Based on the discussion, we have changed the following:
1. Send body only if content-type is application/json (based on the
Docker official daemon REST specification, this is the provided for all
APIs that requires authorization.
2. Correctly verify that the msg body is smaller than max cap (this was
the actual bug). Fix includes UT.
3. Minor: Check content length > 0 (it was -1 for load, altough an
attacker can still modify this)
Signed-off-by: Liron Levin <liron@twistlock.com>
Upstream-commit: ca5c2abecfd12ad22b75c69e0debde7b625c2735
Component: engine
Because devices will be bind-mounted instead of using `mknod`, we need
to make sure the source exists and filter the list by only those whose
source is a valid path/current device entry.
Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
Upstream-commit: 9a554e8c37d522ed791b3bb55f9ba9f21e2ac76a
Component: engine
Attempt layer mounts from up to 3 source repositories, possibly
falling back to a standard blob upload for cross repository pushes.
Addresses compatiblity issues with token servers which do not grant
multiple repository scopes, resulting in an authentication failure for
layer mounts, which would otherwise cause the push to terminate with an
error.
Signed-off-by: Brian Bland <brian.bland@docker.com>
Upstream-commit: 1d3480f9ba3525309030497d5c8a3dd5725ed15a
Component: engine
There are five options 'debug' 'labels' 'cluster-store' 'cluster-store-opts'
and 'cluster-advertise' that can be reconfigured, configure any of these
options should not affect other options which may have configured in flags.
But this is not true, for example, I start a daemon with -D to enable the
debugging, and after a while, I want reconfigure the 'label', so I add a file
'/etc/docker/daemon.json' with content '"labels":["test"]' and send SIGHUP to daemon
to reconfigure the daemon, it work, but the debugging of the daemon is also diabled.
I don't think this is a expeted behaviour.
This patch also have some minor refactor of reconfiguration of cluster-advertiser.
Enable user to reconfigure cluster-advertiser without cluster-store in config file
since cluster-store could also be already set in flag, and we only want to reconfigure
the cluster-advertiser.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Upstream-commit: b9366c9609166d41e987608041b5a2079726aa5f
Component: engine
In cases where the a plugin responds with both a null or empty volume
and a null or empty Err, the daemon would panic.
This is because we assumed the idiom if `err` is nil, then `v` must not
be but in reality the plugin may return whatever it wants and we want to
make sure it doesn't harm the daemon.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: 96c79a1934dd52d2a6f648e519b5d4ac60ac8ca1
Component: engine
Just some suggested wording to update this page to take account of User Namespaces being available as of 1.10.
Signed-off-by: Rory McCune <rorym@mccune.org.uk>
Upstream-commit: c1e53ad1aa9d82568efc045444a5df76b1471905
Component: engine
Removing direct dependencies from the server configuration.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 1ba44a832f6aae811dfc6235287dd5b99e8aa94c
Component: engine
We should support update swap memory without memory.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: 8ae6f6ac28c1e9e28c1503b8118691580b66d885
Component: engine
Add a check in `check-config.sh` to see if we are running on a RHEL7 or
CentOS7 system, which may report that CONFIG_USERNS is OK/enabled, but
user namespaces still won't work because of the experimental feature
flag added by Redhat.
This will add a warning if it is actually disabled and notes what has to
be added to the grub/boot command line to enable it.
Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
Upstream-commit: 23551515564b54128e882dda5eae659883947d39
Component: engine
The Releases file(s) and other bits for EOL-ed distros such as Ubuntu
Vivid should remain untouched when we are releasing debs.
However, few files in https://apt.dockerproject.org/repo/dists/ubuntu-vivid/
were being updated for the docker 1.10 release including the Release files.
This is due to apt-ftparchive generating index files for vivid as well,
due to the stale apt-ftparchive.conf
This change always creates config using suites in contrib/reprepro/suites.sh.
Signed-off-by: Anusha Ragunathan <anusha@docker.com>
Upstream-commit: 204c7808f94259a32f1e89c229116977876cbb88
Component: engine
Sebastiaan van Stijn
Vincent Demeester
Cameron Spear
Liron Levin
Phil Estes
John Howard
David Calavera
Brian Bland
Lei Jitang
Jian Zhang
Brian Goff
Arnaud Porterie
Tomasz Kopczynski
Rory McCune
Nakul Pathak
Mike Danese
Alexander Morozov
Antonio Murdaca
Qiang Huang
Anusha Ragunathan
Morgan Bauer