Commit Graph

2500 Commits

Author SHA1 Message Date
f07bb00458 Merge pull request #18780 from jfrazelle/seccomp-default
set default seccomp profile
Upstream-commit: 78ce43bad85fdf97d7c836315e46b531901c8ae7
Component: engine
2015-12-28 16:46:30 -08:00
3b4ed44ee4 Merge pull request #18897 from runcom/fix-net-none-build
integration-cli: fix --net=none build
Upstream-commit: 38440cadf3e27b32b3ee7b9011b1a0a87cbcca69
Component: engine
2015-12-28 10:51:18 -08:00
3f03a2c89c add docs and unconfined to run a container without the default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 15674c5fb74df00d7560fb35619a5372ea2ee74e
Component: engine
2015-12-28 10:26:51 -08:00
aac8048807 add default seccomp profile tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: a48fe6238494547f392b06adf9d48944b4dd8ac3
Component: engine
2015-12-28 10:26:48 -08:00
b5ffb5a2c4 set default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 947293a28084cb5ee2e10e4d128c6e2b9d9da89d
Component: engine
2015-12-28 10:18:47 -08:00
c4af30652d Implemet docker update command
It's used for updating properties of one or more containers, we only
support resource configs for now. It can be extended in the future.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: 8799c4fc0feadede6ae60e77bd7d9dfd7cc72a79
Component: engine
2015-12-28 19:19:26 +08:00
602cbecb67 integration-cli: fix --net=none build
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: bb8e1dc8fa7bda27592b140b433b5ffabdb44917
Component: engine
2015-12-24 16:36:37 +01:00
1d3ad033b8 Merge pull request #18810 from runcom/pkg-authz-fixes
pkg: authorization: do not register the same plugin
Upstream-commit: 914fad8b7d3426d9c637bfa07ccb47c141048163
Component: engine
2015-12-23 15:09:06 -08:00
547bf07eca pkg: authorization: do not register the same plugin
This patches avoids registering (and calling) the same plugin more than
once. Using an helper map which indexes by name guarantees this and keeps
the order.
The behavior of overriding the same name in a flag is consistent with,
for instance, the `docker run -v /test -v /test` flag which register
the volume just once.
Adds integration tests.

Without this patch:
```
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.080901676+01:00" level=debug msg="Calling
GET
/v1.22/info"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081213202+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081268132+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081699788+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.081762507+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.082092480+01:00" level=debug msg="GET
/v1.22/info"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.628691038+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
Dec 20 19:34:52 localhost.localdomain docker[9988]:
time="2015-12-20T19:34:52.629880930+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
```

With this patch:
```
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376523958+01:00" level=debug msg="Calling
GET
/v1.22/info"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376715483+01:00" level=debug msg="AuthZ
request using plugin docker-novolume-plugin"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.376771230+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.377698897+01:00" level=debug msg="GET
/v1.22/info"
Dec 20 19:37:32 localhost.localdomain docker[16620]:
time="2015-12-20T19:37:32.951016441+01:00" level=debug msg="AuthZ
response using plugin docker-novolume-plugin"
```

Also removes a somehow duplicate debug statement (leaving only the
second one as it's a loop of plugin's manifest):
```
Dec 20 19:52:30 localhost.localdomain docker[25767]:
time="2015-12-20T19:52:30.544090518+01:00" level=debug
msg="docker-novolume-plugin's manifest: &{[authz]}"
Dec 20 19:52:30 localhost.localdomain docker[25767]:
time="2015-12-20T19:52:30.544170677+01:00" level=debug
msg="docker-novolume-plugin implements: authz"
```

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: c28fc06e002e06deed3437da76bc213b7bd752ba
Component: engine
2015-12-23 21:08:40 +01:00
1cfbdcfe91 Remove package pkg/ulimit, use go-units instead.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 83237aab2b9430a88790467867505cc9a5147f3e
Component: engine
2015-12-23 13:27:58 -05:00
595a0cd27e Merge pull request #18839 from aaronlehmann/v1-fallback-404
When a manifest is not found, allow fallback to v1
Upstream-commit: 95b708cf19f24dcf0044f2f4e96db2579201cbeb
Component: engine
2015-12-23 10:01:39 -08:00
6f10e6b229 Add filter for network ls to hide predefined net
Add filter support for `network ls` to hide predefined network,
then user can use "docker network rm `docker network ls -f type=custom`"
to delete a bundle of userdefined networks.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 26dd026bd70c9c18a16b0e339821c309e56d8ff0
Component: engine
2015-12-23 13:26:40 +08:00
13048f0ce1 Merge pull request #18831 from calavera/test_event_observer
Extract event processing to a common function for testing.
Upstream-commit: eacedcbe21e15f396ea1d9f620047718cce03df7
Component: engine
2015-12-22 15:04:32 -08:00
143c9b690b Merge pull request #18762 from calavera/runconfig_to_types
Move container configuration types to api/types/container.
Upstream-commit: 030347c3c9505fa80eed0ecfde5d1e9af05c3cbc
Component: engine
2015-12-22 14:22:08 -08:00
dadaf8ff90 Extract event processing to a common function for testing.
We keep only one logic to test event related behavior that will help us
diagnose flacky event errors.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: af51df20bdd9962b1aaa79819cafefc715290d28
Component: engine
2015-12-22 17:10:06 -05:00
47e00eae65 No options to tmpfs is valid
If you run a

docker run command with --tmpfs /mountpoint:noexec

Or certain options that get translated into mount options, the mount command can get passed "" for mount data.
So this should be valid.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: 89a775d2dc596b9ac86873edf447fff2f7012ef3
Component: engine
2015-12-22 14:15:07 -05:00
027f002cb3 Move Config and HostConfig from runconfig to types/container.
- Make the API client library completely standalone.
- Move windows partition isolation detection to the client, so the
  driver doesn't use external types.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 7ac4232e70fe7cf7318333cd0890db7f95663079
Component: engine
2015-12-22 13:34:30 -05:00
b006691148 Replace usage of pkg/nat with go-connections/nat.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 056e7449039af522fa0a1567ef67916eaa0de93e
Component: engine
2015-12-22 13:31:46 -05:00
8c2d6245d9 upate TestRunWithBlkioInvalidWeightDevice with clearly invalid device name
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 673f2b8697727a0f0bfb3c4bd049cdac89a5a508
Component: engine
2015-12-22 12:43:42 +08:00
ccad5598d4 When a manifest is not found, allow fallback to v1
PR #18590 caused compatibility issues with registries such as gcr.io
which support both the v1 and v2 protocols, but do not provide the same
set of images over both protocols. After #18590, pulls from these
registries would never use the v1 protocol, because of the
Docker-Distribution-Api-Version header indicating that v2 was supported.

Fix the problem by making an exception for the case where a manifest is
not found. This should allow fallback to v1 in case that image is
exposed over the v1 protocol but not the v2 protocol.

This avoids the overly aggressive fallback behavior before #18590 which
would allow protocol fallback after almost any error, but restores
interoperability with mixed v1/v2 registry setups.

Fixes #18832

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 9d6acbee92016c47796ee8751dce9c59056f850d
Component: engine
2015-12-21 18:19:38 -08:00
161c03c6c1 Merge pull request #15879 from Mashimiao/add-support-blkio_throtte_iops
Add support for blkio read/write iops device
Upstream-commit: 312c82677bdc86d50b483d642ad8c61f1c840c55
Component: engine
2015-12-21 23:45:18 +01:00
306ef7b263 Merge pull request #17692 from vdemeester/images-format
Add --format support to images command
Upstream-commit: 42460b6772323552bfb58ae703124145ffd8a56b
Component: engine
2015-12-21 09:57:29 -08:00
f41d29a49b Add --format support to images command
- rename `api/client/ps` to `api/client/formatter`
- add a a image formatter

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 34a3c3cacf2fd827f13a5e37541acff1409658c4
Component: engine
2015-12-21 17:38:07 +01:00
1c5df6581b Change the quiet flag behavior in the build command
Right now, the quiet (-q, --quiet) flag ignores the output
generated from within the container.

However, it ought to be quiet in a way that all kind
of diagnostic output should be ignored, unless the build
process fails.

This patch makes the quiet flag behave in the following way:
 1. If the build process succeeds, stdout contains the image ID
    and stderr is empty.
 2. If the build process fails, stdout is empty and stderr
    has the error message and the diagnostic output of that process.

If the quiet flag is not set, then everything goes to stdout
and error messages, if there are any, go to stderr.

Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
Upstream-commit: 60b4db7eb17f4eb509be4a4968364ada2075d60c
Component: engine
2015-12-21 16:38:50 +02:00
a04e1f9592 Add support for blkio read/write iops device
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 843084b08b521a70baf9284ec4e23e941ab38367
Component: engine
2015-12-21 09:14:49 +08:00
cd79f6b524 Merge pull request #18767 from wenchma/add_checkduplicate_test
Add network create api test on CheckDuplicate
Upstream-commit: 58c049595fba7cb509d8a6656ecce6389c34a5a5
Component: engine
2015-12-19 10:46:11 -05:00
ea70c9d5d6 Add network create api test on CheckDuplicate
Signed-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>
Upstream-commit: 5649dae89bbbb356a24560c1d3164722b2207344
Component: engine
2015-12-19 22:29:30 +08:00
76f3bf50c1 pkg/version.Version: use the new String() method
Resolves #18750

Signed-off-by: Aditi Rajagopal <arajagopal@us.ibm.com>
Upstream-commit: 278e75800c7be10ca43ffb11de25cd342da106fe
Component: engine
2015-12-18 15:29:32 -05:00
d63981ab4d authZ: more fixes
- fix naming and formatting
- provide more context when erroring auth
- do not capitalize errors
- fix wrong documentation
- remove ugly remoteError{}

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 5a64c8027ecd2bebe773c9abd2e73c2fd7d23de1
Component: engine
2015-12-18 16:29:01 +01:00
ef849e6c0d Merge pull request #18716 from clnperez/fix-blkio-tests
Update TestRunWithBlkioInvalidDevice Tests
Upstream-commit: 406da8616ccc13795cb85b9a34c459d3cda2ae82
Component: engine
2015-12-17 10:23:59 -08:00
177c044c3a Merge pull request #18590 from aaronlehmann/limit-v1-fallbacks
Limit v1 protocol fallbacks
Upstream-commit: 98be580794923df223ea623c55311c290d402c54
Component: engine
2015-12-17 14:44:05 +01:00
ce29ee35b2 Merge pull request #18662 from runcom/pkg-authZ-response
pkg: authorization: add Err to tweak response status code
Upstream-commit: 5baa93c04ef4a195df397914baf0a980c93d1271
Component: engine
2015-12-17 11:12:27 +01:00
98eeaeab93 pkg: authorization: add Err to tweak response status code
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 46e3a249a1971f8697ca338c9b02e27d36ddab12
Component: engine
2015-12-17 11:08:47 +01:00
9a50c6c5f4 Merge pull request #18559 from ahmetalpbalkan/return-container-networks
Proposal: Add container networks list to /containers/json
Upstream-commit: 0f749ad55ab794872e601b4f665b07c0be07abfc
Component: engine
2015-12-17 10:11:18 +01:00
d2691dfadc Do not fall back to the V1 protocol when we know we are talking to a V2 registry
If we detect a Docker-Distribution-Api-Version header indicating that
the registry speaks the V2 protocol, no fallback to V1 should take
place.

The same applies if a V2 registry operation succeeds while attempting a
push or pull.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: a57478d65f1f5782cc746c260f9d841a0907ce54
Component: engine
2015-12-16 15:02:03 -08:00
7c30c7ccac Merge pull request #15964 from duglin/APIVersion
Add a DOCKER_API_VERSION env var
Upstream-commit: 905f3336b2715b3960b5ff4f860db387797d9adf
Component: engine
2015-12-16 14:23:47 -08:00
d17a157710 Improve reference parse errors
Fixes #18093

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 15d84a3a48efa12ed8bdc500f28ca58a7b1d1083
Component: engine
2015-12-16 11:58:53 -08:00
e98aacbdae Merge pull request #18705 from runcom/cleanups
Cleanups
Upstream-commit: ebb1d56ecb21ff9833159a52766561bb82be285b
Component: engine
2015-12-16 12:40:31 -05:00
e8473ec20b Update TestRunWithBlkioInvalidDevice Tests
/dev/sda wasn't an invalid device and this test failed, so, hopefully
/dev/sdX isn't going to exist in other envs.

Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>
Upstream-commit: 2236ecddfb89dcc09ba1f4f416b1e44e17308497
Component: engine
2015-12-16 10:58:31 -06:00
91750ca308 reorder imports with goimports
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: baba1a84935bd2114d48f1f4823ee9c379d62e68
Component: engine
2015-12-16 16:50:25 +01:00
51d333deab Merge pull request #18655 from dmcgowan/fix-docker-inspect-container
Add metadata function to layer store
Upstream-commit: bb2c92355cb6f4e6935a945c22989fd3afe8e3cb
Component: engine
2015-12-16 12:23:41 +01:00
b1147e3d7d Move filters package to the API.
These filters are only use to interchange data between clients and daemons.
They don't belong to the parsers package.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: e98cae4919da69dc6f9ae46527792cf2012cc7f2
Component: engine
2015-12-15 18:13:26 -05:00
7f43cd332d Move timeutils functions to the only places where they are used.
- Move time json marshaling to the jsonlog package: this is a docker
  internal hack that we should not promote as a library.
- Move Timestamp encoding/decoding functions to the API types: This is
  only used there. It could be a standalone library but I don't this
it's worth having a separated repo for this. It could introduce more
complexity than it solves.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 27220ecc6b1eedf650ca9cf94965cb0dc2054efd
Component: engine
2015-12-15 14:56:14 -05:00
2a2006ef18 Merge pull request #17034 from rhvgoyal/volume-propagation
Capability to specify per volume mount propagation mode
Upstream-commit: ce0b1841c82b6972d96654e083f813944e72443f
Component: engine
2015-12-15 12:14:41 -05:00
61bb408463 Merge pull request #18531 from coolljt0725/update_container_networking_on_create
fix docker inspect return unconsistent network settings  of created container and stopped container
Upstream-commit: 812a7c204a2396700ca1e95d949659b16302a120
Component: engine
2015-12-15 08:47:54 -08:00
b07ebd0f2f Add containers’ networks to /containers/json
After addition of multi-host networking in Docker 1.9, Docker Remote
API is still returning only the network specified during creation
of the container in the “List Containers” (`/containers/json`) endpoint:

    ...
    "HostConfig": {
      "NetworkMode": "default"
    },

The list of networks containers are attached to is only available at
Get Container (`/containers/<id>/json`) endpoint.
This does not allow applications utilizing multi-host networking to
be built on top of Docker Remote API.

Therefore I added a simple `"NetworkSettings"` section to the
`/containers/json` endpoint. This is not identical to the NetworkSettings
returned in Get Container (`/containers/<id>/json`) endpoint. It only
contains a single field `"Networks"`, which is essentially the same
value shown in inspect output of a container.

This change adds the following section to the `/containers/json`:

    "NetworkSettings": {
      "Networks": {
        "bridge": {
          "EndpointID": "2cdc4edb1ded3631c81f57966563e...",
          "Gateway": "172.17.0.1",
          "IPAddress": "172.17.0.2",
          "IPPrefixLen": 16,
          "IPv6Gateway": "",
          "GlobalIPv6Address": "",
          "GlobalIPv6PrefixLen": 0,
          "MacAddress": "02:42:ac:11:00:02"
        }
      }
    }

This is of type `SummaryNetworkSettings` type, a minimal version of
`api/types#NetworkSettings`.

Actually all I need is the network name and the IPAddress fields. If folks
find this addition too big, I can create a `SummaryEndpointSettings` field
as well, containing just the IPAddress field.

Signed-off-by: Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>
Upstream-commit: 755f8609f699a20cb47ec7269e3a9469541a9419
Component: engine
2015-12-14 19:03:23 -08:00
914e2c1f2d Add metadata function to layer store
Add function to get metadata from layer store for a mutable layer

fixes #18614

Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Upstream-commit: a7e096832123280d26df3c121ecad8dd012060b9
Component: engine
2015-12-14 16:52:15 -08:00
19f8a4f8fb Merge pull request #18486 from aboch/vnd
Vendoring libnetwork bbd6e6d8ca1e7c9b42f6f53277b0bde72847ff90
Upstream-commit: 260cbb19c93ba1dc5aa0f4065cd5c95241bbd59d
Component: engine
2015-12-14 13:32:01 -08:00
6a842265ad Add a DOCKER_API_VERSION env var
Closes: #11486

Just for @ahmetalpbalkan  :-)

Fixed some comment formatting too while in there.

Signed-off-by: Doug Davis <dug@us.ibm.com>
Upstream-commit: 6287ec9095f380449f0b4f1a06d4e5df43fc4449
Component: engine
2015-12-14 12:45:34 -08:00
a1551674ac Add some unit and integration tests
Add a unit test and couple of integration tests for volume propagation.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Upstream-commit: f988c98ff318dcfecb9d2db9511fe78e70b43e44
Component: engine
2015-12-14 10:39:53 -05:00