Commit Graph

94 Commits

Author SHA1 Message Date
6ed9290033 Disable privileged test from in user namespace
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: f01e1c865f35bd6578a2c0ef5b2d530538588ecb
Component: engine
2016-03-25 09:31:36 -07:00
5b031241b0 Fix setting cgroup permission to user/privileged devices
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: ee6123588067eb067ec1c02cc340d7493c8cd9a6
Component: engine
2016-03-24 14:16:33 -07:00
cb854bf11c Consolidate security options to use = as separator.
All other options we have use `=` as separator, labels,
log configurations, graph configurations and so on.
We should be consistent and use `=` for the security
options too.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: cb9aeb0413ca75bb3af7fa723a1f2e6b2bdbcb0e
Component: engine
2016-03-17 13:34:42 -04:00
9875b5b95d speed up DockerSuite.TestRunApparmorProcDirectory
Signed-off-by: Shijiang Wei <mountkin@gmail.com>
Upstream-commit: 7369ddd89fb0c2a85640013265d1e6d9ba8b31c9
Component: engine
2016-03-12 18:58:29 +08:00
356157b64b Merge pull request #18697 from jfrazelle/pids-cgroup
Add PIDs cgroup support to Docker
Upstream-commit: dd32445ecc6b706e8681dcc9d80c42c9b6cbf6cd
Component: engine
2016-03-08 14:03:36 -08:00
de84e87a00 pids limit support
update bash commpletion for pids limit

update check config for kernel

add docs for pids limit

add pids stats

add stats to docker client

Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 69cf03700fed7bf5eb7fe00c9214737e21478e49
Component: engine
2016-03-08 07:55:01 -08:00
3e9b68d581 Add support for NoNewPrivileges in docker
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Add tests for no-new-privileges

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Update documentation for no-new-privileges

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Upstream-commit: 74bb1ce9e9dbfa9dd866e84f891e865fca906d9a
Component: engine
2016-03-07 09:47:02 -08:00
b4d217e93d fix centos when userns not in kernel
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 7ab696f6b0e2d68cda7e28e68679e0f9fa06ef54
Component: engine
2016-03-02 16:58:49 -08:00
cfff83dc7e Follow symlink for --device argument.
Fixes: #13840

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 7ed569efdc822811cdac3b398a16757a54fbe4c4
Component: engine
2016-03-01 07:16:19 +00:00
4b3e3eb7e6 add seccomp default profile fix tests
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 11435b674b8ed580f8cf401c7cee7d24f59d7a43
Component: engine
2016-02-19 13:32:54 -08:00
748967285d make tests faster no apt-key
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 0d02f2a0118f7647876e1ce5c19874ea0dd06bd8
Component: engine
2016-02-11 16:28:00 -08:00
47f5776cce Improve remote integration-cli tests
Progress toward being able to run integration-cli campaign using a
client hitting a remote host.

Most of these fixes imply flagging tests that assume they are running on
the same host than the Daemon. Also fixes the `contrib/httpserver` image
that couldn't run because of a dynamically linked Go binary inside the
busybox image.

Signed-off-by: Arnaud Porterie <arnaud.porterie@docker.com>
Upstream-commit: a943c401509e7994ae5c574a4b7e23354e44a105
Component: engine
2016-02-11 07:31:49 -08:00
f0d917c642 Merge pull request #19725 from WeiZhang555/opt-TestRunSeccompDefaultProfile
Optimize `TestRunSeccompDefaultProfile`
Upstream-commit: c28bba04601c153af5d8f70dd500e7247157b835
Component: engine
2016-02-01 16:01:51 -05:00
75517ee0fb Optimize TestRunSeccompDefaultProfile
Optimize performance of `TestRunSeccompDefaultProfile`

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 2e9bb7870a0ea4a2fdc3fdbe6686ed6159f08803
Component: engine
2016-01-30 10:42:06 +08:00
8bc92ae008 Assert error in body of function inspectField*
1. Replace raw `docker inspect -f xxx` with `inspectField`, to make code
cleaner and more consistent
2. assert the error in function `inspectField*` so we don't need to
assert the return value of it every time, this will make inspect easier.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 62a856e9129c9d5cf7db9ea6322c9073d68e3ea4
Component: engine
2016-01-29 23:39:07 +08:00
8ef9af1262 integration-cli: require Apparmor
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 7ac8c778779253a5debff36453c9c31900e534e9
Component: engine
2016-01-26 11:57:14 +01:00
d22cc489e9 Skip failing tests on ARM to get red/green feedback from Jenkins
Signed-off-by: Stefan Scherer <scherer_stefan@icloud.com>
Upstream-commit: 4f339570cbd3cc57f5410c4ca08c7d7e03e6e56f
Component: engine
2016-01-18 17:00:15 +01:00
4d9fdc3032 fix proc regex
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 2b4f64e59018c21aacbf311d5c774dd5521b5352
Component: engine
2016-01-06 10:08:35 -08:00
65930d6983 Merge pull request #19002 from jfrazelle/update-test-images
cleanup test images
Upstream-commit: fa57eedff409edb7a4ad926b365213a944a97954
Component: engine
2016-01-04 10:24:30 -08:00
5582f5eb83 Implement configurable detach key
Implement configurable detach keys (for `attach`, exec`, `run` and
`start`) using the client-side configuration

- Adds a `--detach-keys` flag to `attach`, `exec`, `run` and `start`
  commands.
- Adds a new configuration field (in `~/.docker/config.json`) to
  configure the default escape keys for docker client.

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 15aa2a663b47b6126a66efefcadb64edfbffb9f5
Component: engine
2016-01-03 23:03:39 +01:00
902a67f4ef add more seccomp profile tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 327421d1df557e156b29d14359a2bfdc59cfb46f
Component: engine
2015-12-30 17:30:44 -08:00
b985b8195a cleanup jess/unshare image
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 626c933730cffb6ca9112271dc4df5a1e462cac1
Component: engine
2015-12-30 16:20:05 -08:00
3f03a2c89c add docs and unconfined to run a container without the default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 15674c5fb74df00d7560fb35619a5372ea2ee74e
Component: engine
2015-12-28 10:26:51 -08:00
aac8048807 add default seccomp profile tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: a48fe6238494547f392b06adf9d48944b4dd8ac3
Component: engine
2015-12-28 10:26:48 -08:00
b5ffb5a2c4 set default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 947293a28084cb5ee2e10e4d128c6e2b9d9da89d
Component: engine
2015-12-28 10:18:47 -08:00
47e00eae65 No options to tmpfs is valid
If you run a

docker run command with --tmpfs /mountpoint:noexec

Or certain options that get translated into mount options, the mount command can get passed "" for mount data.
So this should be valid.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: 89a775d2dc596b9ac86873edf447fff2f7012ef3
Component: engine
2015-12-22 14:15:07 -05:00
8c2d6245d9 upate TestRunWithBlkioInvalidWeightDevice with clearly invalid device name
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 673f2b8697727a0f0bfb3c4bd049cdac89a5a508
Component: engine
2015-12-22 12:43:42 +08:00
a04e1f9592 Add support for blkio read/write iops device
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 843084b08b521a70baf9284ec4e23e941ab38367
Component: engine
2015-12-21 09:14:49 +08:00
e8473ec20b Update TestRunWithBlkioInvalidDevice Tests
/dev/sda wasn't an invalid device and this test failed, so, hopefully
/dev/sdX isn't going to exist in other envs.

Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>
Upstream-commit: 2236ecddfb89dcc09ba1f4f416b1e44e17308497
Component: engine
2015-12-16 10:58:31 -06:00
1aaaffc214 Fixed typo change deivce to device.
This changes deivce to device in daemon, test and docs.

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: 7c077c2c3443fdb9b13b7790bc96cdaa287cf381
Component: engine
2015-12-10 15:23:05 -06:00
8a7da51391 Check minimum kernel memory limit to be 4M
Fixes: #18405

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: 2347f98003af34dd1cfd290bf0f2cc7e6ae07b03
Component: engine
2015-12-09 14:26:41 +08:00
86850a7309 Allow non-seccomp platforms to pass integration-cli tests
Since seccomp is still a configurable build-tag, add a requirements
entry for seccomp, as well as move seccomp tests to "_unix" given it
won't be applicable to other platforms at this time.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
Upstream-commit: 0433e3891532a9783b77d6b02c041bab359b0d91
Component: engine
2015-12-07 20:14:52 -05:00
7be0f9667b Add support for blkio read/write bps device
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 3f15a055e5c50d0f08d4c3e7cd9618d537b84f29
Component: engine
2015-12-04 09:26:03 +08:00
71b21cf347 This patch adds --tmpfs as a option for mounting tmpfs on directories
It will Tar up contents of child directory onto tmpfs if mounted over

This patch will use the new PreMount and PostMount hooks to "tar"
up the contents of the base image on top of tmpfs mount points.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: b3e527dfd242ad30c0297c8b257862116cf2c50e
Component: engine
2015-12-02 10:06:59 -05:00
ec12c4920e fix shm size handling
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: ef1d410b0270fa7309d76aded34113396def7fb2
Component: engine
2015-12-01 16:29:40 +01:00
54560bdc1f Update cgroup integration tests
Cgroup integtaion tests should cover:
- docker can run sucessfully with these options
- these cgroup options are set to HostConfig as expected
- these cgroup options are really set to cgroup files as expected
- other cases (wrong value, combinations etc..)

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: 0a426c47c84cb8aec714cce2c21e6c6696cbc8c4
Component: engine
2015-11-30 08:40:47 +08:00
dfeea039e6 Fix kernel memory limit
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: dd7b4fd651a6f9354efb991f6ce547a03729fa18
Component: engine
2015-11-28 09:47:25 +08:00
e1191bf537 Merge pull request #17459 from brahmaroutu/Power_Z_CI
Build and test Docker on IBM Power and Z using gccgo. Enable CI on Po…
Upstream-commit: 249b3a9479048bcec8da0666c2e224dddcfc3de8
Component: engine
2015-11-19 15:50:07 -08:00
2e538bcbf1 Remove deprecated cli flags
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 7929888214741c4ab194c44e0b14ac08aca06556
Component: engine
2015-11-15 10:40:01 +01:00
cf05bcf15c Build and test Docker on IBM Power and Z using gccgo. Enable CI on Power and Z.
Signed-off-by: Srini Brahmaroutu <srbrahma@us.ibm.com>
Upstream-commit: b1cc78b8f5d0c85c80c04a15fa791025ae7d22e6
Component: engine
2015-11-14 03:16:45 +00:00
1a0735060a Add support for blkio.weight_device
Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
Upstream-commit: 0fbfa1449d917ee0778266139d6035fb0782f7c2
Component: engine
2015-11-11 23:06:36 +08:00
900059747c Use checker for docker_cli_run_unix_test.go
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 7a82429b3d0fc7a93f61406117c170aaf9a4f9be
Component: engine
2015-11-06 22:49:16 +01:00
13125ff6b4 Merge pull request #17700 from calavera/remove_lxc
Remove LXC support.
Upstream-commit: 2519f465501657c24ecd13b8e53964b6c2f1a78d
Component: engine
2015-11-05 15:22:37 -08:00
f427a47755 Remove exec-driver global daemon option.
Each platform has only a driver now.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 157b66ad390902ef6f5b51b3f76d5177eacac81b
Component: engine
2015-11-05 17:09:58 -05:00
ef88e7ace2 Remove LXC support.
The LXC driver was deprecated in Docker 1.8.
Following the deprecation rules, we can remove a deprecated feature
after two major releases. LXC won't be supported anymore starting on Docker 1.10.

Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 3b5fac462d21ca164b3778647420016315289034
Component: engine
2015-11-05 17:09:57 -05:00
f66555fbae Change 'docker run' exit codes to distinguish docker/contained errors
The purpose of this PR is for users to distinguish Docker errors from
contained command errors.
This PR modifies 'docker run' exit codes to follow the chroot standard
for exit codes.
Exit status:
125 if 'docker run' itself fails
126 if contained command cannot be invoked
127 if contained command cannot be found
the exit status otherwise

Signed-off-by: Sally O'Malley <somalley@redhat.com>
Upstream-commit: 41de7a18d8f231568977e66bb58a6a02545d49d9
Component: engine
2015-11-04 15:18:50 -05:00
654728d047 GCCGO requires more memory and time to start containers, fixing GCCGO x86 CI
Signed-off-by: Srini Brahmaroutu <srbrahma@us.ibm.com>
Upstream-commit: 2046ba3e3ceee6c51f6e4c55f5d26af212d2dc3e
Component: engine
2015-10-26 19:09:00 +00:00
d7e9503657 Merge pull request #17011 from sunyuan3/TestRunWithBlkioInvalidWeight
update TestRunWithBlkioInvalidWeight
Upstream-commit: e4dadeed8860dbe748e7257ea13c792a8d82073b
Component: engine
2015-10-15 08:34:52 +02:00
e864e1b06f update TestRunWithBlkioInvalidWeight
Signed-off-by: Yuan Sun <sunyuan3@huawei.com>
Upstream-commit: d550fbb80e0ecf4b10c14e8b06bc8606101696dd
Component: engine
2015-10-14 16:20:52 +08:00
332d97bdef update tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Upstream-commit: 28ad7c588f5ebaf5a41950b42a61759cf47c8de7
Component: engine
2015-10-13 15:52:14 -07:00