Murray <rob.murray@docker.com>
In the remote network driver's ProgramExternalConnectivity,
remember whether endpoints have already been configured as
gateways - so that it's ok for libnetwork to call it more
than once with the same configuration (without passing on
those calls to the actual network driver in HTTP requests).
There's no need to persist this data, even on live-restore
ProgramExternalConnectivity will be called again.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Moving towards making it the network driver's responsibility
to work out whether it should set up port bindings, based on
libnet's gateway selection.
This first step lets the driver know whether an endpoint has
been selected as the container's gateway, allowing the driver
to work out whether mappings between IPv6 host addresses and
IPv4 container addresses are required (when supported).
Signed-off-by: Rob Murray <rob.murray@docker.com>
This special case was added in 540c8e9b20 to
handle situations where a Windows daemon would still have images in legacy
format on Disk.
For legal reasons, Windows base-images were not allowed to be distributed
through registries, and because of that had to be pre-loaded on the host.
Such images would have a RootFS with a special `layers+base` type.
This type is no longer used and [removed from the OCI image spec][1], which
now only allows a single type ("Layers"); from the [OCI image-spec][2]:
> - **rootfs** _object_, REQUIRED
>
> The rootfs key references the layer content addresses used by the image.
> This makes the image config hash depend on the filesystem hash.
>
> - **type** _string_, REQUIRED
>
> MUST be set to `layers`.
> Implementations MUST generate an error if they encounter a unknown value while verifying or unpacking an image.
The special handling was added in 2016 to help in the transition, but
it's very unlikely such images still exist, so we can remove the special
handling.
This reverts commit 540c8e9b20.
[1]: https://github.com/opencontainers/image-spec/pull/211
[2]: https://github.com/opencontainers/image-spec/blob/v1.1.1/config.md#properties
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All uses of this method would construct a RootFS from scratch, so we may as
well remove the argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Outline the DACL used on Windows.
- Extract constructing the SDDL to a utility, to allow re-using
for unix sockets in future.
- Improve documentation to mention that Windows allows multiple
groups and/or users to be given access.
Also removing an intermediate variable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The original intent of this directory was to provide weekly reports
for calls and project meetings, but these haven't been produced for
several Years now (with the most recent report being 8 Years ago).
Let's remove this directory as the information in these reports is
outdated and no longer relevant. If needed, they can still be found
in Git history.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make it a hidden file. From the [CodeCov docs][1]:
> Can I name the file .codecov.yml?
>
> Yes, you can name the file `codecov.yml` or `.codecov.yml`. However, the
> file must still be located in the repository root, `dev/`, or `.github/`
> directories
[1]: https://docs.codecov.com/docs/codecov-yaml#can-i-name-the-file-codecovyml
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The restartmanager is only used internally by the daemon, and has no external
users. Move it to the daemon/internal package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This document was added to outline our vendoring policies and to describe
versioning. It's obsoleted by Go module's definition, which follows SemVer
and MVS.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These scripts have not been actively maintained for several Years, are
un-tested, and there may be better alternatives / implementations to
use for this purpose. A search on GitHub only showed a single active
use of one of these scripts; let's remove them, as there are no plans
to maintain (and test) these scripts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Seeing some test-failures, which could be due to changes on Docker Hub
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite/TestPushToCentralRegistryUnauthorized (51.08s)
docker_cli_push_test.go:229: assertion failed: strings.Contains(out, "Retrying") is true
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite (101.49s)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function effectively is looping three times over the given commands
to apply to the image. The first two loops did not yet invoke the builder
instance, so we can combine those and execute then before constructing the
builder. We could even consider combining all of them to a single loop, but
keeping it closer to the existing logic or now.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility was added in 83b5729f64 to
replace httputils.ParseServerHeader, which was added to print a warning
on Windows in 126529c6d0. At the time, the
only available option to detect the daemon's OS was to parse the `Server`
header, which contained the version of Docker as well as the OS.
However, 7199522ea2 introduced an `OSType`
("Ostype") header that's included on all responses, and a later commit
e9dac5ef5e changed that to also be included
when producing an error for unsupported API versions.
Note that the casing in the midddleware was changed from `OSType` to
`Ostype` (normalized form) in 76a5ca1d4d,
but headers are case-insensitive, and `header.Get()` should handle either
case in the response.
In short; every API response contains an "Ostype" header, which already
contains the OS ("windows" or "linux") that doesn't require any parsing,
so let's put that header to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Avoid importing structs from the root package in favor of defining an
interface for the functions which are called.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Adding image tags that follow the semver major and minor versions (e.g., `28`
and `28.3`) for the moby-bin images.
This makes it easier for users to reference the latest build within a
major or minor version series without having to know the exact
minor/patch version.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The IPsec encryption parameters (Security Association Database and
Security Policy Database entries) for a particular overlay network peer
(VTEP) are shared global state as they have to be programmed into the
root network namespace. The same parameters are used when encrypting
VXLAN traffic to a particular VTEP for all overlay networks. Deleting
the entries for a VTEP will break encryption to that VTEP across all
encrypted overlay networks, therefore the decision of when to delete the
entries must take the state of all overlay networks into account.
Unfortunately this is not the case.
The overlay driver uses local per-network state to decide when to
program and delete the parameters for a VTEP. In practice, the
parameters for all VTEPs participating in an encrypted overlay network
are deleted when the network is deleted. Encryption to that VTEP over
all other active encrypted overlay networks would be broken until some
other incidental peerDB event triggered a re-programming of the
parameters for that VTEP.
Change the setupEncryption and removeEncryption functions to be
reference-counted. The removeEncryption function needs to be called the
same number of times as addEncryption before the parameters are deleted
from the kernel.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver assumes that the peer table in NetworkDB will always
converge to a 1:1:1 mapping from peer endpoint IP address to MAC address
to VTEP. While this currently holds true in practice most of the time,
it is not an invariant and there are ways that users can violate this
assumption.
The driver detects whether peer entries conflict with each other by
matching up (IP, MAC) tuples. In the common case this works out fine as
the MAC address for an endpoint is generally derived from the assigned
IP address. If an IP address gets reassigned to a container on another
node the MAC address will follow, so the driver's conflict resolution
logic will behave as intended. However users may explicitly configure
the MAC address for a container's network endpoints. If an IP address
gets reassigned from a container with an auto-generated MAC address to a
container with a manually-configured MAC, or vice versa, the driver
would not detect the conflict as the (IP, MAC) tuples won't match up. It
would attempt to program the kernel's neighbor table with two
conflicting MAC addresses for one IP, which will fail. And since it
does not realize that there is a conflict, the driver won't reprogram
the kernel from the remaining entry when the other entry is deleted.
The assumption that only one IP address may resolve to a given MAC
address is violated if multiple IP addresses are assigned to an
endpoint. This rarely comes up in practice today as the overlay driver
only supports IPv4 single-stack connectivity for endpoints. If multiple
distinct peer entries exist with the same MAC address, the driver will
delete the MAC->VTEP mapping from the kernel's forwarding database when
any entry is deleted, even if other entries remain active. This
limitation is one of the biggest obstacles in the way of supporting IPv6
and dual-stack connectivity for endpoints attached to overlay networks.
Modify the peer db logic to correctly handle the cases where peer
entries have non-unique MAC or VTEP values. Treat any set of entries
with non-unique IP addresses as a conflict, irrespective of the entries'
MAC addresses. Maintain a reference count of forwarding database entries
and only delete the MAC->VTEP mapping from the kernel when there are no
longer any neighbor entries which resolve to that MAC.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The peer db implementation is more complex than it needs to be.
Notably, the peerCRUD / peerCRUDOp function split is a vestige of its
evolution from a worker goroutine receiving commands over a channel.
Refactor the peer db operations to be easier to read, understand and
modify. Factor the kernel-programming operations out into dedicated
addNeighbor and deleteNeighbor functions. Inline the rest of the
peerCRUDOp functions into their respective peerCRUD wrappers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
- Assert that we're not using empty IDs
- stringid.TruncateID already truncates algorithm, so we can just feed
it the full id
- Fail early on error, and skip asserting the `resp.ID` to reduce some
noise;
=== FAIL: github.com/docker/docker/integration/container TestCreateByImageID/image_short-ID (60.33s)
create_test.go:134: assertion failed: resp.ID is ""
create_test.go:135: assertion failed: error is not nil: error during connect: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.48/containers/create": EOF
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit e98e4a7111 introduced functionality
to hide experimental commands, and hide commands based on API version
negotiation. Before that commit, the user-agent header was used to detect
version-mismatches between the daemon and client based on their binary
version;
3975d648b7/api/server/middleware/user_agent.go (L32-L44)
Because of the above, a check was added to prevent custom headers from
modifying the User-Agent, but given that the user-agent header changed
formatting, and api < 1.25 is long deprecated, it's not very meaningful
to add this check, so let's remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Starting with commit 0d6e7cd983
DeleteNeighbor() needs to be called with the same options as the
AddNeighbor() call that created the neighbor entry. The calls in peerdb
were modified incorrectly, resulting in the deletes failing and leaking
neighbor entries. Fix up the DeleteNeighbor calls so that the FDB entry
is deleted from the FDB instead of the neighbor table, and the neighbor
is deleted from the neighbor table instead of the FDB.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Validation of registry mirrors was performed during daemon startup,
but after the config-file was validated. As a result, the `--validate`
option would incorrectly print that the configuration was valid, but
the daemon would fail to start;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
With this patch applied, validation is also performed as part of the
daemon config validation;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
unable to configure the Docker daemon with file ./my-config.json: merged configuration validation from file and command line flags failed: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
# fix the invalid config
echo '{"registry-mirrors":["https://example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, a missing scheme would sometimes produce a confusing
error message. If no scheme was specified at all, an empty "" would be
included in the message;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "" in "example.com"
If a scheme was missing, but a port was included, the hostname would be
printed as the scheme;
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "example.com" in "example.com:8080"
With this patch applied, the error messages are slightly more user-friendly;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com:8080": must use either 'https://' or 'http://'
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When libnetwork receives a watch event for a driver table entry from
NetworkDB it passes the event along to the interested driver. This code
contains a subtle bug: update events from NetworkDB are passed along to
the driver as Delete events! This bug was lying dormant as driver-table
entries can only be added by the driver, not updated. Now that NetworkDB
broadcasts an UpdateEvent to watchers if the entry is already known to
the local NetworkDB, irrespective of whether the event received from the
remote peer was a CREATE or UPDATE event, the bug is causing problems.
Whenever a remote node replaces an entry in the overlay_peer_table but
the intermediate delete state was not received by the local node, the
new CREATE event would be translated to an UpdateEvent by NetworkDB and
subsequently handled by the overlay driver as if the entry was deleted!
Bubble table UPDATE events up to the network driver as Update events.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Commit 8e6cd44ce4 added synchronisation to
wait for the container's status to be updated in memory. However, since
952902efbc, a defer was used to produce
the container's "stop" event.
As a result of the sychronisation that was added, the "die" event would
now be produced before the "stop" event.
This patch moves the locking inside the defer to restore the previous
behavior.
Unfortunately the order of events is still not guaranteed, because events
are emited from multiple goroutines that don't have synchronisation between
them; this is something to look at for follow ups. This patch keeps the status
quo and should preserve the old behavior, which was "more" correct in most
cases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
As we're only expecting a single `/` prefix to be trimmed from the
container name, it's better to use `TrimPrefix` than `TrimLeft`, as
`TrimPrefix` takes a cut-set to remove any character in the set.
Benchmarking both;
BenchmarkTrimLeft-10 535364544 2.204 ns/op 0 B/op 0 allocs/op
BenchmarkTrimPrefix-10 1000000000 0.3148 ns/op 0 B/op 0 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was added in 5130fe5d38, which
added it for use as intermediate struct when parsing CLI flags (through
`runconfig.ParseExec`) in c786a8ee5e.
Commit 9d9dff3d0d rewrote the CLI to use
Cobra, and as part of this introduced a separate `execOptions` type in
`api/client/container`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use the tagged version instead of the v2.0.0-20250613170222-a45be3cac15c
pseudo-version. The referenced commit has not changed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a mention to stdcopy.StdCopy to the documentation, as the stream returned in the HijackedResponse is multiplexed when tty is disabled.
Signed-off-by: Medhy DOHOU <52136144+PowerPixel@users.noreply.github.com>
The IdentityMapping and Identity types are still used internally, but
should be considered transitional.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- `ParseKeyValueOpt` was deprecated in 5b18a7914c
and moved to the graphdriver package.
- `ParseUintListMaximum` and `ParseUintList` were deprecated in commit
064cdf475c after they were moved internal
to pkg/sysinfo in 2282279180.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package was deprecated in b034dc41a2,
which moved it internal. That commit was part of v28.0.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 4472e9b7f8, which
was part of docker v28.0.0, and to be removed in the next major
release.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Inter-Network Communication rules in the iptables chains
DOCKER-ISOLATION-STAGE-1 / DOCKER-ISOLATION-STAGE-2 (which are
called from filter-FORWARD) currently:
- Block access from containers in one bridge network, to ports
published to host addresses by containers in other bridge
networks, when the userland-proxy is disabled.
- But, that access is allowed when the proxy is enabled.
- Block access to all ports on container addresses in gateway
mode "nat-unprotected" networks.
- But, those ports can be accessed from anywhere else, including
other hosts. Just not other bridge networks.
- Allow access from containers in "nat" bridge networks to published
ports on container addresses in "routed" networks. But, to do that,
extra INC rules are added for the routed network.
The INC rules are no longer needed to block access from containers
in one network to unpublished ports on container addresses in
other networks. Direct routing to containers in NAT networks is
blocked by the "raw-PREROUTING" rules that block access from
untrusted interfaces (all interfaces apart from the network's
own bridge).
Drop these INC rules to resolve the inconsistencies listed above,
with this change:
- Published ports on host addresses can be accessed from containers
in other networks (even without the userland-proxy).
- The rules for direct routing between bridge networks are the same
as the rules for direct routing from outside the Docker host
(allowed for gw modes "routed" and "nat-unprotected", disallowed
for "nat").
Fewer rules, so it's simpler, and perhaps slightly faster.
Internal networks (with no access to networks outside the host)
are also implemented using rules in the DOCKER-ISOLATION chains.
This change moves those rules to a new chain, DOCKER-INTERNAL,
and drops the DOCKER-ISOLATION chains.
Signed-off-by: Rob Murray <rob.murray@docker.com>
A network node is responsible for both broadcasting table events for
entries it owns and for rebroadcasting table events from other nodes it
has received. Table events to be broadcast are added to a single queue
per network, including events for rebroadcasting. As the memberlist
TransmitLimitedQueue is (to a first approximation) LIFO, a flood of
events from other nodes could delay the broadcasting of
locally-generated events indefinitely. Prioritize broadcasting local
events by splitting up the queues and only pulling from the rebroadcast
queue if there is free space in the gossip packet after draining the
local-broadcast queue.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Log more details when assertions fail to provide a more complete picture
of what went wrong when TestCRUDTableEntries fails. Log the state of
each NetworkDB instance at various points in TestCRUDTableEntries to
provide an even more complete picture.
Increase the global logger verbosity in tests so warnings and debug logs
are printed to the test log.
Signed-off-by: Cory Snider <csnider@mirantis.com>
NetworkDB uses a muli-dimensional map of struct network to keep track of
network attachments for both remote nodes and the local node. Only a
subset of the struct fields are used for remote nodes' network
attachments. The tableBroadcasts pointer field in particular is
always initialized for network values representing local attachments
(read: nDB.networks[nDB.config.NodeID]) and always nil for remote
attachments. Consequently, unnecessary defensive nil-pointer checks are
peppered throughout the code despite the aforementioned invariant.
Enshrine the invariant that tableBroadcasts is initialized iff the
network attachment is for the local node in the type system. Pare down
struct network to only the fields needed for remote network attachments
and move the local-only fields into a new struct thisNodeNetwork. Elide
the unnecessary nil-checks.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When joining a network that was previously joined but not yet reaped,
NetworkDB replaces the network struct value with a zeroed-out one with
the entries count copied over. This is also the case when joining a
network that is currently joined! Consequently, joining a network has
the side effect of clearing the broadcast queue. If the queue is cleared
while messages are still pending broadcast, convergence may be delayed
until the next bulk sync cycle.
Make it an error to join a network twice without leaving. Retain the
existing broadcast queue when rejoining a network that has not yet been
reaped.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The map key for nDB.networks is the network ID. The struct field is not
actually used anywhere in practice.
Signed-off-by: Cory Snider <csnider@mirantis.com>
We had some runs timeout after 120 minutes; expected duration is much
lower than that, so let's lower the timeout to make actions fail faster.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The go-connections package implementation is only a shallow wrapper
around go-winio for named pipes; use the go-winio implementation
directly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The (*driver).Join function does many things to set up overlay
networking. One of the first things it does is call
(*network).joinSandbox, which in turn calls (*driver).initSandboxPeerDB.
The initSandboxPeerDB function iterates through the peer db to add
entries to the VXLAN FDB, neighbor table and IPsec security association
database in the kernel for all known peers on the overlay network.
One of the last things the (*driver).Join function does is call
(*driver).initEncryption. The initEncryption function iterates through
the peer db to add entries to the IPsec security association database in
the kernel for all known peers on the overlay network. But the preceding
initSandboxPeerDB call already did that! The initEncryption function is
redundant and can safely be removed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
In addition to being three functions in a trenchcoat, the
checkEncryption function has a very subtle implementation which is
difficult to reason about. That is not a good property for security
relevant code to have.
Replace two of the three calls to checkEncryption with conditional calls
to setupEncryption and removeEncryption, lifting the conditional logic
which was hidden away in checkEncryption into the call sites to make it
easier to reason about the code. Replace the third call with a call to a
new initEncryption function.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The setupEncryption and removeEncryption functions take several
parameters, but all call sites pass the same values for all the
parameters aside from remoteIP: values taken from fields of the driver
struct. Refactor these functions to be methods of the driver struct and
drop the redundant parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Since it is not meaningful to add or remove encryption between the local
node and itself, the isLocal parameter is redundant. Setting up
encryption for all network peers is now invoked by calling
checkEncryption(nid, netip.Addr{}, true)
Calling checkEncryption with isLocal=true, add=false is now more
explicitly a no-op. It always was effectively a no-op, but that was not
easy to spot by inspection. In the world with the isLocal flag,
calls to checkEncryption where isLocal=true and add=false would have rIP
set to d.advertiseAddr. In other words, it was a request to remove
encryption parameters between the local peer and itself if peerDB had no
remote-peer entries for the network. So either the call would do
nothing, or it would remove encryption parameters that aren't used for
anything. Now the equivalent call always does nothing.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Drop the isLocal boolean parameters from the peerDB functions. Local
peers have vtep == netip.Addr{}.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The VTEP value for a peer in peerDB is only accurate for a remote peer.
The VTEP for a local peer would be the driver's advertise address, which
is not necessarily constant for the lifetime of the driver instance.
The VTEP values persisted in the peerDB entries for local peers could be
stale or missing if not kept in sync with the advertise address. And the
peerDB could get polluted with duplicate entries for local peers if the
advertise address was to change, as entries which differ only by VTEP
are considered distinct by SetMatrix. Persisting the advertise address
as the VTEP for local peers creates lots of problems that are not easy
to solve.
Stop persisting the VTEP for local peers in peerDB. Any code that needs
to know the VTEP for local peers can look that up from the source of
truth: the driver's advertise address. Use the lack of a VTEP in peerDB
entries to signify local peers, making the isLocal flag redundant.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver's checkEncryption function configures the IPSec
parameters for the VXLAN tunnels to peer nodes. When called with
isLocal=true, it configures encryption for all peer nodes with at least
one peerDB entry. Since the local peers are also included in the peerDB,
it needs to filter those entries out. It does so by filtering out any
peer entries whose VTEP address is equal to the current local advertise
address. Trouble is, the local advertise address is not necessarily
constant. The driver tries to handle this case by calling
peerDBUpdateSelf() when the advertise address changes. This function
iterates through the peerDB and tries to update the VTEP address for all
local peer entries, but it does not actually do anything: it mutates a
temporary copy of the entry which is not persisted back into the peerDB.
(It used to be functional, but was broken when the peerDB was extended
to use SetMatrix.) So there may be cases where local peer entries are
not filtered out properly, resulting in spurious encryption parameters
being programmed into the kernel.
Filter out local peers when walking the peerDB by filtering on whether
the entry has the isLocal flag set. Remove the no-op code which attempts
to update local entries in the peerDB. No other code takes any interest
in the VTEP value for isLocal peer entries.
Signed-off-by: Cory Snider <csnider@mirantis.com>
2025-05-29 14:13:13 -04:00
4566 changed files with 247342 additions and 137463 deletions
[](https://www.bestpractices.dev/projects/10989)
The Engine API is an HTTP API used by the command-line client to communicate with the daemon. It can also be used by third-party software to control the daemon.
It consists of various components in this repository:
-`api/swagger.yaml` A Swagger definition of the API.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/docker/docker/issues/27919) for progress on this.
-`cli/` The command-line client.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/moby/moby/issues/27919) for progress on this.
-`client/` The Go client used by the command-line client. It can also be used by third-party Go programs.
-`daemon/` The daemon, which serves the API.
@@ -21,6 +27,7 @@ The API is defined by the [Swagger](http://swagger.io/specification/) definition
## Updating the API documentation
The API documentation is generated entirely from `api/swagger.yaml`. If you make updates to the API, edit this file to represent the change in the documentation.
Documentation for each API version can be found in the [docs directory](docs/README.md), which also provides a [CHANGELOG.md](docs/CHANGELOG.md).
The file is split into two main sections:
@@ -29,7 +36,7 @@ The file is split into two main sections:
To make an edit, first look for the endpoint you want to edit under `paths`, then make the required edits. Endpoints may reference reusable objects with `$ref`, which can be found in the `definitions` section.
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/docker/docker/issues/27919).
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/moby/moby/issues/27919).
`swagger.yaml` is validated by `hack/validate/swagger` to ensure it is a valid Swagger definition. This is useful when making edits to ensure you are doing the right thing.
@@ -39,4 +46,4 @@ When you make edits to `swagger.yaml`, you may want to check the generated API d
Run `make swagger-docs` and a preview will be running at `http://localhost:9000`. Some of the styling may be incorrect, but you'll be able to ensure that it is generating the correct documentation.
The production documentation is generated by vendoring `swagger.yaml` into [docker/docker.github.io](https://github.com/docker/docker.github.io).
The production documentation is generated by vendoring `swagger.yaml` into [docker/docs](https://github.com/docker/docs).
StdinStdType=0// Stdin represents standard input stream. It is present for completeness and should NOT be used. When reading the stream with [StdCopy] it is output on [Stdout].
StdoutStdType=1// Stdout represents standard output stream.
StderrStdType=2// Stderr represents standard error steam.
SystemerrStdType=3// Systemerr represents errors originating from the system. When reading the stream with [StdCopy] it is returned as an error.
)
const(
stdWriterPrefixLen=8
stdWriterFdIndex=0
stdWriterSizeIndex=4
startingBufLen=32*1024+stdWriterPrefixLen+1
)
// StdCopy is a modified version of [io.Copy] to de-multiplex messages
// from "multiplexedSource" and copy them to destination streams
// "destOut" and "destErr".
//
// StdCopy demultiplexes "multiplexedSource", assuming that it contains
// two streams, previously multiplexed using a writer created with
// [NewStdWriter].
//
// As it reads from "multiplexedSource", StdCopy writes [Stdout] messages
// to "destOut", and [Stderr] message to "destErr]. For backward-compatibility,
// [Stdin] messages are output to "destOut". The [Systemerr] stream provides
// errors produced by the daemon. It is returned as an error, and terminates
// processing the stream.
//
// StdCopy it reads until it hits [io.EOF] on "multiplexedSource", after
// which it returns a nil error. In other words: any error returned indicates
// a real underlying error, which may be when an unknown [StdType] stream
// is received.
//
// The "written" return holds the total number of bytes written to "destOut"
// TODO(thaJeztah): unify this with Server.makeHTTPHandler, which also logs internal server errors as error-log. See https://github.com/moby/moby/pull/48740#discussion_r1816675574
fields["error-response"]=err
fields["status"]=httpstatus.FromError(err)
logger.WithFields(fields).Debugf("error response for %s request",r.Method)
returnnil,fmt.Errorf("invalid API version: the minimum API version (%s) is higher than the default version (%s)",minAPIVersion,defaultAPIVersion)
}
return&VersionMiddleware{
serverVersion:serverVersion,
defaultAPIVersion:defaultAPIVersion,
minAPIVersion:minAPIVersion,
},nil
}
typeversionUnsupportedErrorstruct{
version,minVersion,maxVersionstring
}
func(eversionUnsupportedError)Error()string{
ife.minVersion!=""{
returnfmt.Sprintf("client version %s is too old. Minimum supported API version is %s, please upgrade your client to a newer version",e.version,e.minVersion)
}
returnfmt.Sprintf("client version %s is too new. Maximum supported API version is %s",e.version,e.maxVersion)
expectedErr:fmt.Sprintf("invalid API version: the minimum API version (%s) is higher than the default version (%s)",api.DefaultVersion,api.MinSupportedAPIVersion),
},
{
doc:"invalid default too low",
defaultVersion:"0.1",
minVersion:api.MinSupportedAPIVersion,
expectedErr:fmt.Sprintf("invalid default API version (0.1): must be between %s and %s",api.MinSupportedAPIVersion,api.DefaultVersion),
},
{
doc:"invalid default too high",
defaultVersion:"9999.9999",
minVersion:api.DefaultVersion,
expectedErr:fmt.Sprintf("invalid default API version (9999.9999): must be between %s and %s",api.MinSupportedAPIVersion,api.DefaultVersion),
},
{
doc:"invalid minimum too low",
defaultVersion:api.MinSupportedAPIVersion,
minVersion:"0.1",
expectedErr:fmt.Sprintf("invalid minimum API version (0.1): must be between %s and %s",api.MinSupportedAPIVersion,api.DefaultVersion),
},
{
doc:"invalid minimum too high",
defaultVersion:api.DefaultVersion,
minVersion:"9999.9999",
expectedErr:fmt.Sprintf("invalid minimum API version (9999.9999): must be between %s and %s",api.MinSupportedAPIVersion,api.DefaultVersion),
errString:fmt.Sprintf("client version 0.1 is too old. Minimum supported API version is %s, please upgrade your client to a newer version",api.MinSupportedAPIVersion),
},
{
reqVersion:"9999.9999",
errString:fmt.Sprintf("client version 9999.9999 is too new. Maximum supported API version is %s",api.DefaultVersion),
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
