In d42dbdd3d48d0134f8bba7ead92a7067791dffab the code was re-arranged to
better report errors, and ignore non-errors.
In doing so we removed a deferred remove of the AUFS diff path, but did
not replace it with a non-deferred one.
This fixes the issue and makes the code a bit more readable.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 276b44608b04f08bdf46ce7c816b1f744bf24b7d)
Signed-off-by: Andrew Hsu <andrewhsu@docker.com>
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
(cherry picked from commit 493002021094d72d405e1cd5bfa10b8080f67920)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
GetTasks can call GetService and GetNode with the read lock held. These
methods try to aquire the read side of the same lock. According to the
sync package documentation, this is not safe:
> If a goroutine holds a RWMutex for reading, it must not expect this or
> any other goroutine to be able to also take the read lock until the
> first read lock is released. In particular, this prohibits recursive
> read locking. This is to ensure that the lock eventually becomes
> available; a blocked Lock call excludes new readers from acquiring the
> lock.
Fix GetTasks to use the lower-level getService and getNode methods
instead. Also, use lockedManagerAction to simplify GetTasks.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit bd4f66c8f1f6ad4a2f228a957f293bc157e13d9c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This prevents mounts in the plugins dir from leaking into other
namespaces which can prevent removal (`device or resource busy`),
particularly on older kernels.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 0c2821d6f2de692d105e50a399daa65169697cca)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
- When a network is created with the null ipam driver, docker api server
thread will deference a nil pointer on `docker network ls` and on
`docker network inspect <nw>`. This because buildIpamResource()
assumes a gateway address is always present, which is not correct.
Signed-off-by: Alessandro Boch <aboch@tetrationanalytics.com>
(cherry picked from commit beebfc0cf6240c8af511eb4d7e29314c8de6ddf2)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
Starting 17.06 swarm service create supports service creates with predefined
networks like host and bridge. Due to the nature of the feature, swarm manager
has a swarm scope predefined networks in addition to local scoped
predefined networks on all nodes. However network inspects for swarm scoped
predefined networks was not possible. The fix adds support for network inspect
for swarm scoped predefined networks.
Signed-off-by: Abhinandan Prativadi <abhi@docker.com>
(cherry picked from commit 5bfefb2d3662fa066ddf0d0e10cac93ee70f7ae8)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
Delete needs to release names related to a container even if that
container isn't present in the db. However, slightly overzealous error
checking causes the transaction to get rolled back. Ignore the error
from Delete on the container itself, since it may not be present.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 1d9546fc62c559dbcbb3dbdce40318fb7c4d67a2)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 4735c7663201ce1bf618e2aa505d7813a331be3f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `is-task` filter was only documented in the usage
section, but this section is not used in the documentation.
This patch adds the missing filter, synchronises the
man page source, and does some slight rephrasing
and reformatting of the filters.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 46064f33f4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some network environments may have NATs, proxies, or gateways which
kill idle connections. There are many Docker API operations which may
be idle for long periods of time (such as ContainerWait and ContainerAttach)
and may result in unexpected connection closures or hangs if TCP keepalives
are not used.
This patch updates the default HTTP transport used by the Docker client
package to enable TCP Keep-Alive with a keep-alive interval of 30 seconds.
It also sets a connect timeout of 30 seconds.
Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
(cherry picked from commit 2831a04cba)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit fc48b5529dca3907ade273921a14906be796e333)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Documents the API changes introduced in
0304c98d85404fe75a1b4a35d3c111931e062f41 and
08f7cf05268782a0dd8e4c41a4cc65fdf78d09f2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c8dad44c326d9d2131f94babbc535e7f442db290)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
releaseableLayer includes automatic handling for creating a read/write layer and mounting it on a call to Mount(), but then does not correspondingly unmount the layer before trying to delete it, which will fail for some graphdrivers. Commit on a releaseable layer also leaks the tarstream for the layer. To fix this, the stream close is deferred in Commit and releaseRWLayer now correctly handles unmounting the layer before trying to delete it. In addition, the changes include better error handling in Release() to make sure that errors are returned to the caller for failures on read/write layers instead of being ignored.# Please enter the commit message for your changes. Lines starting
Signed-off-by: Stefan Wernli <swernli@ntdev.microsoft.com>
(cherry picked from commit 1d457999c4540aacda68f834bdb3c6f220ce3fd5)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Justin Menga <justin.menga@gmail.com>
(cherry picked from commit 0fd5a0bab79f20f910cb7551ec34158a32e05f5a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Specifically, none of the graphdrivers are supposed to return a
not-exist type of error on remove (or at least that's how they are
currently handled).
Found that AUFS still had one case where a not-exist error could escape,
when checking if the directory is mounted we call a `Statfs` on the
path.
This fixes AUFS to not return an error in this case, but also
double-checks at the daemon level on layer remove that the error is not
a `not-exist` type of error.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit d42dbdd3d48d0134f8bba7ead92a7067791dffab)
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
This reverts commit ceac22bf2240df483b1d3bd3a19ac681e665f910.
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
(cherry picked from commit bda73f99e455bd3f041ccc843f094186ca8b8623)
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Vendors new dependency github.com/crosbymichael/upgrade
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 358c36e930)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
Tried out make -C in this scenario and it did not seem to function
correctly, changed to cd.
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
(cherry picked from commit 3a548f8815d5308b197abea1e39f0a0a4939c4f2)
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Integration test were failing in trial runs for docker-ce 17.07 due to
the lack of go-autogen being sourced in `hack/make.sh`. This re-adds
go-autogen to be sourced for test-integration-cli so that we can
actually run tests without the error found in:
https://github.com/moby/moby/pull/33857
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
(cherry picked from commit 3cdd471cac8193c34d8483255065c6c28a7b1645)
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Release jobs will fail if the version files are out of sync due to how
`hack/make.sh` builds binaries (putting them into the version folder
according to `components/engine/VERSION` instead of the base `VERSION`
file)
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Also fix bad reference to ServiceSpec.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: ea1d14a189d62df34427b037a6d043ae3028760b
Component: engine
This adds the new `CreatedAt` field to the API version history
and updates some examples to show this information.
The `CreatedAt` field was implemented in a46f757c4043031379362c5d6b3bad7562ab9fed
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 48a83a3a18185e0ad48737d448524670f8fac4bf
Component: engine
The swagger.yml defined these endpoints to return
a "ServiceSpec" instead of a "SecretSpec".
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: f6954bea9f28c62c50b88c895968045cf801aa81
Component: engine
These commands were only used as subcommands, so did
not have to be exported.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 9c7b0d74cd
Component: cli
Adapt "image prune" and "build cache prune" to have
the same signature as the other prune commands, so
that they can all be added to the "pruneFuncs" array.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 73163ee78b
Component: cli
The `cli/command/prune` just does some aliasing of `Prune*` methods,
doesn't have any use.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 3f4d91508e
Component: cli
I am getting the following warning from gcc when compiling the daemon:
> # github.com/docker/docker/pkg/devicemapper
> pkg/devicemapper/devmapper_wrapper.go: In function ‘log_cb’:
> pkg/devicemapper/devmapper_wrapper.go:20:2: warning: ignoring return
> value of ‘vasprintf’, declared with attribute warn_unused_result
> [-Wunused-result]
> vasprintf(&buffer, f, ap);
> ^
vasprintf(3) man page says if the function returns -1, the buffer is
undefined, so we should not use it. In practice, I assume, this never
happens so we just return.
Introduced by https://github.com/moby/moby/pull/33845 that resulted in
commit 63328c6 ("devicemapper: remove 256 character limit of libdm logs")
Cc: Aleksa Sarai <asarai@suse.de>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Upstream-commit: 7da12bcfa9db4d84b2c547bee93dafeaead15b16
Component: engine
Makes sure that debug endpoints are always available, which will aid in
debugging demon issues.
Wraps debug endpoints in the middleware chain so the can be blocked by
authz.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 408c7ade7008ca9b2181e12e51a01250a7a94413
Component: engine
Use unix.Prctl() instead of manually reimplementing it using
unix.RawSyscall. Also use unix.SECCOMP_MODE_FILTER instead of locally
defining it.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Upstream-commit: 6c9d715a8c64a7c782b8c7b57925e1dc19b29517
Component: engine
This documents the Service privileges
API changes, that were added in:
091b5e68ea735bf4e8ece708bbc8c413a32eab73
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: d0a8e73e7b60f61db0c3799643aaccbbf33f3601
Component: engine
Use the (new) plugin fixtures for plugin tests rather than pulling
plugins from hub.
This removes the restriction for platforms/archs since plugin binaries
get built in the test environment.
Future work would be to add test plugins for the various subsystems so
tests that are actually using plugins (e.g. volumes, networks) can be
ported to use the fixtures as well.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 15a538a627e1d0898862c9e6ca7472cd7fb517ce
Component: engine
With docker-17.06.0 some images pulled do not extract properly. Some files don't appear in correct directories. This may or may not cause the pull to fail. These images can't be pushed or saved. 17.06 is the first version of Docker built with go1.8.
Cause
There are multiple updates to the tar package in go1.8.
https://go-review.googlesource.com/c/32234/ disables using "prefix" field when new tar archives are being written. Prefix field was previously set when a record in the archive used a path longer than 100 bytes.
Another change https://go-review.googlesource.com/c/31444/ makes the reader ignore the "prefix" field value if the record is in GNU format. GNU format defines that same area should be used for access and modified times. If the "prefix" field is not read, a file will only be extracted by the basename.
The problem is that with a previous version of the golang archive package headers could be written, that use the prefix field while at the same time setting the header format to GNU. This happens when numeric fields are big enough that they can not be written as octal strings and need to be written in binary. Usually, this shouldn't happen: uid, gid, devmajor, devminor can use up to 7 bytes, size and timestamp can use 11. If one of the records does overflow it switches the whole writer to GNU mode and all next files will be saved in GNU format.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 4a3cfda45e37b81211fbfbf0c45dbe64860a3ad0
Component: engine
This is a new option added specifically to allow for debugging of bugs
in Docker's storage drivers or libdm itself.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: c7710819a5
Component: cli
Currently, names are maintained by a separate system called "registrar".
This means there is no way to atomically snapshot the state of
containers and the names associated with them.
We can add this atomicity and simplify the code by storing name
associations in the memdb. This removes the need for pkg/registrar, and
makes snapshots a lot less expensive because they no longer need to copy
all the names. This change also avoids some problematic behavior from
pkg/registrar where it returns slices which may be modified later on.
Note that while this change makes the *snapshotting* atomic, it doesn't
yet do anything to make sure containers are named at the same time that
they are added to the database. We can do that by adding a transactional
interface, either as a followup, or as part of this PR.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 1128fc1add66a849c12d2045aed39605e673abc6
Component: engine
Signed-off-by: John Howard <jhoward@microsoft.com>
This changes the LCOW driver to support both global SVM lifetime and
per-instance lifetime. It also corrects the scratch implementation.
Upstream-commit: 76b0d4819a50c50edd79890db0b92eb96c8d46e6
Component: engine
Adds the seccomp buildtag for ubuntu-yakkety on s390x
Note: s390x requires libseccomp-dev 2.3.1 at the moment which is only available
only yakkety and later. This change is also consistent with the s390x yakkety
deb dockerfile in moby/moby.
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: 86c865f571eb9479052e19920fbb0efe7f54fd25
Component: packaging
The case where we are trying to do a remount with changed filesystem specific options was missing,
we need to call `mount` as well here to change those options.
See #33844 for where we need this, as we change `tmpfs` options.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: 3a1ab5b479ce843648cf676fbaaf2bec9e040dce
Component: engine
This commit changes the order stacks and nodes are displayed.
For example, running "docker stack ls" is expected to
display the following list:
NAME SERVICES
service-1 1
service-2 1
service-10 1
However, currently this is what is printed:
NAME SERVICES
service-1 1
service-10 1
service-2 1
To fix this, "docker stack ls" and "docker node ls" are using
natural sorting to make it more human readable.
Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
Upstream-commit: 1333b49194
Component: cli
devicemapper: Wait for device removal if deferredRemoval=true and deferredDeletion=…
Upstream-commit: e04dbe5ac287c2a856b7c96972d931ee5f0e288f
Component: engine
When a container is paused, signals are sent once the container has been
unpaused.
Instead of forcing the user to unpause a container before they can ever
send a signal, allow the user to send the signals, and in the case of a
stop signal, automatically unpause the container afterwards.
This is much safer than unpausing the container first then sending a
signal (what a user is currently forced to do), as the container may be
paused for very good reasons and should not be unpaused except for
stopping.
Note that not even SIGKILL is possible while a process is paused,
but it is killed the instant it is unpaused.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: c3feb046b9b1eb606cc7e853d020799eb3800e0e
Component: engine
Use the symlink xattr syscall wrappers Lgetxattr and Lsetxattr from
x/sys/unix (introduced in golang/sys@b90f89a) instead of providing own
wrappers. Leave the functionality of system.Lgetxattr intact with
respect to the retry with a larger buffer, but switch it to use
unix.Lgetxattr. Also leave system.Lsetxattr intact (even though it's
just a wrapper around the corresponding function from unix) in order to
keep moby building for !linux.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Upstream-commit: 4d966409bc7033e3bebe7deb921d8be8249f8d18
Component: engine
Due to the CL https://go-review.googlesource.com/c/39608/ in
x/sys/windows which changed the definitions of STD_INPUT_HANDLE,
STD_OUTPUT_HANDLE and STD_ERROR_HANDLE, we get the following failure
after re-vendoring x/sys/windows:
07:47:01 # github.com/docker/docker/pkg/term
07:47:01 pkg/term/term_windows.go:82: constant 4294967286 overflows int
07:47:01 pkg/term/term_windows.go:88: constant 4294967285 overflows int
07:47:01 pkg/term/term_windows.go:94: constant 4294967284 overflows int
07:47:12 Build step 'Execute shell' marked build as failure
Temporarily switch back pkg/term to use these constants from the syscall
package and add a comment about it.
To really fix this, go-ansiterm should probably be switched to use
x/sys/windows.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Upstream-commit: ef5252fc5dcd83d1b8dfe173a68691c8a63e7e4a
Component: engine
Due to the CL https://go-review.googlesource.com/c/39608/ in
x/sys/windows which changed the definitions of STD_INPUT_HANDLE,
STD_OUTPUT_HANDLE and STD_ERROR_HANDLE, we get the following failure
in cmd/dockerd/service_windows.go after re-vendoring x/sys/windows:
06:29:57 # github.com/docker/docker/cmd/dockerd
06:29:57 .\service_windows.go:400: cannot use sh (type int) as type uint32 in argument to windows.GetStdHandle
Fix it by adding an explicit type conversion when calling
windows.GetStdHandle.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Upstream-commit: e769da88e6c6e94a397822dd8962cbcb83a402a0
Component: engine
Do not change pause state when restoring container's
status, or status in docker will be different with
status in runc.
Signed-off-by: Fengtu Wang <wangfengtu@huawei.com>
Upstream-commit: 977c4046fd2147d7c04f4b513a94138013ca0dd6
Component: engine
Update golang.org/x/sys to 739734461d1c916b6c72a63d7efda2b27edb369f in
order to get the Lgetxattr, Llistxattr, Lremovexattr and Lsetxattr
syscall wrappers. These will be used in a successive commit to replace
the wrappers in libcontainer/system/xattr_linux.go.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Upstream-commit: bd13a5a9e0e3bfad8bdc533cac45ec4bd17c1c33
Component: engine
this commit matches what's used in SwarmKit
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 9fc66ec869ecd963d7a30b96f5c0b1de69cf5090
Component: engine
Use byte buffers by default, since that is what is done most of the time.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 69b142b52a
Component: cli
Also update gometalinter to use the official version. The update
found some new gosimple errors, which are fixed.
Also update the filewatcher script for the latest version of filewatcher.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 102a8f0c9d
Component: cli
This:
* conflicts with --password (naturally)
* conflicts with the absence of --username (both can't be grabbed by the
stdin)
* strips a trailing newline off the password if it exists
Signed-off-by: Tycho Andersen <tycho@tycho.ws>
Upstream-commit: 7d18477bc2
Component: cli
When running `docker stack rm <some stack>` against an older daemon,
a warning was printed for "configs" being ignored;
WARNING: ignoring "configs" (requires API version 1.30, but the Docker daemon API version is 1.26)
Given that an old daemon cannot _have_ configs, there should not be
a need to warn, or _attempt_ to remove these resources.
This patch removes the warning, and skips fetching (and removing)
configs.
A check if _secrets_ are supported by the daemon is also added,
given that this would result in an error when attempted against
an older (pre 1.13) daemon.
There is one situation where this could lead to secrets or
configs being left behind; if the client is connecting to a
daemon that _does_ support secrets, configs, but the API version
is overridden using `DOCKER_API_VERSION`, no warning is printed,
and secrets and configs are not attempted to be removed.
Given that `DOCKER_API_VERSION` is regarded a feature for
debugging / "power users", it should be ok to ignore this.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 2429f15672
Component: cli
Changes most references of syscall to golang.org/x/sys/
Ones aren't changes include, Errno, Signal and SysProcAttr
as they haven't been implemented in /x/sys/.
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
[s390x] switch utsname from unsigned to signed
per 33267e036f
char in s390x in the /x/sys/unix package is now signed, so
change the buildtags
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: 069fdc8a083cb1663e4f86fe3fd9b9a1aebc3e54
Component: engine
The `--network` option is only available for `docker service create`.
Signed-off-by: Harald Albers <github@albersweb.de>
Upstream-commit: e7e77b5e65
Component: cli
Commit c79c16910c0f3d6e88f2dc6ef609ecc3b02ccef9
inadvertently put these API changes under API 1.31,
but they were added in API 1.30.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: dd5e818fabc7edf7fa4d952e62b949b224909d2a
Component: engine
This make updating vndr a deliberate action, and
prevents updates to vndr from making the vendor
validation fail in CI.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 008785f5b5
Component: cli
This bumps vndr to 9909bb2b8a0b7ea464527b376dc50389c90df587
and revendors dependencies.
Includes a change that prunes go files with `+build ignore`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 63f4bc5237dc928125ac62aa5468f6d8b28272c7
Component: engine
libcontainer/user does not build at all on Windows any more, and
this was breaking the client on Windows with upstream `runc`. As
these functions are not used anyway, just split out and stop
checking `runtime`.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: b7bd959294b5dc5b6e18b3fed5dde18f4f7f1d20
Component: engine
If we get "container not found" error from containerd, it's possibly
because that this container has already been stopped. It will be ok to
ignore this error and just return an empty stats.
Signed-off-by: Yuanhong Peng <pengyuanhong@huawei.com>
Upstream-commit: 4a6cbf9bcb78d38c48ef963f585f0fadf733e101
Component: engine
Fix run `docker rename <container-id> new_name` concurrently, the container will have multi names
Upstream-commit: 8e3555f8539d91f530f895e19a51db14f1ca93fb
Component: engine
Commit 077f08bf54dc89d382cbcbd797b2bd7c4867151d
temporarily switch etcd to a fork, pending a
pull-request to be merged, and a new release
that contains the change.
The pull request was merged, and included in
etcd v3.2.0
This patch bumps etcd to v3.2.1, which contains
some bug-fixes on top of v3.2.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: cbc480a40cb22653ac647a8d24957a0c33e3bffe
Component: engine
Do not allow sharing of container network with hyperv containers
Signed-off-by: Madhan Raj Mookkandy <madhanm@microsoft.com>
Upstream-commit: 349913ce9fde34d8acd08fad5ce866401f4d135e
Component: engine
This script is part of the Docker product,
and no longer maintained in this repository.
The script has been updated to install Docker CE
packages from https://download.docker.com, and is
now located in the https://github.com/docker/docker-install
repository.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: e038f9f81f871237e9ec7a2188eb6b401bdd8809
Component: engine
Enables other subsystems to watch actions for a plugin(s).
This will be used specifically for implementing plugins on swarm where a
swarm controller needs to watch the state of a plugin.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 72c3bcf2a533a827402945e3a55872e2db4fb024
Component: engine
Signed-off-by: Yassine TIJANI <yasstij11@gmail.com>
moving the deffering of the close after the error checking
Signed-off-by: Yassine TIJANI <yasstij11@gmail.com>
fixing SIGSEGV when running containers
Signed-off-by: Yassine TIJANI <yasstij11@gmail.com>
Upstream-commit: 45b0e7cf1a
Component: cli
docker run --name=test ubuntu /bin/sh -c "cd /tmp && echo hi > a && ln a b" && docker cp test:/tmp tmp_
test
link /root/tmp/a /root/tmp_/b: no such file or directory
Signed-off-by: yangshukui <yangshukui@huawei.com>
Upstream-commit: d58ffa0364c04d03a8f25704d7f0489ee6cd9634
Component: engine
The `err` variable was set in a loop, so only
the last result was taken into account to return
"failure" or not.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 4d4c789cac
Component: cli
Before this patch, a log reader is able to block all log writes
indefinitely (and other operations) by simply opening the log stream and
not consuming all the messages.
The reason for this is we protect the read stream from corruption by
ensuring there are no new writes while the log stream is consumed (and
caught up with the live entries).
We can get around this issue because log files are append only, so we
can limit reads to only the section of the file that was written to when
the log stream was first requested.
Now logs are only blocked until all files are opened, rather than
streamed to the client.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: e2209185ed1c959131d4068ec7fc93e194dc0802
Component: engine
When run `docker rename <container-id> new_name` concurrently, every operation will release
container's old name. So container will have multi new names reserve in nameIndex.
Signed-off-by: Yang Pengfei <yangpengfei4@huawei.com>
Upstream-commit: cc2340689c431504689d01c9516b3a340b2e8dbc
Component: engine
Go 1.9 (golang/go@66b5a2f) removed file type bits from
archive/tar.FileInfoHeader().
This commit ensures file type bits are filled even on Go 1.9 for
compatibility.
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Upstream-commit: 1a451d9a7bb9cd7d437b42d4e73b0560fbf84348
Component: engine
`--metrics-addr` does not accept network interface names.
Therefore `__docker_local_interfaces` was refined for this feature to
optionally exclude interface names.
Note that although `--metrics-addr` is experimental, it cannot be
selectively enabled in bash completion because the test for the daemon
running in experimental mode requires a running daemon. As this
completion pertains to starting the daemon, this requirement is not met.
Signed-off-by: Harald Albers <github@albersweb.de>
Upstream-commit: 0ea31afd57
Component: cli
COmmit 0307fe1a0bcdc02583a24add41eb783c117bad8c added
a new `DataPathAddr` property to the swarm/init and swarm/join
endpoints. This property was not yet added to the
documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: c79c16910c0f3d6e88f2dc6ef609ecc3b02ccef9
Component: engine
This package is used by Notary. Add a comment to
the vendor.conf file to explain what it contains
and what it's used for.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 60fe70c900
Component: cli
Do not set a default value for swappiness as the default value should be
`nil`
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: 9d87e6e0fb799d6ef3bb9a97bc523f8d343b5fb3
Component: engine
Because we use our own logging callbacks in order to use libdm
effectively, it is quite difficult to debug complicated devicemapper
issues (because any warnings or notices from libdm are muted by our own
callback function). e07d3cd9a ("devmapper: Fix libdm logging") further
reduced the ability of this debugging by only allowing _LOG_FATAL errors
to be passed to the output.
Unfortunately libdm is very chatty, so in order to avoid making the logs
even more crowded, add a dm.libdm_log_level storage option that allows
people who are debugging the lovely world of libdm to be able to dive in
without recompiling binaries.
The valid values of dm.libdm_log_level map directly to the libdm logging
levels, and are in the range [2,7] as of the time of writing with 7
being _LOG_DEBUG and 2 being _LOG_FATAL. The default is _LOG_FATAL.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: 198f83bba120c6c9bda679d33a55acab6cc9f33d
Component: engine
LogInit used to act as a manual way of registering the *necessary*
pkg/devicemapper logging callbacks. In addition, it was used to split up
the logic of pkg/devicemapper into daemon/graphdriver/devmapper (such
that some things were logged from libdm).
The manual aspect of this API was completely non-sensical and was just
begging for incorrect usage of pkg/devicemapper, so remove that semantic
and always register our own libdm callbacks.
In addition, recombine the split out logging callbacks into
pkg/devicemapper so that the default logger is local to the library and
also shown to be the recommended logger. This makes the code
substantially easier to read. Also the new DefaultLogger now has
configurable upper-bound for the log level, which allows for dynamically
changing the logging level.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: cfd39e8d6d79eee8a71fbe6820dd67babf05d951
Component: engine
e07d3cd9a ("devmapper: Fix libdm logging") removed all of the callers of
DmLogInitVerbose, but we still kept around the wrapper. However, the
libdm dm_log_init_verbose API changes the verbosity of the *default*
libdm logger. Because pkg/devicemapper internally *relies* on using
logging callbacks to understand what errors were encountered by libdm,
this wrapper is useless (it only makes sense for the default logger
which we do not user).
Any user not inside Docker of this function almost certainly was not
using this API correctly, because pkg/devicemapper will misbehave if our
logging callbacks were not registered.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: c654147f0635736fff0035ecdfa53a41c7fad0d0
Component: engine
This limit is unecessary and can lead to the truncation of long libdm
logs (which is quite annoying).
Fixes: b440ec013 ("device-mapper: Move all devicemapper spew to log through utils.Debugf().")
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: 63328c6882c3d1f54c66499ef9963adfbf1883f0
Component: engine
Task command lines are world readable via /proc/pid/cmdline, so this isn't
safe.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>
Upstream-commit: c269ad26e8
Component: cli
Description:
1. start a container with restart=always.
`docker run -d --restart=always ubuntu sleep 3`
2. container init process exits.
3. use `docker pause <id>` to pause this container.
if the pause action is before cgroup data is removed and after the init process died.
`Pause` operation will success to write cgroup data, but actually do not freeze any process.
And then docker received pause event and stateExit event from
containerd, the docker state will be Running(paused), but the container
is free running.
Then we can not remove it, stop it , pause it and unpause it.
Signed-off-by: Wentao Zhang <zhangwentao234@huawei.com>
Upstream-commit: fe1b4cfba6320793373c5397641d743d9fe94cf8
Component: engine
the filemode should be 0640 but not 06400
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: 96ea8eaa1592856e0829c3465e64f93911d3e389
Component: engine
This dependency was temporarily forked, but
the fork was removed in db37a86d37431a1d82505cf6adc91a5d91dad146.
This patch removes the comment
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: fe877c2b959b60d953ad4b2d3eeda377add575a5
Component: engine
The name/ID relationships are maintained separately from the memdb and
can be out of sync from any particular memdb snapshot. If a container
does not exist in the memdb, we must accept this as normal and not fail
the listing. This is consistent with what the code used to do before
memdb was introduced.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: d257a63fb6a2ad0c2369981914544add389917bf
Component: engine
Recently, it's become necessary to build dynbinaries on certain
distributions, so make it easier for users to build dynbinaries. It
looks like this was just an oversight when we added dynbinary builds.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: c81255c9c0314b81ab27f6afd7646cdd259e6495
Component: engine
There have been some cases where umount, a device can be busy for a very
short duration. Maybe its udev rules, or maybe it is runc related races
or probably it is something else. We don't know yet.
If deferred removal is enabled but deferred deletion is not, then for the
case of "docker run -ti --rm fedora bash", a container will exit, device
will be deferred removed and then immediately a call will come to delete
the device. It is possible that deletion will fail if device was busy
at that time.
A device can't be deleted if it can't be removed/deactivated first. There
is only one exception and that is when deferred deletion is on. In that
case graph driver will keep track of deleted device and try to delete it
later and return success to caller.
Always make sure that device deactivation is synchronous when device is
being deleted (except the case when deferred deletion is enabled).
This should also take care of small races when device is busy for a short
duration and it is being deleted.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Upstream-commit: 36cb6efebc599900b691e206fb9e99d3aa2fb9a3
Component: engine
Before this patch, if the plugin's `config.json` is successfully removed
but the main plugin state dir could not be removed for some reason (e.g.
leaked mount), it will prevent the daemon from being able to be
restarted.
This patches changes this to atomically remove the plugin such that on
daemon restart we can detect that there was an error and re-try. It also
changes the logic so that it only logs errors on restore rather than
erroring out the daemon.
This also removes some code which is now duplicated elsewhere.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 11cf394e5ea964636294a219872b188fe5bdf4dd
Component: engine
If a client is initialized without a specific
version set, version negotiation would not be
functional.
This patch changes the behavior to always
perform version negotation (if called), in
which case the "current" (maximum supported
API version) is used as a default.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 5975dc4b4b8a6fa2e0edd1f1b113e7f66dad732b
Component: engine
The NewVersionError checks if the client is using the API version
required for using a specific feature.
If the client is initialized without setting a specific version, an
error would be generated because it was not possible to compare
versions. However, a client without explicit version set is running
the latest supported version.
This patch changes the behavior to only generate an error if a version
was set.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: ff2ed1853099a210245814b4263ce1c92b14c153
Component: engine
If a container doesn't exist in the memdb, First will return nil, not an
error. This should be checked for before using the result.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: c26b0cdfd1a026af88fcfbed9d3c3acdd6d171a0
Component: engine
With debug logging turned on, we currently log the base64-encoded secret
payload.
Change the middleware code to redact this. Since the field is called
"Data", it requires some context-sensitivity. The URI path is examined
to see which route is being invoked.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 3fbc352cbbce06cd3001d6b14b2b1ebcb4d42cd5
Component: engine
Split out a swarmCAOptions struct for options that are shared between
the ca and update commands.
Change the 'no trust root' message to an error.
Add some unit tests.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 81e9837859
Component: cli
In some cases a server may return an error on the ping response but
still provide version details. The client should use these values when
available.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 27ef09a46ffeb8ba42548de937b68351009f30ea
Component: engine
Because of argument order to assert, in case of fail, we'll get message
like:
... obtained string = "uid=100(test) gid=101(test)\n"
... expected string = "uid=100(test) gid=101(test) groups=101(test)\n"
But obtained string should be second one, not the first one. And
expected string should be first. Here's sample output from test above:
... Output: before restart 'uid=100(test) gid=101(test)
', after restart 'uid=100(test) gid=101(test) groups=101(test)
It's confusing, because expected order of strings in assertion is
reversed. What goes before restart - should be "expected string" and
what goes after - should be "obtained string".
Signed-off-by: Vitaly Ostrosablin <vostrosablin@virtuozzo.com>
Upstream-commit: 07cc701947533089fac5fea42e7d5a9a6ea1cfcc
Component: engine
This fix tries to address the issue raised by #33856 where
`make test-unit` will result in the failure:
```
...
...
dockerversion/useragent.go:20: undefined: Version
dockerversion/useragent.go:22: undefined: GitCommit
ok github.com/docker/docker/api 0.026s coverage: 68.0% of statements
ok github.com/docker/docker/api/errors 0.003s coverage: 100.0% of statements
FAIL github.com/docker/docker/api/server [build failed]
make: *** [test-unit] Error 2
```
The issue is because in case of `make test-unit`, `source "${MAKEDIR}/.go-autogen"`
is missing.
This caused the `make test-unit` failure.
This fix adds `source "${MAKEDIR}/.go-autogen"` in `hack/make/test-unit`
This fix fixes#33856.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: fac486d0a02d6af2759f6d0e81bd8a23d82d432c
Component: engine
If a task encounters an error, the interactive "service create" and
"service update" commands should show that error instead of showing a
stuck progress bar.
To validate:
docker service create --detach=false --name broken --restart-condition=none --replicas 3 busybox asdf
and
docker service create --detach=false --name broken --mode global --restart-condition none busybox asdf
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 1ef585f65d
Component: cli
`--internal` is a boolean option. It was falsely treated as non-boolean.
Signed-off-by: Harald Albers <github@albersweb.de>
Upstream-commit: 12dc9eb11f
Component: cli
This commit adds the overlay2.size option to the daemon daemon
storage opts.
The user can override this option by the "docker run --storage-opt"
options.
Signed-off-by: Dhawal Yogesh Bhanushali <dbhanushali@vmware.com>
Upstream-commit: a63d5bc03513755015827d0fe93563240429f1e0
Component: engine
logger.PutMessage, added in #28762 (v17.04.0-ce), clears msg.Source. So journald
and syslog were treating stderr messages as if they were stdout.
Signed-off-by: David Glasser <glasser@davidglasser.net>
Upstream-commit: 917050c5728f2fb9958ccb3ab66a23766f741adc
Component: engine
This function was only used inside gitutils,
and is written specifically for the requirements
there.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: d3d1aabcc68f65d40acbf1b3adc02d13997bb8e2
Component: engine
`docker build` accepts remote repositories
using either the `git://` notation, or `git@`.
Docker attempted to parse both as an URL, however,
`git@` is not an URL, but an argument to `git clone`.
Go 1.7 silently ignored this, and managed to
extract the needed information from these
remotes, however, Go 1.8 does a more strict
validation, and invalidated these.
This patch adds a different path for `git@` remotes,
to prevent them from being handled as URL (and
invalidated).
A test is also added, because there were no
tests for handling of `git@` remotes.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 913eb99fdcd26a4106250bd40dfe8b9c18564b23
Component: engine
This ensures that the final BuildResult is the actual tagged image.
Fixes#33822.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
Upstream-commit: 9777ec3be0e3056d0bedcf36052704f832e45759
Component: engine
This was only showing tasks that belong to nodes that are currently up,
so that tasks on down nodes don't appear to be stuck. But this
unintentionally excludes tasks that haven't been assigned yet, so if a
task is stuck before assignment, for example because no nodes meet its
constraints, a progress bar won't even be shown. The check should only
apply to tasks that have a node assignment.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: d3d09f67b1
Component: cli
commit ea2e4d73c4c753cdc99966e4dfe35143e79564ce removed the autogen
script, but if you happen to clone the dir fresh from git, you can't
build the integration test binaries.
Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>
Upstream-commit: 091e07c87d7dc9130e4f9b0f68342bb07c79ba2f
Component: engine
This has nothing to do in the `api` package for moby as it's just a
cli display function.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 9e142cadc9
Component: cli
- DisplayablePorts is a `cli` function, moving to `docker/cli`
- Move MatchesContentType to the only package using it,
`api/server/httputils` (and remove the deps on logrus for `api` package)
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 565aa41392b01251dfc9398eb69c23bdd8ea64e6
Component: engine
This fix is related to 29005 and 24693. Currently in `Dockerfile`
empty lines will continue as long as there is line escape before.
This may cause some issues. The issue in 24693 is an example.
A non-empty line after an empty line might be considered to be a
separate instruction by many users. However, it is actually part
of the last instruction under the current `Dockerfile` parsing
rule.
This fix is an effort to reduce the confusion around the parsing
of `Dockerfile`. Even though this fix does not change the behavior
of the `Dockerfile` parsing, it tries to deprecate the empty line
continuation and present a warning for the user. In this case,
at least it prompt users to check for the Dockerfile and avoid
the confusion if possible.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 7815c8f8754d5473eda7cd80277a4ea3c59e3c29
Component: engine
Adds an environment variable `DOCKER_BASH_COMPLETION_PATH` that allows to
include a bash completion script into the development container.
This is needid for development of bash completion.
Signed-off-by: Harald Albers <github@albersweb.de>
Upstream-commit: 0e2c424a7f32945a47e271cb804b091c83429912
Component: engine
Fix a deadlock caused by re-entrant locks on container objects.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 37addf0a50ccba51630368c6ed09eb08166d6f48
Component: engine
Migrate legacy volumes (Daemon.verifyVolumesInfo) before containers are
registered on the Daemon, so state on disk is not overwritten and legacy
fields lost during registration.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 76d96418b13080514f3fb861072b06cb91d71cff
Component: engine
initHealthMonitor and updateHealthMonitor can cause container state to
be changed (State.Health).
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 04bd768a889f94a4dc6ad25e2a014dffd0a4e04e
Component: engine
Reuse existing structures and rely on json serialization to deep copy
Container objects.
Also consolidate all "save" operations on container.CheckpointTo, which
now both saves a serialized json to disk, and replicates state to the
ACID in-memory store.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: edad52707c536116363031002e6633e3fec16af5
Component: engine
it is already being saved (with a lock held) on the subsequent
operations.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: f668af4475980e32c99503c4a513668c24ea2da6
Component: engine
It operates on containers that have already been registered on the
daemon, and are visible to other goroutines.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 201a37f7a110402a76ac1ee21b5d09ccffed2acb
Component: engine
State will be saved on the following operation once the container is
properly registered on the daemon.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 03aa24721c88e508f208c1ff72d8cd1af7e6a0f8
Component: engine
Prevent tests failing when teardown tries to delete a container that is
already being removed.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: fcb6d37a8dde8a91896116742116e9d9808b18ac
Component: engine
Also hide ViewDB behind an inteface.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: aacddda89df05b88a6d15fb33c42864760385ab2
Component: engine
Container queries are now served from the consistent in-memory db, and
don't need to grab a lock on every container being listed.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 8e425ebc422876ddf2ffb3beaa5a0443a6097e46
Component: engine
Replicate relevant mutations to the in-memory ACID store. Readers will
then be able to query container state without locking.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: eed4c7b73f0cf98cf48943da1c082f3210b28c82
Component: engine
This can be used by readers/queries so they don't need locks.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: 054728b1f555892c6c0bfd7abfbaeb2fedbc8f10
Component: engine
The Solaris version (previously daemon/inspect_solaris.go) was
apparently missing some fields that should be available on that
platform.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
Upstream-commit: cfc404a375817125e4b32a9cd6a4ec7e3c55dc4e
Component: engine
If the registry responds directly with blob contents, use them,
otherwise follow the redirect without Authorization headers (which
likely aren't valid for the server being redirected to).
This preserves the basic structure of the previous output with up to one
additional progress bar per-layer (for the redirect request and then the
following blob request).
Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
Upstream-commit: 4bbdc0b8f7b2faa3354738c300cfedb2b77c7316
Component: engine
Also exposes shared cache and garbage collection/prune
for the source data.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 5c3d2d552b0430672d5f481ab2d37036f6e92166
Component: engine
The completion scripts have been moved to the
docker/cli repository, so should be taken from
that directory.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: e1902e55b76203dd8a5b5ff8249ff750ab365b96
Component: packaging
The contrib/mkimage-busybox.sh, contrib/mkimage-debootstrap.sh,
and contrib/mkimage-rinse.sh were deprecated in commit
51f707cf9dfb2dbe31cfd0cd92b922ca5d98e842, in favor of
their equivalents in contrib/mkimage/
Given that the deprecation warning has been in place
for over three years, it's save to now remove these.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: d14fb3ac4e712e5927eaad33213b0910aa56ec13
Component: engine
Fixes:
`make -f docker.Makefile binary`
When directories have characters like `&&` they must be wrapped in
quotes or else the docker run command will fail.
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Upstream-commit: 1119e992f2
Component: cli
During container startup we end up spending a fair amount of time
encoding/decoding json.
This cuts out some of that since we already have the decoded object in
memory.
The old flow looked like:
1. Start container request
2. Create file
3. Encode container spec to json
4. Write to file
5. Close file
6. Open file
7. Read file
8. Decode container spec
9. Close file
10. Send to containerd.
The new flow cuts out steps 6-9 completely, and with it a lot of time
spent in reflect and file IO.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 8d588d9c5b5cd019e09bcfc4f790eae79405c7b1
Component: engine
Restore testcases for Volume spec parsing.
And correctly interpret the parsed volume.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 732261f774
Component: cli
Running `docker inspect --format "{{.ID}} {{.Size}}" alpine` prints
sha256:651aa95985aa4a17a38ffcf71f598ec461924ca96865facc2c5782ef2d2be07f 3983636
While `docker inspect --format "{{.Id}} {{.Size}}" alpine` prints
sha256:651aa95985aa4a17a38ffcf71f598ec461924ca96865facc2c5782ef2d2be07f 3.983636e+06
This happens because "Id" is not a field of types.ImageInspect and thus
tryRawInspectFallback is called and converts the raw response into `interface{}`
using a JSON decoder. However, by default that decoder converts numbers into
`float64` unless `UseNumber` is set.
Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
Upstream-commit: 9a2f2d769d
Component: cli
The Docker Compose docs suggest using a separate override
configuration file for production-specific settings, but
it is not obvious how to feed this to `docker stack deploy`,
which only supports a single Compose file as input. Thus,
we now describe how to do this by merging the configuration
files with `docker-compose config`.
Signed-off-by: Denis Washington <denis@denisw.de>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 36fa4af30b
Component: cli
Signed-off-by: John Howard <jhoward@microsoft.com>
Adds the graphdriver for Linux containers on Windows
Upstream-commit: ed4d2aa981a9057766a9cec53c3bd19be4eef059
Component: engine
flags, including cert expiry, will be ignored, so warn if a user attempts
to use `docker swarm ca --cert-expiry` or something.
Signed-off-by: Ying Li <ying.li@docker.com>
Upstream-commit: 32b43bc21a
Component: cli
This showed up in a recent profile.
Search doesn't need to take a lock on the store, because digestset has
its own locking.
Some other methods can get by with a read lock instead of an exclusive
lock.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 44e67adae5695e3e2c3b450453ab0fe6119eb80d
Component: engine
This is no longer needed here. It was required for compiling the CLI
which we no longer do here.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 57f0e0c61982269093eb6d9934656ea70b573938
Component: engine
This commit modifies config.json to allow for any proxies allowed in
build-args to be configured. These values will then be used
by default as build-args in docker build.
Signed-off-by: Dave Tucker <dt@docker.com>
Upstream-commit: 35f1e301b5
Component: cli
Fixes in the Service Discovery areas
Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>
Upstream-commit: e1953f1ca717c2609a0ee801c8af5b874d9fc3d2
Component: engine
Recent changes to devmapper broke the implicit requirement that UdevWait be
called after every call to task.setCookie. Failure to do so results in leaks of
semaphores in the LVM code, eventually leading to semaphore exhaustion.
Previously this was handled by calling UdevWait in a ubiquitous defer function.
While there was initially some concern with deferring the UdevWait function
would cause some amount of race possibiliy, the fact that we never return the
cookie value or any value used to find it, makes that possibility seem unlikely,
so lets go back to that method
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Upstream-commit: 23dcfec1404411489e23fb9b76fc7096db139d04
Component: engine
Doing a chown/chmod automatically can cause `EPERM` in some cases (e.g.
with an NFS mount). Currently Docker will always call chown+chmod on a
volume path unless `:nocopy` is passed in, but we don't need to make
these calls if the perms and ownership already match and potentially
avoid an uneccessary `EPERM`.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: f05a023760493dbd41fbfc1bb76ad334b579e94e
Component: engine
Whitelisting adjtimex get time operation and requiring CAP_SYS_TIME only in case of adjustment
Upstream-commit: 4f259698b07653e9e5220e097df79862f9e54b74
Component: engine
These are replaced by `container-selinux` on fedora-25 and centos-7.
Marking these packages as obsolete makes the installation process a bit
smoother, otherwise the user will have to manually uninstall the older
packages to install the new one.
Also makes fedora24 use container-selinux which is now supports labeling
the `dockerd` binary correctly.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 94943b47520aa81bbe30fbc4eb927c79047ef6d2
Component: packaging
Signed-off-by: zebrilee <zebrilee@gmail.com>
revert change on docker.go, set HasExperimental to true in cli.go
Signed-off-by: zebrilee <zebrilee@gmail.com>
Upstream-commit: cca30cb1d9
Component: cli
otherwise if the user gets the info from the API, makes a non-CA related change,
then updates, swarm will interpret this as the user trying to remove the signing
key from the swarm. We are redacting due to usability reasons, not because
the signing cert is secret. The signing KEY is secret, hence it's redacted.
Signed-off-by: Ying Li <ying.li@docker.com>
Upstream-commit: bdfbd22afbbf16a07f0316656c6c17453df3e0f7
Component: engine
This enables deferred device deletion/removal by default if the driver
version in the kernel is new enough to support the feature.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 0dc1a80565d522fc2cc7c65c3ad2d8ed83aeaf0f
Component: engine
Also cleanup the scripts a bit to be more consistent, and fail on errors.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 343d836a95
Component: cli
By running a 'go test -i' on all the packages first the overall runtime is significantly
decreased.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 3a9ba545bc
Component: cli
Description:
When docker is in startup process and containerd sends an "process exit" event to docker.
If the container config '--restart=always', restartmanager will start this container very soon.
But some initialization is not done, e.g. `daemon.netController`,when visit, docker would panic.
Signed-off-by: Wentao Zhang <zhangwentao234@huawei.com>
Upstream-commit: 5b0993d6c778c18735692560538c790faa3dbbb4
Component: engine
They have been moved to github.com/docker/cli.
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: b5579a4ce33af4c1f67118e11b5a01008a36d26a
Component: engine
Add Casbin plugin to the list of Authorization plugins in docs.
(cherry picked from commit 220831d541bfe9bf566c1038773198d431560dd3)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 0ad3e3294e74f443130b5e1fb1ef6b31f4f92366)
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: 8b11d46ecd
Component: cli
remove extra word
(cherry picked from commit 9db03bd8cdad3c8804105cb5794ebad5e728f48f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 3eaec0071c3ce1b7201e37859afe5bcb78d4f215)
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: ba4dcadcaa
Component: cli
Add note about host-dir in VOLUME
(cherry picked from commit f2fff9d913a8ab0436dd56033189a7c3713a59a2)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 8fd6547fc3eb67e7efa7efb007ae6a4494cd2bb3)
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: 5bf86c1984
Component: cli
Adding more on -m and --memory
(cherry picked from commit c3fbca106552f2dadcb89510ff87945b50f36419)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit b4047a849bd3018f8a8eabf34613a4fca57f818e)
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: b1738f4505
Component: cli
This fix use `scope=swarm` for service related network inspect.
The purpose is that, in case multiple networks with the same
name exist in different scopes, it is still possible to obtain
the network for services.
This fix is related to moby/moby#33630 and docker/cli#167
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 657457ee2c
Component: cli
Also, this removes the use of a questionable golang range feature which
corrects for mutation of a slice during iteration over that slice. This
makes the filter operation easier to read and reason about.
Signed-off-by: David Sheets <dsheets@docker.com>
Upstream-commit: 7da3986297e04b419ce08b19766633dba36b7d30
Component: engine
The `TestServiceCreateCompatiblePlatforms()` test was confusing, because it
did not actually use the mocked API response, but used a local
`distributionInspectBody` variable to verify that the `/distribution/` endpoint
was called.
This flow was especially confusing, because a comment in the test describes;
"check if the /distribution endpoint returned correct output"
If (for whatever reason), the endpoint was not called, the test would panic,
because the `distributionInspectBody` would not be set.
This patch rewrites the test to use the actual API response that is returned
by the mock, and verifies that the information returned by the `/distribution/`
endpoint is properly used in the service's definition.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: f3fce00ef3f3b7ead5ac211f9aafabfebf820c2f
Component: engine
Fix#33052 (workaround style)
**- What I did**
HNS reports networks that don't have anything to do with the Daemon, and
for which no networking plugin is available. This make the Daemon start
sequence pause for 15 secs, as the plugin resolving logic has a wait &
retry logic
**- How I did it**
Just after retrieving the HNS networks, I filter out those with type
`Private`
**- How to verify it**
Replace dockerd coming with Docker for Windows from one built from this
PR. Windows containers daemon should now launch pretty quickly
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
Upstream-commit: b91fd26bb57c94a7ea7f77e5e548233506b78d21
Component: engine
Moby and Docker are separate projects, so
don't assign docker milestones to pull requests
in this repository.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: e481509c746bb53c93b11c349f42ed2549ab728c
Component: engine
This patch simplifies the test by;
- re-using the registry-mock / handler
- skipping the last `docker build`, which was only
used to make sure a local image was present. Instead,
the daemon is started with a `busybox` image loaded.
Also added a comment, explaining why the mock always
returns a 404 (hence, error/output-string should not
be checked in the test), and made the mock return a
valid/correctly formatted error response.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 5d04fe73bf9fa7cff1b99206f39536aed807efb3
Component: engine
The `makefile()` utility was used to create a temporary Dockerfile, and after
tests completed, this file was deleted.
However, the _build_ used the current path (`/usr/local/bin/docker`) as
build-context. As a result, roughtly 20 MB was sent as build-context for each
build, but none of the builds actually required a build-context.
This patch;
- creates a temp-dir for the test, which can be used as build-context
- changes the `makefile()` utility and removes the `cleanup` functionality
- instead, the `temp-dir` is removed after the test finishes (which also removes the temporary `Dockerfile`)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: ebe66b1d0f52dc58a98a428d4efa4d2f2743b96e
Component: engine
Previously, a 'plugin not found' error would be returned if a plugin to be
retrieved was found but disabled. This was misleading and incorrect. Now,
a new error plugin.ErrDisabled is returned in this case. This makes the
error message when trying to statically start plugins (from daemon.json or
dockerd command line) accurate.
Signed-off-by: David Sheets <dsheets@docker.com>
Upstream-commit: e33d598059d8af8c57995a2c52f1f9f5691c09e8
Component: engine
This fix tries to add a `scope` in the query of `/networks/<id>`
(`NetworkInspect`) so that in case of duplicate network names,
it is possible to locate the network ID based on the network
scope (`local`, 'swarm', or `global`).
Multiple networks might exist in different scopes, which is a legitimate case.
For example, a network name `foo` might exists locally and in swarm network.
However, before this PR it was not possible to query a network name `foo`
in a specific scope like swarm.
This fix fixes the issue by allowing a `scope` query in `/networks/<id>`.
Additional test cases have been added to unit tests and integration tests.
This fix is related to docker/cli#167, moby/moby#30897, moby/moby#33561, moby/moby#30242
This fix fixesdocker/cli#167
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 158b2a1875cf33f3560dedaeb0149e1fbe54c1ef
Component: engine
we see a lot of
```
level=debug msg="Failed to unmount a03b1bb6f569421857e5407d73d89451f92724674caa56bfc2170de7e585a00b-init overlay: device or resource busy"
```
in daemon logs and there is a lot of mountpoint leftover.
This cause failed to remove container.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: f65fa1f115df896b2440f50c374f032fc781188d
Component: engine
This option is no longer supported in docker 17.06,
so should not be used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: a7672b8331b1b96db6390a9356650e67893fbe36
Component: engine
Deprecation of interacting with v1 registries was
started in docker 1.8.3, which added a `--disable-legacy-registry`
flag.
This option was anounced to be the default starting
with docker 17.06, and v1 registries completely
removed in docker 17.12.
This patch updates the default, and disables
interaction with v1 registres by default.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 128280013f2ad90520c97b47a787be0db883e870
Component: engine
Increases the test coverage of pkg/plugins.
Changed signature of function NewClientWithTimeout in pkg/plugin/client, to
take time.Duration instead of integers.
Signed-off-by: Raja Sami <raja.sami@tenpearl.com>
Upstream-commit: 8dd100a2297a34a0aef422383117fb0c3314fba1
Component: engine
Commit 858b4b44c8172eb2c92767c8f624f4138db5212b added
support for obtaining the runtime version
if a custom path was set, but accidentally
removed the "--version" flag.
This patch restores the flag, and adds an integration
test to verify the behavior..
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 6400ce8f0a97e456f9694396f58c0958f3580277
Component: engine
The use of pools.Copy avoids io.Copy's internal buffer allocation.
This commit replaces io.Copy with pools.Copy to avoid the allocation of
buffers in io.Copy.
Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
Upstream-commit: 014095e6a07748d0e1ce2f759f5c4f4b3783e765
Component: engine
The Docker CLI already performs version-checks when
running commands, but other clients consuming the API
client may not do so.
This patch adds a version check to various
client functions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 1401342f466bafbb902157a2460746ac829e0b01
Component: engine
Local volumes support mount options which, when in use, can mount
external file systems. We don't really need to enumerate these external
filesystems which may be a very slow process.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 0822d903642e02c44b086e6856a30f80887412ee
Component: engine
With the Moby/Docker split, no decisions have been
made yet how, and when to bump the API version.
Although these decisions should not be lead
by Docker releases, I'm bumping the API version
to not complicate things for now; after this bump
we should make a plan how to handle this in future
(for example, using SemVer for the REST api, and
bump with every change).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 7839ff2244a7fcbac0882b1426bbd2c5477c1abe
Component: engine
Add Casbin plugin to the list of Authorization plugins in docs.
(cherry picked from commit 220831d541bfe9bf566c1038773198d431560dd3)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 0ad3e3294e74f443130b5e1fb1ef6b31f4f92366
Component: engine
remove extra word
(cherry picked from commit 9db03bd8cdad3c8804105cb5794ebad5e728f48f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 3eaec0071c3ce1b7201e37859afe5bcb78d4f215
Component: engine
Add note about host-dir in VOLUME
(cherry picked from commit f2fff9d913a8ab0436dd56033189a7c3713a59a2)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 8fd6547fc3eb67e7efa7efb007ae6a4494cd2bb3
Component: engine
Adding more on -m and --memory
(cherry picked from commit c3fbca106552f2dadcb89510ff87945b50f36419)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: b4047a849bd3018f8a8eabf34613a4fca57f818e
Component: engine
When sending SIGUSR1 to the daemon, it can crash because of a concurrent
map access panic, showing a stack trace involving dumpDaemon. It appears
it's not possible to recover from a concurrent map access panic. Since
it's important that SIGUSR1 not be a destructive operation, sadly the
best course of action I can think of is to remove this functionality.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: a4c68ee8574c9b8a3309ebebee0d90108042ba61
Component: engine
Previously these were in docker/docker/pkg/archive, but unused
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 0310de5213
Component: cli
Commit the rwLayer to get the correct DiffID
Refacator copy in thebuilder
move more code into exportImage
cleanup some windows tests
Release the newly commited layer.
Set the imageID on the buildStage after exporting a new image.
Move archiver to BuildManager.
Have ReleaseableLayer.Commit return a layer
and store the Image from exportImage in the local imageSources cache
Remove NewChild from image interface.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 51360965206b0db49cc0365dabb590063a17a9df
Component: engine
Add CreateImage() to the daemon
Refactor daemon.Comit() and expose a Image.NewChild()
Update copy to use IDMappings.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: bd5f92d2631df7c932b93e72e45b39cba19f2f3b
Component: engine
and update some dependent packages.
We would like to keep moby/moby and swarmkit somewhat in sync here and
https://github.com/docker/swarmkit/pull/2229 proposes a similar bump to
swarmkit, needed due to https://github.com/docker/swarmkit/pull/1965 which
pulls in containerd which uses some newer features of the grpc package.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
Upstream-commit: 379557a95873aad26b7eb20a7a48f8e1e7551041
Component: engine
We add ",dirperm1" but only increase length by len("dirperm1").
Signed-off-by: Peng Tao <bergwolf@gmail.com>
Upstream-commit: 1a6bf8248a32c160347e4daf3dd4f15023357889
Component: engine
When user execute docker exec command, docker daemon maybe have err return because
of ExecExists check, and then the hijack stream will not be close, it can lead to
docker exec command block.
Signed-off-by: yangshukui <yangshukui@huawei.com>
Upstream-commit: 26231b29e7881d25822bffd740d5f73fc2687460
Component: engine
This reverts to a version of runc without the ONCLR cleared to not cause
a regression with different clients using --tty.
This also reverts the OPOST changes to the term package to support the
initial change.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: a5e83836a49547b2add871bb52cbd8bfedb57114
Component: engine
If a service alias is copied to task, then the DNS resolution on the
service name will resolve to service VIP and all of Task-IPs and that
will break the concept of vip based load-balancing resulting in all the
dns-rr caching issues.
This is a regression introduced in #33130
Signed-off-by: Madhu Venugopal <madhu@docker.com>
Upstream-commit: 38c15531501578b96d34be5ce7f33a0be6be078f
Component: engine
There is no case which would resolve in this error. The root user always exists, and if the id maps are empty, the default value of 0 is correct.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 93fbdb69acf9248283a91a1c5c6ea24711c26eda
Component: engine
The test was failing because TarOptions was using a non-pointer for
ChownOpts, which meant the check for nil was never true, and
createTarFile was never using the hdr.UID/GID
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: acdbc285e29ddd92e7a1cc99daf8b16502204d2e
Component: engine
If configs are declared for a service and pointing on an old
daemon, error out properly (instead of "page not found").
If there is no configs declared, don't call convertServiceConfigObjs
to avoid having an error.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: cf5550c426
Component: cli
Don't create source directory while the daemon is being shutdown, fix#30348
Upstream-commit: cd2255a296acf8408d2afb65b897560479f1ecd3
Component: engine
This will hopefully make the tests more robust by replacing a fixed 3s
sleep with a polling loop that looks at whether the key PEM file is
encrypted or not.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 17173efbe00d422392f91c672350266314808b28
Component: engine
Fix delete a image while saving it, delete successfully but failed to save it
Upstream-commit: c8141a1fb1ff33b2bfab85a40e5da9a282f36cdc
Component: engine
the source was missing from the second dispatch
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 3f2604157790408acf5ad05c74cebe105f2b6979
Component: engine
Use octal values for file mode in filenotify poller and sysinfo_linux tests
Upstream-commit: 91e0141784ab5570fd7f94ad4af399d23c827391
Component: engine
Docker use default GRPC backoff strategy to reconnect to containerd when
connection is lost. and the delay time grows exponentially, until reaches 120s.
So Change the max delay time to 2s to avoid docker and containerd
connection failure.
Signed-off-by: Wentao Zhang <zhangwentao234@huawei.com>
Upstream-commit: d3d8c77d195ce74f36ae6eee24578b9cac48f897
Component: engine
This commit is an extension of fix for 29325 based on the review comment.
In this commit, the quota size for btrfs is kept in `/var/lib/docker/btrfs/quotas`
so that a daemon restart keeps quota.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 16328cc207a493ecff0cabc11ebf51e958131418
Component: engine
This fix tries to address the issue raised in 29325 where
btrfs quota groups are not clean up even after containers
have been destroyed.
The reason for the issue is that btrfs quota groups have
to be explicitly destroyed. This fix fixes this issue.
This fix is tested manually in Ubuntu 16.04,
with steps specified in 29325.
This fix fixes 29325.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: e907c6418a2ae7754f69fede5897a7176250e8bd
Component: engine
- Moving the `common*.go` files in `cmd/dockerd` directly (it's the
only place it's getting used)
- Rename `cli/flags` to `cli/config` because it's the only thing left
in that package 👼
Now, `integration-cli` does *truly* not depend on `cobra` stuff.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 9ff9a91ab7f964f4e5042f94fe22dd50b5c3d832
Component: engine
Treat return code -1 as error instead.
People from glibc say that errno is undefined in case of successful
sysconf call according to POSIX standard:
Glibc bug: https://sourceware.org/bugzilla/show_bug.cgi?id=21536
More over in sysconf man it is wrongly said that "errno is not changed"
on success. So I've created a bug to man-pages:
https://bugzilla.kernel.org/show_bug.cgi?id=195955
Background: Glibc's sysconf(_SC_NPROCESSORS_ONLN) changes errno to
ENOENT, if there is no /sys/devices/system/cpu/online file, while
the call itself is successful. In Virtuozzo containers we prohibit
most of sysfs files for security reasons. So we have Run():daemon
/stats/collector.go infinitely loop never actualy collecting stats
from publisher pairs.
v2: add comment
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Upstream-commit: dec084962eab41eb20b1808955de34cfec4fc8b3
Component: engine
Commit 78c204ef79 added
(f9bd8ec8b268581f93095c5a80679f0a8ff498bf in the moby repo)
a validation to prevent `--rollback` from being used
in combination with other flags that update the
service spec.
This validation was not taking into account that
some flags only affect the CLI behavior, and
are okay to be used when rolling back.
This patch updates the validation, and adds
`--quiet` and `--detach` to the list of allowed
flags.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: f10f29df8d
Component: cli
The `docker login -e` / `docker login --email` option was deprecated in
Docker 1.11 (https://github.com/moby/moby/releases/tag/v1.11.0) through
aee260d4eb3aa0fc86ee5038010b7bbc24512ae5 (April 2016), and when used has
been outputing a deprecation warning since;
Flag --email has been deprecated, will be removed in 17.06.
Originally this option was scheduled to be removed in docker 1.13, but
extended to docker 17.06 due to a change in our deprecation policy.
Given that only docker 1.10 and older use this flag (which is EOL, including
for CS versions, as of February 2017), will now be removed.
With this patch, `docker login` will now produce an Error if the flag
is used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 8b383d2351
Component: cli
Issue Description:
* 1. Saving more than one images, `docker save -o a.tar aaa bbb`
* 2. Delete the last image which in saving progress. `docker rmi bbb`
Espected:
Saving images operation shouldn't be disturbed. But the real result is that failed to
save image and get an error as below:
`Error response from daemon: open
/var/lib/docker/image/devicemapper/imagedb/content/sha256/7c24e4d533a76e801662ad1b7e6e06bc1204f80110b5623e96ba2877c51479a1:
no such file or directory`
Analysis:
1. While saving more than one images, it will get all the image info from reference/imagestore,
and then using the `cached data` to save the images to a tar file.
2. But this process doesn't have a resource lock, if a deletion operation comes, the image will be deleted,
so saving operation will fail.
Solution:
When begin to save an image, `Get` all the layers first. then the
deletion operation won't delete the layers.
Signed-off-by: Wentao Zhang <zhangwentao234@huawei.com>
Upstream-commit: 4a014e6b0d7e2d310ee1ba442128a6802559a63a
Component: engine
For stack compose files, use filepath.IsAbs instead of path.IsAbs, for
bind-mounted service volumes, because filepath.IsAbs handles Windows
paths, while path.IsAbs does not.
Signed-off-by: John Stephens <johnstep@docker.com>
Upstream-commit: 9043d39dea
Component: cli
Fixes#33415Fixes#33346
Implemented few additional IPVS APIs to be used by other projects
Signed-off-by: Madhu Venugopal <madhu@docker.com>
Upstream-commit: 0484bdb6ca0ddd0bebc490e335a7f788cdc30f13
Component: engine
The docker CLI matches objects either by ID _prefix_
or a full name match, but not partial name matches.
The correct order of resolution is;
- Full ID match (a name should not be able to mask an ID)
- Full name
- ID-prefix
This patch changes the way services are matched.
Also change to use the first matching service, if there's a
full match (by ID or Name) instead of continue looking for
other possible matches.
Error handling changed;
- Do not error early if multiple services were requested
and one or more services were not found. Print the
services that were not found after printing those that
_were_ found instead
- Print an error if ID-prefix matching is ambiguous
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 6279612443
Component: cli
`ConnectToNetwork` is modfying the container but is not locking the
object.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 4d0888e32bccfd8c0f27a7b66b2a5607d42e2698
Component: engine
Generate a token for each download process to avoid token expired.
Closes: #33441
Signed-off-by: vanderliang <lansheng@meili-inc.com>
Upstream-commit: cb502cd4e894a78e723902a4d2f23174b69430ce
Component: engine
If a container mount the socket the daemon is listening on into
container while the daemon is being shutdown, the socket will
not exist on the host, then daemon will assume it's a directory
and create it on the host, this will cause the daemon can't start
next time.
fix issue https://github.com/moby/moby/issues/30348
To reproduce this issue, you can add following code
```
--- a/daemon/oci_linux.go
+++ b/daemon/oci_linux.go
@@ -8,6 +8,7 @@ import (
"sort"
"strconv"
"strings"
+ "time"
"github.com/Sirupsen/logrus"
"github.com/docker/docker/container"
@@ -666,7 +667,8 @@ func (daemon *Daemon) createSpec(c *container.Container) (*libcontainerd.Spec, e
if err := daemon.setupIpcDirs(c); err != nil {
return nil, err
}
-
+ fmt.Printf("===please stop the daemon===\n")
+ time.Sleep(time.Second * 2)
ms, err := daemon.setupMounts(c)
if err != nil {
return nil, err
```
step1 run a container which has `--restart always` and `-v /var/run/docker.sock:/sock`
```
$ docker run -ti --restart always -v /var/run/docker.sock:/sock busybox
/ #
```
step2 exit the the container
```
/ # exit
```
and kill the daemon when you see
```
===please stop the daemon===
```
in the daemon log
The daemon can't restart again and fail with `can't create unix socket /var/run/docker.sock: is a directory`.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: 7318eba5b2f8bb4b867ca943c3229260ca98a3bc
Component: engine
This fixes an issue where if a stop signal is set, and a user sends
SIGKILL, `container.ExitOnNext()` is not set, thus causing the container
to restart.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 114652ab86609e5c0cbfad84f642942b466a0596
Component: engine
Volumes tend to carry important data and pruning them on `docker system
prune` can easily cause unwanted data loss.
Let's play it safe and not prune volumes on `system prune` by default,
and instead provide an option.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 37fd6128dc
Component: cli
This makes integration not depend anymore of `cli` and thus not
require `cobra` and other packages to compile.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 71d60ec0eb7eeddc73d2cf63748ab7debe3f06af
Component: engine
When closing the log-file, and the file is already
closed, there's no need to log an error.
This patch adds a `closed` boolean to check if the
file was closed, and if so, skip closing the file.
This prevents errors like this being logged:
level=error msg="Error closing logger: invalid argument"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 07b51ed300429e88871e40b4d67dc031e2e8901c
Component: engine
This was mistakenly unmounting everything under `plugins/*` instead of
just `plugins/<id>/*` anytime a plugin is removed.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: db5f31732a9868c1e9e4f9a49be70b794ff82d4f
Component: engine
It has observed defunct containerd processes accumulating over
time while dockerd was permanently failing to restart containerd.
Due to a bug in the runContainerdDaemon() function, dockerd does not clean up
its child process if containerd already exits very soon after the (re)start.
The reproducer and analysis below comes from docker 1.12.x but bug
still applies on latest master.
- from libcontainerd/remote_linux.go:
329 func (r *remote) runContainerdDaemon() error {
:
: // start the containerd child process
:
403 if err := cmd.Start(); err != nil {
404 return err
405 }
:
: // If containerd exits very soon after (re)start, it is
possible
: // that containerd is already in defunct state at the time
when
: // dockerd gets here. The setOOMScore() function tries to
write
: // to /proc/PID_OF_CONTAINERD/oom_score_adj. However, this
fails
: // with errno EINVAL because containerd is defunct. Please see
: // snippets of kernel source code and further explanation
below.
:
407 if err := setOOMScore(cmd.Process.Pid, r.oomScore); err != nil
{
408 utils.KillProcess(cmd.Process.Pid)
:
: // Due to the error from write() we return here. As
the
: // goroutine that would clean up the child has not
been
: // started yet, containerd remains in the defunct
state
: // and never gets reaped.
:
409 return err
410 }
:
417 go func() {
418 cmd.Wait()
419 close(r.daemonWaitCh)
420 }() // Reap our child when needed
:
423 }
This is the kernel function that gets invoked when dockerd tries to
write
to /proc/PID_OF_CONTAINERD/oom_score_adj.
- from fs/proc/base.c:
1197 static ssize_t oom_score_adj_write(struct file *file, ...
1198 size_t count, loff_t
*ppos)
1199 {
:
1223 task = get_proc_task(file_inode(file));
:
: // The defunct containerd process does not have a virtual
: // address space anymore, i.e. task->mm is NULL. Thus the
: // following code returns errno EINVAL to dockerd.
:
1230 if (!task->mm) {
1231 err = -EINVAL;
1232 goto err_task_lock;
1233 }
:
1253 err_task_lock:
:
1257 return err < 0 ? err : count;
1258 }
The purpose of the following program is to demonstrate the behavior of
the oom_score_adj_write() function in connection with a defunct process.
$ cat defunct_test.c
\#include <unistd.h>
main()
{
pid_t pid = fork();
if (pid == 0)
// child
_exit(0);
// parent
pause();
}
$ make defunct_test
cc defunct_test.c -o defunct_test
$ ./defunct_test &
[1] 3142
$ ps -f | grep defunct_test | grep -v grep
root 3142 2956 0 13:04 pts/0 00:00:00 ./defunct_test
root 3143 3142 0 13:04 pts/0 00:00:00 [defunct_test] <defunct>
$ echo "ps 3143" | crash -s
PID PPID CPU TASK ST %MEM VSZ RSS COMM
3143 3142 2 ffff880035def300 ZO 0.0 0 0
defunct_test
$ echo "px ((struct task_struct *)0xffff880035def300)->mm" | crash -s
$1 = (struct mm_struct *) 0x0
^^^ task->mm is NULL
$ cat /proc/3143/oom_score_adj
0
$ echo 0 > /proc/3143/oom_score_adj
-bash: echo: write error: Invalid argument"
---
This patch fixes the above issue by making sure we start the reaper
goroutine as soon as possible.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 27087eacbf96e6ef9d48a6d3dc89c7c1cff155b4
Component: engine
The current implementation of the ElectAuthServer doesn't handle well when the
default Registry server is not included in the response from the daemon Info
endpoint.
That leads to the storage and usage of the credentials for the default registry
(`https://index.docker.io/v1/`) under an empty string on the client config file.
Sample config file after a login via a Docker Daemon without Registry
information:
```json
{
"auths": {
"": {
"auth": "***"
}
}
}
```
That can lead to duplication of the password for the default registry and
authentication failures against the default registry if a pull/push is performed
without first authenticating via the misbehaving daemon.
Also, changes the output of the warning message from stdout to sdterr as
per dnephin suggestion.
Signed-off-by: Marcus Martins <marcus@docker.com>
Upstream-commit: 862649707e
Component: cli
Add armhf dockerfiles for deb building
Signed-off-by: Eli Uriegas <seemethere101@gmail.com>
Upstream-commit: f0c8cea1b79b049743cd1503f7ac4a34c265f476
Component: packaging
Closes#32663 by adding CreatedAt field when volume is created.
Displaying CreatedAt value when volume is inspected
Adding tests to verfiy the new field is correctly populated
Signed-off-by: Marianna <mtesselh@gmail.com>
Moving CreatedAt tests from the CLI
Moving the tests added for the newly added CreatedAt field for Volume, from CLI to API tests
Signed-off-by: Marianna <mtesselh@gmail.com>
Upstream-commit: a46f757c4043031379362c5d6b3bad7562ab9fed
Component: engine
be attached to special networks such as host and bridge. This fix brings
in the required changes to make sure the stack file accepts these
networks as well.
Signed-off-by: Madhu Venugopal <madhu@docker.com>
Upstream-commit: 123f0bfd98
Component: cli
Description:
Kill docker-containerd continuously, and use kill -SIGUSR1 <dockerpid>
to check docker callstacks. And we will find that event
handler: startEventsMonitor or handleEventStream will exit.
This will only happen when system is busy, containerd need more time to
startup, and the monitor gorotine maybe exit.
Signed-off-by: Wentao Zhang <zhangwentao234@huawei.com>
Upstream-commit: 02ce73f62e73e78a4ec29b29fb2ba552221fe885
Component: engine
DeviceMapper tasks in go use SetFinalizer to clean up C construct
counterparts in the C LVM library. While thats well and good, it relies
heavily on the exact interpretation of when the golang garbage collector
determines that an object is unreachable is subject to reclaimation.
While common sense would assert that for stack variables (which these DM
tasks always are), are unreachable when the stack frame in which they
are declared returns, thats not the case. According to this:
https://golang.org/pkg/runtime/#SetFinalizer
The garbage collector decides that, if a function calls into a
systemcall (which task.run() always will in LVM), and there are no
subsequent references to the task variable within that stack frame, then
it can be reclaimed. Those conditions are met in several devmapper.go
routines, and if the garbage collector runs in the middle of a
deviceMapper operation, then the task can be destroyed while the
operation is in progress, leading to crashes, failed operations and
other unpredictable behavior.
The fix is to use the KeepAlive interface:
https://golang.org/pkg/runtime/#KeepAlive
The KeepAlive method is effectively an empy reference that fools the
garbage collector into thinking that a variable is still reachable. By
adding a call to KeepAlive in the task.run() method, we can ensure that
the garbage collector won't reclaim a task object until its execution
within the deviceMapper C library is complete.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Upstream-commit: d764d8b16624e4924b3949273089f851efa0f717
Component: engine
This code currently passes a random manager address when creating a new
Node. This doesn't really make sense - we should only pass a join
address on the initial join, or when retrying that join. An upcoming
change to swarmkit will pay attention to JoinAddr significant when a
node is already part of a cluster, so passing in the random value needs
to be avoided.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 24477e70040019ca421ec1031dc553dc780c02f1
Component: engine
We should check for error before reading the response (response can be
nil, and thus this would panic)
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 45e0376ea361811b2f5d0653a6b103dd39653371
Component: engine
Extract a common function for builder.createContainer
Extract imageCache for doing cache probes
Removes the cacheBuested field from Builder
Create a new containerManager class which reduces the interface between the
builder and managing containers to 3 functions (from 6)
Signed-off-by: Daniel Nephin <dnephin@docker.com>
Upstream-commit: 19f3b0715cf89f336efa286ea1d3f8b57d8c4973
Component: engine
However, do clear the directory if init or join fails, because we don't
want to leave it in a half-finished state.
Signed-off-by: Ying Li <ying.li@docker.com>
Upstream-commit: bf3e9293a66c77a2fddf4e691222898846b4af9f
Component: engine
So we can use it at will
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Upstream-commit: 533a843393bd7c3674074ec9af73c8e666fc7484
Component: packaging
This appears to be a remnant from the CLI that is no longer imported
anywhere. Remove it from vendor.conf and the vendor directory.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: aa6fc939baf0bae00391a0ba703187018055b8bf
Component: engine
This commit exposes `Client.host` as `Client.DaemonHost()`
This allows users of the client, a CLI for example, to query the Host
that the client is attempting to contact and vary their behaviour
accordingly. For example, to allow client-side configuration of
HTTP proxy settings for a number of different docker hosts.
Signed-off-by: Dave Tucker <dt@docker.com>
Upstream-commit: 6ce6ae1cd11d888e0c8ede20926b86981cee5ce1
Component: engine
The health check process doesn't have all the environment
varialbes in the container or has them set incorrectly.
This patch should fix that problem.
Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
Upstream-commit: 5836d86ac4d617e837d94010aa60384648ab59ea
Component: engine
If use docker attach command to attach to a stop container, it will return
"You cannot attach to a stopped container" error, it's ok, but when
attach to a running container, it(docker attach) use inspect to check
the container's state, if it pass the state check on the client side,
and then the container is stopped, docker attach command still attach to
the container and not exit.
Signed-off-by: Shukui Yang <yangshukui@huawei.com>
Upstream-commit: f9dc3337f9
Component: cli
They have nothing to do with service and could be used on their own.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: b5182ba17f
Component: cli
The unnecessary `random` package has been removed in favor of using the
`math/rand` package directly. Seeding of the random value from crypto
has been added to the `stringid` package to account for the change.
May need to add an equivalent seed to `namesgenerator`, but this is
often used with `stringid` and has collision protection.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
Upstream-commit: 66cfe61f71252f528ddb458d554cd241e996d9f1
Component: engine
if docker exec exit and at the same the the container is pause,
there could be a chance the `docker exec exit` will fail
```
$ docker exec -ti 388c7f47a06c sh
/ # exit
Error response from daemon: Container 388c7f47a06cce0856266ffd56a2ce2901689ca7a6b9cd741b37652418448f2b is paused, unpause the container before exec
```
To reproduce this error easilly, we can add a sleep in `containerPause`
```
--- a/daemon/pause.go
+++ b/daemon/pause.go
@@ -2,6 +2,7 @@ package daemon
import (
"fmt"
+ "time"
"github.com/docker/docker/container"
)
@@ -25,7 +26,7 @@ func (daemon *Daemon) ContainerPause(name string) error {
func (daemon *Daemon) containerPause(container *container.Container) error {
container.Lock()
defer container.Unlock()
-
+ time.Sleep(time.Second * 5)
// We cannot Pause the container which is not running
if !container.Running {
return errNotRunning{container.ID}
```
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: 0e87588bbb2482f9635a19ac43be1c0ee9652ac2
Component: engine
if initDevmapper failed after creating thin-pool, the thin-pool will not be removed,
this would cause we can't use the same lvm to create another thin-pool.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: ea22d7ab91e7febc69433b979160dda8a79ad46e
Component: engine
According to documentation (https://docs.docker.com/engine/reference/builder/#dockerignore-file), absolute paths like `/foo/bar` should have the same effect as `foo/bar`. This is not the case today.
This fix normalize paths when reading the .dockerignore file by removing
leading slashes.
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
Upstream-commit: 1cde87c43abd100f4233e965e040e30a6bd34112
Component: engine
2017-03-31 10:43:59 +02:00
1526 changed files with 88093 additions and 53656 deletions
@ -5,83 +5,70 @@ information on the list of deprecated flags and APIs please have a look at
https://docs.docker.com/engine/deprecated/ where target removal dates can also
be found.
## 17.06.2-ce (2017-09-05)
## 17.07.0-ce (2017-08-29)
### Client
### API & Client
-Enable TCP keepalive in the client to prevent loss of connection [docker/cli#415](https://github.com/docker/cli/pull/415)
### Runtime
-Devmapper: ensure UdevWait is called after calls to setCookie [moby/moby#33732](https://github.com/moby/moby/pull/33732)
-Aufs: ensure diff layers are correctly removed to prevent leftover files from using up storage [moby/moby#34587](https://github.com/moby/moby/pull/34587)
### Swarm mode
-Ignore PullOptions for running tasks [docker/swarmkit#2351](https://github.com/docker/swarmkit/pull/2351)
## 17.06.1-ce (2017-08-17)
*Add support for proxy configuration in config.json [docker/cli#93](https://github.com/docker/cli/pull/93)
* Enable pprof/debug endpoints by default [moby/moby#32453](https://github.com/moby/moby/pull/32453)
* Passwords can now be passed using `STDIN` using the new `--password-stdin` flag on `docker login` [docker/cli#271](https://github.com/docker/cli/pull/271)
+ Add `--detach` to docker scale [docker/cli#243](https://github.com/docker/cli/pull/243)
*Prevent `docker logs --no-stream` from hanging due to non-existing containers [moby/moby#34004](https://github.com/moby/moby/pull/34004)
-Fix `docker stack ps` printing error to `stdout` instead of `stderr` [docker/cli#298](https://github.com/docker/cli/pull/298)
* Fix progress bar being stuck on `docker service create` if an error occurs during deploy [docker/cli#259](https://github.com/docker/cli/pull/259)
* Improve presentation of progress bars in interactive mode [docker/cli#260](https://github.com/docker/cli/pull/260) [docker/cli#237](https://github.com/docker/cli/pull/237)
* Print a warning if `docker login --password` is used, and recommend `--password-stdin` [docker/cli#270](https://github.com/docker/cli/pull/270)
*Make API version negotiation more robust [moby/moby#33827](https://github.com/moby/moby/pull/33827)
* Hide `--detach` when connected to daemons older than Docker 17.05 [docker/cli#219](https://github.com/docker/cli/pull/219)
+ Add `scope` filter in `GET /networks/(id or name)` [moby/moby#33630](https://github.com/moby/moby/pull/33630)
### Builder
*Fix a regression, where `ADD` from remote URL's extracted archives [#89](https://github.com/docker/docker-ce/pull/89)
*Fix handling of remote "git@" notation [#100](https://github.com/docker/docker-ce/pull/100)
* Fix copy `--from` conflict with force pull [#86](https://github.com/docker/docker-ce/pull/86)
### Client
* Make pruning volumes optional when running `docker system prune`, and add a `--volumes` flag [#109](https://github.com/docker/docker-ce/pull/109)
* Show progress of replicated tasks before they are assigned [#97](https://github.com/docker/docker-ce/pull/97)
* Fix `docker wait` hanging if the container does not exist [#106](https://github.com/docker/docker-ce/pull/106)
* If `docker swarm ca` is called without the `--rotate` flag, warn if other flags are passed [#110](https://github.com/docker/docker-ce/pull/110)
* Fix API version negotiation not working if the daemon returns an error [#115](https://github.com/docker/docker-ce/pull/115)
* Print an error if "until" filter is combined with "--volumes" on system prune [#154](https://github.com/docker/docker-ce/pull/154)
*Implement long running interactive session and sending build context incrementally [moby/moby#32677](https://github.com/moby/moby/pull/32677) [docker/cli#231](https://github.com/docker/cli/pull/231) [moby/moby#33859](https://github.com/moby/moby/pull/33859)
*Warn on empty continuation lines [moby/moby#33719](https://github.com/moby/moby/pull/33719)
- Fix `.dockerignore` entries with a leading `/` not matching anything [moby/moby#32088](https://github.com/moby/moby/pull/32088)
### Logging
* Fix stderr logging for journald and syslog [#95](https://github.com/docker/docker-ce/pull/95)
* Fix log readers can block writes indefinitely [#98](https://github.com/docker/docker-ce/pull/98)
* Fix awslogs driver repeating last event [#151](https://github.com/docker/docker-ce/pull/151)
### Networking
* Fixed issue with driver options not received by network drivers [#127](https://github.com/docker/docker-ce/pull/127)
* Fixed issue with overlay network IP address reuse [#197](https://github.com/docker/docker-ce/pull/197)
### Plugins
* Make plugin removes more resilient to failure [#91](https://github.com/docker/docker-ce/pull/91)
- Fix wrong filemode for rotate log files [moby/moby#33926](https://github.com/moby/moby/pull/33926)
- Fix stderr logging for journald and syslog [moby/moby#33832](https://github.com/moby/moby/pull/33832)
### Runtime
*Prevent a goroutine leak when healthcheck gets stopped [#90](https://github.com/docker/docker-ce/pull/90)
* Do not error on relabel when relabel not supported [#92](https://github.com/docker/docker-ce/pull/92)
*Limit max backoff delay to 2 seconds for GRPC connection [#94](https://github.com/docker/docker-ce/pull/94)
*Fix issue preventing containers to run when memory cgroup was specified due to bug in certain kernels [#102](https://github.com/docker/docker-ce/pull/102)
* Fix container not responding to SIGKILL when paused [#102](https://github.com/docker/docker-ce/pull/102)
*Improve error message if an image for an incompatible OS is loaded [#108](https://github.com/docker/docker-ce/pull/108)
*Fix a handle leak in go-winio [#112](https://github.com/docker/docker-ce/pull/112)
*Fix issue upon upgrade, preventing docker from showing running containers when `--live-restore` is enabled [#117](https://github.com/docker/docker-ce/pull/117)
*Fix bug where services using secrets would fail to start on daemons using the `userns-remap` feature [#121](https://github.com/docker/docker-ce/pull/121)
* Fix error handling with not-exist errors on remove [#142](https://github.com/docker/docker-ce/pull/142)
* Fix REST API Swagger representation cannot be loaded with SwaggerUI [#156](https://github.com/docker/docker-ce/pull/156)
### Security
*Redact secret data on "secret create" [#99](https://github.com/docker/docker-ce/pull/99)
*Allow stopping of paused container [moby/moby#34027](https://github.com/moby/moby/pull/34027)
+ Add quota support for the overlay2 storage driver [moby/moby#32977](https://github.com/moby/moby/pull/32977)
*Remove container locks on `docker ps` [moby/moby#31273](https://github.com/moby/moby/pull/31273)
*Store container names in memdb [moby/moby#33886](https://github.com/moby/moby/pull/33886)
* Fix race condition between `docker exec` and `docker pause` [moby/moby#32881](https://github.com/moby/moby/pull/32881)
*Devicemapper: Rework logging and add `--storage-opt dm.libdm_log_level` [moby/moby#33845](https://github.com/moby/moby/pull/33845)
*Devicemapper: Prevent "device in use" errors if deferred removal is enabled, but not deferred deletion [moby/moby#33877](https://github.com/moby/moby/pull/33877)
*Devicemapper: Use KeepAlive to prevent tasks being garbage-collected while still in use [moby/moby#33376](https://github.com/moby/moby/pull/33376)
*Report inetermediate prune results if prune is cancelled [moby/moby#33979](https://github.com/moby/moby/pull/33979)
- Fix run `docker rename <container-id> new_name` concurrently resulting in the having multiple names [moby/moby#33940](https://github.com/moby/moby/pull/33940)
* Fix file-descriptor leak and error handling [moby/moby#33713](https://github.com/moby/moby/pull/33713)
- Fix SIGSEGV when running containers [docker/cli#303](https://github.com/docker/cli/pull/303)
* Prevent a goroutine leak when healthcheck gets stopped [moby/moby#33781](https://github.com/moby/moby/pull/33781)
* Image: Improve store locking [moby/moby#33755](https://github.com/moby/moby/pull/33755)
*Fix Btrfs quota groups not being removed when container is destroyed [moby/moby#29427](https://github.com/moby/moby/pull/29427)
* Libcontainerd: fix defunct containerd processes not being properly reaped [moby/moby#33419](https://github.com/moby/moby/pull/33419)
* Preparations for Linux Containers on Windows
* LCOW: Dedicated scratch space for service VM utilities [moby/moby#33809](https://github.com/moby/moby/pull/33809)
* LCOW: Support most operations excluding remote filesystem [moby/moby#33241](https://github.com/moby/moby/pull/33241) [moby/moby#33826](https://github.com/moby/moby/pull/33826)
* LCOW: Change directory from lcow to "Linux Containers" [moby/moby#33835](https://github.com/moby/moby/pull/33835)
* LCOW: pass command arguments without extra quoting [moby/moby#33815](https://github.com/moby/moby/pull/33815)
* LCOW: Updates necessary due to platform schema change [moby/moby#33785](https://github.com/moby/moby/pull/33785)
- Aufs: ensure diff layers are correctly removed to prevent leftover files from using up storage [moby/moby#34587](https://github.com/moby/moby/pull/34587)
### Swarm Mode
*Do not add duplicate platform information to service spec [#107](https://github.com/docker/docker-ce/pull/107)
*Cluster update and memory issue fixes [#114](https://github.com/docker/docker-ce/pull/114)
*Changing get network request to return predefined network in swarm [#150](https://github.com/docker/docker-ce/pull/150)
*Initial support for plugable secret backends [moby/moby#34157](https://github.com/moby/moby/pull/34157) [moby/moby#34123](https://github.com/moby/moby/pull/34123)
*Sort swarm stacks and nodes using natural sorting [docker/cli#315](https://github.com/docker/cli/pull/315)
*Make engine support cluster config event [moby/moby#34032](https://github.com/moby/moby/pull/34032)
* Only pass a join address when in the process of joining a cluster [moby/moby#33361](https://github.com/moby/moby/pull/33361)
* Fix error during service creation if a network with the same name exists both as "local" and "swarm" scoped network [docker/cli#184](https://github.com/docker/cli/pull/184)
* (experimental) Add support for plugins on swarm [moby/moby#33575](https://github.com/moby/moby/pull/33575)
## 17.06.0-ce (2017-06-19)
**NOTE**: Docker 17.06 by default disables communication with legacy (v1) registries. If you
require interaction with registries that have not yet migrated to the v2 protocol, set the
`--disable-legacy-registry=false` daemon option. Interaction with v1 registries will be removed
in Docker 17.12.
## 17.06.0-ce (2017-06-07)
### Builder
@ -101,11 +88,6 @@ in Docker 17.12.
+ Add new `ca ` subcommand to `docker swarm` to allow managing a swarm CA [#docker/cli/48](https://github.com/docker/cli/pull/48)
+ Add credential-spec to compose [#docker/cli/71](https://github.com/docker/cli/pull/71)
+ Add support for csv format options to `--network` and `--network-add` [#docker/cli/62](https://github.com/docker/cli/pull/62) [#33130](https://github.com/moby/moby/pull/33130)
- Fix stack compose bind-mount volumes on Windows [#docker/cli/136](https://github.com/docker/cli/pull/136)
- Correctly handle a Docker daemon without registry info [#docker/cli/126](https://github.com/docker/cli/pull/126)
+ Allow --detach and --quiet flags when using --rollback [#docker/cli/144](https://github.com/docker/cli/pull/144)
+ Remove deprecated `--email` flag from `docker login` [#docker/cli/143](https://github.com/docker/cli/pull/143)
+ Add Support swarm-mode services with node-local networks such as macvlan, ipvlan, bridge, host [#32981](https://github.com/moby/moby/pull/32981)
+ Pass driver-options to network drivers on service creation [#32981] (https://github.com/moby/moby/pull/33130)
+ Isolate Swarm Control-plane traffic from Application data traffic using --data-path-addr [#32717] (https://github.com/moby/moby/pull/32717)
* Several improvments to Service Discovery [#docker/libnetwork/1796](https://github.com/docker/libnetwork/pull/1796)
* Add DOCKER-USER chain enabling user customization of iptables FORWARD policy [#docker/libnetwork/1675](https://github.com/docker/libnetwork/pull/1675)
### Packaging
@ -142,14 +122,6 @@ in Docker 17.12.
+ Add daemon option to allow pushing foreign layers [#33151](https://github.com/moby/moby/pull/33151)
- Fix an issue preventing containerd to be restarted after it died [#32986](https://github.com/moby/moby/pull/32986)
+ Add cluster events to Docker event stream. [#32421](https://github.com/moby/moby/pull/32421)
+ Add support for DNS search on windows [#33311](https://github.com/moby/moby/pull/33311)
* Upgrade to Go 1.8.3 [#33387](https://github.com/moby/moby/pull/33387)
- Prevent a containerd crash when journald is restarted [#containerd/930](https://github.com/containerd/containerd/pull/930)
- Fix healthcheck failures due to invalid environment variables [#33249](https://github.com/moby/moby/pull/33249)
- Prevent a directory to be created in lieu of the daemon socket when a container mounting it is to be restarted during a shutdown [#30348](https://github.com/moby/moby/pull/33330)
- Prevent a container to be restarted upon stop if its stop signal is set to `SIGKILL` [#33335](https://github.com/moby/moby/pull/33335)
- Ensure log drivers get passed the same filename to both StartLogging and StopLogging endpoints [#33583](https://github.com/moby/moby/pull/33583)
- Remove daemon data structure dump on `SIGUSR1` to avoid a panic [#33598](https://github.com/moby/moby/pull/33598)
### Security
@ -165,14 +137,6 @@ in Docker 17.12.
+ Add API to rotate swarm CA certificate [#32993](https://github.com/moby/moby/pull/32993)
* Service digest pining is now handled client side [#32388](https://github.com/moby/moby/pull/32388), [#33239](https://github.com/moby/moby/pull/33239)
+ Placement now also take platform in account [#33144](https://github.com/moby/moby/pull/33144)
- Fix possible hang when joining fails [#docker-ce/19](https://github.com/docker/docker-ce/pull/19)
- Fix an issue preventing external CA to be accepted [#33341](https://github.com/moby/moby/pull/33341)
- Fix possible orchestration panic in mixed version clusters [#swarmkit/2233](https://github.com/docker/swarmkit/pull/2233)
- Avoid assigning duplicate IPs during initialization [#swarmkit/2237](https://github.com/docker/swarmkit/pull/2237)
### Deprecation
* Disable legacy registry (v1) by default [#33629](https://github.com/moby/moby/pull/33629)
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
