From a0a24043be65818d13eff653c63fdede3db3ffd6 Mon Sep 17 00:00:00 2001 From: Daniel Nephin Date: Mon, 5 Feb 2018 16:35:47 -0500 Subject: [PATCH 1/5] Remove broken container check from image prune The imageRefs map was being popualted with containerID, and accessed with an imageID which would never match. Remove this broken code because: 1) it hasn't ever worked so isn't necessary, and 2) because at best it would be racy ImageDelete() should already handle preventing of removal of used images. Signed-off-by: Daniel Nephin Upstream-commit: 3aa4f7f0d71f04c5cc93d5e80cbdd47b0b5fdb7f Component: engine --- components/engine/daemon/prune.go | 38 ++++++++++++++----------------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/components/engine/daemon/prune.go b/components/engine/daemon/prune.go index 7ed73f0594..eee9e106bd 100644 --- a/components/engine/daemon/prune.go +++ b/components/engine/daemon/prune.go @@ -10,6 +10,7 @@ import ( "github.com/docker/docker/api/types" "github.com/docker/docker/api/types/filters" timetypes "github.com/docker/docker/api/types/time" + "github.com/docker/docker/errdefs" "github.com/docker/docker/image" "github.com/docker/docker/layer" "github.com/docker/docker/pkg/directory" @@ -193,16 +194,6 @@ func (daemon *Daemon) ImagesPrune(ctx context.Context, pruneFilters filters.Args } else { allImages = daemon.imageStore.Map() } - allContainers := daemon.List() - imageRefs := map[string]bool{} - for _, c := range allContainers { - select { - case <-ctx.Done(): - return nil, ctx.Err() - default: - imageRefs[c.ID] = true - } - } // Filter intermediary images and get their unique size allLayers := make(map[layer.ChainID]layer.Layer) @@ -242,14 +233,8 @@ deleteImagesLoop: default: } - dgst := digest.Digest(id) - hex := dgst.Hex() - if _, ok := imageRefs[hex]; ok { - continue - } - deletedImages := []types.ImageDeleteResponseItem{} - refs := daemon.referenceStore.References(dgst) + refs := daemon.referenceStore.References(id.Digest()) if len(refs) > 0 { shouldDelete := !danglingOnly if !shouldDelete { @@ -268,17 +253,16 @@ deleteImagesLoop: if shouldDelete { for _, ref := range refs { imgDel, err := daemon.ImageDelete(ref.String(), false, true) - if err != nil { - logrus.Warnf("could not delete reference %s: %v", ref.String(), err) + if imageDeleteFailed(ref.String(), err) { continue } deletedImages = append(deletedImages, imgDel...) } } } else { + hex := id.Digest().Hex() imgDel, err := daemon.ImageDelete(hex, false, true) - if err != nil { - logrus.Warnf("could not delete image %s: %v", hex, err) + if imageDeleteFailed(hex, err) { continue } deletedImages = append(deletedImages, imgDel...) @@ -309,6 +293,18 @@ deleteImagesLoop: return rep, nil } +func imageDeleteFailed(ref string, err error) bool { + switch { + case err == nil: + return false + case errdefs.IsConflict(err): + return true + default: + logrus.Warnf("failed to prune image %s: %v", ref, err) + return true + } +} + // localNetworksPrune removes unused local networks func (daemon *Daemon) localNetworksPrune(ctx context.Context, pruneFilters filters.Args) *types.NetworksPruneReport { rep := &types.NetworksPruneReport{} From 40a7a5b6d7c3553e8145377b878d258e8c261537 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 21 Feb 2018 15:21:48 +0100 Subject: [PATCH 2/5] Bump default API version to 1.37 Signed-off-by: Sebastiaan van Stijn Upstream-commit: 453f2b8b40b923862ce1c08c11531ff5042770f1 Component: engine --- components/engine/api/common.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/engine/api/common.go b/components/engine/api/common.go index 97a92f8b78..beb251a989 100644 --- a/components/engine/api/common.go +++ b/components/engine/api/common.go @@ -3,7 +3,7 @@ package api // import "github.com/docker/docker/api" // Common constants for daemon and client. const ( // DefaultVersion of Current REST API - DefaultVersion string = "1.36" + DefaultVersion string = "1.37" // NoBaseImageSpecifier is the symbol used by the FROM // command to specify that no base image is to be used. From e09ff74ed56aff8bcf6fe33dcc550c15f8c8d53a Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 21 Feb 2018 13:50:48 +0100 Subject: [PATCH 3/5] Adjust minimum API version for templated configs/secrets Also adds a note to the API version history Signed-off-by: Sebastiaan van Stijn Upstream-commit: a3efeaad529b945ce5af78c4b08a6ed47399f8d5 Component: engine --- components/engine/api/server/router/swarm/cluster_routes.go | 4 ++-- components/engine/docs/api/version-history.md | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/components/engine/api/server/router/swarm/cluster_routes.go b/components/engine/api/server/router/swarm/cluster_routes.go index 865ed6add6..6b13bf331d 100644 --- a/components/engine/api/server/router/swarm/cluster_routes.go +++ b/components/engine/api/server/router/swarm/cluster_routes.go @@ -373,7 +373,7 @@ func (sr *swarmRouter) createSecret(ctx context.Context, w http.ResponseWriter, return err } version := httputils.VersionFromContext(ctx) - if secret.Templating != nil && versions.LessThan(version, "1.36") { + if secret.Templating != nil && versions.LessThan(version, "1.37") { return errdefs.InvalidParameter(errors.Errorf("secret templating is not supported on the specified API version: %s", version)) } @@ -445,7 +445,7 @@ func (sr *swarmRouter) createConfig(ctx context.Context, w http.ResponseWriter, } version := httputils.VersionFromContext(ctx) - if config.Templating != nil && versions.LessThan(version, "1.36") { + if config.Templating != nil && versions.LessThan(version, "1.37") { return errdefs.InvalidParameter(errors.Errorf("config templating is not supported on the specified API version: %s", version)) } diff --git a/components/engine/docs/api/version-history.md b/components/engine/docs/api/version-history.md index 3405083776..51111bf061 100644 --- a/components/engine/docs/api/version-history.md +++ b/components/engine/docs/api/version-history.md @@ -18,6 +18,10 @@ keywords: "API, Docker, rcli, REST, documentation" [Docker Engine API v1.37](https://docs.docker.com/engine/api/v1.36/) documentation * `POST /containers/create` and `POST /services/create` now supports exposing SCTP ports. +* `POST /configs/create` and `POST /configs/{id}/create` now accept a `Templating` driver. +* `GET /configs` and `GET /configs/{id}` now return the `Templating` driver of the config. +* `POST /secrets/create` and `POST /secrets/{id}/create` now accept a `Templating` driver. +* `GET /secrets` and `GET /secrets/{id}` now return the `Templating` driver of the secret. ## v1.36 API changes From 87cd2bf7ea33dcdcd52cd736a62f35b83a42e7c7 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Wed, 21 Feb 2018 16:23:34 +0000 Subject: [PATCH 4/5] Add /proc/keys to masked paths This leaks information about keyrings on the host. Keyrings are not namespaced. Signed-off-by: Justin Cormack Upstream-commit: de23cb939858a66829d5b75057c7ac664c5acda5 Component: engine --- components/engine/oci/defaults.go | 1 + 1 file changed, 1 insertion(+) diff --git a/components/engine/oci/defaults.go b/components/engine/oci/defaults.go index 578da3a81b..4145412dd4 100644 --- a/components/engine/oci/defaults.go +++ b/components/engine/oci/defaults.go @@ -115,6 +115,7 @@ func DefaultLinuxSpec() specs.Spec { s.Linux = &specs.Linux{ MaskedPaths: []string{ "/proc/kcore", + "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", From c3a24a0fbd6858f62f4223e605baba682451f539 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 21 Feb 2018 21:12:31 +0100 Subject: [PATCH 5/5] Update authors Signed-off-by: Sebastiaan van Stijn Upstream-commit: fb005971c2bd82de482d1cfe924f2f4ec60c60ae Component: engine --- components/engine/.mailmap | 5 +++++ components/engine/AUTHORS | 11 +++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/components/engine/.mailmap b/components/engine/.mailmap index 4dc2d65f04..828ea78481 100644 --- a/components/engine/.mailmap +++ b/components/engine/.mailmap @@ -177,6 +177,7 @@ Huu Nguyen Hyzhou Zhy Hyzhou Zhy <1187766782@qq.com> Ilya Khlopotov +Ivan Markin Jack Laxson Jacob Atzen Jacob Tomlinson @@ -210,6 +211,7 @@ John Howard (VM) John Howard (VM) John Howard (VM) John Stephens +Jon Surrell Jordan Arentsen Jordan Jennings Jorit Kleine-Möllhoff @@ -379,6 +381,7 @@ Stefan Berger Stefan Berger Stefan J. Wernli Stefan S. +Stephan Spindler Stephen Day Stephen Day Steve Desmond @@ -436,6 +439,8 @@ Vincent Demeester Vishnu Kannan Vladimir Rutsky Walter Stanish +Wang Chao +Wang Chao Wang Guoliang Wang Jie Wang Ping diff --git a/components/engine/AUTHORS b/components/engine/AUTHORS index 84059b7c2e..c5dafd7228 100644 --- a/components/engine/AUTHORS +++ b/components/engine/AUTHORS @@ -374,6 +374,7 @@ Dan Levy Dan McPherson Dan Stine Dan Williams +Dani Louca Daniel Antlinger Daniel Dao Daniel Exner @@ -740,7 +741,7 @@ Isao Jonas Ivan Babrou Ivan Fraixedes Ivan Grcic -Ivan Markin +Ivan Markin J Bruni J. Nunn Jack Danger Canty @@ -886,6 +887,7 @@ John V. Martinez John Warwick John Willis Jon Johnson +Jon Surrell Jon Wedaman Jonas Pfenniger Jonathan A. Sternberg @@ -1161,6 +1163,7 @@ Matt Hoyle Matt McCormick Matt Moore Matt Richardson +Matt Rickard Matt Robenolt Matt Schurenko Matt Williams @@ -1317,6 +1320,7 @@ Nikolay Milovanov Nirmal Mehta Nishant Totla NIWA Hideyuki +Noah Meyerhans Noah Treuhaft noducks Nolan Darilek @@ -1365,6 +1369,7 @@ Paul Nasrat Paul Weaver Paulo Ribeiro Pavel Lobashov +Pavel Pletenev Pavel Pospisil Pavel Sutyrin Pavel Tikhomirov @@ -1642,6 +1647,7 @@ Stefan S. Stefan Scherer Stefan Staudenmeyer Stefan Weil +Stephan Spindler Stephen Crosby Stephen Day Stephen Drake @@ -1823,7 +1829,7 @@ Vojtech Vitek (V-Teq) waitingkuo Walter Leibbrandt Walter Stanish -WANG Chao +Wang Chao Wang Guoliang Wang Jie Wang Long @@ -1834,6 +1840,7 @@ Ward Vandewege WarheadsSE Wayne Chang Wayne Song +Weerasak Chongnguluam Wei Wu Wei-Ting Kuo weiyan