When a container is run on a --attachable network, the endpoint
configs passed by the user were incorrectly overwritten.
Copy the relevant configs instead of overwriting the entire configs.
Signed-off-by: Madhu Venugopal <madhu@docker.com>
Upstream-commit: c5dd4d70c6ea3371d61409112a45c0573280111d
Component: engine
If user namespaces is enabled on the daemon, reveal that via docker info
by adding "userns" to the list of security options reported by the
info endpoint.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
Upstream-commit: ae74092e450f1f2665b90257b65513cc0c19702f
Component: engine
When processing the --userns-remap flag, add the
capability to call out to `getent` if the user and
group information is not found via local file
parsing code already in libcontainer/user.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
Upstream-commit: 6cb8392be9cdc5bf44436a092dd88b39968ffc7d
Component: engine
A HealthConfig entry was added to the ContainerSpec associated with the
service being created or updated.
Signed-off-by: Cezar Sa Espinola <cezarsa@gmail.com>
Upstream-commit: 7bd2611789e6898576f7229255c238f7c1129293
Component: engine
Fixes#27779
Currently `followLogs` can get into a deadlock if we receive an inotify
IN_MODIFY event while we are trying to close the `fileWatcher`. This is
due to the fact that closing the `fileWatcher` happens in the same block
as consumes events from the `fileWatcher`. We are trying to run
`fileWatcher.Close`, which is waiting for an IN_IGNORE event to come in
over inotify to confirm the watch was been removed. But, because an
IN_MODIFY event has appeared after `Close` was entered but before the
IN_IGNORE, the broadcast never comes. The IN_MODIFY cannot be consumed
as the events channel is unbuffered and the only `select` that reads
from it is busy waiting for the IN_IGNORE event.
In order to try and fix this race condition I've moved the removal of
the `fileWatcher` out to a separate go block that waits for a signal to
close, removes the watcher and then signals to the previous selects on
the close signal.
This has introduced a `fileWatcher.Remove` in the final case, but if we
try and remove a watcher that does not exist it will just return an
error saying so. We are not doing any checking on the return of `Remove`
so this shouldn't cause any side-effects.
Signed-off-by: Tom Booth <tombooth@gmail.com>
Upstream-commit: a69a59ffc7e3d028a72d1195c2c1535f447eaa84
Component: engine
Make it possible to use health_status, exec_start and exec_create as
is in event filter. This way, using `health_status` as filter will allow
to get all health_status events (healthy, unhealthy, …) instead of
having to us all combination (`health_status: healthy`, `health_status:
unhealthy`, …). Same goes for `exec_start` and `exec_create`.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: 71d8313ad415b8ec6efff3e88f48b5465f30c9a9
Component: engine
This adds a metrics packages that creates additional metrics. Add the
metrics endpoint to the docker api server under `/metrics`.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Add metrics to daemon package
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
api: use standard way for metrics route
Also add "type" query parameter
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Convert timers to ms
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: 3343d234f3b131d4be1d4ca84385e184633a79bd
Component: engine
This fix tries to address the issue raised in 26341
where multiple addresses in a bridge may cause `--fixed-cidr`
to not have the correct addresses.
The issue is that `netutils.ElectInterfaceAddresses(bridgeName)`
only returns the first IPv4 address.
This fix (together with the PR created in libnetwork )
changes `ElectInterfaceAddresses()` and `addresses()`
so that all IPv4 addresses are returned. This will allow the
possibility of selectively choose the address needed.
In `daemon_unix.go`, bridge address is chosen by comparing with
the `--fixed-cidr` first, thus resolve the issue in 26341.
This fix is tested manually, as is described in 26341:
```
brctl addbr cbr0
ip addr add 10.111.111.111/20 dev cbr0 label cbr0:main
ip addr add 10.222.222.222/12 dev cbr0 label cbr0:docker
ip link set cbr0 up
docker daemon --bridge=cbr0 --iptables=false --ip-masq=false --fixed-cidr=10.222.222.222/24
docker run --rm busybox ip route get 8.8.8.8 | grep -Po 'src.*'
src 10.222.222.0
```
This fix fixes 26341.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: e9c4c513d11e6c3986f8858b9a11535d61cfdf74
Component: engine
`golint` had the following issue when linting this file:
```
daemon/logger/jsonfilelog/read.go:116:10: should omit type io.Reader
from declaration of var rdr; it will be inferred from the right-hand
side
```
In order to keep it happy changing it to an indirect assignment will
still maintain the same functionality.
Signed-off-by: Tom Booth <tombooth@gmail.com>
Upstream-commit: 6314bec641b473571c0160d85bdc70250342185a
Component: engine
containers may specify these cgroup values at runtime. This will allow
processes to change their priority to real-time within the container
when CONFIG_RT_GROUP_SCHED is enabled in the kernel. See #22380.
Also added sanity checks for the new --cpu-rt-runtime and --cpu-rt-period
flags to ensure that that the kernel supports these features and that
runtime is not greater than period.
Daemon will support a --cpu-rt-runtime flag to initialize the parent
cgroup on startup, this prevents the administrator from alotting runtime
to docker after each restart.
There are additional checks that could be added but maybe too far? Check
parent cgroups to ensure values are <= parent, inspecting rtprio ulimit
and issuing a warning.
Signed-off-by: Erik St. Martin <alakriti@gmail.com>
Upstream-commit: 56f77d5ade945b3b8816a6c8acb328b7c6dce9a7
Component: engine
In root case no mount call or reference count
increment actually happens so don’t try to unmount.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: e4349ad90114c741c729046f7749f0c2fde415c9
Component: engine
Even after a slew of PRs, this still wasn't quite right. Now, we ensure
the task name is calculared in one place in the executor, as least.
We'll have to follow this up once the `api/naming` package from SwarmKit
lands.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
Upstream-commit: 3b1af1751897680d32f4685e86d5dd1d9f3720b1
Component: engine
Signed-off-by: Akira Koyasu <mail@akirakoyasu.net>
- add scheme to fluentd-address
- define a new type `location`
- use `errors.Wrapf`
Upstream-commit: cb176c848e0731f77fa48b4e1a90ae74d1f2deae
Component: engine
This fix tries to address the issue raised in 27695 where
duplicate `nat` and `null` has been listed in `docker info`
for Windows.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 3347aba95762955fe17916e8cfc66aabbd6d66d6
Component: engine
If a container sets a stop-signal, taking it into account to disable or
not the restart policy.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Upstream-commit: d2e64247e6dfd3257a7d015890aa2f168ff643a0
Component: engine
Madhu Venugopal
Qiang Huang
Vincent Demeester
Phil Estes
Josh Horwitz
John Howard
Darren Stahl
Michael Crosby
John Howard
Cezar Sa Espinola
boucher
Tom Booth
Akihiro Suda
Sebastiaan van Stijn
Brian Goff
Yong Tang
Erik St. Martin
Tonis Tiigi
Stephen J Day
Alexander Morozov
Akira Koyasu
Antonio Murdaca
Kenfe-Mickael Laventure