This updates containerd to b93a33be39bc4ef0fb00bfcb79147a28c33d9d43
fixing the start sync issues.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: 7db7e046315eed5ccfb3a913b965be4b1a595601
Component: engine
Due to the issue of go-md2man, a numbered list in `man docker login` was not rendered correctly.
a8f937e113
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Upstream-commit: cfe16e0d5b4bb7d1d194553f2a82cc1879d60e6b
Component: engine
We have to wait until runc version (RUNC_COMMIT) is bumped.
Otherwise we get the following error:
oci runtime error: string SCMP_ARCH_S390 is not a valid
arch for seccomp
Fixes: bf2a577c131d899 ("Enable seccomp for s390x")
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Upstream-commit: e6e51d37f7b6509f6422ad97533e9bb581042461
Component: engine
This bumps containerd to cf554d59dd96e459544748290eb9167f4bcde509 and
includes various fixes and updates the grpc package and types generated
for use.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: d17b9f3da064f4c7e70867be5e64d06b127df301
Component: engine
To implement seccomp for s390x the following changes are required:
1) seccomp_default: Add s390 compat mode
On s390x (64 bit) we can run s390 (32 bit) programs in 32 bit
compat mode. Therefore add this information to arches().
2) seccomp_default: Use correct flags parameter for sys_clone on s390x
On s390x the second parameter for the clone system call is the flags
parameter. On all other architectures it is the first one.
See kernel code kernel/fork.c:
#elif defined(CONFIG_CLONE_BACKWARDS2)
SYSCALL_DEFINE5(clone, unsigned long, newsp, unsigned long, clone_flags,
int __user *, parent_tidptr,
So fix the docker default seccomp rule and check for the second
parameter on s390/s390x.
3) seccomp_default: Add s390 specific syscalls
For s390 we currently have three additional system calls that should
be added to the seccomp whitelist:
- Other architectures can read/write unprivileged from/to PCI MMIO memory.
On s390 the instructions are privileged and therefore we need system
calls for that purpose:
* s390_pci_mmio_write()
* s390_pci_mmio_read()
- Runtime instrumentation:
* s390_runtime_instr()
4) test_integration: Do not run seccomp default profile test on s390x
The generated profile that we check in is for amd64 and i386
architectures and does not work correctly on s390x.
See also: 75385dc216e ("Do not run the seccomp tests that use
default.json on non x86 architectures")
5) Dockerfile.s390x: Add "seccomp" to DOCKER_BUILDTAGS
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Upstream-commit: bf2a577c131d8998eb6ecac986d80e1289e6c801
Component: engine
Pull request #22840 and commit 40b21745cc ("Upgrade to golang 1.6.2")
introduces gcc 6.1 for Dockerfile.gccgo and Dockerfile.ppc64le.
So do this also for s390x and use "s390x/gcc:6.1" as base image.
In addition to this use "GO15VENDOREXPERIMENT=0" for notary build
as a workaround for:
* golang/go#15814
* golang/go#15628
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Upstream-commit: b5490d48979c3afa29d50dc8527aa6579cd1e634
Component: engine
is still on the Go 1.4 library, whereas the Notary Yubikey library needs interfaces from
Go 1.5
Signed-off-by: cyli <cyli@twistedmatrix.com>
Upstream-commit: 4710ed6304b8456060f4cb4401b2ed47343991e4
Component: engine
The runc compile currently fails on s390x:
Step 35 : RUN set -x && export GOPATH="$(mktemp -d)" && git clone
https://github.com/opencontainers/runc.git
"$GOPATH/src/github.com/opencontainers/runc" && cd
"$GOPATH/src/github.com/opencontainers/runc" && git checkout -q
"$RUNC_COMMIT" && make static BUILDTAGS="seccomp apparmor selinux" &&
cp runc /usr/local/bin/docker-runc
[snip]
# github.com/seccomp/libseccomp-golang
Godeps/_workspace/src/github.com/seccomp/libseccomp-golang/seccomp.go:25:22:
fatal error: seccomp.h: No such file or directory
// #include <seccomp.h>
The problem is that the installed libseccomp version in trusty is too old.
Fix this and install version 2.3.0 of libseccomp like it is done in the
x86 Dockerfile.
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Upstream-commit: 97f45bd629fa3e5921c5a70f3e8087c1afbb07a6
Component: engine
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Set up the mount label in the spec for a container
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Upstream-commit: e0f98c698b49e3790fe63bff611eeda6f5b46055
Component: engine
This change adds file version information to docker.exe and dockerd.exe by
adding a Windows version resource with the windres tool.
This change adds a dependency to binutils-mingw-w64 on Linux, but removes
a dependency on rsrc. Most Windows build environments should already have
windres if they have gcc (which is necessary to build dockerd).
Signed-off-by: John Starks <jostarks@microsoft.com>
Upstream-commit: 4677f8036e8d090303ef76cbbe4f703d5c85d752
Component: engine
With gcc 5 version 1.4.2 of go is included. This version does not support
go's "native vendoring" which is needed to build notary since git commit
51dc1747e4ab5 ("Move the godeps workspace to the vendor directory to be
compliant with Go 1.6").
As a workaround create a symlink "vendor/src" that points to "vendor/".
This allows to compile notary with gcc 5.
Closes#22007
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Upstream-commit: 241898d136e41f80ab2dda95078f971a8248675d
Component: engine
This vendors in new spec/runc that supports
setting readonly and masked paths in the
configuration. Using this allows us to make an
exception for `—-privileged`.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 3f81b4935292d5daedea9de4e2db0895986115da
Component: engine
This includes fixes for;
- outputing errors for missing seccomp options on seccomp versions < 2.3
- cap set apply EPERM errors on ARM systems
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 752b31d3fe6fcbea9e14247c3896334734eba7f2
Component: engine
runc expects a systemd cgroupsPath to be in slice:scopePrefix:containerName
format and the "--systemd-cgroup" option to be set. Update docker accordingly.
Fixes 21475
Signed-off-by: Anusha Ragunathan <anusha@docker.com>
Upstream-commit: 7ed3d265a4499ec03f10537fea0aac3ebaa0cec6
Component: engine
To not hit the issue with the request Host header.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 3e0bd74a3d2647fa8c7783f4a053ad225746e6eb
Component: engine
Contains fixes for:
- pid.max fix that is causing hang on network stats test.
- fix for early stdin close containerd-shim
- better logging for `could not synchronise with container process`
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 22d997b3745e278d5a2b0b85d56c0d2b166e3a74
Component: engine
Fixes broken-pipe issue when piping s3cmd to grep -q, by removing the -q
flag and redirecting to /dev/null instead.
Add net-tools for ifconfig, because some tests rely on ifconfig.
Harmonize all Dockerfiles in this direction.
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: f27b5dda4afc0b0a278eb5379d17dfc3533c5397
Component: engine
