Commit Graph

10820 Commits

Author SHA1 Message Date
879acd15ff Merge pull request #5911 from thaJeztah/builder_nits
cli/command/image: fix some minor linting issues
2025-03-10 16:12:24 +01:00
a07391c65d Merge pull request #5906 from thaJeztah/remove_client_warnings
fix duplicate warnings on docker run / docker create, and slight refactor
2025-03-10 16:03:38 +01:00
650b45a42a Merge pull request #5915 from thaJeztah/remove_StringSliceReplaceAt
cli/command: remove StringSliceReplaceAt utility
2025-03-10 13:37:31 +01:00
bc57a035c4 Merge pull request #5916 from thaJeztah/move_command_prettyprint
cli/command: move PrettyPrint utility to cli/command/formatter
2025-03-10 13:35:03 +01:00
a390a32da1 Merge pull request #5917 from thaJeztah/prunefilters_shallow_interface
cli/command: PruneFilters: require smaller interface
2025-03-10 13:33:00 +01:00
70bf6cb7c5 Merge pull request #5863 from Benehiko/only-experimental-workflow
workflow/e2e: only run experimental daemon
2025-03-10 13:32:13 +01:00
e9cf371b56 Merge pull request #5913 from thaJeztah/image_load_cleanup
image load: combine checks to a single switch
2025-03-10 11:54:30 +00:00
c26090bd3e workflow/e2e: only run experimental daemon
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
2025-03-10 12:26:20 +01:00
7ec69def79 Merge pull request #5904 from thaJeztah/cleanup_buildtags
remove legacy build-tags
2025-03-10 11:41:58 +01:00
d2b751ce58 cli/command: PruneFilters: require smaller interface
This function only needs access to the CLI's configfile; use the
config.Prider interface to be more clear on what's expected.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-09 22:30:05 +01:00
a5ec6c2963 cli/command: remove StringSliceReplaceAt utility
It was only used internally in cmd/docker and has no known external
consumers. Move it to cmd/docker and un-export it.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-09 22:22:29 +01:00
ce3090ccc4 cli/command: move PrettyPrint utility to cli/command/formatter
This utility was only used internally, and has no external consumers;
move it to the "formatter" package, which is also imported in all files
using this utility.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-09 22:20:12 +01:00
802d8e801a image load: combine checks to a single switch
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-09 14:43:57 +01:00
2c0f9f476d cli/command/image: explicitly ignore some unhandled errs
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 22:47:56 +01:00
e73fb7d2f6 cli/command/image: rename var that shadowed type
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 22:43:21 +01:00
bc90bb6855 container create: combine client-side warning with daemon-side
Use a consistent approach for producing warnings, but add a TODO for moving
this warning to the daemon, which can make a better call if it will work
or not (depending on networking mode).

This warning was originally added in [moby@afa92a9], before integration with
libnetwork, and this warning may be incorrect in many scenarios.

While updating, also removing the custom regular expression used to
detect if the IP is a loopback address, and using go's netip package
instead.

[moby@afa92a9]: afa92a9af0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 16:15:50 +01:00
58a35692d6 remove duplicate --oom-kill-disable warnings on docker run / docker create
This warning was originally added in [moby@3aa70c1], and moved to be printed
on both `run` and `create` in commit 7c514a31c9.

However, [moby@57f1305] (docker 19.03, API 1.40) moved such warnings to
the daemon side. The patch mentioned this issue:

> This patch will have one side-effect; docker cli's that also perform this check
> client-side will print the warning twice; this can be addressed by disabling
> the cli-side check for newer API versions, but will generate a bit of extra
> noise when using an older CLI.

The CLI does not take this into account currently, and still prints warnings
twice; even in cases where the option is not supported by the daemon, and
discarded:

On a host without OomKillDisable support:

    docker create --oom-kill-disable alpine
    WARNING: Disabling the OOM killer on containers without setting a '-m/--memory' limit may be dangerous.
    WARNING: Your kernel does not support OomKillDisable. OomKillDisable discarded.

On a host that supports it:

    docker create --oom-kill-disable alpine
    WARNING: Disabling the OOM killer on containers without setting a '-m/--memory' limit may be dangerous.
    WARNING: OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.

This patch removes the client-side warning, leaving it to the daemon to
report if any warnings should produced (and the client to print them).

With this patch applied:

On a host without OomKillDisable support:

    docker create --oom-kill-disable alpine
    WARNING: Your kernel does not support OomKillDisable. OomKillDisable discarded.

On a host that supports it:

    docker create --oom-kill-disable alpine
    WARNING: OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.

[moby@3aa70c1]: 3aa70c1948
[moby@57f1305]: 57f1305e74

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 15:39:21 +01:00
f6d49e9ca4 docs: remove legacy build-tags
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 12:47:19 +01:00
46caf5697c remove legacy build-tags
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-08 12:47:03 +01:00
2eec74659e Merge pull request #5901 from NinaLua/master
chore: make function comment match function name
2025-03-07 20:42:38 +01:00
e201b4e8a5 Merge pull request #5902 from thaJeztah/cli_plugin_metadata
move cli-plugins metadata types/consts to a separate package
2025-03-07 19:13:02 +01:00
292713c887 move cli-plugins annotation consts to a separate package
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-07 12:46:11 +01:00
4321293972 move cli-plugins metadata types/consts to a separate package
This prevents cli-plugins having to import the plugin-manager.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-07 12:38:06 +01:00
aa66f07a3e chore: make function comment match function name
Signed-off-by: NinaLua <iturf@sina.cn>
2025-03-07 14:21:27 +08:00
ceef542046 Merge pull request #5894 from thaJeztah/more_internalize
move some trust-related code to trust package
2025-03-06 18:10:20 +01:00
f9b3c8ce10 Merge pull request #5875 from thaJeztah/bump_creds_helper_0.9.0
vendor: github.com/docker/docker-credential-helpers v0.9.2
2025-03-06 00:34:34 +01:00
b2a669fb56 vendor: github.com/docker/docker-credential-helpers v0.9.2
full diff: https://github.com/docker/docker-credential-helpers/compare/v0.8.2...v0.9.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 22:38:56 +01:00
e37d814ce9 cli/command/image: deprecate TagTrusted, move to cli/trust
This function was shared between "image" and "container" packages,
all of which needed the trust package, so move it there instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 21:36:53 +01:00
d80436021c cli/command/image: deprecate PushTrustedReference, move to trust
This function was shared between "trust" "image" and "plugin" packages,
all of which needed the trust package, so move it there instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 18:29:12 +01:00
c6f456bc90 cli/command/image: deprecate and internalize TrustedPush
This function was only used by "docker trust sign"; inline the code
and deprecate the function.

This function has no known external consumers, so we should remove
it on the first possible ocassion (which could be a minor release).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 18:29:08 +01:00
e558b915c2 Merge pull request #5892 from thaJeztah/pluginmanager_smaller_interface
cli-plugins/manager: use shallower interface
2025-03-05 13:18:57 +01:00
a9e530999e Merge pull request #5893 from thaJeztah/hooks_optim
small performance optimizations for running hooks
2025-03-05 12:59:04 +01:00
a89a15a85c Merge pull request #5890 from vvoland/update-go
update to go1.23.7
2025-03-05 12:56:31 +01:00
4be2ddedd3 cli/command: Cli: embed config.Provider interface
Makes sure we implement that interface, and don't diverge.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 12:05:56 +01:00
8dcde50b6e cli-plugins/manager: use shallower interface
The manager only requires the CLI's configuration; define a shallow interface
for this so that we don't have to import cli/command.

In addition to the CLI's configuration, `runHooks` also used the CLI's configured
StdErr output. We set the Cobra input and output streams to be the same as the
DockerCLI outputs in [newDockerCommand] and [newPluginCommand], so we can
get this from the Cobra command.

[newDockerCommand]: ea1f10b440/cmd/docker/docker.go (L148-L150)
[newPluginCommand]: ea1f10b440/cli-plugins/plugin/plugin.go (L166-L168)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 12:04:49 +01:00
6d551e0a5a cli/command: DockerCli.HooksEnabled check current before legacy
The DOCKER_CLI_HINTS env-var is replaced by DOCKER_CLI_HOOKS; check the
new env-var first, and only fall back to checking the legacy env-var
if it's not set.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 11:52:01 +01:00
a2d78071c1 cmd/docker: small performance optimizations for running hooks
Order conditions to check for lightweight ones first;

- checck if the command is not nil
- dockerCli.Out().IsTerminal() is a lightweight getter
- dockerCli.HooksEnabled() checks for env-vars, parses booleans, and
  reading the CLI config-file

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-05 11:51:58 +01:00
df209212cf update to go1.23.7
- https://github.com/golang/go/issues?q=milestone%3AGo1.23.7+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.23.6...go1.23.7

These minor releases include 1 security fixes following the security policy:

net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs

Matching of hosts against proxy patterns could improperly treat an IPv6
zone ID as a hostname component. For example, when the NO_PROXY
environment variable was set to "*.example.com", a request to
"[::1%25.example.com]:80` would incorrectly match and not be proxied.

Thanks to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2025-22870 and Go issue https://go.dev/issue/71984.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.23.7

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-03-04 22:59:28 +01:00
ea1f10b440 Merge pull request #5889 from thaJeztah/internalize_manifest
cli/command: deprecate Cli.ManifestStore, Cli.RegistryClient
2025-03-04 20:31:55 +01:00
7bcbe0837b Merge pull request #5888 from thaJeztah/command_no_go_connections
cli/command: remove direct import of docker/go-connections
2025-03-04 20:30:53 +01:00
0b985e74f1 Merge pull request #5881 from thaJeztah/cleanup_otel
cli/command: un-export ResourceAttributesEnvvar, DockerCliAttributePrefix
2025-03-04 18:14:50 +01:00
95ac11e714 cli/command: remove direct import of docker/go-connections
It was only used to check if the value was nil; pass a boolean instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 18:00:58 +01:00
8ad07217dc cli/command: deprecate Cli.RegistryClient
This method was a shallow wrapper around registryclient.NewRegistryClient but
due to its signature resulted in various dependencies becoming a dependency
of the "command" package. Consequence of this was that cli-plugins, which
need the cli/command package, would also get those dependencies. It is no
longer used in our code, which constructs the client in packages that need it,
so we can deprecate this method.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:48:43 +01:00
e32d5d56f5 cli/command: deprecate Cli.ManifestStore
This method is a shallow wrapper around manifeststore.NewStore, but
due to its signature resulted in various dependencies becoming a dependency
of the "command" package. Consequence of this was that cli-plugins, which
need the cli/command package, would also get those dependencies. It is no
longer used in our code, which constructs the client in packages that need it,
so we can deprecate this method.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:48:43 +01:00
985b58e7e1 cli/command: internalize constructing RegistryClient
The CLI.RegistryClient method is a shallow wrapper around registryclient.NewRegistryClient
but due to its signature resulted in various dependencies becoming a dependency
of the "command" package. Consequence of this was that cli-plugins, which
need the cli/command package, would also get those dependencies.

This patch inlines the code where needed, skipping the wrapper

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:48:42 +01:00
3b5dff2783 cli/command: internalize constructing ManifestStore
The CLI.ManifestStore method is a shallow wrapper around manifeststore.NewStore
and has no dependency on the CLI itself. However, due to its signature resulted
in various dependencies becoming a dependency of the "command" package.
Consequence of this was that cli-plugins, which need the cli/command package,
would also get those dependencies.

- This patch inlines the code to produce the store, skipping the wrapper.
- Define a local interface for some tests where a dummy store was used.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:48:42 +01:00
c775585e6c Merge pull request #5885 from thaJeztah/internalize_notaryclient
cli/command: internalize and deprecate Cli.NotaryClient
2025-03-04 17:48:17 +01:00
9bc16bbde0 cli/command: deprecate Cli.NotaryClient
This method is a shallow wrapper around trust.GetNotaryRepository, but
due to its signature resulted in the trust package, and notary dependencies
to become a dependency of the CLI. Consequence of this was that cli-plugins,
which need the cli/command package, would also get notary and its
dependencies as a dependency. It is no longer used in our code, which
constructs the client in packages that need it, so we can deprecate this
method.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:40:08 +01:00
2793731977 cli/command: internalize constructing Notary client
The CLI.NotaryClient method is a shallow wrapper around trust.GetNotaryRepository
and only depends on the CLI itself to pass its StdErr/StrOut streams.

- This patch inlines the code to produce the client, skipping the wrapper.
- Define a local interface for some tests where a dummy notary client was used.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-03-04 17:40:06 +01:00
539f6de682 Merge pull request #5887 from thaJeztah/gha_bump_ubuntu
gha: validate-pr: update to ubuntu 24.04
2025-03-04 17:39:16 +01:00