- Remove keep-storage parameter from swagger.yaml API specification
- Remove KeepStorage field from CachePruneOptions struct
- Remove client-side logic for setting keep-storage query parameter
- Remove server-side fallback logic for keep-storage in API v1.49+
- Remove backward compatibility logic in builder.go
- Add comprehensive tests to validate keep-storage is no longer sent
- Maintain backward compatibility for API versions < v1.49
Co-authored-by: vvoland <5046555+vvoland@users.noreply.github.com>
The PR validation workflow now enforces that every PR with an 'impact/*'
label must also have a corresponding 'kind/*' label, in addition to the
existing 'area/*' label requirement.
This change helps ensure proper categorization of pull requests by
requiring contributors to specify both the impact area and the kind of
change being made.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
It better describes its purpose, and allows "Port" to be used for
other purposes (e.g. to replace "nat.Port").
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Co-authored-by: Austin Vazquez <austin.vazquez@docker.com>
The input is a string, and we're producing an error if those strings
are in the wrong format, so we may as well just use a map[string]bool
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Fix the compilation issue on aix, android and solaris due to wrong use of maxMapSize
- Add protection on meta page when it's being written
- Correct the incorrect usage of debug method
- Add clarification on the option InitialMmapSize
- Fix the crash when writing huge values
full diff: https://github.com/etcd-io/bbolt/compare/v1.4.0...v1.4.2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
ensureReaderClosed was designed to be usable regardless if a response
was nil (error) or non-nil (success). Some code-paths were optimized to
avoid using a defer (which used to have an overhead), but the overhead
of defer is neglectable in current versions of Go, and some of these
optimizations made the logic more complicated (and err-prone).
This patch switches to use a defer for all places.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Only use checkResponseErr if `client.doRequest` did not return an error;
any error returned by `client.doRequest` means there was an error connecting,
so there's no response to handle (including errors in the response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Outline that any error returned is a connectivity error and a nil-error
requires the response to be handled (including errors returned in the
response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Ping function first tries to do a HEAD request, but the parsePingResponse
was written with the assumption that a Body could be present in the response
that may include errors returned by the API server.
HEAD responses don't include a body, so there's no response to handle, and
no errors to return by the API, other than a HTTP status code.
This patch:
- Rewrites `parsePingResponse` to a `newPingResponse`, removing the error-
handling for the response-body. It's also simplified, because a non-nil
response is guaranteed to have a non-nil Header (but it may not have
any of the headers set that are used for the Ping).
- Rewrites the `Client.Ping` to only return a Ping-response from the HEAD
request if no error was returned (i.e., we connected with the API) and
a successful status-code, otherwise it will fallback to a GET request,
which allows (for non "OK" (200) status-codes) returning errors from
the daemon (for example, if the daemon is in an unhealthy state).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This change restores the environment variable configuration of daemon storage driver through the DOCKER_DRIVER environment variable.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
It was implemented as a method on Client, but the receiver was not used;
make it a regular function to prevent passing around the Client where
not needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `TransporPort` type is comparable; it doesn't have fields that
require special handling. It's defined as;
// TransportPort represents a local Layer 4 endpoint
type TransportPort struct {
Proto Protocol
Port uint16
}
where `Protocol` is an int (with a stringer interface);
type Protocol uint8
So we can remove the `Equal` method, and simplify places where it's
compared.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `GetCopy()` function doesn't de-reference anything, as it's
all a straight copy. We can remove it as it's only making things
more complicated than needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Modernize using maps.Clone, slices.Clone. This method is needed to
satisfy the datastore.KVObject interface, so also assert it does.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The endpointJoinInfo.CopyTo function expected the caller to construct an
EndpointInterface to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error return
was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The EndpointInterface.CopyTo function expected the caller to construct an
EndpointInterface to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error return
was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Change `PortBinding.Equal` to use a value receiver and parameter, this
allows us to use it directly with `slices.IndexFunc`, `DeleteFunc`,
without having to add a wrapper func.
The only exception currently is the `UnmapPorts` function (stub), which
takes portmapperapi.PortBinding as argument; the portmapperapi.PortBinding
type embeds `types.PortBinding`, and it's the only field that's compared
as part of `UnmapPorts`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Rename `PortBinding.GetCopy()` to `PortBinding.Copy()`, which is more
idiomatic, and aligns with other similar methods.
- Change it to a non-pointer receiver; `Copy` does not mutate state, and
the type should still be reasonably small.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite both to use slices.Clone, and GetIPNetCanonical to not depend
on GetIPNetCopy. GetIPNetCopy only has a single consumer, so we should
consider moving it local to where it's used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The IpamInfo.CopyTo function expected the caller to construct an
IpamInfo to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error
return was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The IpamConf.CopyTo function expected the caller to construct an
IpamConf to copy to, but all callsites created an empty struct.
In addition, `CopyTo` would never return an error, so the error
return was redundant.
Replace it with a `Copy()` function, which makes it easier to
consume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
During the arm64 tests, the rootfs directory does not seem to exist when
this test is run and will cause a failure when using snapshotter.
Signed-off-by: Derek McGowan <derek@mcg.dev>
- Use slices.Clone where suitable.
- Handle `nil` values so that callers don't have to check for `nil`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- construct the `ports` copy before `networkSettings` so that it
can be used as part of the struct-literal. This copy was added
in 7917a36cc7 to prevent a race-
condition.
- `mountPoints` is not used until the very end, but (likely) still
needs to happen while we hold the lock, so move it before it's
released.
- add a comment referencing the reason to unlock early before the
size calculation, in case it become irrelevant in future.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Repository has been archived, and we only use a single package, so we
could even consider forking. For now, let's at least update it to the
latest code, which added a go.mod.
full diff: 72a348e765...20d68f94ee
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add layer migration on startup
Use image size threshold rather than image count
Add daemon integration test
Add test for migrating to containerd snapshotters
Add vfs migration
Add tar export for containerd migration
Add containerd migration test with save and load
Signed-off-by: Derek McGowan <derek@mcg.dev>
For nftables only, never enable IP forwarding on the host. Instead,
return an error on network creation if forwarding is not enabled,
required by a bridge network, and --ip-forward=true.
If IPv4 forwarding is not enabled when the daemon is started with
nftables enabled and other config at defaults, the daemon will
exit when it tries to create the default bridge.
Otherwise, network creation will fail with an error if IPv4/IPv6
forwarding is not enabled when a network is created with IPv4/IPv6.
It's the user's responsibility to configure and secure their host
when they run Docker with nftables.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The userland proxy uses unconnected UDP sockets to receive packets from
anywhere, so enabling SO_REUSEADDR means that multiple sockets can bind
the same port. This defeats the purpose of the portallocator, which is
supposed to ensure that the port is free and not already in use (either
by us, or by another process). So, do not enable SO_REUSEADDR for UDP
sockets.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When creating development containers currently, `Makefile` doesn't use
the GIT_BRANCH variable to tag `docker-dev` image. But in some
documentation files for contributing, references remain for image tags
with the `git branch` name.
This commit simply removes those references. Correct image tag names are
important for newcomers, especially for copy-pasteable commands.
Related PR: 42652
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
Test was flaky because it was not waiting for an image load
operation to complete before proceeding to check if the load
succeeded. Fix this.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
The strslice.StrSlice type is a string-slice with a custom JSON Unmarshal
function to provide backward-compatibility with older API requests from
before docker 1.7 (see [moby@17d6f00] and [moby@ea4a067]), which used a
string instead of an array of strings for some fields (Cmd, Entrypoint).
We no longer support those API versions, and we no longer support pulling
v1 images that may contain such a config, so we can deprecate the type
and remove its use.
[moby@17d6f00]: 17d6f00ec2
[moby@ea4a067]: ea4a06740b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- deprecate sockets.GetProxyEnv, sockets.DialerFromEnvironment
- add support for unix sockets on Windows
- remove legacy CBC cipher suites from client config
- align client and server defaults to be the same.
- remove support for encrypted TLS private keys.
- nat: optimize ParsePortSpec
full diff: https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's 12 lines of code total; we may as well write it as part of building;
it looks to be the only place this is used, so we can remove the contrib
directory, which should not be used by anyone.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- always build the go binary, instead of trying to find if it exists
and then trying to copy it.
- write the Dockerfile ourselves, instead of trying to copy the one
from contrib.
- update the Dockerfile to be built "FROM scratch"; we don't need
busybox here.
- start the container with "PublishAllPorts: true", otherwise no
ports would be mapped.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Passing the Auth to the redirected location was fixed in curl 7.58:
https://curl.se/changes.html#7_58_0 so we no longer need the extra
handling and can just use `-L` to let curl handle redirects.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Correctly parse HTTP response that doesn't contain an HTTP version with a decimal place:
```
< HTTP/2 307
```
The previous version would only match strings like `HTTP/2.0 307`.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
If unmarshaling the peer record fails, there is no need to check if it's
a record for a local peer. Attempting to do so anyway will result in a
nil-dereference panic. Don't do that.
The Windows overlay driver has a typo: prevPeer is being checked twice
for whether it was a local-peer record. Check prevPeer once and newPeer
once each, as intended.
Signed-off-by: Cory Snider <csnider@mirantis.com>
- release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.0
- full diff: https://github.com/opencontainers/runc/compare/v1.2.6..v1.3.0
-----
This is the first release of the 1.3.z release branch of runc. It
contains a few minor fixes for issues found in 1.3.0-rc.2.
This is the first release of runc that will follow our new release and
support policy (see RELEASES.md for more details). This means that, as
of this release:
* As of this release, the runc 1.2.z release branch will now only
receive security and "significant" bugfixes.
* Users are encouraged to plan migrating to runc 1.3.0 as soon as
possible.
* Due to its particular situation, runc 1.1.z is officially no longer
supported and will no longer receive any updates (not even for
critical security issues). Users are urged (in the strongest possible
terms) to upgrade to a supported version of runc.
* Barring any future changes to our release policy, users should expect
a runc 1.4.0 release in late October 2025.
Fixed
* Removed pre-emptive "full access to cgroups" warning when calling
`runc pause` or `runc unpause` as an unprivileged user without
`--systemd-cgroups`. Now the warning is only emitted if an actual permission
error was encountered.
* Several fixes to our CI, mainly related to AlmaLinux and CRIU.
Changed
* In runc 1.2, we changed our mount behaviour to correctly handle clearing
flags. However, the error messages we returned did not provide as much
information to users about what clearing flags were conflicting with locked
mount flags. We now provide more diagnostic information if there is an error
when in the fallback path to handle locked mount flags.
* Upgrade our CI to use golangci-lint v2.0.
* `runc version` information is now filled in using `//go:embed` rather than
being set through `Makefile`. This allows `go install` or other non-`make`
builds to contain the correct version information. Note that
`make EXTRA_VERSION=...` still works.
* Remove `exclude` directives from our `go.mod` for broken `cilium/ebpf`
versions. `v0.17.3` resolved the issue we had, and `exclude` directives are
incompatible with `go install`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This includes the changes from c13266d2c0
in the versioned swagger, as those changes were made after the
v1.52 versioned document was created.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The github.com/docker/docker/reference package was moved to
github.com/moby/moby/v2/daemon/internal/refstore, so this
check no longer did anything (and no aliasing needed).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The buildSandboxPlatformOptions function was given a pointer to the
sboxOptions and modified it in-place.
Similarly, a pointer to the container was passed and `container.HostsPath`
and `container.ResolvConfPath` mutated. In cases where either of those
failed, we would return an error, but the container (and sboxOptions)
would already be modified.
This patch;
- updates the signature of buildSandboxPlatformOptions to return a fresh
slice of sandbox options, which can be appended to the sboxOptions by
the caller.
- uses intermediate variables for `hostsPath` and `resolvConfPath`, and
only mutates the container if both were obtained successfully.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove/rename named error-return
- remove redundant defer
- use "continue" to reduce nesting
- use structured logs
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Markdown subheading name was changed in `CONTRIBUTING.md` in the past,
so this commit fixes the link by changing it from `docker` to `moby`.
Signed-off-by: Serhan Tutar <randomnoise@users.noreply.github.com>
handleFirewalldReloadNw locks `d.mu` and then `d.configNetworks`.
However, the rest of the driver locks `d.configNetworks` first and then
`d.mu`.
This could result in deadlocks if `handleFirewalldReloadNw` is called
while the bridge driver is already holding `d.configNetworks` lock.
Other code paths were checked to ensure that they all follow the same
locking order.
This bug was introduced by commit a527e5a.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The bridge driver was embedding `sync.Mutex` which is unconventional and
makes it harder to analyze locks ordering.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Outline the purpose of the Stdin and Systemerr streams and how
they're used.
- Update docs for StdCopy function
- Touch-up error for unknown stream types
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
iota can be convenient for internal use for cases where the value
doesn't matter. It can be a footgun when using it to define public
values; it's easy to accidentally change values (e.g. by re-ordering
or adding a value), which may go undetected within our code because
both producer and consumer would be updated.
This patch updates these consts to have a concrete value, because it's
part of the API contract and must not be changed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Not perfect yet, but addressing some godoc "doc" links that needed
to be updated, and touching up some references.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allow overriding the go-swagger version to install.
With this patch:
docker build -q --call=outline --target=swagger .
TARGET: swagger
BUILD ARG VALUE DESCRIPTION
GO_VERSION 1.24.5
BASE_DEBIAN_DISTRO bookworm
GOLANG_IMAGE golang:1.24.5-bookworm
XX_VERSION 1.6.1
GO_SWAGGER_VERSION v0.32.3 specifies the version of the go-swagger binary to install.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This file was added in 962f347923, at which
time there already were doubts about it being useful. For Go, `gofmt`
already dictates formatting (and proper editors would integrat with
that). For other languages, most editors would already have a config,
and our CI validates formatting for various files.
Give that the file was never updated since it was added, it's fair
to say that it's unmaintained. Let's remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This script was added in 6860c101ad
to allow testing a custom daemon in Docker Desktop, but has not
been maintained since, and likely no longer functional, so let's
remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Dockerfile syntax is now maintained as part of BuildKit in the
https://github.com/moby/buildkit repository, but our contrib still
had syntax highlighting files for various editors;
- The TextMate (`.tmbundle`) syntax was last update 9 months ago
in c2029cb257, but this was a stale
pull request from 2018, so at least 7 Years behind on updates to
the syntax.
- The vim syntax is now integrated in upstream, and our copy was
remove 6 Years ago in 5511f45767.
- The Nano syntax was added 10 Years ago in 76bc44fb91,
and received an update 9 Years ago in 4cb71f8082,
and received no contributions since.
- The kate syntax was already unmaintained, and removed 9 Years ago
in a2f695d7fa.
I think it's fair to state that these are unmaintained and severely outdated.
I _do_ think it would be good to have maintained versions of such files,
as it can improve the experience for users. However, this would be more
suitable for the BuildKit project, and I'm not sure if the current copies
of these files are a good starting point (if needed, they can still be
obtained from git history).
This patch removes the files.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image spec was moved to the github.com/moby/docker-image-spec repository,
and 03a17a2887 removed the files from the
moby repository, but left markdown files in place to point people to
the new location.
As these files were now moved internally, they no longer serve that purpose,
so we can remove them.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a `RouteType` type, type the related consts, and update the
`JoinInfo.AddStaticRoute` signature in the interface.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These use the Linux-specific values as convention, so unfortunately,
the syscall package doesn't define consts for these on Windows, so
keeping our own definition (values are not really relevant here).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Define a type to help discovery, and update the signatures of
`ResolveName`, `Network.ResolveName`, and `Sandbox.ResolveName`
accordingly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The wire type of Plugin.Config.Interface.Types is an array of strings,
not of objects with three properties. We just so happen to have a Go
struct type to represent a plugin-interface-type value in memory with
all the fields parsed out for convenience, but that is not part of the
REST API contract documented by the Swager spec.U pdate the Swagger spec
to correctly document that the Types property is an array of strings in
the API, while still generating Go definitions that unmarshal into the
convenient struct type.
Move the definition and marshal/unmarshal methods for
PluginInterfaceType into a more appropriate location than api/types.
Rename the type to one that does not stutter or overload already
heavily overloaded terminology.
Modernize the parser and use property-based testing to assert that it
behaves the same as the old parser for all well-formed inputs.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Modernize the field and allow using it as-is in some places, or
convert it to a string (which won't produce an error down the line).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's now only used to back the `Service.ResolveAuthConfig` method, and
not used outside of the package currently.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `session` struct was just bundling a http.Client with a v1Endpoint.
It was never a long-lived service; every use initialized the session,
only to call the `searchRepositories` method on it.
Dismantle it, and make it a regular function that gets a http.Client and
a v1Endpoint passed as argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We want to get rid of the use of using "registry.IndexInfo". Make the
function un-exported to discourage additional use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The distributionRouter receiver was not used; make it a regular function
to make clear it doesn't require the router.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove redundant if/else
- Move vars closer to where used now that we don't have the if/else.
- Touch-up error-message to remove engine version and update doc link to DeprecatedSchema1ImageError.
- Touch-up TODOs and add reference to help trace back what's meant.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is a wrapper for the libnetwork/internal/resolvconf package,
which is a modernized, more performant rewrite of the original parsing
code.
The libnetwork/resolvconf package was still maintained because it was
used by BuildKit, but since [moby/buildkit@3d43066], BuildKit maintains
its own copy of the internal package.
The only remaining uses of this package was as part of some tests (which
would also benefit of using the internal pacakge's implementation directly),
and a _single_ use of `resolvconf.Path` in the daemon, which cannot use
the internal package currently because it's internal to libnetwork.
This patch:
- Removes all functions that were not used.
- Rewrites some tests in libnetwork to use the internal/resolvconf package
directly, instead of depending on the wrapper.
- Add TODOs to consider moving the "Path" function separate (which could
be in daemon/config if we consider it to be the default for the daemon's
resolvconf path configuration).
[moby/buildkit@3d43066]: 3d43066f2e
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was introduced in 1af76ef597
and based on the previous code in the daemon, which had platform-specific
handling for exec inspect in [setPlatformSpecificExecProcessConfig], which
was added in 5fa2e4d4f2 to account for
Windows not having "Privileged" and not setting the "User".
Given that "User" would be empty and "Privileged" not set, we may as well
combine both platforms, and just return the info we have.
[setPlatformSpecificExecProcessConfig]: 1af76ef597/daemon/exec_unix.go (L11-L21)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Looks like I accidentally added these 5 Years ago in
9f0b3f5609, and never
noticed.
Let's clean this up.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 3a447bc079.
Some daemon versions don't handle empty values well, which resulted in
an io.EOF error when sending an empty X-Registry-Auth during decoding
or unmarshaling.
We should investigate what code-paths are hit to trigger this, but
in the meantime, let's revert this patch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Staticcheck is suggesting to cast the type or to directly copy, but
doesn't account for nat.SortPortMap mutating the second argument, so
mutating the HostConfig.PortBindings. From the code, it looks like the
intent here was to prevent that (creating a deep copy), so let's keep
that.
daemon/container_operations.go:109:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
daemon/network.go:952:39: S1016: should convert bb (type github.com/docker/docker/vendor/github.com/docker/go-connections/nat.PortBinding) to github.com/docker/docker/vendor/github.com/moby/moby/api/types/container.PortBinding instead of using struct literal (staticcheck)
bindings[p] = append(bindings[p], containertypes.PortBinding{
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to 494677f93f, which added
the aliases, but did not yet replace our own use of the nat types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to update code to not be attached to go-connections
directly (in future we may be able to move the types to be concrete
types).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was an adaptor around DisplayJSONMessagesStream for CLI-specific
primitives that was used in the CLI, but can be implemented by users
of this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The API still returns it for backward-compatibility (but probably
shouldn't), but we should no longer print it. This removes the
use of these fields for printing, but keeps them for streamformatter
to use.
- ErrorMessage was deprecated in 3043c26419
- ProgressMessage was deprecated in 597e0e69b4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package depends on jsonformatter.JSONProgress and jsonmessage.JSONMessage,
and it looks like it requires some of those for their stringer interface.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the type to the API, but embed it, so that we keep the
methods on the struct in this package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can probably use [aec.EmptyBuilder] for managing the output, but
currently we're doing it all manually, so defining some consts for
the basics we use.
[aec.EmptyBuilder]: https://pkg.go.dev/github.com/morikuni/aec#EmptyBuilder
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's only used by the client to support API versions older than v1.22.
Make it an internal utility that doesn't depend on internal fields of
`filter.Args`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external users, and this package still has too many different
responsibilities, some of which may be available elsewhere, so moving it
internal so that we can decide to dismantle it further.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the stub implementation for non-Windows platforms, and remove the
os.FileMode argument, which is ignored on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior, making
it not a good candidate to carry in the module.
This moves it to the daemon as a non-exported `resolveSymlinkedDirectory`
utility, so that it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It has no external consumers, is written with specific behavior (including
some potentially surprising behavior), making it not a good candidate to
carry in the module.
This moves it internal to the daemon as a non-exported utility, so that
it's only accessible where it's currently used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that it's part of the daemon, we can use the internal
package again to help discovery of rootless-specific codepaths
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both locations checked an error from `filepath.Rel` in stdlib, which
would never return a `system.XattrError`, so this was just dead code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The logdriver package should be moved to another external repository for
building plugins. While transitioning, move to internal package using
the same structure.
Signed-off-by: Derek McGowan <derek@mcg.dev>
CONFIG_MEMCG_SWAP has been deprecated since kernel v5.8-rc1 (commit 2d1c498) and removed since kernel v6.1-rc1 (commit e55b9f9).
Since kernel v5.8-rc1, swap tracking has been an integral part of memory control. CONFIG_MEMCG_SWAP becomes invisible to user and simply means CONFIG_MEMCG && CONFIG_SWAP.
Disable the check for kernel v5.8+.
Signed-off-by: 纯真 <38834411+chunzhennn@users.noreply.github.com>
This package is used internally by the daemon, and was only used out
side of the daemon by pkg/plugins (for which we still need to look
where it should be kept).
Making it internal because it's trivial to implement if needed by
anyone. The only reason it's a package is to keep it central, and
to make it easier to discover where we have rootlesskit-specific
codepaths in our codebase.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stdcopy moved to github.com/moby/moby/api/stdcopy, and the 28.4
transitional releasee will provide an alias for those that use
github.com/docker/docker as dependency, so we can remove the alias
for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/stringid moved to github.com/moby/moby/client/pkg/stringid, and
the 28.4 transitional releasee will provide an alias for those that
use github.com/docker/docker as dependency, so we can remove the
alias for the moby module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is used by the daemon to produce a stack-dump, It has no
external consumers, so we can move it to daemon/internal.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The runconfig package is used by the "container" router to unmarshal, normalize,
and validate a container.CreateRequest. The router converts the result to a
backend.ContainerCreateConfig to be passed on to the backend (daemon).
This package could possibly be part of the router itself, or moved to an
internal package in the server, but we don't have an internal package
there yet.
Put it in daemon/internal for now, which still leaves our options open.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that we no longer need the ContainerDecoder interface, we can
simplify this to just a function; effectively the ContainerDecoder
had three tasks;
- decode a container.CreateRequest
- validate the hostConfig
- split the container.CreateRequest to Config, HostConfig, and NetworkingConfig
Rewrite this to a DecodeCreateRequest function that returns
a DecodeCreateRequest.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These types used to be internal to the container package, but were
moved to the API in 100102108b.
However, the `StateStatus` type is only used internally; it's used
as an intermediate type because [`container.State`] contains a sync.Mutex
field which would make copying it unsafe (see [moby@2998945]).
This moves the type and re-introduces an internal type
in the original location, effectively reverting
100102108b
[`container.State`]: 19e79906cb/container/state.go (L15-L23)
[moby@2998945]: 2998945a54
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These errors were not used as sentinel error, and used as any other
"invalid parameter" / "invalid argument" error, so remove them, and
just produce errors where used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Since 28.0.0, an iptables rule related to SCTP has only been
included if escape hatch variable DOCKER_IPTABLES_SCTP_CHECKSUM=1
Nobody's reported that the escape hatch was needed, and the rule
it guards doesn't make sense. So, remove.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The "backend" types in API were designed to decouple the API server
implementation from the daemon, or other parts of the code that
back the API server. This would allow the daemon to evolve (e.g.
functionality moved to different subsystems) without that impacting
the API server's implementation.
Now that the API server is no longer part of the API package (module),
there is no benefit to having it in the API module. The API server
may evolve (and require changes in the backend), which has no direct
relation with the API module (types, responses); the backend definition
is, however, coupled to the API server implementation.
It's worth noting that, while "technically" possible to use the API
server package, and implement an alternative backend implementation,
this has never been a prime objective. The backend definition was
never considered "stable", and we don't expect external users to
(attempt) to use it as such.
This patch moves the backend types to the daemon/server package,
so that they can evolve with the daemon and API server implementation
without that impacting the API module (which we intend to be stable,
following SemVer).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The postCommit used the container-decoder from runconfig to unmarshal
the body. However, this function was written to decode a container
CreateRequest. Commit only accepts a container Config, so we can
just unmarshal to that type.
A local `commitRequest` type was added because the client posts a bare
`*container.Config` but it may be empty / nil (see [Client.ContainerCommit]
and [container.CommitOptions]), in which case it must be ignored, and no
overrides to be applied.
[Client.ContainerCommit]: c4afa77157/client/container_commit.go (L52)
[container.CommitOptions]: c4afa77157/api/types/container/options.go (L30)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some of these tests were making assumptions about the daemon's internals
by using `config.DefaultShmSize` from the daemon config package.
Rewrite them to start a daemon with a custom default, and verify the
tests to use that default.
This migrates the following tests from integration-cli to integration;
- `DockerAPISuite.TestPostContainersCreateShmSizeNegative`
- `DockerAPISuite.TestPostContainersCreateShmSizeHostConfigOmitted`
- `DockerAPISuite.TestPostContainersCreateShmSizeOmitted`
- `DockerAPISuite.TestPostContainersCreateWithShmSize`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The replacement is also deprecated, but at least returns a strong type,
which may help transitioning to using an api-client for these, and
removing one abstraction at a time.
Also rewriting the TestContainerAPIDeleteRemoveVolume to use the API
client (as it's part of the API suite), and touched-up the
TestRunMountShmMqueueFromHost test a bit.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was a very shallow wrapper around reading the response
headers, and querying those directly is more transparent.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It took me some time to find these commands because they were not named
after their canonical name, unlike (most) other commands.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Now that the types for the backend were moved to api/types/backend,
we can move the actual response-type and related options to
api/types/system.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While it is imported by both the client and the daemon, values of the
PluginCreateOptions struct are not marshaled or unmarshaled. The only
field is mapped to and from an HTTP query parameter. Furthermore, this
options type is the odd one out: the daemon uses types in
api/types/backend to pass options around for the other plugin lifecycle
operations. Move the PluginCreateOptions type into client, and define a
new PluginCreateConfig struct in api/types/backend for the daemon to use
alongside PluginRmConfig, PluginEnableConfig and PluginDisableConfig.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stringid package is used in many places; while it's trivial
to implement a similar utility, let's just provide it as a utility
package in the client, removing the daemon-specific logic.
For integration tests, I opted to use the implementation in the
client, as those should not ideally not make assumptions about
the daemon implementation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Because:
- it's the last thing outside 'daemon/' that uses libnetwork's
resolvconf package
- there's better coverage of the host resolv.conf transformations
in the resolvconf package's unit tests
- there are integration tests that don't modify the test host's
resolv.conf file in 'integration/networking/resolvconf_test.go'
Signed-off-by: Rob Murray <rob.murray@docker.com>
It's not really a helper, and it's trivial to inline it;
registry/registry_test.go:366:19: test helper function should start from t.Helper() (thelper)
testIndexInfo := func(t *testing.T, config *serviceConfig, expectedIndexInfos map[string]*registry.IndexInfo) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/auth.go:43:31: import-shadowing: The name 'auth' shadows an import name (revive)
func NewStaticCredentialStore(auth *registry.AuthConfig) auth.CredentialStore {
^
registry/auth.go:63:7: unused-receiver: method receiver 'scs' is not referenced in method's body, consider removing or renaming it as _ (revive)
func (scs staticCredentialStore) SetRefreshToken(*url.URL, string, string) {
^
registry/auth.go:143:40: import-shadowing: The name 'transport' shadows an import name (revive)
func PingV2Registry(endpoint *url.URL, transport http.RoundTripper) (challenge.Manager, error) {
^
registry/registry_mock_test.go:85:22: response body must be closed (bodyclose)
res, err := http.Get(makeURL("/v1/_ping"))
^
registry/search_session.go:222:96: integer-format: fmt.Sprintf can be replaced with faster strconv.Itoa (perfsprint)
u := r.indexEndpoint.String() + "search?q=" + url.QueryEscape(term) + "&n=" + url.QueryEscape(fmt.Sprintf("%d", limit))
^
registry/auth.go:134:24: import-shadowing: The name 'url' shadows an import name (revive)
func ConvertToHostname(url string) string {
^
registry/search_endpoint_v1.go:61: line-length-limit: line is 437 characters, out of limit 200 (revive)
return nil, invalidParamf("invalid registry endpoint %s: %v. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry %s` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/%s/ca.crt", endpoint, err, endpoint.URL.Host, endpoint.URL.Host)
registry/search_endpoint_v1.go:166:17: import-shadowing: The name 'transport' shadows an import name (revive)
func httpClient(transport http.RoundTripper) *http.Client {
^
registry/search_session.go:239:26: ST1005: error strings should not be capitalized (staticcheck)
return nil, errUnknown{fmt.Errorf("Unexpected status code %d", res.StatusCode)}
^
registry/search_test.go:18:6: test helper function should start from t.Helper() (thelper)
func spawnTestRegistrySession(t *testing.T) *session {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/errors.go:11:2: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e := err.(type) {
^
registry/errors.go:13:3: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2 := e.Err.(type) {
^
registry/errors.go:15:4: singleCaseSwitch: should rewrite switch statement to if statement (gocritic)
switch e2.Code {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
registry/config.go:267:46: captLocal: `URLHost' should not be capitalized (gocritic)
func isCIDRMatch(cidrs []*registry.NetIPNet, URLHost string) bool {
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 5f91c769f5, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 08654b0b30, which
was part of the v28.x release, and is no longer used so we can remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bf6d52bba1, but don't
think it was ever used; at least it's severely outdated, so let's
remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- refactor programIngressPorts to use Rule.Insert/Append/Delete for improved rule management
- split programIngress() and dependent functions on Add and Del functions
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
- Extract plumpIngressProxy steps in a separate function
- Don't create a new listener if there's already one in ingressProxyTbl
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
Make sure iptables rules are restored properly once firewalld
has deleted them.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Signed-off-by: Andrey Epifanov <aepifanov@mirantis.com>
This type was deprecated in ca06b222e3,
and is no longer used. Now that the API is in a new module, we can
remove the alias.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to fcc8209e12, which didn't
make the window for API v1.51, so had to be adjusted for the API
version it requires.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The strslice.StrSlice type is a string-slice with a custom JSON Unmarshal
function to provide backward-compatibility with older API requests from
before docker 1.7 (see [moby@17d6f00] and [moby@ea4a067]), which used a
string instead of an array of strings for some fields (Cmd, Entrypoint).
We no longer support those API versions, and we no longer support pulling
v1 images that may contain such a config, so we can remove these tests that
validate the behavior as they're invalid API requests.
This;
- removes DockerAPISuite.TestPostContainerAPICreateWithStringOrSliceEntrypoint
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCmd
- removes DockerAPISuite.TestPostContainersCreateWithStringOrSliceCapAddDrop
- updates DockerAPISuite.TestContainerAPIPostCreateNull, which used an invalid example
[moby@17d6f00]: 17d6f00ec2
[moby@ea4a067]: ea4a06740b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This interface was marked deprecated in 2997c0ddc0.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in 639a1214fa.
Now that the client is in a new module, we can remove the old.
This;
- Removes the `Client.ImageInspectWithRaw` implementation.
- Removes `ImageAPIClient.ImageInspectWithRaw` from the `ImageAPIClient` interface.
- Removes `APIClient.ImageInspectWithRaw` from the `APIClient` interface.
- Removes `ImageAPIClientDeprecated.ImageInspectWithRaw` from the `ImageAPIClientDeprecated`.
- Removes the `ImageAPIClientDeprecated` interface.
Note that the `ImageAPIClientDeprecated` interface itself was not marked
as deprecated, but it has no known external users, and it has no remaining
definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was marked deprecated in 7aa7369f1f,
and is no longer used.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was only used internally, and marked deprecated in
846b2272e6.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `NewClient` and `NewEnvClient` function were deprecated in 2018
through 772edd020c, with the deprecation
message updated in a68ae4a2d9 and
6b9968e8b1 to make sure it's properly
identified as deprecated.
Now that the client is in a new module, we can remove the old.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 20d594fb79, but was
written before the API module was added. Now that the API is a separate
module, the check will no longer flag packages importing the API.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Merge the matchAllWithPreference matcher into the matchAnyWithPreference
matcher to reduce code duplication and simplify the code.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Currently the image export and load APIs can be used to export or load all
platforms for the image, or a single specified platform.
This commit updates the API so that it accepts a list of platforms to export or
load, thereby giving clients the ability to export only selected platforms of an
image into a tar file, or load selected platforms from a tar file.
Unit and integration tests were updated accordingly.
As this requires a daemon API change, the API version was bumped.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Before this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
error during connect: Get "http://example.invalid:2375/docker/v1.51/version": dial tcp: lookup example.invalid: no such host
With this patch:
DOCKER_HOST=tcp://example.invalid/docker docker version
failed to connect to the docker API at tcp://example.invalid:2375/docker: lookup example.invalid: no such host
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this change, a generic "Cannot connect to the docker daemon" error
was produced which, while helpful, instructed the user to check if the daemon
was running, but didn't provide context on the reason we failed (i.e., the
socket was not found).
This patch adds a dedicated check for cases where the socket was not found,
and preserves the original error.
Before this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
Cannot connect to the Docker daemon at unix:///var/run/no.sock. Is the docker daemon running?
With this patch:
DOCKER_HOST=unix:///var/run/no.sock docker version
failed to connect to the docker API at unix:///var/run/no.sock; check if the path is correct and the daemon is running: dial unix /var/run/no.sock: connect: no such file or directory
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, we were using os.IsPermission, which doesn't unwrap errors;
change to use `errors.Is` to detect permission errors, and unwrap the
error to remove information about the request, which is irrelevant if
we weren't able to connect in the first place.
Also tweak the error slightly to not assume "docker socket", instead
mentioning "docker API".
Before this;
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version": dial unix /var/run/docker.sock: connect: permission denied
With this patch applied:
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock: dial unix /var/run/docker.sock: connect: permission denied
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Packets with the given firewall mark are accepted by the bridge
driver's filter-FORWARD rules.
The value can either be an integer mark, or it can include a
mask in the format "<mark>/<mask>".
Signed-off-by: Rob Murray <rob.murray@docker.com>
While the container package had a type for `ExecInspect`, this type only
contained the information currently used by the client, which was a subset
of the information returned by the API endpoint;
curl --unix-socket /var/run/docker.sock http://localhost/v1.51/exec/2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9/json | jq .
{
"ID": "2f8fc8b4b5003e9a58d97459e6561f2bf2d88bc059bc59c6633e7f765fb8d1e9",
"Running": true,
"ExitCode": null,
"ProcessConfig": {
"tty": true,
"entrypoint": "bash",
"arguments": [],
"privileged": false
},
"OpenStdin": true,
"OpenStderr": true,
"OpenStdout": true,
"CanRemove": false,
"ContainerID": "8b7cd6b151613ccc20ebe9fc24d72cc7865b04c592848ab1415a80da9b315479",
"DetachKeys": "EBE=",
"Pid": 19964
}
The API documentation for the endpoint documented the full response, but
we did not have a type for this, other than a type used by the backend.
This patch adds a type for the response. It currently aliases the backend
type to this type to preserve backward compatibility (and allow the API
module to be used in older branches). We can probably switch the backend
to use this type directly though (unless we want the backend to be
decoupled from the API response).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When an endpoint in a gateway mode "nat" network is selected
as a container's default gateway, the bridge driver sets up
bindings between host and container ports (NAT, userland proxy
etc).
When gateway mode "routed" was added as an alternative to
the default "nat" mode - port bindings followed the same rules.
But, unlike "nat" mode, there's no host port binding to set
up - there's routing between remote client and the container,
so it doesn't matter what the default gateway is.
So, in "routed" mode, set up the rules to make a container's
published ports accessible when the endpoint is added, and
remove those rules when the endpoint is removed (when the
container is disconnected from the endpoint's network).
Port mappings are only provided by ProgramExternalConnectivity,
they can't be set up during the Join. So, include routed
bindings in the port bindings mode that's stored as part of
endpoint state - and use that to work out whether to add or
remove bindings.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The libnetwork controller naively handled events for endpoint_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, adding a new
service binding without removing the old one. This would
have various side effects, such as having the "transient state" of
having multiple conflicting service bindings where more than one
endpoint is assigned an IP address never settling.
Modify the libnetwork controller to handle an UPDATE by removing the
previous service binding then adding the new one.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The eventually-consistent nature of NetworkDB means we cannot depend on
events being received in the same order that they were sent. Nor can we
depend on receiving events for all intermediate states. It is possible
for a series of entry UPDATEs, or a DELETE followed by a CREATE with the
same key, to get coalesced into a single UPDATE event on the receiving
node. Watchers of NetworkDB tables therefore need to be prepared to
gracefully handle arbitrary UPDATEs of a key, including those where the
new value may have nothing in common with the previous value.
The overlay driver naively handled events for overlay_peer_table
assuming that an endpoint leave followed by a rejoin of the same
endpoint would always be expressed as a DELETE event followed by a
CREATE. It would handle a coalesced UPDATE as a CREATE, inserting a new
entry into peerDB without removing the old one. This would
have various side effects, such as having the "transient state" of
multiple entries in peerDB with the same peer IP never settle.
Update driverapi to pass both the previous and new value of a table
entry into the driver. Modify the overlay driver to handle an UPDATE by
removing the previous peer entry from peerDB then adding the new one.
Modify the Windows overlay driver to match.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Windows and Linux overlay driver instances are interoperable, working
from the same NetworkDB table for peer discovery. As both drivers
produce and consume serialized data through the table, they both need to
have a shared understanding of the shape and semantics of that data.
The Windows overlay driver contains a duplicate copy of the protobuf
definitions used for marshaling and unmarshaling the NetworkDB peer
entries for dubious reasons. It gives us the flexibility to have the
definitions diverge, which is only really useful for shooting ourselves
in the foot.
Make daemon/libnetwork/drivers/overlay the source of truth for the peer
record definitions and the name of the NetworkDB table for distributing
peer records.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The macAddr and ipmac types are generally useful within libnetwork. Move
them to a dedicated package and overhaul the API to be more like that of
the net/netip package.
Update the overlay driver to utilize these types, adapting to the new
API.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Overlay is the only driver which makes use of the EventNotify facility,
yet all other driver implementations are forced to provide a stub
implementation. Move the EventNotify and DecodeTableEntry methods into a
new optional TableWatcher interface and remove the stubs from all the
other drivers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When handling updates to existing entries, it is often necessary to know
what the previous value was. NetworkDB knows the previous and new values
when it broadcasts an update event for an entry. Include both values in
the update event so the watchers do not have to do their own parallel
bookkeeping.
Unify the event types under WatchEvent as representing the operation kind
in the type system has been inconvenient, not useful. The operation is
now implied by the nilness of the Value and Prev event fields.
Signed-off-by: Cory Snider <csnider@mirantis.com>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It only uses the last element of the import_path to be used as package
name (omitting it will pick the name of the `.proto`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The bridge driver currently determines if hairpin mode is enabled by
checking whether the userland proxy is enabled, and if the binary path
is set to a non-empty string. It's used (amongst other things) by the
driver to decide whether 6-to-4 portmappings are supported, while it
normalizes port bindings.
As the userland proxy is going to be handled by the nat portmapper,
proxy-related params will be removed from the bridge driver, but the
port binding normalization will stay in the bridge driver.
So, introduce a new Hairpin config flag, and reimplement the original
logic in the daemon, when creating the bridge config.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The two unexported fields of portBindingReq (ChildHostIP and DisableNAT)
are temporarily exported. DisableNAT will be replaced in a future commit
by a 'Mapper' field indicating which portmapper should be used (e.g.
'nat' or 'routed').
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This code has various other issue, for which TODOs were added; this
commit only does some initial cleaning up, and improves docs and
test-coverage.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The stdcopy package is used to produce and read multiplexed streams for
"attach" and "logs". It is used both by the API server (to produce), and
the client (to read / de-multiplex).
Move it to the api package, so that it can be included in the api module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests don't account well for submodules and are not needed when
importers are using go modules. The tests are still relevant in the 28
branch which does not use go modules.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The ContainerConfigWrapper type was deprecated and removed; refer
to the correct type (container.CreateCreateRequest).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in bb899c654a,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `RequestPrivilegeFunc` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in b99b5422b0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `IDResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 1abc8f6158,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `ContainerJSONBase`, `ContainerJSON` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 05b0e653dd,
which shipped in the latest v28.x releases, so we can remove these.
This removes the Container type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in 84ffc644ef,
which shipped in the latest v28.x releases, so we can remove these.
This removes the ContainerState type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in df22a511cb,
which shipped in the latest v28.x releases, so we can remove these.
This removes the NetworkSettings, NetworkSettingsBase, DefaultNetworkSettings,
and SummaryNetworkSettings types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in c130ce1f5d,
which shipped in the latest v28.x releases, so we can remove these.
This removes the `Health` and `HealthcheckResult` types to the container package,
as well as the related `NoHealthcheck`, `Starting`, `Healthy`, and `Unhealthy`
consts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5517322cf9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.MountPoint`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in e12b7493b9,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.Port`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in da039ca918,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.GraphDriverData`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 7053007f71,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ImageInspect` and
`RootFS`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 23117afca8,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.SecretCreateResponse` and
`SecretListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in a411a39be0,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ConfigCreateResponse` and
`ConfigListOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in f008d85edc,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.NodeListOptions` and
`NodeRemoveOptions`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These was added in 5ad0867236,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.TaskListOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 31d62930f7,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types.ServiceCreateOptions`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 0b1c7a8306,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ServiceUpdateOptions`
- `RegistryAuthFromSpec`
- `RegistryAuthFromPreviousSpec`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in b13528522a,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.ServiceListOptions` and
`api/types.ServiceInspectOptions` types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in 7e8f630bec,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.SwarmUnlockKeyResponse` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in eefe68a37c,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `BuildCache`
- `BuildCachePruneOptions`
- `BuildCachePruneReport`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This alias was added in bb7dbaafcd,
which shipped in the latest v28.x releases, so we can remove this.
This removes the deprecated `api/types.BuildResult` type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These aliases were added in 3d1e4d9002,
which shipped in the latest v28.x releases, so we can remove these.
This removes the deprecated `api/types`;
- `ImageBuildOptions`
- `ImageBuildOutput`
- `ImageBuildResponse`
- `BuilderVersion`
- `BuilderV1`
- `BuilderBuildKit`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to maintain GoDoc in a single place, and for
"Kill" and "Alive" to have consistent error-handling (Windows
does not support negative process-IDs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Originally I've found this datarace on a project I'm working at. I'm not
able to consistently reproduce this. But by looking at the codebase I
took a chance to fix other 2 possible function that might produce such
data race.
Original stack trace produced when running `go test -race` on GH CI:
```
WARNING: DATA RACE
Write at 0x00c0005dc688 by goroutine 43:
github.com/docker/docker/client.(*Client).negotiateAPIVersionPing()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:389 +0x12f
github.com/docker/docker/client.(*Client).checkVersion()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:298 +0x249
github.com/docker/docker/client.(*Client).getAPIPath()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/client.go:307 +0x76
github.com/docker/docker/client.(*Client).sendRequest()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:111 +0x9b
github.com/docker/docker/client.(*Client).get()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/request.go:28 +0x736
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:47 +0x6f0
Previous read at 0x00c0005dc688 by goroutine 42:
github.com/docker/docker/client.(*Client).ContainerList()
/home/runner/go/pkg/mod/github.com/docker/docker@v28.2.2+incompatible/client/container_list.go:39 +0x5ef
```
Co-authored-by: Luca Rinaldi <lucarin@protonmail.com>
Signed-off-by: Alessio Perugini <alessio@perugini.xyz>
- Get dependent containers before starting containers
- Dependent containers can be either from legacy link or container network
- Wait on a best effort basis for the dependent containers
Fixes: #50326
Signed-off-by: Adrien Pompée <adrien.pompee@atmosphere.aero>
This const is no longer used and will be removed in the next release.
Also fixed a var that shadowed a type.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the daemon and API migrating to separate modules, users of the daemon
module may upgrade the API module to higher versions. Currently, the daemon
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Daemon
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the daemon/config package that is
used as default version of the API for the daemon to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
#27 94.97 executor/oci/internal/resolvconf/resolvconf.go:461:6: the error type name `systemErr` should conform to the `xxxError` format (errname)
#27 94.97 type systemErr struct{ error }
#27 94.97 ^
Also fix an unhandled error; we don't need a defer() for that one
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rewrite this function to not use text/template, which is ~74× faster,
~25× less memory, and ~56× fewer allocations.
Before/After:
BenchmarkGenerate-10 42550 27439 ns/op 18083 B/op 394 allocs/op
BenchmarkGenerate-10 3148328 373 ns/op 712 B/op 7 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With the client and API migrating to separate modules, users of the Client
module may upgrade the API module to higher versions. Currently, the Client
uses the API's Default version. While the version of the API module is
allowed to be updated (following SemVer), we should not allow the Client
to support higher API versions than it was written for.
This patch introduces a DefaultAPIVersion in the client package that is
used as default version of the API for the client to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The image load is only used by integration tests but the specialimage
testutils package used by many different tests. The image load relies on
the client which creates a transitive client dependency from the daemon
packages.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Currently, EncodeAuthConfig always returns a base64url-encoded JSON
doc, even if an empty auth-config passed. As a result, it's more
complicated to detect if authentication was present.
This patch changes the behavior to return an empty string for these
cases so that teh client can skip setting the `X-Registry-Auth` header,
and the daemon can detect whether authentication is sent or not.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Remove the special condition needed to run Windows integration tests
with the containerd integration enabled in addition to the graphdriver.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The property test for the mRandomNodes function revealed that it may
sometimes pick out a sample of fewer than m nodes even when the number
of nodes to pick from (excluding the local node) is >= m. Rewrite it
using a random shuffle or permutation so that it always picks a
uniformly-distributed sample of the requested size whenever the
population is large enough.
Signed-off-by: Cory Snider <csnider@mirantis.com>
TestNetworkDBAlwaysConverges will occasionally find a failure where one
entry is missing on one node even after waiting a full five minutes. One
possible explanation is that the selection of nodes to gossip with is
biased in some way. Test that the mRandomNodes function picks a
uniformly distributed sample of node IDs of sufficient length.
The new test reveals that mRandomNodes may sometimes pick out a sample
of fewer than m nodes even when the number of nodes to pick from
(excluding the local node) is >= m. Put the test behind an xfail tag so
it is opt-in to run, without interfering with CI or bisecting.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a property-based test which asserts that a cluster of NetworkDB
nodes always eventually converges to a consistent state. As this test
takes a long time to run it is build-tagged to be excluded from CI.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Integration tests should not be using daemon internals. Since this is
testing against regression and the relevant code has a feature freeze on
it, this test can be removed. The test is not relevant with containerd,
which has more protection against these cases through gc.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Before ea29dffaa5, the image create endpoint
had a [fallback for very old client versions][1] that would send authentication
as body instead of through the `X-Registry-Auth` header.
However, the implementation of this fallback did not handle empty bodies,
resulting in an `io.EOF` error to be returned when trying to parse the
body as JSON.
In practice, this problem didn't happen when using the CLI, because even
if no authentication was present, `registry.EncodeAuthConfig()` (used by
the CLI to set the `X-Registry-Auth` header) would produce an empty JSON
document (`{}`), which would be encoded in base64 (`e30=`), so we would
never set an empty `X-Registry-Auth` (but other clients may have hit this
situation). That behavior was unexpected, because not all registries require
authentication, and omitting the `X-Registry-Auth` should be valid. We
also want to have more flexibility in authentication (and being able to
distinguish unauthenticated requests, so that we can fallback to
alternative paths).
Unfortunately, we can't change existing daemons, so must account for the
faulty fallback. Currently, omitting the `X-Registry-Auth` produces an
error, but we can avoid this by unconditionally sending a body, which
may be an empty JSON document (`{}`).
I explored possible options for this; we can either construct our own
empty JSON (`json.RawMessage("{}")`) to be explicit that we're sending
empty JSON, but [`encodeBody()`][2] is currently hard-coded to expect
JSON requests, and unconditionally calls [`encodeData`][3], which
encodes to JSON, so we may as well take advantage of `http.NoBody`,
which gets marshaled to an empty JSON document;
https://go.dev/play/p/QCw9dJ6LGQu
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
body, _ := json.Marshal(http.NoBody)
fmt.Println(string(body))
}
Before this patch, a client omitting `X-Registry-Auth` (and no body)
would produce an error;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
Error response from daemon: bad parameters and missing X-Registry-Auth: invalid X-Registry-Auth header: EOF
With this patch applied, no error is produced;
docker pull -q busybox
docker tag busybox 127.0.0.1:5001/myimage:latest
docker run -d --name registry -p 127.0.0.1:5001:5000 registry:3
docker push 127.0.0.1:5001/myimage:latest
The push refers to repository [127.0.0.1:5001/myimage]
189fdd150837: Pushed
latest: digest: sha256:68a0d55a75c935e1101d16ded1c748babb7f96a9af43f7533ba83b87e2508b82 size: 610
[1]: 63fcf7d858/api/types/registry/authconfig_test.go (L109-L114)
[2]: 63fcf7d858/client/request.go (L67-L87)
[3]: 63fcf7d858/client/request.go (L296-L304)
[4]: ea29dffaa5
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This new struct allocates ports from the operating system by creating
sockets and binding them. It's based on the existing bindTCPOrUDP and
bindSCTP functions previously defined in the bridge driver. It tries to
detect conflicts on best effort basis, and doesn't guarantee that the
ports it allocates are not in use by other processes.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- Use doc-links for references to other types.
- Fix reference to "types.HijackedConnection", which doesn't exist.
- Use a bullet-list for the different stream formats used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The registry package is used in docker/cli, and currently depends on
pkg/homedir. This package was anly used when running with rootlesskit,
which only is supported on Linux; on other platforms, homedir.GetConfigHome
would return an error;
abba330bbf/pkg/homedir/homedir_others.go (L24-L27)
Replace homedir.GetConfigHome with os.UserConfigDir from stdlib, which
is similar, with exception of not falling back to `getent` for
resolving the user's homedir, which would be a corner-case.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The previous implementation generated layer names based on container ID
and source image, which would cause conflicts when mounting the same
image to multiple destinations within a container.
This fixes the issue by changing the layer naming strategy to include
the destination path in the layer name, making it unique for each mount
point.
To avoid filesystem paths producing unexpected names, the combined
string is hex-encoded and used as a layer name.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change changes the default for noOverwriteDirNonDir to be true
internally, with the intent to change the default at the API to follow
accordingly.
The `AllowOverwriteDirWithFile` option in the Client was added when
reimplementing the CLI using the API Client lib in [moby@1b2b91b].
Before that refactor, the `noOverwriteDirNonDir` query argument
[would be set unconditionally][1] by the CLI, with no options to
control the behavior.
The `noOverwriteDirNonDir` query parameter was added in [moby@db9cc91] to
set the `NoOverwriteDirNonDir` option that was implemented in pkg/archive
in [moby@a74799b].
It was added in [PR13171-comment2], following a discussion on the risk
of replacing a directory with a file and vice-versa in [PR13171-comment].
> In my latest changes from yesterday:
>
> - Removed the `GET stat-path` endpoint and added a `HEAD` handler to
> the `archive-path` endpoint. Updated the api docs to reflect this.
> Also moved api docs changes from `v1.19` to `v1.20`.
> - Added a `NoOverwriteDirNonDir` flag to `archive.TarOptions` to indicate
> that we do not want to overwrite a directory with a non-directory (and
> vice versa) when unpacking an archive.
> - Added a corresponding but optional `noOverwriteDirNonDir` parameter
> to the `PUT extract-to-dir` endpoint to specify desired behavior.
>
> These changes combine to keep the behavior we want
It's unclear why these were added as an *option* and why it was implemented
as opt-in (not opt-out), as overwriting a file with a directory (or vice-versa)
would generally be unexpected behavior.
[1]: 8c9ad7b818/api/client/cp.go (L345-L346)
[moby@1b2b91b]: 1b2b91ba43
[moby@a74799b]: a74799b701
[moby@db9cc91]: db9cc91a9e
[PR13171-comment]: https://github.com/moby/moby/pull/13171#issuecomment-106559765
[PR13171-comment2]: https://github.com/moby/moby/pull/13171#issuecomment-108538643
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is failing frequently (50%) on Windows;
=== FAIL: github.com/docker/docker/integration/container TestExecResize/success (0.01s)
exec_test.go:144: assertion failed: error is not nil: Error response from daemon: NotFound: exec: '9c19c467436132df24d8b606b0c462b1110dacfbbd13b63e5b42579eda76d7fc' in task: '7d1f371218285a0c653ae77024a1ab3f5d61a5d097c651ddf7df97364fafb454' not found: not found
Let's keep the test, but log the failure and skip on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These functions were used internally to keep track of whether containerd
was enabled as runtime on Windows; move it to libcontainerd.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was failing frequently on Windows, waiting for the state
of the container to be "running" after restarting, however, this
would race because the command of the container was very short-lived;
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIRestartSuite/TestRestartStoppedContainer (37.00s)
docker_cli_restart_test.go:42: assertion failed: error is not nil: condition ""true" == "false"" not true in time (20s)
Ironically, that check was added in 48ccdd46ae
to make the test less flaky.
This patch takes the approach from TestRestartRunningContainer, which had
similar issues on Windows that were addressed in bae22d167c
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`Daemon.Stop()` is called in teardown of tests, resulting in a lot of noise;
docker_cli_network_unix_test.go:52: [d124e10f67e01] daemon is not started
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
docker_cli_external_volume_driver_test.go:59: [d50e371ba1d6f] daemon is not started
Let's ignore if the daemon is already stopped, as that's what we want to here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test was testing a non-gracceful kill od the daemon, after which it
started it again, however `d.Stop()` would log that the daemon wasn't running,
which is expected, so let's reduce noise;
docker_cli_network_unix_test.go:1143: [dadd2ae3b638b] daemon is not started
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test depended on the container to die after running the `true` command,
but this condition failed frequently on Windows 2025.
=== Failed
=== FAIL: github.com/docker/docker/integration/container TestRemoveContainerWithVolume (32.68s)
remove_test.go:61: timeout hit after 10s: waiting for container State.Status to be 'exited', currently 'running'
While this may be revealing an actual issue (and we should have a test for
that), it's irrelevant for this test, which;
- creates and starts a container with an anonymous volume
- verifies the anonymous volume was created
- removes the container
- verifies the anonymous volume was removed
We can force-remove the container to kill, and removed it; we probably
could've sufficed with "container create" (without starting), but it's
good to add extra coverage, in case running the container impacts whether
we're able to remove the volume.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make sure we have basic coverage for this function; integration-cli may
have additional tests covering this as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Add test for privileged containers
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use ContainerInspect instead of manually unmarshaling the raw JSON
- Explicitly stop the container instead of polling for it to die
- Use subtests and run parallel
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 44b653ef99, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in df662ebc59, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in 100102108b, which
was part of v28.2, but the container package was moved inside the daemon
in 5419eb1efc, so these aliases were no
longer useful.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was added in a63ff8da46, but looks
like the only reason was to just have the var initialized, so let's
do so when we create the var.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These fields were deprecated in 1932091e21,
which is part of v28. They were kept in place for responses in older API
versions, but no longer used since 7d9c50db2b,
which implemented a fallback without requiring the fields to be present.
This patch:
- removes `ServiceConfig.AllowNondistributableArtifactsCIDRs`
- removes `ServiceConfig.AllowNondistributableArtifactsHostnames`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in b633c4cc33, which was
in v28, and no longer has any consumer, so we can remove it.
Now that we no longer have to synchronise `CertsDir` with `SetCertsDir`
we can also remove the synchronization (`homedir.GetConfigHome()` does
some additional lookups, but those usually are just looking up env-vars,
and `user.Current()` already has a `sync.Once` or equivalent). Also
unifying the platform-specific code to remove some abstraction and put
the logic in plain sight.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in dd7ab0e82b which was
in v28, and no longer has any consumer, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the only non-daemon import of the image package. The platform
type is also the better type to use.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The writeToStore() call was removed from CreateNetwork in
commit 0fa873c0fe. The comment about
undoing the write is no longer applicable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Legacy links were set up by ProgramExternalConnectivity, but
removed by Leave (rather than RevokeExternalConnectivity). The
options needed by legacy links are all available in Join, and
Join will only be called once per Endpoint. So, create legacy
links there.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Change the semantics of ProgramExternalConnectivity, libnet
can now call it whenever an endpoint is selected or deselected
as a container's gateway endpoint.
It's the driver's responsibility to remember what bindings it's
set up, and to work out what needs to change.
So, calling ProgramExternalConnectivity to tell the driver
an endpoint is no longer a gateway has the same effect as
RevokeExternalConnectivity - bindings need to be removed.
That means libnet no longer needs to work out whether to
Program/Revoke, it can just call ProgramExternalConnectivity.
RevokeExternalConnectivity has been removed.
Signed-off-by: Rob Murray <rob.murray@docker.com>
The concurrency control in the overlay driver is logically unsound.
While the use of mutexes is sufficient to prevent data races --
violations of the Go memory model -- many operations which need to be
atomic are performed with unbounded concurrency.
Overhaul the use of locks in the overlay network driver. Implement sound
locking at the network granularity: operations may proceed concurrently
iff they are being applied to distinct networks. Push the responsibility
of locking up to the code which calls methods or accesses struct fields
to avoid deadlock situations like we had previously with
d.initSandboxPeerDB() and to make the code easier to reason about.
Each overlay network has a distinct peer db. The NetworkDB watch for the
overlay peer table for the network will only start after
(*driver).CreateNetwork returns and will be stopped before libnetwork
calls (*driver).DeleteNetwork, therefore the lifetime of the peer db for
a network is constrained to the lifetime of the network itself. Yet the
peer db for a network is tracked in a dedicated map, separately from the
network objects themselves. This has resulted in a parallel set of
mutexes to manage concurrency of the peer db distinct from the mutexes
for the driver and networks. Move the peer db for a network into a field
of the network struct and guard it from concurrent access using the
per-network lock. Move the methods for manipulating the peer db into the
network struct so that the methods can only be called if the caller has
a reference to the network object.
Network creation and deletion are synchronized using the driver-scope
mutex, but some of the kernel programming is performed outside of the
critical section. It is possible for network deletion to race with
recreating the network, interleaving the kernel programming for the
network creation and deletion, resulting in inconsistent kernel state.
Parallelize network creation and deletion soundly. Use a double-checked
locking scheme to soundly handle the case of concurrent CreateNetwork
and DeleteNetwork for the same network id without blocking operations
on other networks. Synchronize operations on a network so that
operations on the network such as adding a neighbor to the peer db are
performed atomically, not interleaved with deleting the network.
Signed-off-by: Cory Snider <csnider@mirantis.com>
There is a dedicated mutex for synchronizing access to the encrMap.
Separately, the main driver mutex is used for synchronizing access to
the encryption keys. Their use is sufficient to prevent data races (if
used correctly, which is not the case) but not logical race conditions.
Programming the encryption parameters for a peer can race with
encryption keys being updated, which could lead to inconsistencies
between the parameters programmed into the kernel and the desired state.
Introduce a new mutex for synchronizing encryption operations. Use that
mutex to synchronize access to both encrMap and keys. Handle encryption
key updates in a critical section so they can no longer be interleaved
with kernel programming of encryption parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
func (*driver) secMapWalk is a curious beast. It is named walk, yet it
also mutates the collection being iterated over. It returns an error,
but that error is always nil. It takes a callback that can break
iteration, yet the only caller makes no use of that affordance. Its
utility is limited and the abstraction hinders readability more than it
helps. Open-code the d.secMap.nodes loop into
func (*driver) updateKeys(), the only caller.
Signed-off-by: Cory Snider <csnider@mirantis.com>
bindHostPorts currently handles both NATed and routed port mappings.
Split this into two separate functions, one for each type of mapping.
This will help split portmappers.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Port bindings are currently sorted — to form groups that should be
mapped in one go — and then normalized by `configurePortBindingIPv[4|6]`.
However, gw_modes might not be the same for IPv4/v6, so the upcoming
split of NATed / routed portmappers will require that they're processed
independently.
With this commit, PBs are now normalized (by calling the `configure...`
funcs), and then sorted. The sort func is updated to group routed PBs.
`needSamePort` was comparing the container's IP address, but this field
was never set by the time it's called. Now it's set, and has a different
value when IPv4 / IPv6 portmappings are mixed, so remove it from the
comparison.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Since commit b3fabedec, the bridge driver maps ports following a 3-step
process: 1. create a socket, and bind it to the host port; 2. create
iptables rules; 3. start the userland proxy (if it's enabled). This
ensures that the port is really free before inserting iptables rules
that could otherwise disrupt host services.
However, this 3-step process wasn't implemented for SCTP, because we had
no way to instiantiate an SCTP listener from an fd. Since
github.com/ishidawataru/sctp@4719921f9, we can.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5
This minor releases include 1 security fixes following the security policy:
- cmd/go: unexpected command execution in untrusted VCS repositories
Various uses of the Go toolchain in untrusted VCS repositories can result in
unexpected code execution. When using the Go toolchain in directories fetched
using various VCS tools (such as directly cloning Git or Mercurial repositories)
can cause the toolchain to execute unexpected commands, if said directory
contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
repository). This is due to how the Go toolchain attempts to resolve which VCS
is being used in order to embed build information in binaries and determine
module versions.
The toolchain will now abort attempting to resolve which VCS is being used if it
detects multiple VCS configuration metadata in a module directory or nested VCS
configuration metadata (such as a '.git' directoy in a parent directory and a
'.hg' directory in a child directory). This will not prevent the toolchain from
building modules, but will result in binaries omitting VCS related build
information.
If this behavior is expected by the user, the old behavior can be re-enabled by
setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
repositories.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
this issue.
This is CVE-2025-4674 and https://go.dev/issue/74380.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.5
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The TestNatNetworkICC and TestFlakyPortMappedHairpinWindows (TestPortMappedHairpinWindows)
tests were frequently failing on Windows with a context timeout;
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC/User_defined_nat_network (9.67s)
nat_windows_test.go:62: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/4357bd24c9b77b955ee961530d1f552ce099b3dcbeb396db599971b2396d8b08/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network mynat has active endpoints (name:"ctr2" id:"dc8d597dafef")
=== FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC (18.34s)
=== FAIL: github.com/docker/docker/integration/networking TestFlakyPortMappedHairpinWindows (13.02s)
nat_windows_test.go:110: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/65207ae3d6953d85cd2123feac45af60b059842d570d4f897ea53c813cba3cb4/start": context deadline exceeded
panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network clientnet has active endpoints (name:"amazing_visvesvaraya" id:"18add58d415e")
These timeouts were set in c1ab6eda4b and
2df4391473, and were shared between Linux
and Windows; likely Windows is slower to start, so these timeouts to be
expected.
Let's increase the context timeout to give it a bit more time.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
NetworkDB's JoinNetwork function enqueues a message onto a
TransmitLimitedQueue while holding the NetworkDB mutex locked for
writing. The TransmitLimitedQueue has its own synchronization;
it locks its mutex when enqueueing a message. Locking order:
1. (NetworkDB).RWMutex.Lock()
2. (TransmitLimitedQueue).mu.Lock()
NetworkDB's gossip periodic task calls GetBroadcasts on the same
TransmitLimitedQueue to retrieve the enqueued messages. GetBroadcasts
invokes the queue's NumNodes callback while the mutex is locked. The
NumNodes callback function that NetworkDB sets locks the NetworkDB mutex
for reading to take the length of the nodes map. Locking order:
1. (TransmitLimitedQueue).mu.Lock()
2. (NetworkDB).RWMutex.RLock()
If one goroutine calls GetBroadcasts on the queue concurrently with
another goroutine calling JoinNetwork on the NetworkDB, the goroutines
may deadlock due to the lock inversion.
Fix the deadlock by caching the number of nodes in an atomic variable so
that the NumNodes callback can load the value without blocking or
violating Go's memory model. And fix a similar deadlock situation with
the table-event broadcast queues.
Signed-off-by: Cory Snider <csnider@mirantis.com>
With rejoinClusterBootStrap fixed in tests, split clusters should
reliably self-heal in tests as well as production. Work around the other
source of flakiness in TestNetworkDBIslands: timing out waiting for a
failed node to transition to gracefully left. This flake happens when
one of the leaving nodes sends its NodeLeft message to the other leaving
node, and the second is shut down before it has a chance to rebroadcast
the message to the remaining nodes. The proper fix would be to leverage
memberlist's own bookkeeping instead of duplicating it poorly with user
messages, but doing so requires a change in the memberlist module.
Instead have the test check that the sum of failed+left nodes is
expected instead of waiting for all nodes to have failed==3 && left==0.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The rejoinClusterBootStrap periodic task rejoins with the bootstrap
nodes if none of them are members of the cluster. It correlates the
cluster nodes with the bootstrap list by comparing IP addresses,
ignoring ports. In normal operation this works out fine as every node
has a unique IP address, but in unit tests every node listens on a
distinct port of 127.0.0.1. This situation causes the check to
incorrectly filter out all nodes from the list, mistaking them for the
local node.
Filter out the local node using pointer equality of the *node to avoid
any ambiguity. Correlate the remote nodes by IP:port so that the check
behaves the same in tests and in production.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When a node leaves a network, all entries owned by that node are
implicitly deleted. The other NetworkDB nodes handle the leave by
setting the deleted flag on the entries owned by the left node in their
local stores. This behaviour is problematic as it results in two
conflicting entries with the same Lamport timestamp propagating
through the cluster.
Consider two NetworkDB nodes, A, and B, which are both joined to some
network. Node A in quick succession leaves the network, immediately
rejoins it, then creates an entry. If Node B processes the
entry-creation event first, it will add the entry to its local store
then set the deleted flag upon processing the network-leave. No matter
how many times B bulk-syncs with A, B will ignore the live entry for
having the same timestamp as its local tombstone entry. Once this
situation occurs, the only way to recover is for the entry to get
updated by A with a new timestamp.
There is no need for a node to store forged tombstones for another
node's entries. All nodes will purge the entries naturally when they
process the network-leave or node-leave event. Simply delete the
non-owned entries from the local store so there is no inconsistent state
to interfere with convergence when nodes rejoin a network. Have nodes
update their local store with tombstones for entries when leaving a
network so that after a rapid leave-then-rejoin the entry deletions
propagate to nodes which may have missed the leave event.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Use the media-types defined in containerd, and create a local copy
of the media-type for plugins, which is not defined in either the
OCI or containerd package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The current detection based on mediaType only accounted for the non-signed
mediatype (`application/vnd.docker.distribution.manifest.v1+json`), but
most (if not all) v1 images used the "signed" manifest type; for example;
docker buildx imagetools inspect docker:1.0.1
Name: docker.io/library/docker:1.0.1
MediaType: application/vnd.docker.distribution.manifest.v1+prettyjws
Digest: sha256:666987df8e0c46670ea52bcd078547297a738fd6b421ec77aac910e1c0f688fd
Various code-paths would still detect the unsupported type through type-
matching the `*schema1.SignedManifest` type, but given that the only reason
for this is to detect whether the image is supported, we might as well just
match the mediaType.
Unfortunately, the [containerd images package][1] currently only defines a
const for the signed variant, and not for the unsigned ones, so to remove
the dependency on the `schema1` package, this patch introduces a (temporary)
local definition.
With this patch, the dependency on the "schema1" package is removed, and with
that also the use of "libtrust"; the dependency still shows up in vendor.mod
due to the docker/distribution dependency not being a go module, but should
dissolve once we remove that dependency in future.
This patch can also be verified using the `distribution` endpoint, which
returns an error when trying to get information for a "v1" image;
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:1.0.1/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:1.0.1/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:00:18 GMT
< Content-Length: 311
{"message":"Docker Image Format v1 and Docker Image manifest version 2, schema 1 support has been removed. Suggest the author of docker.io/library/docker:1.0.1 to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/"}
curl -v --unix-socket /var/run/docker.sock 'http://localhost/v1.51/distribution/docker.io/library/docker:28/json'
* Trying /var/run/docker.sock:0...
* Connected to localhost (/var/run/docker.sock) port 80 (#0)
> GET /v1.51/distribution/docker.io/library/docker:28/json HTTP/1.1
> Host: localhost
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Api-Version: 1.51
< Content-Type: application/json
< Docker-Experimental: false
< Ostype: linux
< Server: Docker/dev (linux)
< Date: Sat, 05 Jul 2025 17:01:06 GMT
< Content-Length: 541
{"Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:0a2ee60851e1b61a54707476526c4ed48cc55641a17a5cba8a77fb78e7a4742c","size":5165},"Platforms":[{"architecture":"amd64","os":"linux"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v6"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm","os":"linux","variant":"v7"},{"architecture":"unknown","os":"unknown"},{"architecture":"arm64","os":"linux","variant":"v8"},{"architecture":"unknown","os":"unknown"}]}
[1]: https://github.com/containerd/containerd/blob/v2.1.3/core/images/mediatypes.go#L54-L55
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The OCI types should be able to unmarshal the image manifest (regardless
if it was created from the legacy distribution types or otherwise), so
we can drop the use of the legacy distribution types here.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test is verifying that push/pull works; current versions of the registry
used should support both the legacy (docker distribution) and OCI media-types,
so let's use the OCI types.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Trying to reduce the places where we depend on the legacy distribution
dependency. For this test, we used it to generate the JSON for a manifest-list,
which we can do with the OCI types as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the code where used to allow producing logs customized to the
code-path performing the cleanup.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This removes the tarexporter.legacyLoadImage method and related helpers.
This functionality was added in 01ba0a935b
(docker v1.10), which introduced the new content-addressable image
format; this code provided backward-compatibility with older archives
which contained v0/v1 images.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Contribute a Wireshark plugin for decrypting and dissecting
hashicorp/memberlist messages. And contribue a plugin for dissecting the
NetworkDB messages transported as memberlist User messages.
Add a feature to NetworkDB to log the encryption keys to a file for the
Wireshark memberlist plugin to consume, configured using an environment
variable.
Signed-off-by: Cory Snider <csnider@mirantis.com>
As of Go 1.17, `Setenv` can be used to set environment variables
specific to a single test. This also removes a package which gets
vendored just for this.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The same env-var is used for action/setup-go as for overriding
the default Go version in Dockerfiles, however action/setup-go
only accepts SemVer (e.g. 1.25.0-rc.1) whereas the official golang
image follows the Go project's versioning, which doesn't use
a SemVer-compatible format (go1.25rc1 / 1.25rc1).
Trying to use the same "GO_VERSION" value for both will therefore
fail.
As we're already updating the default version in the Dockerfile to
the version we want to use, let's remove the --build-arg, and use
the default that's set in the Dockerfile.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This endpoint was useful when libnetwork was a standalone component that
could be integrated with other products, but now that libnetwork is part
of moby/moby, and considered an internal package, we're sure that the
Engine's SIGUSR1 handler is available to dump stack traces. No need
to keep a duplicate feature.
Moreover, this endpoint is only available over an HTTP server listening
on 127.0.0.1 (hardcoded), and the stackdump is always written to the
disk. So, to have use of it, you need access to the host anyway.
Finally, unlike the Engine's SIGUSR1 handler, this endpoint write stack
traces to `/tmp` and not to the daemon's `--data-root`.
This is a non-core feature, there's an alternative available, it's not
documented in libnetwork/cmd/diagnostic/README.md (which is the
only place that mentions the diag server AFAIK), and the diag client
doesn't support it, so drop it unceremoniously.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
When ProgramExternalConnectvity is called, the bridge driver
works out whether it needs to add port bindings for an endpoint
based on whether it was selected as the container's gateway.
Remember whether IPv4/IPv6 bindings have been set up, as part
of the endpoint's state. When ProgramExternalConnectivity is
called again, use differences between that stored state and
the newly requested state to decide whether to add bindings.
Port binding state is not persisted, on live-restore port
bindings are re-created (so, the initial state should always
be that no port bindings are set up).
Signed-off-by: Rob Murray <rob.murray@docker.com>
In the remote network driver's ProgramExternalConnectivity,
remember whether endpoints have already been configured as
gateways - so that it's ok for libnetwork to call it more
than once with the same configuration (without passing on
those calls to the actual network driver in HTTP requests).
There's no need to persist this data, even on live-restore
ProgramExternalConnectivity will be called again.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Moving towards making it the network driver's responsibility
to work out whether it should set up port bindings, based on
libnet's gateway selection.
This first step lets the driver know whether an endpoint has
been selected as the container's gateway, allowing the driver
to work out whether mappings between IPv6 host addresses and
IPv4 container addresses are required (when supported).
Signed-off-by: Rob Murray <rob.murray@docker.com>
This special case was added in 540c8e9b20 to
handle situations where a Windows daemon would still have images in legacy
format on Disk.
For legal reasons, Windows base-images were not allowed to be distributed
through registries, and because of that had to be pre-loaded on the host.
Such images would have a RootFS with a special `layers+base` type.
This type is no longer used and [removed from the OCI image spec][1], which
now only allows a single type ("Layers"); from the [OCI image-spec][2]:
> - **rootfs** _object_, REQUIRED
>
> The rootfs key references the layer content addresses used by the image.
> This makes the image config hash depend on the filesystem hash.
>
> - **type** _string_, REQUIRED
>
> MUST be set to `layers`.
> Implementations MUST generate an error if they encounter a unknown value while verifying or unpacking an image.
The special handling was added in 2016 to help in the transition, but
it's very unlikely such images still exist, so we can remove the special
handling.
This reverts commit 540c8e9b20.
[1]: https://github.com/opencontainers/image-spec/pull/211
[2]: https://github.com/opencontainers/image-spec/blob/v1.1.1/config.md#properties
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All uses of this method would construct a RootFS from scratch, so we may as
well remove the argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Outline the DACL used on Windows.
- Extract constructing the SDDL to a utility, to allow re-using
for unix sockets in future.
- Improve documentation to mention that Windows allows multiple
groups and/or users to be given access.
Also removing an intermediate variable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The original intent of this directory was to provide weekly reports
for calls and project meetings, but these haven't been produced for
several Years now (with the most recent report being 8 Years ago).
Let's remove this directory as the information in these reports is
outdated and no longer relevant. If needed, they can still be found
in Git history.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make it a hidden file. From the [CodeCov docs][1]:
> Can I name the file .codecov.yml?
>
> Yes, you can name the file `codecov.yml` or `.codecov.yml`. However, the
> file must still be located in the repository root, `dev/`, or `.github/`
> directories
[1]: https://docs.codecov.com/docs/codecov-yaml#can-i-name-the-file-codecovyml
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The restartmanager is only used internally by the daemon, and has no external
users. Move it to the daemon/internal package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This document was added to outline our vendoring policies and to describe
versioning. It's obsoleted by Go module's definition, which follows SemVer
and MVS.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These scripts have not been actively maintained for several Years, are
un-tested, and there may be better alternatives / implementations to
use for this purpose. A search on GitHub only showed a single active
use of one of these scripts; let's remove them, as there are no plans
to maintain (and test) these scripts.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Seeing some test-failures, which could be due to changes on Docker Hub
=== Failed
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite/TestPushToCentralRegistryUnauthorized (51.08s)
docker_cli_push_test.go:229: assertion failed: strings.Contains(out, "Retrying") is true
=== FAIL: github.com/docker/docker/integration-cli TestDockerCLIPushSuite (101.49s)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function effectively is looping three times over the given commands
to apply to the image. The first two loops did not yet invoke the builder
instance, so we can combine those and execute then before constructing the
builder. We could even consider combining all of them to a single loop, but
keeping it closer to the existing logic or now.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility was added in 83b5729f64 to
replace httputils.ParseServerHeader, which was added to print a warning
on Windows in 126529c6d0. At the time, the
only available option to detect the daemon's OS was to parse the `Server`
header, which contained the version of Docker as well as the OS.
However, 7199522ea2 introduced an `OSType`
("Ostype") header that's included on all responses, and a later commit
e9dac5ef5e changed that to also be included
when producing an error for unsupported API versions.
Note that the casing in the midddleware was changed from `OSType` to
`Ostype` (normalized form) in 76a5ca1d4d,
but headers are case-insensitive, and `header.Get()` should handle either
case in the response.
In short; every API response contains an "Ostype" header, which already
contains the OS ("windows" or "linux") that doesn't require any parsing,
so let's put that header to use.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Avoid importing structs from the root package in favor of defining an
interface for the functions which are called.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Adding image tags that follow the semver major and minor versions (e.g., `28`
and `28.3`) for the moby-bin images.
This makes it easier for users to reference the latest build within a
major or minor version series without having to know the exact
minor/patch version.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The IPsec encryption parameters (Security Association Database and
Security Policy Database entries) for a particular overlay network peer
(VTEP) are shared global state as they have to be programmed into the
root network namespace. The same parameters are used when encrypting
VXLAN traffic to a particular VTEP for all overlay networks. Deleting
the entries for a VTEP will break encryption to that VTEP across all
encrypted overlay networks, therefore the decision of when to delete the
entries must take the state of all overlay networks into account.
Unfortunately this is not the case.
The overlay driver uses local per-network state to decide when to
program and delete the parameters for a VTEP. In practice, the
parameters for all VTEPs participating in an encrypted overlay network
are deleted when the network is deleted. Encryption to that VTEP over
all other active encrypted overlay networks would be broken until some
other incidental peerDB event triggered a re-programming of the
parameters for that VTEP.
Change the setupEncryption and removeEncryption functions to be
reference-counted. The removeEncryption function needs to be called the
same number of times as addEncryption before the parameters are deleted
from the kernel.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver assumes that the peer table in NetworkDB will always
converge to a 1:1:1 mapping from peer endpoint IP address to MAC address
to VTEP. While this currently holds true in practice most of the time,
it is not an invariant and there are ways that users can violate this
assumption.
The driver detects whether peer entries conflict with each other by
matching up (IP, MAC) tuples. In the common case this works out fine as
the MAC address for an endpoint is generally derived from the assigned
IP address. If an IP address gets reassigned to a container on another
node the MAC address will follow, so the driver's conflict resolution
logic will behave as intended. However users may explicitly configure
the MAC address for a container's network endpoints. If an IP address
gets reassigned from a container with an auto-generated MAC address to a
container with a manually-configured MAC, or vice versa, the driver
would not detect the conflict as the (IP, MAC) tuples won't match up. It
would attempt to program the kernel's neighbor table with two
conflicting MAC addresses for one IP, which will fail. And since it
does not realize that there is a conflict, the driver won't reprogram
the kernel from the remaining entry when the other entry is deleted.
The assumption that only one IP address may resolve to a given MAC
address is violated if multiple IP addresses are assigned to an
endpoint. This rarely comes up in practice today as the overlay driver
only supports IPv4 single-stack connectivity for endpoints. If multiple
distinct peer entries exist with the same MAC address, the driver will
delete the MAC->VTEP mapping from the kernel's forwarding database when
any entry is deleted, even if other entries remain active. This
limitation is one of the biggest obstacles in the way of supporting IPv6
and dual-stack connectivity for endpoints attached to overlay networks.
Modify the peer db logic to correctly handle the cases where peer
entries have non-unique MAC or VTEP values. Treat any set of entries
with non-unique IP addresses as a conflict, irrespective of the entries'
MAC addresses. Maintain a reference count of forwarding database entries
and only delete the MAC->VTEP mapping from the kernel when there are no
longer any neighbor entries which resolve to that MAC.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The peer db implementation is more complex than it needs to be.
Notably, the peerCRUD / peerCRUDOp function split is a vestige of its
evolution from a worker goroutine receiving commands over a channel.
Refactor the peer db operations to be easier to read, understand and
modify. Factor the kernel-programming operations out into dedicated
addNeighbor and deleteNeighbor functions. Inline the rest of the
peerCRUDOp functions into their respective peerCRUD wrappers.
Signed-off-by: Cory Snider <csnider@mirantis.com>
- Assert that we're not using empty IDs
- stringid.TruncateID already truncates algorithm, so we can just feed
it the full id
- Fail early on error, and skip asserting the `resp.ID` to reduce some
noise;
=== FAIL: github.com/docker/docker/integration/container TestCreateByImageID/image_short-ID (60.33s)
create_test.go:134: assertion failed: resp.ID is ""
create_test.go:135: assertion failed: error is not nil: error during connect: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.48/containers/create": EOF
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit e98e4a7111 introduced functionality
to hide experimental commands, and hide commands based on API version
negotiation. Before that commit, the user-agent header was used to detect
version-mismatches between the daemon and client based on their binary
version;
3975d648b7/api/server/middleware/user_agent.go (L32-L44)
Because of the above, a check was added to prevent custom headers from
modifying the User-Agent, but given that the user-agent header changed
formatting, and api < 1.25 is long deprecated, it's not very meaningful
to add this check, so let's remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Starting with commit 0d6e7cd983
DeleteNeighbor() needs to be called with the same options as the
AddNeighbor() call that created the neighbor entry. The calls in peerdb
were modified incorrectly, resulting in the deletes failing and leaking
neighbor entries. Fix up the DeleteNeighbor calls so that the FDB entry
is deleted from the FDB instead of the neighbor table, and the neighbor
is deleted from the neighbor table instead of the FDB.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Validation of registry mirrors was performed during daemon startup,
but after the config-file was validated. As a result, the `--validate`
option would incorrectly print that the configuration was valid, but
the daemon would fail to start;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
With this patch applied, validation is also performed as part of the
daemon config validation;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
unable to configure the Docker daemon with file ./my-config.json: merged configuration validation from file and command line flags failed: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
# fix the invalid config
echo '{"registry-mirrors":["https://example.com"]}' > my-config.json
dockerd --config-file ./my-config.json --validate
configuration OK
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, a missing scheme would sometimes produce a confusing
error message. If no scheme was specified at all, an empty "" would be
included in the message;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "" in "example.com"
If a scheme was missing, but a port was included, the hostname would be
printed as the scheme;
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: unsupported scheme "example.com" in "example.com:8080"
With this patch applied, the error messages are slightly more user-friendly;
echo '{"registry-mirrors":["example.com"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com": must use either 'https://' or 'http://'
echo '{"registry-mirrors":["example.com:8080"]}' > my-config.json
dockerd --config-file ./my-config.json
# ...
failed to start daemon: invalid mirror: no scheme specified for "example.com:8080": must use either 'https://' or 'http://'
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When libnetwork receives a watch event for a driver table entry from
NetworkDB it passes the event along to the interested driver. This code
contains a subtle bug: update events from NetworkDB are passed along to
the driver as Delete events! This bug was lying dormant as driver-table
entries can only be added by the driver, not updated. Now that NetworkDB
broadcasts an UpdateEvent to watchers if the entry is already known to
the local NetworkDB, irrespective of whether the event received from the
remote peer was a CREATE or UPDATE event, the bug is causing problems.
Whenever a remote node replaces an entry in the overlay_peer_table but
the intermediate delete state was not received by the local node, the
new CREATE event would be translated to an UpdateEvent by NetworkDB and
subsequently handled by the overlay driver as if the entry was deleted!
Bubble table UPDATE events up to the network driver as Update events.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Commit 8e6cd44ce4 added synchronisation to
wait for the container's status to be updated in memory. However, since
952902efbc, a defer was used to produce
the container's "stop" event.
As a result of the sychronisation that was added, the "die" event would
now be produced before the "stop" event.
This patch moves the locking inside the defer to restore the previous
behavior.
Unfortunately the order of events is still not guaranteed, because events
are emited from multiple goroutines that don't have synchronisation between
them; this is something to look at for follow ups. This patch keeps the status
quo and should preserve the old behavior, which was "more" correct in most
cases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
As we're only expecting a single `/` prefix to be trimmed from the
container name, it's better to use `TrimPrefix` than `TrimLeft`, as
`TrimPrefix` takes a cut-set to remove any character in the set.
Benchmarking both;
BenchmarkTrimLeft-10 535364544 2.204 ns/op 0 B/op 0 allocs/op
BenchmarkTrimPrefix-10 1000000000 0.3148 ns/op 0 B/op 0 allocs/op
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was added in 5130fe5d38, which
added it for use as intermediate struct when parsing CLI flags (through
`runconfig.ParseExec`) in c786a8ee5e.
Commit 9d9dff3d0d rewrote the CLI to use
Cobra, and as part of this introduced a separate `execOptions` type in
`api/client/container`.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use the tagged version instead of the v2.0.0-20250613170222-a45be3cac15c
pseudo-version. The referenced commit has not changed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Add a mention to stdcopy.StdCopy to the documentation, as the stream returned in the HijackedResponse is multiplexed when tty is disabled.
Signed-off-by: Medhy DOHOU <52136144+PowerPixel@users.noreply.github.com>
The IdentityMapping and Identity types are still used internally, but
should be considered transitional.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The atomicwriter utilities were moved to a separate package in commit
7864454792 (v28.0.0), which in its turn was
moved to a separate module in 6422ff2804
(v28.1.0).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- `ParseKeyValueOpt` was deprecated in 5b18a7914c
and moved to the graphdriver package.
- `ParseUintListMaximum` and `ParseUintList` were deprecated in commit
064cdf475c after they were moved internal
to pkg/sysinfo in 2282279180.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package was deprecated in b034dc41a2,
which moved it internal. That commit was part of v28.0.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 4472e9b7f8, which
was part of docker v28.0.0, and to be removed in the next major
release.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Inter-Network Communication rules in the iptables chains
DOCKER-ISOLATION-STAGE-1 / DOCKER-ISOLATION-STAGE-2 (which are
called from filter-FORWARD) currently:
- Block access from containers in one bridge network, to ports
published to host addresses by containers in other bridge
networks, when the userland-proxy is disabled.
- But, that access is allowed when the proxy is enabled.
- Block access to all ports on container addresses in gateway
mode "nat-unprotected" networks.
- But, those ports can be accessed from anywhere else, including
other hosts. Just not other bridge networks.
- Allow access from containers in "nat" bridge networks to published
ports on container addresses in "routed" networks. But, to do that,
extra INC rules are added for the routed network.
The INC rules are no longer needed to block access from containers
in one network to unpublished ports on container addresses in
other networks. Direct routing to containers in NAT networks is
blocked by the "raw-PREROUTING" rules that block access from
untrusted interfaces (all interfaces apart from the network's
own bridge).
Drop these INC rules to resolve the inconsistencies listed above,
with this change:
- Published ports on host addresses can be accessed from containers
in other networks (even without the userland-proxy).
- The rules for direct routing between bridge networks are the same
as the rules for direct routing from outside the Docker host
(allowed for gw modes "routed" and "nat-unprotected", disallowed
for "nat").
Fewer rules, so it's simpler, and perhaps slightly faster.
Internal networks (with no access to networks outside the host)
are also implemented using rules in the DOCKER-ISOLATION chains.
This change moves those rules to a new chain, DOCKER-INTERNAL,
and drops the DOCKER-ISOLATION chains.
Signed-off-by: Rob Murray <rob.murray@docker.com>
A network node is responsible for both broadcasting table events for
entries it owns and for rebroadcasting table events from other nodes it
has received. Table events to be broadcast are added to a single queue
per network, including events for rebroadcasting. As the memberlist
TransmitLimitedQueue is (to a first approximation) LIFO, a flood of
events from other nodes could delay the broadcasting of
locally-generated events indefinitely. Prioritize broadcasting local
events by splitting up the queues and only pulling from the rebroadcast
queue if there is free space in the gossip packet after draining the
local-broadcast queue.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Log more details when assertions fail to provide a more complete picture
of what went wrong when TestCRUDTableEntries fails. Log the state of
each NetworkDB instance at various points in TestCRUDTableEntries to
provide an even more complete picture.
Increase the global logger verbosity in tests so warnings and debug logs
are printed to the test log.
Signed-off-by: Cory Snider <csnider@mirantis.com>
NetworkDB uses a muli-dimensional map of struct network to keep track of
network attachments for both remote nodes and the local node. Only a
subset of the struct fields are used for remote nodes' network
attachments. The tableBroadcasts pointer field in particular is
always initialized for network values representing local attachments
(read: nDB.networks[nDB.config.NodeID]) and always nil for remote
attachments. Consequently, unnecessary defensive nil-pointer checks are
peppered throughout the code despite the aforementioned invariant.
Enshrine the invariant that tableBroadcasts is initialized iff the
network attachment is for the local node in the type system. Pare down
struct network to only the fields needed for remote network attachments
and move the local-only fields into a new struct thisNodeNetwork. Elide
the unnecessary nil-checks.
Signed-off-by: Cory Snider <csnider@mirantis.com>
When joining a network that was previously joined but not yet reaped,
NetworkDB replaces the network struct value with a zeroed-out one with
the entries count copied over. This is also the case when joining a
network that is currently joined! Consequently, joining a network has
the side effect of clearing the broadcast queue. If the queue is cleared
while messages are still pending broadcast, convergence may be delayed
until the next bulk sync cycle.
Make it an error to join a network twice without leaving. Retain the
existing broadcast queue when rejoining a network that has not yet been
reaped.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The map key for nDB.networks is the network ID. The struct field is not
actually used anywhere in practice.
Signed-off-by: Cory Snider <csnider@mirantis.com>
We had some runs timeout after 120 minutes; expected duration is much
lower than that, so let's lower the timeout to make actions fail faster.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The go-connections package implementation is only a shallow wrapper
around go-winio for named pipes; use the go-winio implementation
directly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The (*driver).Join function does many things to set up overlay
networking. One of the first things it does is call
(*network).joinSandbox, which in turn calls (*driver).initSandboxPeerDB.
The initSandboxPeerDB function iterates through the peer db to add
entries to the VXLAN FDB, neighbor table and IPsec security association
database in the kernel for all known peers on the overlay network.
One of the last things the (*driver).Join function does is call
(*driver).initEncryption. The initEncryption function iterates through
the peer db to add entries to the IPsec security association database in
the kernel for all known peers on the overlay network. But the preceding
initSandboxPeerDB call already did that! The initEncryption function is
redundant and can safely be removed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
In addition to being three functions in a trenchcoat, the
checkEncryption function has a very subtle implementation which is
difficult to reason about. That is not a good property for security
relevant code to have.
Replace two of the three calls to checkEncryption with conditional calls
to setupEncryption and removeEncryption, lifting the conditional logic
which was hidden away in checkEncryption into the call sites to make it
easier to reason about the code. Replace the third call with a call to a
new initEncryption function.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The setupEncryption and removeEncryption functions take several
parameters, but all call sites pass the same values for all the
parameters aside from remoteIP: values taken from fields of the driver
struct. Refactor these functions to be methods of the driver struct and
drop the redundant parameters.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Since it is not meaningful to add or remove encryption between the local
node and itself, the isLocal parameter is redundant. Setting up
encryption for all network peers is now invoked by calling
checkEncryption(nid, netip.Addr{}, true)
Calling checkEncryption with isLocal=true, add=false is now more
explicitly a no-op. It always was effectively a no-op, but that was not
easy to spot by inspection. In the world with the isLocal flag,
calls to checkEncryption where isLocal=true and add=false would have rIP
set to d.advertiseAddr. In other words, it was a request to remove
encryption parameters between the local peer and itself if peerDB had no
remote-peer entries for the network. So either the call would do
nothing, or it would remove encryption parameters that aren't used for
anything. Now the equivalent call always does nothing.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Drop the isLocal boolean parameters from the peerDB functions. Local
peers have vtep == netip.Addr{}.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The VTEP value for a peer in peerDB is only accurate for a remote peer.
The VTEP for a local peer would be the driver's advertise address, which
is not necessarily constant for the lifetime of the driver instance.
The VTEP values persisted in the peerDB entries for local peers could be
stale or missing if not kept in sync with the advertise address. And the
peerDB could get polluted with duplicate entries for local peers if the
advertise address was to change, as entries which differ only by VTEP
are considered distinct by SetMatrix. Persisting the advertise address
as the VTEP for local peers creates lots of problems that are not easy
to solve.
Stop persisting the VTEP for local peers in peerDB. Any code that needs
to know the VTEP for local peers can look that up from the source of
truth: the driver's advertise address. Use the lack of a VTEP in peerDB
entries to signify local peers, making the isLocal flag redundant.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The overlay driver's checkEncryption function configures the IPSec
parameters for the VXLAN tunnels to peer nodes. When called with
isLocal=true, it configures encryption for all peer nodes with at least
one peerDB entry. Since the local peers are also included in the peerDB,
it needs to filter those entries out. It does so by filtering out any
peer entries whose VTEP address is equal to the current local advertise
address. Trouble is, the local advertise address is not necessarily
constant. The driver tries to handle this case by calling
peerDBUpdateSelf() when the advertise address changes. This function
iterates through the peerDB and tries to update the VTEP address for all
local peer entries, but it does not actually do anything: it mutates a
temporary copy of the entry which is not persisted back into the peerDB.
(It used to be functional, but was broken when the peerDB was extended
to use SetMatrix.) So there may be cases where local peer entries are
not filtered out properly, resulting in spurious encryption parameters
being programmed into the kernel.
Filter out local peers when walking the peerDB by filtering on whether
the entry has the isLocal flag set. Remove the no-op code which attempts
to update local entries in the peerDB. No other code takes any interest
in the VTEP value for isLocal peer entries.
Signed-off-by: Cory Snider <csnider@mirantis.com>
2025-05-29 14:13:13 -04:00
3234 changed files with 118340 additions and 36135 deletions
[](https://www.bestpractices.dev/projects/10989)
The Engine API is an HTTP API used by the command-line client to communicate with the daemon. It can also be used by third-party software to control the daemon.
It consists of various components in this repository:
-`api/swagger.yaml` A Swagger definition of the API.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/docker/docker/issues/27919) for progress on this.
-`cli/` The command-line client.
-`api/types/` Types shared by both the client and server, representing various objects, options, responses, etc. Most are written manually, but some are automatically generated from the Swagger definition. See [#27919](https://github.com/moby/moby/issues/27919) for progress on this.
-`client/` The Go client used by the command-line client. It can also be used by third-party Go programs.
-`daemon/` The daemon, which serves the API.
@@ -21,6 +27,7 @@ The API is defined by the [Swagger](http://swagger.io/specification/) definition
## Updating the API documentation
The API documentation is generated entirely from `api/swagger.yaml`. If you make updates to the API, edit this file to represent the change in the documentation.
Documentation for each API version can be found in the [docs directory](docs/README.md), which also provides a [CHANGELOG.md](docs/CHANGELOG.md).
The file is split into two main sections:
@@ -29,7 +36,7 @@ The file is split into two main sections:
To make an edit, first look for the endpoint you want to edit under `paths`, then make the required edits. Endpoints may reference reusable objects with `$ref`, which can be found in the `definitions` section.
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/docker/docker/issues/27919).
There is hopefully enough example material in the file for you to copy a similar pattern from elsewhere in the file (e.g. adding new fields or endpoints), but for the full reference, see the [Swagger specification](https://github.com/moby/moby/issues/27919).
`swagger.yaml` is validated by `hack/validate/swagger` to ensure it is a valid Swagger definition. This is useful when making edits to ensure you are doing the right thing.
@@ -39,4 +46,4 @@ When you make edits to `swagger.yaml`, you may want to check the generated API d
Run `make swagger-docs` and a preview will be running at `http://localhost:9000`. Some of the styling may be incorrect, but you'll be able to ensure that it is generating the correct documentation.
The production documentation is generated by vendoring `swagger.yaml` into [docker/docker.github.io](https://github.com/docker/docker.github.io).
The production documentation is generated by vendoring `swagger.yaml` into [docker/docs](https://github.com/docker/docs).
// Systemerr represents errors originating from the system that make it
// into the multiplexed stream.
Systemerr
StdinStdType=0// Stdin represents standard input stream. It is present for completeness and should NOT be used. When reading the stream with [StdCopy] it is output on [Stdout].
StdoutStdType=1// Stdout represents standard output stream.
StderrStdType=2// Stderr represents standard error steam.
SystemerrStdType=3// Systemerr represents errors originating from the system. When reading the stream with [StdCopy] it is returned as an error.
type {{pascalize.Name}}{{template"typeSchemaType".}}{{/* For types declared as $ref on some other type, just declare the type as a golang _aliased_ type, e.g. type A = B. No method shall be redeclared. */}}
{{-if.IsBaseType}}
{{template"baseTypeSerializer".}}{{/* When the alias redeclares a polymorphic type, define factory methods with this alias. */}}
{{-end}}
{{-elseif.IsEmbedded}}
{{-template"schemaEmbedded".}}
{{-else}}
{{-ifor.IsComplexObject.IsTuple.IsAdditionalProperties}}{{/* TODO(fred): handle case of subtype inheriting from base type with AdditionalProperties, issue #2220 */}}
// ContextValidate validates this {{humanize.Name}} based on context it is used {{/* this schema implements the runtime.ContextValidatable interface but has no validations to check */}}
// AdditionalProperties in base type shoud be handled just like regular properties{{/* TODO(fred): add full support for AdditionalProperties in base type */}}
// At this moment, the base type property is pushed down to the subtype
// Host IP address that the container's port is mapped to
IPstring`json:"IP,omitempty"`
@@ -19,5 +24,6 @@ type Port struct {
// type
// Required: true
// Enum: ["tcp","udp","sctp"]
Typestring`json:"Type"`
}
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
