Only open_by_handle_at requires CAP_DAC_READ_SEARCH.
This allows systemd to run with only `--cap-add SYS_ADMIN`
rather than having to also add `--cap-add DAC_READ_SEARCH`
as well which it does not really need.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: c1ca124682a90f3306b34ad104ba80e413f7bf88
Component: engine
New codes introduced a new method to wait container's exit code and
removal via Events API, but it specified a "since" filter based on
client side clock, which sometimes isn't synced up with daemon's clock,
hence leads the client to hang on waiting container's exit status.
This commit brings the Events call before start, and removes the time
filter, so that it can catch daemon events correctly without care of the
clock issue.
Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: a422813113b3b9a14184766f7f0977ccaaeb661b
Component: engine
This fix tries to address the issue raised in 25529 wehre the
image/load API returns `application/json` for quiet=0 and
`text/plain` for quite=1.
This fix makes the change so that `application/json` is returned
for both quiet=0 and quite=1.
This fix has been tested manually.
This fix fixes 25529.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 2f27632cde2f0e514bd3a8de77cc1934e5193a83
Component: engine
In cases there are failures in task start, swarmkit might be trying to
restart the task again in the same node which might keep failing. This
creates a race where when a failed task is getting removed it might
remove the associated network while another task for the same service
or a different service but connected to the same network is proceeding
with starting the container knowing that the network is still
present. Fix this by reacting to `ErrNoSuchNetwork` error during
container start by trying to recreate the managed networks. If they
have been removed it will be recreated. If they are already present
nothing bad will happen.
Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
Upstream-commit: 117cef5e9766d6ba228770c225e816c6afd16ff8
Component: engine
Fixes case where shutdown occurs before content is synced to disked
on layer creation. This case can leave the layer store in an bad
state and require manual recovery. This change ensures all files
are synced to disk before a layer is committed. Any shutdown that
occurs will only cause the layer to not show up but will allow it to
be repulled or recreated without error.
Added generic io logic to ioutils package to abstract it out of
the layer store package.
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
Upstream-commit: c37bd10f8cfc4cb6df5513881eed53e6c5f0be09
Component: engine
commit 41d580c7a610d8111dc63353cbd94319ca854627 added
"Joined at" to the output of node inspect,
but I forgot that docs changes are needed.
This change updates the example output
of node inspect in the documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: dcb052c12bf6e67184d0cb6a69daf39c25666cfe
Component: engine
Progress reporting during image load was added
in 415dd8688618ac2b3872c6a5b5af3afcef2c3e10, but
the corresponding query-parameter was not documented
in the API docs.
This updates the API docs, and adds a response example
both with quiet enabled and disabled.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: d13ed38471decb332e9a0872854a97730d548583
Component: engine
Without a content-type header, Go uses a max post size
of 10 megabytes, which makes loading images fail
if they're larger than 10 megabytes
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 3892ac7e9418547785c36c91c3fb49a9c876c4b1
Component: engine
This fix tries to address the issue in 25404 where updating environmental
variable in `service update --env-add` will not work.
The issue is because `--env-add` will only append the env, not update if
the same env already exist.
This fix tracks the env variable with a map and update if the variable
is the same.
An integration test has been added.
This fix fixes 25404.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: c6de8add5fd5443aa820adbcd3c9a438df78823f
Component: engine
Fixes an issue that showed up on gccgo.
Fix#25360
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: e4402b285ba0a764ea1cffc1487c92b05b59a0ea
Component: engine
This change allows btrfs subvolumes to be found in additional system
configurations. The old logic failed to correctly identify subvolumes
when the root fs was mounted as a subvolume that was not the btrfs
filesystem root.
Signed-off-by: Adam Mills <adam@armills.info>
Upstream-commit: c3aa75c5a73bed12f44d863618cabef780f5f5bd
Component: engine
The error message suggests you need one argument even when you
have provided one. Suggest having another argument.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: 4ce93940b7c2a640c94296f20352cf6f052d1028
Component: engine
Unlike `docker run -v..`, `docker service create --mount`
does not allow bind-mounting non-existing host paths.
This adds validation for the specified `source`, and
produces an error if the path is not found on the
host.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 84d5ab96ef33355e65f5c31210eb1777db372c52
Component: engine
Before this, container's auto-removal after exit is done in a goroutine,
this commit will get ContainerRm out of the goroutine.
Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
Upstream-commit: 1537dbe2d617013c94aa42c28744feb07a09fb63
Component: engine
Vincent Demeester
Justin Cormack
lixiaobing10051267
mgniu
Sebastiaan van Stijn
Shukui Yang
Zhang Wei
Yong Tang
allencloud
Jana Radhakrishnan
Alexander Morozov
Derek McGowan
Victor Vieux
Brian Goff
Sebastiaan van Stijn
yuexiao-wang
unclejack
Diogo Monica
John Howard
Charles Smith
Darren Stahl
Alexander Morozov
Adam Mills