The engine policy will now only complain
as a temporary measure to ensure we do not
cause breakages while users exercise this
policy.
This is NOT the policy for containers, but
for the newly-introduced policy for the
daemon itself.
Signed-off-by: Eric Windisch <eric@windisch.us>
Upstream-commit: 6c887be76951e802900a07e16aeaf0a079ac4534
Component: engine
Implements the policies for the remaining binaries
called by the Docker engine and eliminates the
giant whitelisted 'all files' permission in favor
of granular whitelisting and child-specific policies.
It should be possible now to remove the 'file' permission,
but for the sake of keeping Docker unbroken, we'll try
to gradually tighten the policy.
Signed-off-by: Eric Windisch <eric@windisch.us>
Upstream-commit: 8b2fcddcd251e58473abf6c4949573e03f44bb96
Component: engine
Will attempt to load profiles automatically. If loading fails
but the profiles are already loaded, execution will continue.
A hard failure will only occur if Docker cannot load
the profiles *and* they have not already been loaded via
some other means.
Also introduces documentation for AppArmor.
Signed-off-by: Eric Windisch <eric@windisch.us>
Upstream-commit: 3edc88f76df6a3bc9d887de8157ec71730c9057a
Component: engine
Use our goroutine-safe random source.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 40ea67a5962d5e47f883421a637c93b888206677
Component: engine
The `ApplyDiff` function takes a tar archive stream that is
automagically decompressed later. This was causing a double
decompression, and when the layer was empty, that causes an early EOF.
Signed-off-by: Vincent Batts <vbatts@redhat.com>
Upstream-commit: 273f50c741e82a0be3e9f9d4c975cc18801dfe38
Component: engine
In `ApplyLayer` and `Untar`, the stream is magically decompressed. Since
this is not able to be toggled, rather than break this ./pkg/ API, add
an `ApplyUncompressedLayer` and `UntarUncompressed` that does not
magically decompress the layer stream.
Signed-off-by: Vincent Batts <vbatts@redhat.com>
Upstream-commit: 56bf275e32fc27bd31c5dba6b715336b43981695
Component: engine
Return an error when the container is stopped only in api versions
equal or greater than 1.20 (docker 1.8).
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 621e3d8587bbee86b4e36d0b7822662bfbedd76c
Component: engine
Options for zfs storage driver were incorrectly placed
under 'exec driver options' header. Move the header to
the correct place.
Now, this is the second time I am fixing this. First time
it was commit 68efb27, but the following commit 9af7afb
screwed it up again, so the header appears twice now.
Get rid of the the wrong one.
Cc: David Calavera <david.calavera@gmail.com>
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Upstream-commit: f52514a03888441a51aac677054958516b2ae43f
Component: engine
Currently login and search do not load per registry certificates.
This is a regression caused by the last refactor since this was recently fixed.
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Upstream-commit: e863a07b89599fd4a03d34491d67c09c6bc84444
Component: engine
daemon_test.go supposted to be unit test for daemon, so
don't see reason why we need another daemon_unit_test.go.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: ada852aa701e1ba34fd29589401b114309a2f74f
Component: engine
- boot2docker is deprecated in the 1.8.0
- docker-machine replaces it
- this fixes#14563
- Updating with thaJetzah comments
Signed-off-by: Mary Anthony <mary@docker.com>
Upstream-commit: 1825e06944db20ec677aa8d26b36e9036b0dd257
Component: engine
Actually determine the relative path of the Dockerfile to the context
directory. Error out if the relative path starts with "../".
Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Upstream-commit: af06d289e4300f3b86ec9deba7280c3c37fa4e05
Component: engine
I think it was original intention, because even half of a comment was about
MaxInt32.
Fix#15038
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: eb45602d2fa0fac8a694d2afb1c59ef60b0e1f77
Component: engine
Jay Kamat
root
Eric Windisch
David Calavera
Alexander Morozov
Vincent Batts
Sebastiaan van Stijn
Chander G
Jessie Frazelle
Kir Kolyshkin
Morgan Bauer
Derek McGowan
John Howard
Félix Cantournet
Ed Costello
Qiang Huang
Srini Brahmaroutu
Mary Anthony
Aaron Lehmann
David Cramer
Jessica Frazelle
Chris Seto
Josh Hawn
Michael Crosby
Alexander Morozov