The IndexServerAddress field was as part of the initial Windows implementation
of the engine. For legal reasons, Microsoft Windows (and thus Docker images
based on Windows) were not allowed to be distributed through non-Microsoft
infrastructure. As a temporary solution, a dedicated "registry-win-tp3.docker.io"
registry was created to serve Windows images.
Currently, this field always shows "https://index.docker.io/v1/", which is
confusing, because that address is not used for the registry (only for
authentication and "v1" search).
docker info
...
Registry: https://index.docker.io/v1/
Starting with b4ca1c7368, this field is also
no longer used during authentication, and a3d56e7d06
removed the (deprecated) ElectAuthServer() which was previously used to
query it.
Given that there's currently no practical use for this information, and
it only adds "noise" (and confusion), this patch removes it from the default
output.
For now, the field is (still) available for those that want to use it;
docker info --format '{{.IndexServerAddress}}'
https://index.docker.io/v1/
But it won't be printed by default.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Deprecate this function in favor of the implementation in the API types,
considering that to be the canonical implementation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This utility provides the same logic as was implemented here (and using it
aligns with the "docker pull" equivalent).
Also added a TODO to replace this function with the regular "docker pull"
code.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace uses of this function in favor of the implementation in the
API types, so that we have a single, canonical implementation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
changes readInput() to trim whitespace. The existing code tried to be
conservative and only trimmed whitespace for username (not for password).
Passwords with leading/trailing whitespace would be _very_ unlikely, and
trimming whitespace is generally accepted.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
ConfigureAuth used the readInput() utility to read the username and password.
However, this utility did not return errors it encountered, but instead did
an os.Exit(1). A result of this was that the terminal was not restored if
an error happened. When reading the password, the terminal is configured to
disable echo (i.e. characters are not printed), and failing to restore
the previous state means that the terminal is now "non-functional".
This patch:
- changes readInput() to return errors it encounters
- uses a defer() to restore terminal state
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
No need to mention that the env-var may be removed at that point to keep
the description more to-the-point.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Support for this environment variable was removed in docker 23.0 in
1240f8b41d
From that patch:
> All regular, non-EOL Linux distros now come with more recent kernels
> out of the box. There may still be users trying to run on kernel 3.10
> or older (some embedded systems, e.g.), but those should be a rare
> exception, which we don't have to take into account.
>
> This patch removes the kernel version check on Linux, and the corresponding
> DOCKER_NOWARN_KERNEL_VERSION environment that was there to skip this
> check.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function no longer uses the /info endpoint to resolve the registry
to use. The documentation for this function was still referring to
the (once used) special registry for Windows images, which is no longer
in use, so update the docs to reflect reality :)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This patch adds additional information to the Client section of the output.
We were already outputting versions of CLI Plugins, and the Server, but not
for the Client.
Adding this information can help with bug-reports where the reporter only
provided the `docker info` output, or (e.g.) only `docker --version`. The
platform name helps identify what kind of builds the user has installed
(e.g. docker's docker-ce packages have "Docker Engine - Community" set
for this), although we should consider including "packager" information
as a more formalized field for this information.
Before this patch:
$ docker info
Client:
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.10.4
Path: /usr/libexec/docker/cli-plugins/docker-buildx
...
With this patch applied:
$ docker info
Client: Docker Engine - Community
Version: 24.0.0-dev
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.10.4
Path: /usr/libexec/docker/cli-plugins/docker-buildx
...
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows the type to be used for situations where this information is
not present, or not to be printed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Platform field was defined with omitempty, but would always be shown
in the JSON output, because it was never nil.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It's defined on a non-exported type, and was only used in a template.
Replacing for a basic "nil" check, which should do the same.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The --format=json option was added for all inspect commands, but was not
implemented for "docker version". This patch implements the missing option.
Before this patch:
docker version --format=json
json
With this patch:
docker version --format=json
{"Client":{"Platform":{"Name":""},"Version":"24.0.0-dev","ApiVersion":"..."}}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The --format=json option was added for all inspect commands, but was not implemented
for "docker info". This patch implements the missing option.
Before this patch:
docker info --format=json
json
With this patch applied:
docker info --format=json
{"ID":"80c2f18a-2c88-4e4a-ba69-dca0eea59835","Containers":7,"ContainersRunning":"..."}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Of both "--quiet" and "--format" are set, --quiet takes precedence. This
patch adds a warning to inform the user that their custom format is not
used:
docker ps --format='{{.Image}}'
ubuntu:22.04
alpine
docker ps --format='{{.Image}}' --quiet
WARNING: Ignoring custom format, because both --format and --quiet are set.
40111f61d5c5
482efdf39fac
The warning is printed on STDERR, so can be redirected:
docker ps --format='{{.Image}}' --quiet 2> /dev/null
40111f61d5c5
482efdf39fac
The warning is only shown if the format is set using the "--format" option.
No warning is shown if a custom format is set through the CLI configuration
file:
mkdir -p ~/.docker/
echo '{"psFormat": "{{.Image}}"}' > ~/.docker/config.json
docker ps
ubuntu:22.04
alpine
docker ps --quiet
40111f61d5c5
482efdf39fac
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Previously, the formatter would ignore the quiet option if a custom format
was passed; this situation was handled in runPs(), where custom formats
would only be applied if the quiet option was not set, but only if the
format was set in the CLI's config.
This patch updates NewContainerFormat() to do the same, even if a `--format`
was passed on the command-line.
This is a change in behavior, so may need some discussion; possible alternatives;
- produce an error if both `--format` and `--quiet` are passed
- print a warning if both are passed (but use the logic from this patch)
Before this patch:
```console
docker ps --format '{{.Image}}'
ubuntu:22.04
alpine
docker ps --format '{{.Image}}' --quiet
ubuntu:22.04
alpine
mkdir -p ~/.docker/
echo '{"psFormat": "{{.Image}}"}' > ~/.docker/config.json
docker ps
ubuntu:22.04
alpine
docker ps --quiet
ubuntu:22.04
alpine
```
With this patch applied:
```console
docker ps --format '{{.Image}}'
ubuntu:22.04
alpine
docker ps --format '{{.Image}}' --quiet
40111f61d5c5
482efdf39fac
mkdir -p ~/.docker/
echo '{"psFormat": "{{.Image}}"}' > ~/.docker/config.json
docker ps
ubuntu:22.04
alpine
docker ps --quiet
40111f61d5c5
482efdf39fac
```
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- containerConfig collided with the containerConfig type
- warning collided with the warning const
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
release notes: https://github.com/spf13/cobra/releases/tag/v1.7.0
Features
- Allow to preserve ordering of completions in bash, zsh, pwsh, & fish
- Add support for PowerShell 7.2+ in completions
- Allow sourcing zsh completion script
Bug fixes
- Don't remove flag values that match sub-command name
- Fix powershell completions not returning single word
- Remove masked template import variable name
- Correctly detect completions with dash in argument
Testing & CI/CD
- Deprecate Go 1.15 in CI
- Deprecate Go 1.16 in CI
- Add testing for Go 1.20 in CI
- Add tests to illustrate unknown flag bug
Maintenance
- Update main image to better handle dark backgrounds
- Fix stale.yaml mispellings
- Remove stale bot from GitHub actions
- Add makefile target for installing dependencies
- Add Sia to projects using Cobra
- Add Vitess and Arewefastyet to projects using cobra
- Fixup for Kubescape github org
- Fix route for GitHub workflows badge
- Fixup for GoDoc style documentation
- Various bash scripting improvements for completion
- Add Constellation to projects using Cobra
Documentation
- Add documentation about disabling completion descriptions
- Improve MarkFlagsMutuallyExclusive example in user guide
- Update shell_completions.md
- Update copywrite year
- Document suggested layout of subcommands
- Replace deprecated ExactValidArgs with MatchAll in doc
full diff: https://github.com/spf13/cobra/compare/v1.6.1...v1.7.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Commit 1e3622c50c moved the generator code
to a subdirectory, but forgot to update the markdown version of this script.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
go1.20.3 (released 2023-04-04) includes security fixes to the go/parser,
html/template, mime/multipart, net/http, and net/textproto packages, as well
as bug fixes to the compiler, the linker, the runtime, and the time package.
See the Go 1.20.3 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.20.3+label%3ACherryPickApproved
full diff: https://github.com/golang/go/compare/go1.20.2...go1.20.3
Further details from the announcement on the mailing list:
We have just released Go versions 1.20.3 and 1.19.8, minor point releases.
These minor releases include 4 security fixes following the security policy:
- go/parser: infinite loop in parsing
Calling any of the Parse functions on Go source code which contains `//line`
directives with very large line numbers can cause an infinite loop due to
integer overflow.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is CVE-2023-24537 and Go issue https://go.dev/issue/59180.
- html/template: backticks not treated as string delimiters
Templates did not properly consider backticks (`) as Javascript string
delimiters, and as such did not escape them as expected. Backticks are
used, since ES6, for JS template literals. If a template contained a Go
template action within a Javascript template literal, the contents of the
action could be used to terminate the literal, injecting arbitrary Javascript
code into the Go template.
As ES6 template literals are rather complex, and themselves can do string
interpolation, we've decided to simply disallow Go template actions from being
used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe
way to allow this behavior. This takes the same approach as
github.com/google/safehtml. Template.Parse will now return an Error when it
encounters templates like this, with a currently unexported ErrorCode with a
value of 12. This ErrorCode will be exported in the next major release.
Users who rely on this behavior can re-enable it using the GODEBUG flag
jstmpllitinterp=1, with the caveat that backticks will now be escaped. This
should be used with caution.
Thanks to Sohom Datta, Manipal Institute of Technology, for reporting this issue.
This is CVE-2023-24538 and Go issue https://go.dev/issue/59234.
- net/http, net/textproto: denial of service from excessive memory allocation
HTTP and MIME header parsing could allocate large amounts of memory, even when
parsing small inputs.
Certain unusual patterns of input data could cause the common function used to
parse HTTP and MIME headers to allocate substantially more memory than
required to hold the parsed headers. An attacker can exploit this behavior to
cause an HTTP server to allocate large amounts of memory from a small request,
potentially leading to memory exhaustion and a denial of service.
Header parsing now correctly allocates only the memory required to hold parsed
headers.
Thanks to Jakob Ackermann (@das7pad) for discovering this issue.
This is CVE-2023-24534 and Go issue https://go.dev/issue/58975.
- net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
Multipart form parsing can consume large amounts of CPU and memory when
processing form inputs containing very large numbers of parts. This stems from
several causes:
mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form
can consume. ReadForm could undercount the amount of memory consumed, leading
it to accept larger inputs than intended. Limiting total memory does not
account for increased pressure on the garbage collector from large numbers of
small allocations in forms with many parts. ReadForm could allocate a large
number of short-lived buffers, further increasing pressure on the garbage
collector. The combination of these factors can permit an attacker to cause an
program that parses multipart forms to consume large amounts of CPU and
memory, potentially resulting in a denial of service. This affects programs
that use mime/multipart.Reader.ReadForm, as well as form parsing in the
net/http package with the Request methods FormFile, FormValue,
ParseMultipartForm, and PostFormValue.
ReadForm now does a better job of estimating the memory consumption of parsed
forms, and performs many fewer short-lived allocations.
In addition, mime/multipart.Reader now imposes the following limits on the
size of parsed forms:
Forms parsed with ReadForm may contain no more than 1000 parts. This limit may
be adjusted with the environment variable GODEBUG=multipartmaxparts=. Form
parts parsed with NextPart and NextRawPart may contain no more than 10,000
header fields. In addition, forms parsed with ReadForm may contain no more
than 10,000 header fields across all parts. This limit may be adjusted with
the environment variable GODEBUG=multipartmaxheaders=.
Thanks to Jakob Ackermann for discovering this issue.
This is CVE-2023-24536 and Go issue https://go.dev/issue/59153.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Touch-up GoDoc to better document each method, adding punctuation, and
use doc-links where applicable.
- SetRawTerminal(): change the order in which we check if a terminal is
connected; check the local boolean first before checking if the NORAW
env-var is set.
- NewOut() / NewIn(); remove intermediate variables
- Remove explicit use of the embedded "commonStream" to make the code
slightly less verbose, and more "to the point".
- Document the intended purpose of SetIsTerminal(), which was added in
b2551c619d
to be used in unit-tests.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was deprecated in 6ea2767289, which
is part of docker 23.0, so users should have had a chance to migrate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This field was deprecated in 15535d4594, which
is part of docker 23.0, so users should have had a chance to migrate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in 3499669e18, which
is part of docker 23.0, so users should have had a chance to migrate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in de6020a240, which
is part of docker 23.0, so users should have had a chance to migrate.
This removes IsErrContextDoesNotExist() and IsErrTLSDataDoesNotExist()
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This was deprecated in 467e650d4c, which
is part of docker 23.0, so users should have had a chance to migrate.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were deprecated in 6c400a9c2009bba9376ad61ab59c04c1ad675871 (docker 19.03),
but the "Deprecated:" comments were missing a newline before them.
While most IDEs will detect such comments as "deprecated", pkg.go.dev and linters
will ignore them, which may result in users not being aware of them being deprecated.
This patch;
- Fixes the "Deprecated:" comments.
- Changes the var aliases to functions, which is slightly more boilerplating,
but makes sure the functions are documented as "function", instead of shown
in the "variables" section on pkg.go.dev.
- Adds some punctuation and adds "doc links", which allows readers to navigate
to related content on pkg.go.dev.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 62f2358b99.
Spawning a goroutine for each iteration in the loop when listing
plugins is racy unfortunately. `plugins` slice is protected with
a mutex so not sure why it fails.
I tried using a channel to collect the plugins instead of a slice
to guarantee that they will be appended to the list in the order
they are processed but no dice.
I also tried without errgroup package and simply use sync.WaitGroup
but same. I have also created an extra channel to receive errors
from the goroutines but racy too.
I think the change in this function is not related to the race
condition but newPlugin is. So revert in the meantime :(
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
This moves all the terminal writing to a goroutine that updates the
terminal periodically.
In our MITM copier we just use an atomic to add to the total number of
bytes read/written, the goroutine reads the total and updates the
terminal as needed.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
internal/test/cli.go:184:34: unused-parameter: parameter 'insecure' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeCli) RegistryClient(insecure bool) registryclient.RegistryClient {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
internal/test/notary/client.go:16:33: unused-parameter: parameter 'imgRefAndAuth' seems to be unused, consider removing or renaming it as _ (revive)
func GetOfflineNotaryRepository(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error) {
^
internal/test/notary/client.go:25:45: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) Initialize(rootKeyIDs []string, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:30:60: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) InitializeWithCertificate(rootKeyIDs []string, rootCerts []data.PublicKey, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:42:44: unused-parameter: parameter 'target' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) AddTarget(target *client.Target, roles ...data.RoleName) error {
^
internal/test/notary/client.go:48:47: unused-parameter: parameter 'targetName' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RemoveTarget(targetName string, roles ...data.RoleName) error {
^
internal/test/notary/client.go:54:46: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) ListTargets(roles ...data.RoleName) ([]*client.TargetWithRole, error) {
^
internal/test/notary/client.go:59:50: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) GetTargetByName(name string, roles ...data.RoleName) (*client.TargetWithRole, error) {
^
internal/test/notary/client.go:65:61: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) GetAllTargetMetadataByName(name string) ([]client.TargetSignedStruct, error) {
^
internal/test/notary/client.go:85:48: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) AddDelegation(name data.RoleName, delegationKeys []data.PublicKey, paths []string) error {
^
internal/test/notary/client.go:90:59: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) AddDelegationRoleAndKeys(name data.RoleName, delegationKeys []data.PublicKey) error {
^
internal/test/notary/client.go:95:53: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) AddDelegationPaths(name data.RoleName, paths []string) error {
^
internal/test/notary/client.go💯63: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RemoveDelegationKeysAndPaths(name data.RoleName, keyIDs, paths []string) error {
^
internal/test/notary/client.go:105:55: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RemoveDelegationRole(name data.RoleName) error {
^
internal/test/notary/client.go:110:56: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RemoveDelegationPaths(name data.RoleName, paths []string) error {
^
internal/test/notary/client.go:115:55: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RemoveDelegationKeys(name data.RoleName, keyIDs []string) error {
^
internal/test/notary/client.go:120:55: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) ClearDelegationPaths(name data.RoleName) error {
^
internal/test/notary/client.go:126:42: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) Witness(roles ...data.RoleName) ([]data.RoleName, error) {
^
internal/test/notary/client.go:131:44: unused-parameter: parameter 'role' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) RotateKey(role data.RoleName, serverManagesKey bool, keyList []string) error {
^
internal/test/notary/client.go:142:52: unused-parameter: parameter 'version' seems to be unused, consider removing or renaming it as _ (revive)
func (o OfflineNotaryRepository) SetLegacyVersions(version int) {}
^
internal/test/notary/client.go:150:39: unused-parameter: parameter 'imgRefAndAuth' seems to be unused, consider removing or renaming it as _ (revive)
func GetUninitializedNotaryRepository(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error) {
^
internal/test/notary/client.go:163:51: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) Initialize(rootKeyIDs []string, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:168:66: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) InitializeWithCertificate(rootKeyIDs []string, rootCerts []data.PublicKey, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:180:52: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) ListTargets(roles ...data.RoleName) ([]*client.TargetWithRole, error) {
^
internal/test/notary/client.go:185:56: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) GetTargetByName(name string, roles ...data.RoleName) (*client.TargetWithRole, error) {
^
internal/test/notary/client.go:191:67: unused-parameter: parameter 'name' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) GetAllTargetMetadataByName(name string) ([]client.TargetSignedStruct, error) {
^
internal/test/notary/client.go:206:50: unused-parameter: parameter 'role' seems to be unused, consider removing or renaming it as _ (revive)
func (u UninitializedNotaryRepository) RotateKey(role data.RoleName, serverManagesKey bool, keyList []string) error {
^
internal/test/notary/client.go:211:38: unused-parameter: parameter 'imgRefAndAuth' seems to be unused, consider removing or renaming it as _ (revive)
func GetEmptyTargetsNotaryRepository(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error) {
^
internal/test/notary/client.go:223:50: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (e EmptyTargetsNotaryRepository) Initialize(rootKeyIDs []string, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:228:65: unused-parameter: parameter 'rootKeyIDs' seems to be unused, consider removing or renaming it as _ (revive)
func (e EmptyTargetsNotaryRepository) InitializeWithCertificate(rootKeyIDs []string, rootCerts []data.PublicKey, serverManagedRoles ...data.RoleName) error {
^
internal/test/notary/client.go:240:51: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (e EmptyTargetsNotaryRepository) ListTargets(roles ...data.RoleName) ([]*client.TargetWithRole, error) {
^
internal/test/notary/client.go:245:68: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (e EmptyTargetsNotaryRepository) GetTargetByName(name string, roles ...data.RoleName) (*client.TargetWithRole, error) {
^
internal/test/notary/client.go:284:49: unused-parameter: parameter 'role' seems to be unused, consider removing or renaming it as _ (revive)
func (e EmptyTargetsNotaryRepository) RotateKey(role data.RoleName, serverManagesKey bool, keyList []string) error {
^
internal/test/notary/client.go:289:32: unused-parameter: parameter 'imgRefAndAuth' seems to be unused, consider removing or renaming it as _ (revive)
func GetLoadedNotaryRepository(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error) {
^
internal/test/notary/client.go:509:45: unused-parameter: parameter 'imgRefAndAuth' seems to be unused, consider removing or renaming it as _ (revive)
func GetLoadedWithNoSignersNotaryRepository(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error) {
^
internal/test/notary/client.go:532:75: unused-parameter: parameter 'roles' seems to be unused, consider removing or renaming it as _ (revive)
func (l LoadedWithNoSignersNotaryRepository) GetTargetByName(name string, roles ...data.RoleName) (*client.TargetWithRole, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/config/configfile/file_test.go:189:33: unused-parameter: parameter 'authConfig' seems to be unused, consider removing or renaming it as _ (revive)
func (c *mockNativeStore) Store(authConfig types.AuthConfig) error {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/compose/schema/schema.go:20:44: unused-parameter: parameter 'input' seems to be unused, consider removing or renaming it as _ (revive)
func (checker portsFormatChecker) IsFormat(input interface{}) bool {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/command/volume/prune_test.go:113:22: unused-parameter: parameter 'args' seems to be unused, consider removing or renaming it as _ (revive)
func simplePruneFunc(args filters.Args) (types.VolumesPruneReport, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/command/service/update_test.go:507:41: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (s secretAPIClientMock) SecretList(ctx context.Context, options types.SecretListOptions) ([]swarm.Secret, error) {
^
cli/command/service/update_test.go:511:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (s secretAPIClientMock) SecretCreate(ctx context.Context, secret swarm.SecretSpec) (types.SecretCreateResponse, error) {
^
cli/command/service/update_test.go:515:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (s secretAPIClientMock) SecretRemove(ctx context.Context, id string) error {
^
cli/command/service/update_test.go:519:51: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (s secretAPIClientMock) SecretInspectWithRaw(ctx context.Context, name string) (swarm.Secret, []byte, error) {
^
cli/command/service/update_test.go:523:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (s secretAPIClientMock) SecretUpdate(ctx context.Context, id string, version swarm.Version, secret swarm.SecretSpec) error {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/command/plugin/client_test.go:23:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginCreate(ctx context.Context, createContext io.Reader, createOptions types.PluginCreateOptions) error {
^
cli/command/plugin/client_test.go:30:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginEnable(ctx context.Context, name string, enableOptions types.PluginEnableOptions) error {
^
cli/command/plugin/client_test.go:37:36: unused-parameter: parameter 'context' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginDisable(context context.Context, name string, disableOptions types.PluginDisableOptions) error {
^
cli/command/plugin/client_test.go:44:35: unused-parameter: parameter 'context' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginRemove(context context.Context, name string, removeOptions types.PluginRemoveOptions) error {
^
cli/command/plugin/client_test.go:51:36: unused-parameter: parameter 'context' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginInstall(context context.Context, name string, installOptions types.PluginInstallOptions) (io.ReadCloser, error) {
^
cli/command/plugin/client_test.go:58:33: unused-parameter: parameter 'context' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginList(context context.Context, filter filters.Args) (types.PluginsListResponse, error) {
^
cli/command/plugin/client_test.go:66:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) PluginInspectWithRaw(ctx context.Context, name string) (*types.Plugin, []byte, error) {
^
cli/command/plugin/client_test.go:74:27: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) Info(ctx context.Context) (types.Info, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/command/image/build/context_test.go:21:19: unused-parameter: parameter 't' seems to be unused, consider removing or renaming it as _ (revive)
func prepareEmpty(t *testing.T) string {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I could either remove the name for these contexts, or make the fake functions
more accurately reflect the actual implementation (decided to go for the latter
one)
cli/command/secret/client_test.go:19:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) SecretCreate(ctx context.Context, spec swarm.SecretSpec) (types.SecretCreateResponse, error) {
^
cli/command/secret/client_test.go:26:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) SecretInspectWithRaw(ctx context.Context, id string) (swarm.Secret, []byte, error) {
^
cli/command/secret/client_test.go:33:33: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) SecretList(ctx context.Context, options types.SecretListOptions) ([]swarm.Secret, error) {
^
cli/command/secret/client_test.go:40:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) SecretRemove(ctx context.Context, name string) error {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I could either remove the name for these contexts, or make the fake functions
more accurately reflect the actual implementation (decided to go for the latter
one)
. cli/command/config/client_test.go:19:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) ConfigCreate(ctx context.Context, spec swarm.ConfigSpec) (types.ConfigCreateResponse, error) {
^
cli/command/config/client_test.go:26:43: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) ConfigInspectWithRaw(ctx context.Context, id string) (swarm.Config, []byte, error) {
^
cli/command/config/client_test.go:33:33: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) ConfigList(ctx context.Context, options types.ConfigListOptions) ([]swarm.Config, error) {
^
cli/command/config/client_test.go:40:35: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *fakeClient) ConfigRemove(ctx context.Context, name string) error {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Only a single method of the FakeClient was actually implemented (and used).
This patch embeds the interface it must implement to reduce the boilerplating
for not yet implemented methods.
Calling any of the unimplemented methods will result in a panic, which will
make it clear when they must be implemented :)
This also fixes various linting errors;
internal/test/network/client.go:17:37: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworkConnect(ctx context.Context, networkID, container string, config *network.EndpointSettings) error {
^
internal/test/network/client.go:22:65: unused-parameter: parameter 'options' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworkCreate(_ context.Context, _ string, options types.NetworkCreate) (types.NetworkCreateResponse, error) {
^
internal/test/network/client.go:27:40: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworkDisconnect(ctx context.Context, networkID, container string, force bool) error {
^
internal/test/network/client.go:45:53: unused-parameter: parameter 'options' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworkList(_ context.Context, options types.NetworkListOptions) ([]types.NetworkResource, error) {
^
internal/test/network/client.go:50:36: unused-parameter: parameter 'ctx' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworkRemove(ctx context.Context, networkID string) error {
^
internal/test/network/client.go:55:55: unused-parameter: parameter 'pruneFilter' seems to be unused, consider removing or renaming it as _ (revive)
func (c *FakeClient) NetworksPrune(_ context.Context, pruneFilter filters.Args) (types.NetworksPruneReport, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These method must implements an interface, but don't use the argument.
cli/trust/trust.go:85:40: unused-parameter: parameter 'u' seems to be unused, consider removing or renaming it as _ (revive)
func (scs simpleCredentialStore) Basic(u *url.URL) (string, string) {
^
cli/trust/trust.go:89:47: unused-parameter: parameter 'u' seems to be unused, consider removing or renaming it as _ (revive)
func (scs simpleCredentialStore) RefreshToken(u *url.URL, service string) string {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
opts/capabilities.go:25:2: redefines-builtin-id: redefinition of the built-in function cap (revive)
cap = strings.ToUpper(strings.TrimSpace(cap))
^
opts/capabilities.go:30:3: redefines-builtin-id: redefinition of the built-in function cap (revive)
cap = "CAP_" + cap
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This method implements the interface defined in distribution, but doesn't
use the argument.
cli/registry/client/endpoint.go:123:69: unused-parameter: parameter 'params' seems to be unused, consider removing or renaming it as _ (revive)
func (th *existingTokenHandler) AuthorizeRequest(req *http.Request, params map[string]string) error {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function must match the interface, but doesn't use the firs argument.
cli/command/service/progress/progress.go:417:40: unused-parameter: parameter 'service' seems to be unused, consider removing or renaming it as _ (revive)
func (u *globalProgressUpdater) update(service swarm.Service, tasks []swarm.Task, activeNodes map[string]struct{}, rollback bool) (bool, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These functions must have the same signature, but only some of them accept
an "all" boolean argument;
88924b1802/cli/command/system/prune.go (L79)
cli/command/container/prune.go:78:38: unused-parameter: parameter 'all' seems to be unused, consider removing or renaming it as _ (revive)
func RunPrune(dockerCli command.Cli, all bool, filter opts.FilterOpt) (uint64, string, error) {
^
cli/command/network/prune.go:73:38: unused-parameter: parameter 'all' seems to be unused, consider removing or renaming it as _ (revive)
func RunPrune(dockerCli command.Cli, all bool, filter opts.FilterOpt) (uint64, string, error) {
^
cli/command/volume/prune.go:78:38: unused-parameter: parameter 'all' seems to be unused, consider removing or renaming it as _ (revive)
func RunPrune(dockerCli command.Cli, all bool, filter opts.FilterOpt) (uint64, string, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These wrappers were added to abstract stack deploy to k8s and swarm. Now
that support for deploying to k8s was removed, we can remove these wrappers.
This deprecates:
- RunDeploy()
- RunPs()
- RunRemove()
- GetServices()
This also addresses some linting failers, due to these functions having
unused arguments:
cli/command/stack/deploy.go:51:39: unused-parameter: parameter 'flags' seems to be unused, consider removing or renaming it as _ (revive)
func RunDeploy(dockerCli command.Cli, flags *pflag.FlagSet, config *composetypes.Config, opts options.Deploy) error {
^
cli/command/stack/ps.go:42:35: unused-parameter: parameter 'flags' seems to be unused, consider removing or renaming it as _ (revive)
func RunPs(dockerCli command.Cli, flags *pflag.FlagSet, opts options.PS) error {
^
cli/command/stack/remove.go:35:39: unused-parameter: parameter 'flags' seems to be unused, consider removing or renaming it as _ (revive)
func RunRemove(dockerCli command.Cli, flags *pflag.FlagSet, opts options.Remove) error {
^
cli/command/stack/list.go:37:14: unused-parameter: parameter 'cmd' seems to be unused, consider removing or renaming it as _ (revive)
func RunList(cmd *cobra.Command, dockerCli command.Cli, opts options.List) error {
^
cli/command/stack/services.go:56:41: unused-parameter: parameter 'flags' seems to be unused, consider removing or renaming it as _ (revive)
func GetServices(dockerCli command.Cli, flags *pflag.FlagSet, opts options.Services) ([]swarmtypes.Service, error) {
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
cli/command/container/run.go:176:3: redefines-builtin-id: redefinition of the built-in function close (revive)
close, err := attachContainer(ctx, dockerCli, &errCh, config, createResponse.ID)
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Only show progress updates after a time threshold has elapsed in order
to reduce the number of writes to the terminal.
This improves readability of the progress.
Also moves cursor show/hide into the progress printer to reduce chances
if messing up the user's terminal in case of cancellation.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Edited second paragraph under ### Daemon configuration file to change "regardless their value" to "regardless of their value"
Signed-off-by: Jake Stokes <contactjake@developerjake.com>
- Instead of rewriting the entire line every time only clear and write
the parts that changed.
- Hide the cursor while writing progress
Both these things make the progress updates significantly easier to
read.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
This fixes a case where a non-tty will have control characters + the log
line for every single read operation.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
We are currently loading plugin command stubs for every
invocation which still has a significant performance hit.
With this change we are doing this operation only if cobra
completion arg request is found.
- 20.10.23: `docker --version` takes ~15ms
- 23.0.1: `docker --version` takes ~93ms
With this change `docker --version` takes ~9ms
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
We are currently loading plugin commands stubs for every
command invocation to add support for Cobra v2 completion.
This cause a significant performance hit if there is a
lot of plugins in the user space (7 atm in Docker Desktop):
`docker --version` takes in current 23.0.1 ~93ms
Instead of removing completion for plugins to fix the
regression, we can slightly improve plugins discovery by
spawning a goroutine for each iteration in the loop when
listing plugins:
`docker --version` now takes ~38ms
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
This code depended on the registry Service interface, which has been removed,
so needed to be refactored. Digging further into the reason this code existed,
it looked like the Class=plugin was previously required on Docker Hub to handle
plugins, but this requirement is no longer there, so we can remove this special
handling.
This patch removes the special handling to both remove the use of the registry.Service
interface, as well as removing complexity that is no longer needed.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function was deprecated in b4ca1c7368,
which is part of the v23.0 release, and is no longer used, so we can remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The comment was not formatted correctly, and because of that not picked up as
being deprecated.
updates b4ca1c7368
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests were deliberately producing errors as part of the test, but
printing those errors could be confusing / make it more difficult to find
actual test-failures.
Before this patch:
=== RUN TestVolumeCreateErrors
Error: conflicting options: either specify --name or provide positional arg, not both
Error: "create" requires at most 1 argument.
See 'create --help'.
Usage: create [OPTIONS] [VOLUME] [flags]
Create a volume
Error: error creating volume
--- PASS: TestVolumeCreateErrors (0.00s)
PASS
With this patch applied:
=== RUN TestVolumeCreateErrors
--- PASS: TestVolumeCreateErrors (0.00s)
PASS
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Includes a security fix for crypto/elliptic (CVE-2023-24532).
> go1.19.7 (released 2023-03-07) includes a security fix to the crypto/elliptic
> package, as well as bug fixes to the linker, the runtime, and the crypto/x509
> and syscall packages. See the Go 1.19.7 milestone on our issue tracker for
> details.
https://go.dev/doc/devel/release#go1.19.minor
From the announcement:
> We have just released Go versions 1.20.2 and 1.19.7, minor point releases.
>
> These minor releases include 1 security fixes following the security policy:
>
> - crypto/elliptic: incorrect P-256 ScalarMult and ScalarBaseMult results
>
> The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an
> incorrect result if called with some specific unreduced scalars (a scalar larger
> than the order of the curve).
>
> This does not impact usages of crypto/ecdsa or crypto/ecdh.
>
> This is CVE-2023-24532 and Go issue https://go.dev/issue/58647.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make the error more specific by stating that it's caused by a specific
environment variable and not an environment as a whole.
Also don't escape the variable to make it more readable.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
On Windows, ignore all variables that start with "=" when building an
environment variables map for stack.
For MS-DOS compatibility cmd.exe can set some special environment
variables that start with a "=" characters, which breaks the general
assumption that the first encountered "=" separates a variable name from
variable value and causes trouble when parsing.
These variables don't seem to be documented anywhere, but they are
described by some third-party sources and confirmed empirically on my
Windows installation.
Useful sources:
https://devblogs.microsoft.com/oldnewthing/20100506-00/?p=14133https://ss64.com/nt/syntax-variables.html
Known variables:
- `=ExitCode` stores the exit code returned by external command (in hex
format)
- `=ExitCodeAscii` - same as above, except the value is the ASCII
representation of the code (so exit code 65 (0x41) becomes 'A').
- `=::=::\` and friends - store drive specific working directory.
There is one env variable for each separate drive letter that was
accessed in the shell session and stores the working directory for that
specific drive.
The general format for these is:
`=<DRIVE_LETTER>:=<CWD>` (key=`=<DRIVE_LETTER>:`, value=`<CWD>`)
where <CWD> is a working directory for the drive that is assigned to
the letter <DRIVE_LETTER>
A couple of examples:
`=C:=C:\some\dir` (key: `=C:`, value: `C:\some\dir`)
`=D:=D:\some\other\dir` (key: `=C:`, value: `C:\some\dir`)
`=Z:=Z:\` (key: `=Z:`, value: `Z:\`)
`=::=::\` is the one that seems to be always set and I'm not exactly
sure what this one is for (what's drive `::`?). Others are set as
soon as you CD to a path on some drive. Considering that you start a
cmd.exe also has some working directory, there are 2 of these on start.
All these variables can be safely ignored because they can't be
deliberately set by the user, their meaning is only relevant to the
cmd.exe session and they're all are related to the MS-DOS/Batch feature
that are irrelevant for us.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Tests mocking the output of GET images/json with fakeClient used an
array with one empty element as an empty response.
Change it to just an empty array.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
go1.19.6 (released 2023-02-14) includes security fixes to the crypto/tls,
mime/multipart, net/http, and path/filepath packages, as well as bug fixes to
the go command, the linker, the runtime, and the crypto/x509, net/http, and
time packages. See the Go 1.19.6 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.19.6+label%3ACherryPickApproved
From the announcement on the security mailing:
We have just released Go versions 1.20.1 and 1.19.6, minor point releases.
These minor releases include 4 security fixes following the security policy:
- path/filepath: path traversal in filepath.Clean on Windows
On Windows, the filepath.Clean function could transform an invalid path such
as a/../c:/b into the valid path c:\b. This transformation of a relative (if
invalid) path into an absolute path could enable a directory traversal attack.
The filepath.Clean function will now transform this path into the relative
(but still invalid) path .\c:\b.
This is CVE-2022-41722 and Go issue https://go.dev/issue/57274.
- net/http, mime/multipart: denial of service from excessive resource
consumption
Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely
unlimited amounts of memory and disk files. This also affects form parsing in
the net/http package with the Request methods FormFile, FormValue,
ParseMultipartForm, and PostFormValue.
ReadForm takes a maxMemory parameter, and is documented as storing "up to
maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts
which cannot be stored in memory are stored on disk in temporary files. The
unconfigurable 10MB reserved for non-file parts is excessively large and can
potentially open a denial of service vector on its own. However, ReadForm did
not properly account for all memory consumed by a parsed form, such as map
ntry overhead, part names, and MIME headers, permitting a maliciously crafted
form to consume well over 10MB. In addition, ReadForm contained no limit on
the number of disk files created, permitting a relatively small request body
to create a large number of disk temporary files.
ReadForm now properly accounts for various forms of memory overhead, and
should now stay within its documented limit of 10MB + maxMemory bytes of
memory consumption. Users should still be aware that this limit is high and
may still be hazardous.
ReadForm now creates at most one on-disk temporary file, combining multiple
form parts into a single temporary file. The mime/multipart.File interface
type's documentation states, "If stored on disk, the File's underlying
concrete type will be an *os.File.". This is no longer the case when a form
contains more than one file part, due to this coalescing of parts into a
single file. The previous behavior of using distinct files for each form part
may be reenabled with the environment variable
GODEBUG=multipartfiles=distinct.
Users should be aware that multipart.ReadForm and the http.Request methods
that call it do not limit the amount of disk consumed by temporary files.
Callers can limit the size of form data with http.MaxBytesReader.
This is CVE-2022-41725 and Go issue https://go.dev/issue/58006.
- crypto/tls: large handshake records may cause panics
Both clients and servers may send large TLS handshake records which cause
servers and clients, respectively, to panic when attempting to construct
responses.
This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable
session resumption (by setting Config.ClientSessionCache to a non-nil value),
and TLS 1.3 servers which request client certificates (by setting
Config.ClientAuth
> = RequestClientCert).
This is CVE-2022-41724 and Go issue https://go.dev/issue/58001.
- net/http: avoid quadratic complexity in HPACK decoding
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption
in the HPACK decoder, sufficient to cause a denial of service from a small
number of small requests.
This issue is also fixed in golang.org/x/net/http2 v0.7.0, for users manually
configuring HTTP/2.
This is CVE-2022-41723 and Go issue https://go.dev/issue/57855.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The error returned from "os/exec".Command when attempting to execute a
directory has been changed from syscall.EACCESS to syscall.EISDIR on
Go 1.20. 2b8f214094
Consequently, any runc runtime built against Go 1.20 will return an
error containing 'is a directory' and not 'permission denied'. Update
the string matching so the CLI exits with status code 126 on 'is a
directory' errors (EISDIR) in addition to 'permission denied' (EACCESS).
Signed-off-by: Cory Snider <csnider@mirantis.com>
This prevents us needing to attempt to reconstruct the exact indentation
registry side, which is not canonical - so may differ.
Signed-off-by: Justin Chadwell <me@jedevc.com>
This behavior should not break any more use cases than before.
Previously, if the mismatch occured, we would actually push a manifest
that we then never referred to in the manifest list! If this was done in
a new repository, the command would fail with an obscure error from the
registry - the content wouldn't exist with the descriptor we expect it
to.
Signed-off-by: Justin Chadwell <me@jedevc.com>
The additionalHelp message is printed at the end of the --help output;
To get more help with docker, check out our guides at https://docs.docker.com/go/guides/
PS>
As this message may contain an URL, users may copy/paste the URL to open it
in their browser, but can easily end up copying their prompt (as there's
no whitespace after it), and as a result end up on a broken URL, for example:
https://docs.docker.com/go/guides/PS
This patch adds an extra newline at the end to provide some whitespace
around the message, making it less error-prone to copy the URL;
To get more help with docker, check out our guides at https://docs.docker.com/go/guides/
PS>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This prevents the escape-characters being included when piping the
output, e.g. `docker --help > output.txt`, or `docker --help | something`.
These control-characters could cause issues if users copy/pasted the URL
from the output, resulting in them becoming part of the URL they tried
to visit, which would fail, e.g. when copying the output from:
To get more help with docker, check out our guides at https://docs.docker.com/go/guides/
Users ended up on URLs like;
https://docs.docker.com/go/guides/ESChttps://docs.docker.com/go/guides/%1B[0m
Before this patch, control characters ("bold") would be printed, even if
no TTY was attached;
docker --help > output.txt
cat output.txt | grep 'For more help' | od -c
0000000 033 [ 1 m F o r m o r e h e l
0000020 p o n h o w t o u s e
0000040 D o c k e r , h e a d t o
0000060 h t t p s : / / d o c s . d o c
0000100 k e r . c o m / g o / g u i d e
0000120 s / 033 [ 0 m \n
0000127
docker --help | grep 'For more help' | od -c
0000000 033 [ 1 m F o r m o r e h e l
0000020 p o n h o w t o u s e
0000040 D o c k e r , h e a d t o
0000060 h t t p s : / / d o c s . d o c
0000100 k e r . c o m / g o / g u i d e
0000120 s / 033 [ 0 m \n
0000127
With this patch, no control characters are included:
docker --help > output.txt
cat output.txt | grep 'For more help' | od -c
0000000 F o r m o r e h e l p o n
0000020 h o w t o u s e D o c k
0000040 e r , h e a d t o h t t p
0000060 s : / / d o c s . d o c k e r .
0000100 c o m / g o / g u i d e s / \n
0000117
docker --help | grep 'For more help' | od -c
0000000 F o r m o r e h e l p o n
0000020 h o w t o u s e D o c k
0000040 e r , h e a d t o h t t p
0000060 s : / / d o c s . d o c k e r .
0000100 c o m / g o / g u i d e s / \n
0000117
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The DockerCLI interface was repeating the Streams interface. Embed
the interface to make it more transparent that they're the same.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Both the DockerCLI and Cobra Commands provide accessors for Input, Output,
and Error streams (usually STDIN, STDOUT, STDERR). While we were already
passing DockerCLI's Output to Cobra, we were not doing so for the other
streams (and were passing none for plugin commands), potentially resulting
in DockerCLI output/input to mean something else than a Cobra Command's
intput/output/error.
This patch sets them to the same streams when constructing the Cobra
command.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Current versions of the docs generator take this into account, but on
the 20.10 branch, the trailing whitespace can make the YAML generator
switch to use "compact" formatting, which is hard to read, and hard
to review diffs when updating.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Synchronize append on the `removed` slice with mutex because
containerRemoveFunc is called in parallel for each removed container by
`container rm` cli command.
Also reduced the shared access area by separating the scopes of test
cases.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This validator was not specific to "log options", so renaming it to make this
clearer; also updating values used in the tests to make it clear they're not
"actual" valid values, just for testing, and while updating, also fixed some
unhandled errors in tests.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This comment was added in 7929888214
when this code was still in the Moby repository. That comment doesn't appear
to apply to the CLI's usage of this struct though, as nothing in the CLI
sets this field (or uses it), so this should be safe to remove.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I think the cli code block misses a backslash to brevent line break when copy/pasting it to a terminal.
I doubt that this is intentional, if it is, feel free to reject the pr.
Signed-off-by: Julian <gitea+julian@ic.thejulian.uk>
Libtrust was only used for pushing schema 2, v1 images, which is no longer
supported; this TODO was likely left from when the CLI and daemon were
in the same repository.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this change, the error would suggest installing buildx:
echo "FROM scratch" | DOCKER_BUILDKIT=0 docker build -
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
Install the buildx component to build images with BuildKit:
https://docs.docker.com/go/buildx/
...
However, this error would also be shown if buildx is actually installed,
but disabled through "DOCKER_BUILDKIT=0";
docker buildx version
github.com/docker/buildx v0.9.1 ed00243
With this patch, it reports that it's disabled, and how to fix:
echo "FROM scratch" | DOCKER_BUILDKIT=0 docker build -
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
BuildKit is currently disabled; enabled it by removing the DOCKER_BUILDKIT=0
environment-variable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allows us to remove the replace rule, although we probably need to
add it back if we want to update to a newer version from the release
branch (as go mod doesn't support release branches :(( ).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Includes security fixes for net/http (CVE-2022-41717, CVE-2022-41720),
and os (CVE-2022-41720).
These minor releases include 2 security fixes following the security policy:
- os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
The os.DirFS function and http.Dir type provide access to a tree of files
rooted at a given directory. These functions permitted access to Windows
device files under that root. For example, os.DirFS("C:/tmp").Open("COM1")
would open the COM1 device.
Both os.DirFS and http.Dir only provide read-only filesystem access.
In addition, on Windows, an os.DirFS for the directory \(the root of the
current drive) can permit a maliciously crafted path to escape from the
drive and access any path on the system.
The behavior of os.DirFS("") has changed. Previously, an empty root was
treated equivalently to "/", so os.DirFS("").Open("tmp") would open the
path "/tmp". This now returns an error.
This is CVE-2022-41720 and Go issue https://go.dev/issue/56694.
- net/http: limit canonical header cache by bytes, not entries
An attacker can cause excessive memory growth in a Go server accepting
HTTP/2 requests.
HTTP/2 server connections contain a cache of HTTP header keys sent by
the client. While the total number of entries in this cache is capped,
an attacker sending very large keys can cause the server to allocate
approximately 64 MiB per open connection.
This issue is also fixed in golang.org/x/net/http2 vX.Y.Z, for users
manually configuring HTTP/2.
Thanks to Josselin Costanzi for reporting this issue.
This is CVE-2022-41717 and Go issue https://go.dev/issue/56350.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.19.4
And the milestone on the issue tracker:
https://github.com/golang/go/issues?q=milestone%3AGo1.19.4+label%3ACherryPickApproved
Full diff: https://github.com/golang/go/compare/go1.19.3...go1.19.4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
flags.StringVar(&options.name,"name","","Assign a name to the container")
flags.StringVar(&options.pull,"pull",PullImageMissing,`Pull image before creating ("`+PullImageAlways+`"|"`+PullImageMissing+`"|"`+PullImageNever+`")`)
flags.StringVar(&options.pull,"pull",PullImageMissing,`Pull image before creating ("`+PullImageAlways+`", "|`+PullImageMissing+`", "`+PullImageNever+`")`)
flags.BoolVarP(&options.quiet,"quiet","q",false,"Suppress the pull output")
// Add an explicit help that doesn't have a `-h` to prevent the conflict
fmt.Fprintln(cli.Out(),"Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https://hub.docker.com to create one.")
flags.Uint64Var(&opts.maxReplicas,flagMaxReplicas,defaultFlagValues.getUint64(flagMaxReplicas),"Maximum number of tasks per node (default 0 = unlimited)")
flags.StringVar(&opts.restartPolicy.condition,flagRestartCondition,"",flagDesc(flagRestartCondition,`Restart when condition is met ("none"|"on-failure"|"any")`))
flags.StringVar(&opts.restartPolicy.condition,flagRestartCondition,"",flagDesc(flagRestartCondition,`Restart when condition is met ("none", "on-failure", "any")`))
flags.Var(&opts.restartPolicy.delay,flagRestartDelay,flagDesc(flagRestartDelay,"Delay between restart attempts (ns|us|ms|s|m|h)"))
flags.Var(&opts.restartPolicy.maxAttempts,flagRestartMaxAttempts,flagDesc(flagRestartMaxAttempts,"Maximum number of restarts before giving up"))
flags.DurationVar(&opts.update.delay,flagUpdateDelay,0,flagDesc(flagUpdateDelay,"Delay between updates (ns|us|ms|s|m|h)"))
flags.DurationVar(&opts.update.monitor,flagUpdateMonitor,0,flagDesc(flagUpdateMonitor,"Duration after each task update to monitor for failure (ns|us|ms|s|m|h)"))
flags.StringVar(&opts.update.onFailure,flagUpdateFailureAction,"",flagDesc(flagUpdateFailureAction,`Action on update failure ("pause"|"continue"|"rollback")`))
flags.StringVar(&opts.update.onFailure,flagUpdateFailureAction,"",flagDesc(flagUpdateFailureAction,`Action on update failure ("pause", "continue", "rollback")`))
flags.Var(&opts.update.maxFailureRatio,flagUpdateMaxFailureRatio,flagDesc(flagUpdateMaxFailureRatio,"Failure rate to tolerate during an update"))
flags.DurationVar(&opts.rollback.monitor,flagRollbackMonitor,0,flagDesc(flagRollbackMonitor,"Duration after each task rollback to monitor for failure (ns|us|ms|s|m|h)"))
flags.StringVar(&opts.rollback.onFailure,flagRollbackFailureAction,"",flagDesc(flagRollbackFailureAction,`Action on rollback failure ("pause"|"continue")`))
flags.StringVar(&opts.rollback.onFailure,flagRollbackFailureAction,"",flagDesc(flagRollbackFailureAction,`Action on rollback failure ("pause", "continue")`))
flags.Var(&opts.rollback.maxFailureRatio,flagRollbackMaxFailureRatio,flagDesc(flagRollbackMaxFailureRatio,"Failure rate to tolerate during a rollback"))
`Query the registry to resolve image digest and supported platforms ("`+swarm.ResolveImageAlways+`"|"`+swarm.ResolveImageChanged+`"|"`+swarm.ResolveImageNever+`")`)
`Query the registry to resolve image digest and supported platforms ("`+swarm.ResolveImageAlways+`", "`+swarm.ResolveImageChanged+`", "`+swarm.ResolveImageNever+`")`)
flags.Uint32Var(&opts.dataPathPort,flagDataPathPort,0,"Port number to use for data path traffic (1024 - 49151). If no value is set or is set to 0, the default port (4789) is used.")
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
