To ensure manifest integrity when pulling by digest, this changeset ensures
that not only the remote digest provided by the registry is verified but also
that the digest provided on the command line is checked, as well. If this check
fails, the pull is cancelled as with an error. Inspection also should that
while layers were being verified against their digests, the error was being
treated as tech preview image signing verification error. This, in fact, is not
a tech preview and opens up the docker daemon to man in the middle attacks that
can be avoided with the v2 registry protocol.
As a matter of cleanliness, the digest package from the distribution project
has been updated to latest version. There were some recent improvements in the
digest package.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
Upstream-commit: 06612cc0fee103bf6f46429e3cd572725ef72948
Component: engine
This version brings in upto-date important bug-fixes from libnetwork
Signed-off-by: Madhu Venugopal <madhu@docker.com>
Upstream-commit: a3d22c764cfc3e175cdfb992f3b2314f23540236
Component: engine
If a container was started with a non-root user the container
may not be able to resolve DNS names because of too restrictive
permission in the /etc/resolv.conf container file. This problem
is in how this file gets created in libnetwork and ths PR
attempts to fix the issue by vendoring in the libnetwork code
with the fix.
Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
Upstream-commit: afd901e408d8d4ed00707c545ae985bc637a1979
Component: engine
It adds List function for listing all supported caps
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: 5a2d592c27e93cf7f3d01216cf6e22656330fe84
Component: engine
Previously, we've taken advantage of the fact that libcontainer's `update-vendor.sh` is the same syntax as Docker's `vendor.sh` with some shell magic. This changes that to copy libcontainer's dependencies into this file explicitly so that we can scale to more projects with varying methods of vendoring (assuming they don't use import re-writing, which screws up everyone).
We'll need to stay diligent in making sure this list matches what's in libcontainer's `update-vendor.sh` (minus the not-required codegangsta/cli dep), but that's a fair trade-off for being able to scale our dependency model better (and track new discrete dependencies more directly).
Signed-off-by: Andrew "Tianon" Page <admwiggin@gmail.com>
Upstream-commit: b919dee8347a47763d576136254bcbc922ef4c57
Component: engine
To help avoid version mismatches between libcontainer and Docker, this updates libcontainer to be the source of truth for which version of logrus the project is using. This should help avoid potential incompatibilities in the future, too. 👍
Signed-off-by: Andrew "Tianon" Page <admwiggin@gmail.com>
Upstream-commit: 80a895142e7101b44ff71910bb2da994b1cc4f5f
Component: engine
This includes a fix for the minor v2 API change introduced by 341a37095f. 👍
Signed-off-by: Andrew "Tianon" Page <admwiggin@gmail.com>
Upstream-commit: b447fef7ecb740bc0f9ece75e10926fc5f121b5c
Component: engine
Changes relevant for Docker since 0.6.6 are (most other changes are hooks and
options for formatters):
* Debugging color output changed to gray.
* Don't quote the number 9 when it's by it self (i.e. `omg=9` instead of
`omg="8"`, this was the case for all other numbers)
* Performance is better when running a high logging level with lots of low-level
logging.
* Minor internal refactoring and more tests.
Signed-off-by: Simon Eskildsen <sirup@sirupsen.com>
Upstream-commit: 3a33bff7fdd96705e761bb1f1750cfa6f4df4070
Component: engine
This addresses a subtle deadlock where an error during a copy prevented pipe
closure to propagate correctly. By closing down the read end of the pipe rather
than the write end, the waiting writer is properly signaled. A nice side-effect
of this change is that errors encountered by io.Copy are now propagated to the
verifier's Write method.
A test to ensure validation errors for unsupported digest types has been added,
as well.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
Upstream-commit: 0306a41909175b467d08ebc97d4c5136ca9e7ebd
Component: engine
It includes fixes to selinux Getfilecon, mounting sysfs and cgroups.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Upstream-commit: 591f821aee9e1d59ec3c619e15344c90047463d6
Component: engine
- Use `%v` verb to format errors.
- Give `param` constant in portallocator some better name.
Signed-off-by: Michal Minar <miminar@redhat.com>
Upstream-commit: 210ab030bc3dab7bcf8f7252f2f9facb5a26cb6b
Component: engine
It includes new Type() method for Factory, which needed for replacing
execdriver.Driver.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: eade8eac09ad8cfdaf762e88d382daf6017201d7
Component: engine
Includes mqueue label fix and cgroups improvements.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: c553be5a4f3ff24079337e2ffe2437325f9969e1
Component: engine
This revision is from docker_1.5 branch, because we don't want to
introduce user namespace in docker 1.5, but fix for --pid=host is
needed.
Fixes#10303
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: fd2d45d7d465fe02f159f21389b92164dbb433d3
Component: engine
Correct exit code when dying on a signal (fixes#9979).
Signed-off-by: Arnaud Porterie <arnaud.porterie@docker.com>
Upstream-commit: 009041cdfd815c0ab49493f9f5757b171ee8c987
Component: engine
This fixes wrong behavior of mutating methods of Namespaces object
Signed-off-by: Alexandr Morozov <lk4d4@docker.com>
Upstream-commit: c98ae1f88fccd89eb2184cd2b780f9827ad5ad41
Component: engine
This commit contains changes for docker:
* user.GetGroupFile to user.GetGroupPath docker/libcontainer#301
* Add systemd support for OOM docker/libcontainer#307
* Support for custom namespaces docker/libcontainer#279, docker/libcontainer#312
* Fixes#9699docker/libcontainer#308
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
Upstream-commit: 50905a6d6ce2fdd1ab0c33ec0b7a26895e0cbeea
Component: engine
