Following #19995 and #17409 this PR enables skipping userns re-mapping
when creating a container (or when executing a command). Thus, enabling
privileged containers running side by side with userns remapped
containers.
The feature is enabled by specifying ```--userns:host```, which will not
remapped the user if userns are applied. If this flag is not specified,
the existing behavior (which blocks specific privileged operation)
remains.
Signed-off-by: Liron Levin <liron@twistlock.com>
Upstream-commit: 6993e891d10c760d22e0ea3d455f13858cd0de46
Component: engine
- add test for pull from private registry with no credentials
- add test for push to docker hub with no credentials
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Signed-off-by: Antonio Murdaca <amurdaca@localhost.localdomain>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 6d23c3c57a733436d902b7883f2f0b00846df9e2
Component: engine
Fix and add test for case c) in #21054
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 497d545093bce4f01455bf8d2e1658435dbb040b
Component: engine
This PR adds the "notary" binary requirement for tests.
Previously, NotaryHosting was checking for the "notary-server"
binary under the name notaryBinary. This renames that reference to
notaryServerBinary, so that notaryBinary can rightly refer
to the actual "notary" binary.
Currently only one test actually uses the notary binary, so it's been
updated accordingly.
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: db700a678d1da4275553ff7201e2597c7a8016ee
Component: engine
Fixes a bug when the log output is empty.
The length of a slice containing an empty string is 1, not 0, so
the test fails to catch when the log is empty. Instead, take a look at
out, which is just a string.
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: 2a0291489247b79058f0f94a2af7c5b3f89b78af
Component: engine
Fixes#20972
Also makes sure there is no check to registry if
no image is found for the prefixed IDs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 16e4c4e481aca8d5a99d5a4760b5d27bf5bbb9fd
Component: engine
Attach can hang forever if there is no data to send. This PR adds notification
of Attach goroutine about container stop.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: 7bb815e2960c97c5cc0624566ac51581bdd884ab
Component: engine
Update unit test and documentation to handle the new case where Username
is set to <token> to indicate an identity token is involved.
Change the "Password" field in communications with the credential helper
to "Secret" to make clear it has a more generic purpose.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: ba0aa5311aa27fe77166f03d8bcc0174e2985913
Component: engine
On redhat based distribution, checking that USER_NS is compiled in the
kernel is not sufficient, we also have to check that the feature as
been enabled.
With this commit, it is now done by checking the content of
`/sys/module/user_namespace/parameters/enable`.
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
Upstream-commit: 6cbff9505c992bd1e61ea7943737dac04ba665ea
Component: engine
Optimized integration test case DockerSuite.TestBuildUsersAndGroups fixes#19425
Upstream-commit: 016be532368ac45d425b770e0b02aa12de7d5620
Component: engine
Removed unnecessary RUN statements and combined some of the RUN statement into a single line.
The runtime performance is seen as follows:
pre-change:
PASS: docker_cli_build_test.go:3826: DockerSuite.TestBuildUsersAndGroups
63.074s
post-change:
PASS: docker_cli_build_test.go:3826: DockerSuite.TestBuildUsersAndGroups
49.698s
Signed-off-by: Anil Belur <askb23@gmail.com>
Upstream-commit: deeb5c95e2eaa58d4490cb126839b8bc41e5ba08
Component: engine
Correct creation of a non-existing WORKDIR during docker build to use
remapped root uid/gid on mkdir
Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
Upstream-commit: 799a6b94ee661022d66f88a009ff58f08eb5a2c3
Component: engine
It'll weaken this test case, and the flaky test is resolved
by another commit in this PR.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: 021a12ef1b96ebee852173212d9de6b0a6285f92
Component: engine
Fixes: #20709
As discussed in the issue, we need refine the message to
help user more understood, what happened for non-exist image.
Signed-off-by: Kai Qiang Wu(Kennan) <wkqwu@cn.ibm.com>
Upstream-commit: ed231d409501d1e496fbe2b2e31a279eb2998cf2
Component: engine
This fix tries to improve the time to run TestRunUnshareProc
in #19425.
In this fix goroutines are used to run test cases in parallel to
prevent the test from taking a long time to run.
As the majority of the execution time in the tests is from
multiple executions of 'docker run' and each of which takes
several seconds, parallel executions improve the test time.
Since each 'docker run' is independent, the purpose of the
test is not altered in this fix.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 526c2fe942107908fe324db2ecceee14b69cb191
Component: engine
