Each plug-in operates as a separate service, and registers with Docker
through general (plug-ins API)
[https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No
Docker daemon recompilation is required in order to add / remove an
authentication plug-in. Each plug-in is notified twice for each
operation: 1) before the operation is performed and, 2) before the
response is returned to the client. The plug-ins can modify the response
that is returned to the client.
The authorization depends on the authorization effort that takes place
in parallel [https://github.com/docker/docker/issues/13697].
This is the official issue of the authorization effort:
https://github.com/docker/docker/issues/14674
(Here)[https://github.com/rhatdan/docker-rbac] you can find an open
document that discusses a default RBAC plug-in for Docker.
Signed-off-by: Liron Levin <liron@twistlock.com>
Added container create flow test and extended the verification for ps
Upstream-commit: 75c353f0ad73bd83ed18e92857dd99a103bb47e3
Component: engine
- Moved the following config structs to api/types
- ContainerRmConfig
- ContainerCommitConfig
Signed-off-by: Morgan Bauer <mbauer@us.ibm.com>
Upstream-commit: 63fb931a0b7298c6281898bcc5f53ab0655ad1a6
Component: engine
Modify docker volume inspect to return existed volumes and the names of the unexsited volumes
Upstream-commit: 5b4734aaa543243ba076bf606286bbc46fed9e38
Component: engine
Because I like the name `system` better than `local` :)
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 867f432985d6b4a46c2f66225d70a4ffdb28d8a3
Component: engine
Following `docker inspect` conventions:
- Keep partial info in a buffer to not print incomplete template outputs.
- Break execution when template parsing or decoding fail.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: b9d30280f6eb2f817b1315c22953a133f1b66e69
Component: engine
A TopicFunc is an interface to let the pubisher decide whether it needs
to send a message to a subscriber or not. It returns true if the
publisher must send the message and false otherwise.
Users of the pubsub package can create a subscriber with a topic
function by calling `pubsub.SubscribeTopic`.
Message delivery has also been modified to use concurrent channels per
subscriber. That way, topic verification and message delivery is not
o(N+M) anymore, based on the number of subscribers and topic verification
complexity.
Using pubsub topics, the API stops controlling the message delivery,
delegating that function to a topic generated with the filtering
provided by the user. The publisher sends every message to the
subscriber if there is no filter, but the api doesn't have to select
messages to return anymore.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 434d2e8745696255a204d9eefc6a2854ff74e5c2
Component: engine
…for consistency as docker inspect and docker volume inspect supports it too
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 295c27388dd1e7cc4196fbb8ffe0646b33bacb5b
Component: engine
Improves the current filtering implementation complixity.
Currently, the best case is O(N) and worst case O(N^2) for key-value filtering.
In the new implementation, the best case is O(1) and worst case O(N), again for key-value filtering.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 93d1dd8036d57f5cf1e5cbbbad875ae9a6fa6180
Component: engine
Consolidate all the API to same time format: RFC3339, and it will be
client's responsibility to present it in more user friendly way.
Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 9daca1222adabf3aeae97a2c4e5f4ed1bb8c15e1
Component: engine
Closes#9798
@maintainers please note that this is a change to the UX. We no longer
require the -f flag on `docker tag` to move a tag from an existing image.
However, this does make us more consistent across our commands,
see https://github.com/docker/docker/issues/9798 for the history.
Signed-off-by: Doug Davis <dug@us.ibm.com>
Upstream-commit: 8d4fe141c4c3f456df9c2be75ffe5071d1665717
Component: engine
We can remove one function from the stack by injecting the middleware
only when logging in enabled and the level is debug.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 82323294db96e8043244027c262481af6c8f478d
Component: engine
It actually adds nothing to queuing requests.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: ca5795cef810c85f101eb0aa3efe3ec8d756490b
Component: engine
When tools like kubernetes and cockpit are talking to the docker daemon
actively, we are seeing large number of log messages that look like debug
information.
For example
docker info adds the following line to journald.
Nov 26 07:09:23 dhcp-10-19-62-196.boston.devel.redhat.com docker[32686]: time="2015-11-26T07:09:23.124503455-05:00" level=info msg="GET /v1.22/info"
We think this should be Debug level not Info level.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: cf4fb150880ec5f4153c291e67238e28f3cbdf9b
Component: engine
Leaving only one versioned main function that a backend must implement.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 38abba9e2c8f7ac27bd26bf98685b51585922317
Component: engine
Add distribution package for managing pulls and pushes. This is based on
the old code in the graph package, with major changes to work with the
new image/layer model.
Add v1 migration code.
Update registry, api/*, and daemon packages to use the reference
package's types where applicable.
Update daemon package to use image/layer/tag stores instead of the graph
package
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 4352da7803d182a6013a5238ce20a7c749db979a
Component: engine
This commit enhance `docker network rm` command to allow user to delete
multi networks at the same time.
Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: e7eb6687ef7da34cd69b27cfbaf3fd8112073530
Component: engine
Fixes#16555
Original docker `cp` always copy symbol link itself instead of target,
now we provide '-L' option to allow docker to follow symbol link to real
target.
Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 92600bdec1284f9031868751f61bef476d2e1dbd
Component: engine
* This commit will mark --before and --since as deprecated, but leave their behavior
unchanged until they are removed, then re-implement them as options for --filter.
* And update the related docs.
* Update the integration tests.
Fixes issue #17716
Signed-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>
Upstream-commit: 1921c629381d25ebff7b8b8c8348a0a81525f264
Component: engine
- Optional "--shm-size=" was added to the sub-command(run, create,and build).
- The size of /dev/shm in the container can be changed
when container is made.
- Being able to specify is a numerical value that applies number,
b, k, m, and g.
- The default value is 64MB, when this option is not set.
- It deals with both native and lxc drivers.
Signed-off-by: NIWA Hideyuki <niwa.hiedyuki@jp.fujitsu.com>
Upstream-commit: 5aeaf2a0c4236711e0981515d8627b30e22a1637
Component: engine
