Fixes#20972
Also makes sure there is no check to registry if
no image is found for the prefixed IDs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Upstream-commit: 16e4c4e481aca8d5a99d5a4760b5d27bf5bbb9fd
Component: engine
Fixes#20818
This syscall was blocked as there was some concern that it could be
used to bypass filtering of other syscall arguments. However none of the
potential syscalls where this could be an issue (poll, nanosleep,
clock_nanosleep, futex) are blocked in the default profile anyway.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: 5abd881883883a132f96f8adb1b07b5545af452b
Component: engine
Fixes#20550
This update to libseccomp supports the new versions of socket
system calls that can be called directly rather than via the
socketcall syscall in kernel versions 4.3 or later with new glibc.
Note this library version now supports s390x and ppc64le, so
seccomp can be potentially be enabled for these architectures now.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: 68bda672dc0fb53c5247047104e09c7f8346e24e
Component: engine
Instead of being split between three files, let's let `hack/make/.detect-daemon-osarch` be our single source of truth for multiarch detection/vars. Not only does it make it slightly easier to make sure we change everything properly when these bits have to change, but it also makes it so that all bits of `hack/make.sh` (especially `hack/make/.ensure-frozen-images`) work properly outside the context of the `Makefile` on all platforms.
Signed-off-by: Andrew "Tianon" Page <admwiggin@gmail.com>
Upstream-commit: a667cd88c3dc9262f4ef4e2a317c10f6cdcdf5ae
Component: engine
Going forward, Docker won't use a different default registry on Windows.
This changes Windows to use the standard Docker Hub registry as the
default registry.
There is a plan in place to migrate existing images from the Windows
registry to Hub's normal registry, in advance of the 1.11 release. In
the mean time, images on the Windows registry can be accessed by
prefixing them with `registry-win-tp3.docker.io/`.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 87535ca2e9fee074b4174ecc5b01c91a9e922f54
Component: engine
When I use `docker exec -ti test ls`, I got error:
```
ERRO[0035] Handler for POST /v1.23/exec/9677ecd7aa9de96f8e9e667519ff266ad26a5be80e80021a997fff6084ed6d75/resize returned error: bad file descriptor
```
It's because `POST /exec/<id>/start` and
`POST /exec/<id>/resize` are asynchronous, it is
possible that exec process finishes and ternimal
is closed before resize. Then `console.Fd()` will
get a large invalid number and we got the above
error.
Fix it by adding synchronization between exec and
resize.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Upstream-commit: dc56a76bc9f16b2d57b9d64822e305c1e787fcf0
Component: engine
Add more contrast and change `you` to `I` in pull requests template.
Signed-off-by: Tibor Vass <tibor@docker.com>
Upstream-commit: 8d9396c5f93ff0f8597e07abf88839071999eadf
Component: engine
The version of sed on MacOS X is different then the one on linux. The mac version
requires a parameter for the inline (-i) flag, where this isn't required on linux.
On the mac it thinks the -e flag is the parameter, and it causes the vendoring script
to fail.
This fix adds an empty string '' as a parameter to sed, which works fine on both the
mac and linux versions.
Signed-off-by: Ken Cochrane <kencochrane@gmail.com>
Upstream-commit: 9488696814f481d2b0dce03d77657ec6860b9701
Component: engine
Now what we provide dynamic binaries for all plaforms,
we shouldn't try to run docker without udev sync support.
This change changes the previous warning to an Error,
unless the user explicitly overrides the warning, in
which case they're at their own risk.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: de641715105a116042ad9be5e1b2d1bb2962eb9c
Component: engine
Allowing to set their values in the daemon configuration file.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 59586d02b1cc004f14cd7ff6b454211f562da326
Component: engine
Attach can hang forever if there is no data to send. This PR adds notification
of Attach goroutine about container stop.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: 7bb815e2960c97c5cc0624566ac51581bdd884ab
Component: engine
Docker creates a UTS namespace by default, even with --net=host, so it
is reasonable to let the user set the hostname. Note that --hostname is
forbidden if the user specifies --uts=host.
Closes#12076
Signed-off-by: Jason Heiss <jheiss@aput.net>
Upstream-commit: 3f445e63b4568845f439c5d30a99ba10603b1938
Component: engine
This change centralizes the template manipulation in a single package
and adds basic string functions to their execution.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: 8514880997bd1bc944769dcc41e52307bb01f7ff
Component: engine
Update unit test and documentation to handle the new case where Username
is set to <token> to indicate an identity token is involved.
Change the "Password" field in communications with the credential helper
to "Secret" to make clear it has a more generic purpose.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: ba0aa5311aa27fe77166f03d8bcc0174e2985913
Component: engine
This mechanism exchanges basic auth credentials for an identity token.
The identity token is used going forward to request scoped-down tokens
to use for registry operations.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: a6d0c66b4c923cddeaea09f5b41ad353ea7a9b5f
Component: engine
Use token handler options for initialization.
Update auth endpoint to set identity token in response.
Update credential store to match distribution interface changes.
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Upstream-commit: e896d1d7c4459c4b357efdd780e9fb9dd9bc90e0
Component: engine
Pull in changes for refresh token in the registry client
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Upstream-commit: 5730259f324a59a6dddf63a950ab8eb9cde3ca0c
Component: engine
Dump from 1.10.1 has this fields.
Signed-off-by: Kanstantsin Shautsou <kanstantsin.sha@gmail.com>
Close and carry #20377
Include David's request
Signed-off-by: Mary Anthony <mary@docker.com>
Upstream-commit: 205844875cb848b04fef401d3e7fcc3a8959bba0
Component: engine
On redhat based distribution, checking that USER_NS is compiled in the
kernel is not sufficient, we also have to check that the feature as
been enabled.
With this commit, it is now done by checking the content of
`/sys/module/user_namespace/parameters/enable`.
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
Upstream-commit: 6cbff9505c992bd1e61ea7943737dac04ba665ea
Component: engine
Previously docker used obsolete rfc3164 syslog format for syslog. rfc3164 explicitly
uses semicolon as a separator between 'TAG' and 'Content' section of the log message.
Docker uses semicolon as a separator between image name and version tag.
When {{.ImageName}} was used as a tag expression and contained ":" syslog parser mistreated
"tag" part of the image name as syslog message body, which resulted in incorrect "syslogtag" been reported by syslog
daemon.
Use of rfc5424 log format partually fixes the issue as it does not use semicolon as a separator.
However using default rfc5424 syslog format itroduces backward incompatability because rsyslog template keyword %syslogtag%
is parsed differently. In rfc3164 it uses the "TAG" part reported before the "pid" part. In rfc5424 it uses "appname" part reported
before the pid part, while tag part is introduced by %msgid% part.
For more information on rsyslog configuration properties see: http://www.rsyslog.com/doc/master/configuration/properties.html
Added two options to specify logging in either rfc5424, rfc3164 format or unix format omitting hostname in order to keep backwards compatability with
previous versions.
Signed-off-by: Solganik Alexander <solganik@gmail.com>
Upstream-commit: 1a40dd535fb12cade584f085baa23734e8a9bb0e
Component: engine
In order to solve the issue metioned in https://github.com/docker/docker/issues/18712
it is required to use rfc5424 log formatted message, made available in latest srslog library.
Signed-off-by: Solganik Alexander <solganik@gmail.com>
Upstream-commit: f988741823c1c510e97f2508d6a5bed68f65440a
Component: engine
David Calavera
Tonis Tiigi
Justin Cormack
Tibor Vass
allencloud
Daniel Dao
Tianon Gravi
Brian Goff
Aaron Lehmann
Qiang Huang
Ken Cochrane
Sebastiaan van Stijn
Tibor Vass
Arnaud Porterie
Sebastiaan van Stijn
Alexander Morozov
Alexander Morozov
Dan Walsh
Antonio Murdaca
msabansal
Jason Heiss
Alessandro Boch
Derek McGowan
Kanstantsin Shautsou
Kenfe-Mickael Laventure
Solganik Alexander