Eric Windisch 793088ed0a Make /proc, /sys, /dev readonly for readonly containers ...

If a container is read-only, also set /proc, /sys,
& /dev to read-only. This should apply to both privileged and
unprivileged containers.

Note that when /dev is read-only, device files may still be
written to. This change will simply prevent the device paths
from being modified, or performing mknod of new devices within
the /dev path.

Tests are included for all cases. Also adds a test to ensure
that /dev/pts is always mounted read/write, even in the case of a
read-write rootfs. The kernel restricts writes here naturally and
bad things will happen if we mount it ro.

Signed-off-by: Eric Windisch <eric@windisch.us>
Upstream-commit: 5400d8873f730e6099d29af49fe45931665c3b49
Component: engine

2015-07-02 19:08:00 +00:00

..

fixtures/https

Move https integration tests as unit tests under client

2015-04-23 15:40:46 +00:00

check_test.go

Remove timer and use -check.v for tests formatting

2015-06-18 14:22:40 -07:00

docker_api_attach_test.go

Fix regression in containers attach/wsattach api, return not found before hijacking

2015-07-01 18:16:17 +02:00

docker_api_containers_test.go

Fix regression in parsing capabilities list when a single string is given

2015-07-01 21:28:02 +02:00

docker_api_exec_resize_test.go

Fixing statusCode checks for sockRequest

2015-04-23 15:35:56 -07:00

docker_api_exec_test.go

Fixing statusCode checks for sockRequest

2015-04-23 15:35:56 -07:00

docker_api_images_test.go

Remove API codepaths < 1.12

2015-05-12 20:09:49 +02:00

docker_api_info_test.go

Fixing statusCode checks for sockRequest

2015-04-23 15:35:56 -07:00

docker_api_inspect_test.go

docker-inspect: Extend docker inspect to export image/container metadata related to graph driver

2015-06-15 14:05:10 -04:00

docker_api_logs_test.go

Delete "defer deleteAllContainers()" from integration-cli

2015-05-22 17:01:52 +08:00

docker_api_network_test.go

register libnetwork API and UI with docker parent chain

2015-06-18 12:07:58 -07:00

docker_api_resize_test.go

Fixing statusCode checks for sockRequest

2015-04-23 15:35:56 -07:00

docker_api_service_test.go

attaching services api and UI chain to docker parent

2015-06-19 09:19:09 -07:00

docker_api_stats_test.go

Stats API to retrieve nw stats from libnetwork

2015-07-01 11:15:16 -07:00

docker_api_test.go

Error out if client API version is too old

2015-06-18 11:03:07 +02:00

docker_api_version_test.go

Fixing statusCode checks for sockRequest

2015-04-23 15:35:56 -07:00

docker_cli_attach_test.go

c.Fatal won't fail and exit test inside a goroutine, errors should be handled outside with a channel

2015-04-29 17:02:22 +02:00

docker_cli_attach_unix_test.go

c.Fatal won't fail and exit test inside a goroutine, errors should be handled outside with a channel

2015-04-29 17:02:22 +02:00

docker_cli_build_test.go

Support downloading remote tarball contexts in builder jobs.

2015-06-19 16:35:00 -03:00

docker_cli_build_unix_test.go

Do not require cgroups capabilities on windows to run the integration tests.

2015-05-29 11:42:40 -07:00

docker_cli_by_digest_test.go

Prevent fallback to v1 registry for digest pulls

2015-05-18 08:26:26 +03:00

docker_cli_commit_test.go

just adding label to whitelist for commit command (Fixes #13738)

2015-06-16 13:59:16 -05:00

docker_cli_config_test.go

Add GOOS in User-Agent

2015-06-04 13:37:41 -07:00

docker_cli_cp_test.go

Merge pull request #13493 from jlhawn/volume_unmount_fix

2015-05-27 08:44:11 -07:00

docker_cli_create_test.go

Move /nat to /pkg/nat

2015-06-30 17:43:17 +01:00

docker_cli_daemon_experimental_test.go

Vendoring in libnetwork for native multihost networking

2015-06-22 04:15:41 -07:00

docker_cli_daemon_test.go

Merge pull request #14294 from mavenugo/bnone

2015-06-30 13:40:52 -07:00

docker_cli_diff_test.go

fixed TestDiffEnsureDockerinitFilesAreIgnored is too long #12672

2015-04-27 13:24:15 -07:00

docker_cli_events_test.go

Default events since to current time

2015-06-10 12:37:40 -04:00

docker_cli_events_unix_test.go

Use suite for integration-cli

2015-04-21 10:28:52 -07:00

docker_cli_exec_test.go

Default process user to container config user.

2015-06-29 12:52:05 -07:00

docker_cli_exec_unix_test.go

reuse same code for setting pipes in run/exec

2015-04-23 21:54:21 +00:00

docker_cli_experimental_test.go

fix experimental version and release script

2015-05-29 10:00:22 -07:00

docker_cli_export_import_test.go

Clean tests from not needed inspect call

2015-05-16 18:12:54 +02:00

docker_cli_help_test.go

api/client: Allow for multi-line usage help

2015-06-10 16:14:45 -07:00

docker_cli_history_test.go

Implement teardown removeAllImages

2015-04-24 10:37:21 -07:00

docker_cli_images_test.go

Implement teardown removeAllImages

2015-04-24 10:37:21 -07:00

docker_cli_import_test.go

work on #11094 allow import from local file

2015-06-20 09:04:43 +02:00

docker_cli_info_test.go

Add suffix to experimental builds version

2015-05-21 16:27:42 -07:00

docker_cli_inspect_test.go

Flag Addition: --type flag added for docker inspect command

2015-07-01 12:14:01 -04:00

docker_cli_kill_test.go

Merge pull request #12371 from rhatdan/kill

2015-06-10 08:32:57 -07:00

docker_cli_links_test.go

Docker integration with libnetwork

2015-05-19 22:40:19 +00:00

docker_cli_login_test.go

Use suite for integration-cli

2015-04-21 10:28:52 -07:00

docker_cli_logs_test.go

Fix goroutine leak on logs -f with no output

2015-06-04 13:56:40 -07:00

docker_cli_nat_test.go

Vendoring in libnetwork to fix #13873.

2015-06-12 04:58:37 -07:00

docker_cli_network_test.go

Support for --publish-service flag in docker run

2015-06-20 11:03:38 -07:00

docker_cli_pause_test.go

Use suite for integration-cli

2015-04-21 10:28:52 -07:00

docker_cli_port_test.go

Add integ test for unpublished ports in ps o/p

2015-06-09 09:40:19 -07:00

docker_cli_proxy_test.go

Implement daemon suite for integration-cli

2015-04-27 15:48:29 -07:00

docker_cli_ps_test.go

Merge pull request #12838 from fntlnz/test-cmd

2015-06-02 14:12:22 -07:00

docker_cli_pull_test.go

Implement DockerRegistrySuite in integration-cli

2015-04-24 14:17:00 -07:00

docker_cli_push_test.go

Finally remove our copy of "archive/tar" now that Go 1.4 is the minimum!

2015-05-01 16:01:10 -06:00

docker_cli_rename_test.go

Fix TestRenameStoppedContainer race

2015-04-23 16:11:46 +02:00

docker_cli_restart_test.go

Use inspectField to simplify code

2015-05-18 10:06:13 +08:00

docker_cli_rm_test.go

a few cleanups for client output

2015-05-05 15:59:17 +08:00

docker_cli_rmi_test.go

Add the expected error verification for TestRmiBlank.

2015-07-01 19:34:43 +08:00

docker_cli_run_test.go

Make /proc, /sys, /dev readonly for readonly containers

2015-07-02 19:08:00 +00:00

docker_cli_run_unix_test.go

Do not require cgroups capabilities on windows to run the integration tests.

2015-05-29 11:42:40 -07:00

docker_cli_save_load_test.go

Clean tests from not needed inspect call

2015-05-16 18:12:54 +02:00

docker_cli_save_load_unix_test.go

Fix kr/pty import path

2015-06-04 09:02:14 -07:00

docker_cli_search_test.go

api/client: Allow for multi-line usage help

2015-06-10 16:14:45 -07:00

docker_cli_service_test.go

Support for --publish-service flag in docker run

2015-06-20 11:03:38 -07:00

docker_cli_start_test.go

Volumes refactor and external plugin implementation.

2015-05-21 20:34:17 -07:00

docker_cli_start_volume_driver_unix_test.go

Plugins JSON spec.

2015-06-29 10:32:18 -07:00

docker_cli_stats_test.go

Add docker stats --no-stream show cpu usage

2015-05-31 01:25:51 +08:00

docker_cli_tag_test.go

Use distribution's ValidateRepositoryName for remote name validation.

2015-06-17 15:15:16 -04:00

docker_cli_top_test.go

Removed deleteContainer calls

2015-05-20 08:38:23 +02:00

docker_cli_version_test.go

Add branch and build time to version

2015-06-22 13:00:27 -07:00

docker_cli_wait_test.go

Use inspectField to simplify code

2015-05-18 10:06:13 +08:00

docker_test_vars_cli.go

integration-cli: add mechanism to skip tests

2015-02-17 00:43:41 -08:00

docker_test_vars_daemon.go

integration-cli: add mechanism to skip tests

2015-02-17 00:43:41 -08:00

docker_test_vars.go

Volumes refactor and external plugin implementation.

2015-05-21 20:34:17 -07:00

docker_utils.go

fix the goroutine leak in the stats API if the container is not running

2015-06-23 19:38:15 +08:00

registry.go

Use suite for integration-cli

2015-04-21 10:28:52 -07:00

requirements_unix.go

Do not require cgroups capabilities on windows to run the integration tests.

2015-05-29 11:42:40 -07:00

requirements.go

integration-cli: Add Tests for IPv6 and Fixed CIDR

2015-06-29 14:45:00 +01:00

test_vars_exec.go

integration-cli: add test requirement ExecSupport

2015-02-20 23:24:30 -08:00

test_vars_noexec.go

integration-cli: add test requirement ExecSupport

2015-02-20 23:24:30 -08:00

test_vars_unix.go

pkg/archive: adjust chmod bits on windows

2015-03-04 14:10:37 -08:00

test_vars_windows.go

Change windows default permissions to 755 not 711, read access for all poses little security risk and prevents breaking existing Dockerfiles

2015-03-20 21:54:33 -07:00

utils.go

Merge pull request #13499 from cpuguy83/fix_stats_unsubscribe

2015-05-27 11:10:36 -04:00