From c695a430f0c3da79af972484ae5f408921ace2a4 Mon Sep 17 00:00:00 2001 From: Hacktivista Date: Wed, 7 Nov 2018 11:15:49 -0300 Subject: [PATCH 01/10] Update configs.md configs key is not (and will not be) supported in docker compose, check https://github.com/docker/compose/issues/5110 for more info --- engine/swarm/configs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/engine/swarm/configs.md b/engine/swarm/configs.md index f78c1c4616..5127c47de1 100644 --- a/engine/swarm/configs.md +++ b/engine/swarm/configs.md @@ -122,8 +122,8 @@ Docker configs. ### Defining and using configs in compose files -Both the `docker compose` and `docker stack` commands support defining configs -in a compose file. See +`docker stack` command supports defining configs in a compose file, though +`docker compose` will ignore the `configs` key as is not supported. See [the Compose file reference](/compose/compose-file/#configs) for details. ### Simple example: Get started with configs From 67938199a8617243c3a58e7538b3667d557daf17 Mon Sep 17 00:00:00 2001 From: paigehargrave Date: Mon, 1 Apr 2019 14:14:18 -0400 Subject: [PATCH 02/10] Update release-notes.md --- ee/ucp/release-notes.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ee/ucp/release-notes.md b/ee/ucp/release-notes.md index b1bef82dac..7161890fd2 100644 --- a/ee/ucp/release-notes.md +++ b/ee/ucp/release-notes.md @@ -43,11 +43,6 @@ upgrade your installation to the latest release. ### Known Issues * There are important changes to the upgrade process that, if not correctly followed, can impact the availability of applications running on the Swarm during uprades. These constraints impact any upgrades coming from any Docker Engine version before 18.09 to version 18.09 or greater. For more information about about upgrading Docker Enterprise to version 2.1, see [Upgrade Docker](../upgrade) -* You must use the ID of the user, organization, or team if you manually create a **ClusterRoleBinding** or **RoleBinding** for `User` or `Group` subjects. (#14935) - * For the `User` subject Kind, the `Name` field contains the ID of the user. - * For the `Group` subject Kind, the format depends on whether you are create a Binding for a team or an organization: - * For an organization, the format is `org:{org-id}` - * For a team, the format is `team:{org-id}:{team-id}` * To deploy Pods with containers using Restricted Parameters, the user must be an admin and a service account must explicitly have a **ClusterRoleBinding** with `cluster-admin` as the **ClusterRole**. Restricted Parameters on Containers include: * Host Bind Mounts * Privileged Mode @@ -96,11 +91,6 @@ upgrade your installation to the latest release. * Newly added Windows node reports "Awaiting healthy status in classic node inventory". [Learn more](https://success.docker.com/article/newly-added-windows-node-reports-awaiting-healthy-status-in-classic-node-inventory). * There are important changes to the upgrade process that, if not correctly followed, can impact the availability of applications running on the Swarm during uprades. These constraints impact any upgrades coming from any Docker Engine version before 18.09 to version 18.09 or greater. For more information about about upgrading Docker Enterprise to version 2.1, see [Upgrade Docker](../upgrade) * In the UCP web interface, LDAP settings disappear after submitting them. However, the settings are properly saved. (docker/orca#15503) -* You must use the ID of the user, organization, or team if you manually create a **ClusterRoleBinding** or **RoleBinding** for `User` or `Group` subjects. (docker/orca#14935) - * For the `User` subject Kind, the `Name` field contains the ID of the user. - * For the `Group` subject Kind, the format depends on whether you are create a Binding for a team or an organization: - * For an organization, the format is `org:{org-id}` - * For a team, the format is `team:{org-id}:{team-id}` * To deploy Pods with containers using Restricted Parameters, the user must be an admin and a service account must explicitly have a **ClusterRoleBinding** with `cluster-admin` as the **ClusterRole**. Restricted Parameters on Containers include: * Host Bind Mounts * Privileged Mode From f4a3e5576e363337081e8f3bd5da11af8f630950 Mon Sep 17 00:00:00 2001 From: Ally Smith Date: Mon, 1 Apr 2019 13:16:03 -0500 Subject: [PATCH 03/10] add slack webhook to Jenkinsfile --- Jenkinsfile | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 8e420440ae..34916fbce7 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -1,5 +1,6 @@ def dtrVpnAddress = "vpn.corp-us-east-1.aws.dckr.io" def ucpBundle = [file(credentialsId: "ucp-bundle", variable: 'UCP')] +def slackString = [string(credentialsId: 'slack-docs-webhook', variable: 'slack')] def reg = [credentialsId: 'csebuildbot', url: 'https://index.docker.io/v1/'] pipeline { @@ -50,7 +51,6 @@ pipeline { } withDockerRegistry(reg) { sh """ - cd ucp-bundle-success_bot export DOCKER_TLS_VERIFY=1 export COMPOSE_TLS_VERSION=TLSv1_2 export DOCKER_CERT_PATH=${WORKSPACE}/ucp-bundle-success_bot @@ -70,15 +70,18 @@ pipeline { withCredentials(ucpBundle) { sh 'unzip -o $UCP' } - withDockerRegistry(reg) { - sh """ - cd ucp-bundle-success_bot - export DOCKER_TLS_VERIFY=1 - export COMPOSE_TLS_VERSION=TLSv1_2 - export DOCKER_CERT_PATH=${WORKSPACE}/ucp-bundle-success_bot - export DOCKER_HOST=tcp://ucp.corp-us-east-1.aws.dckr.io:443 - docker service update --detach=false --force --image docs/docker.github.io:prod-${env.BUILD_NUMBER} docs-docker-com_docs --with-registry-auth - """ + withCredentials(slackString) { + withDockerRegistry(reg) { + sh """ + cd ucp-bundle-success_bot + export DOCKER_TLS_VERIFY=1 + export COMPOSE_TLS_VERSION=TLSv1_2 + export DOCKER_CERT_PATH=${WORKSPACE}/ucp-bundle-success_bot + export DOCKER_HOST=tcp://ucp.corp-us-east-1.aws.dckr.io:443 + docker service update --detach=false --force --image docs/docker.github.io:prod-${env.BUILD_NUMBER} docs-docker-com_docs --with-registry-auth + curl -X POST -H 'Content-type: application/json' --data '{"text":"Successfully published docs. https://docs.docker.com/"}' $slack + """ + } } } } @@ -86,4 +89,4 @@ pipeline { } } } -} \ No newline at end of file +} From 74b8c48305a42398de15ffa0ad7976326bf779ea Mon Sep 17 00:00:00 2001 From: paigehargrave Date: Mon, 1 Apr 2019 14:20:17 -0400 Subject: [PATCH 04/10] Fix labels-reference link --- _data/toc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/toc.yaml b/_data/toc.yaml index 0e340a612a..1986831ae5 100644 --- a/_data/toc.yaml +++ b/_data/toc.yaml @@ -1350,7 +1350,7 @@ manuals: - title: Specifying a routing mode path: /ee/ucp/interlock/usage/interlock-vip-mode/ - title: Using routing labels - path: /ee/ucp/interlock/usage/labels-reference.md/ + path: /ee/ucp/interlock/usage/labels-reference/ - title: Implementing redirects path: /ee/ucp/interlock/usage/redirects/ - title: Implementing a service cluster From 9ff6e4f4f6f83ab13091c3040d45d6afe6471920 Mon Sep 17 00:00:00 2001 From: Ulysses Souza Date: Mon, 1 Apr 2019 20:35:23 +0200 Subject: [PATCH 05/10] Add pip dependencies to compose doc for alpine (#8554) * Add pip dependencies to compose doc for alpine Signed-off-by: Ulysses Souza * Minor edit --- compose/install.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/compose/install.md b/compose/install.md index fa9a5219f1..b739bf792e 100644 --- a/compose/install.md +++ b/compose/install.md @@ -124,6 +124,10 @@ repository release page on GitHub](https://github.com/docker/compose/releases){: target="_blank" class="_"}. Follow the instructions from the link, which involve running the `curl` command in your terminal to download the binaries. These step-by-step instructions are also included below. +> For `alpine`, the following dependency packages are needed: +> `py-pip`, `python-dev`, `libffi-dev`, `openssl-dev`, `gcc`, `libc-dev`, and `make`. +{: .important} + 1. Run this command to download the current stable release of Docker Compose: ```bash @@ -170,6 +174,10 @@ sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose #### Install using pip +> For `alpine`, the following dependency packages are needed: +> `py-pip`, `python-dev`, `libffi-dev`, `openssl-dev`, `gcc`, `libc-dev`, and `make`. +{: .important} + Compose can be installed from [pypi](https://pypi.python.org/pypi/docker-compose) using `pip`. If you install using `pip`, we recommend that you use a From c3b0c02153edfb8f47945822d1b35107f9de6b38 Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Mon, 1 Apr 2019 14:45:04 -0400 Subject: [PATCH 06/10] Audit branch (#8564) * Update trust-with-remote-ucp.md * Fix link texts * Addresses 8446 * Update trust_delegation.md * - Addresses 8446 - Cleans up broken links - Fixes vague link texts Addresses 8446 Update trust_delegation.md * Update running_ssh_service.md * Update running_ssh_service.md Fixed formatting and wording. Also moved note above the code. * Update running_ssh_service.md Fixed typo. * Compose: Update build docs, Add --quiet flag * Fix destroy reference page link Relates to https://github.com/docker/docker.github.io/pull/8441 * Rephrase Ubuntu 14.04 note * Revert "Compose: Update build docs, Add --quiet flag" * # This is a combination of 4 commits. # This is the 1st commit message: - Addresses 8446 - Cleans up broken links - Fixes vague link texts Addresses 8446 Update trust_delegation.md # This is the commit message #2: # This is a combination of 2 commits. # This is the 1st commit message: - Addresses 8446 - Cleans up broken links - Fixes vague link texts Addresses 8446 Update trust_delegation.md # This is the commit message #2: Update trust-with-remote-ucp.md # This is the commit message #3: - Addresses 8446 - Cleans up broken links - Fixes vague link texts # This is the commit message #4: Fix destroy reference page link Relates to https://github.com/docker/docker.github.io/pull/8441 * - Addresses 8446 - Cleans up broken links - Fixes vague link texts * Addresses 8446 with text and link cleanup. * Update syntax language from none to bash * Update index.md --- ee/dtr/user/manage-images/sign-images/index.md | 9 ++++----- .../sign-images/trust-with-remote-ucp.md | 12 +++++------- ee/ucp/authorization/reset-user-password.md | 2 +- engine/examples/running_ssh_service.md | 12 +++++++++++- engine/security/trust/trust_delegation.md | 5 +++-- 5 files changed, 24 insertions(+), 16 deletions(-) diff --git a/ee/dtr/user/manage-images/sign-images/index.md b/ee/dtr/user/manage-images/sign-images/index.md index a26f42cc9d..9fa9511695 100644 --- a/ee/dtr/user/manage-images/sign-images/index.md +++ b/ee/dtr/user/manage-images/sign-images/index.md @@ -71,9 +71,8 @@ your image. In this example we've created the `prod/nginx` repository. As part of initiating the repository, we will add the public key of the UCP User as a signer. You will be asked for a number of passphrases to protect the keys. -Please keep note of these passphrases, and to learn more about managing keys -head to the Docker Content Trust documentation -[here](/engine/security/trust/trust_delegation/#managing-delegations-in-a-notary-server). +Make a note of these passphrases, and see [Managing Delegations in a Notary Server](/engine/security/trust/trust_delegation/#managing-delegations-in-a-notary-server) +to learn more about managing keys. ```bash @@ -215,7 +214,7 @@ Administrative keys for dtr.example.com/prod/nginx:1 Root Key: b74854cb27cc25220ede4b08028967d1c6e297a759a6939dfef1ea72fbdd7b9a ``` -For more advanced use cases like this, more information can be found [here](/engine/security/trust/trust_delegation/) +For more advanced use cases like this, see [Delegations for content trust](/engine/security/trust/trust_delegation/). ## Delete trust data @@ -243,4 +242,4 @@ but will not delete data from the Notary server. * [Automating Docker Content Trust](/engine/security/trust/trust_automation/) -* [Using Docker Content Trust with a Remote UCP](./trust-with-remote-ucp.md) \ No newline at end of file +* [Using Docker Content Trust with a Remote UCP](./trust-with-remote-ucp/) diff --git a/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp.md b/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp.md index 7539154616..011cdb3535 100644 --- a/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp.md +++ b/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp.md @@ -9,7 +9,7 @@ redirect_from: For more advanced deployments, you may want to share one Docker Trusted Registry across multiple Universal Control Planes. However, customers wanting to adopt this model alongside the [Only Run Signed -Images](../.../../ucp/admin/configure/run-only-the-images-you-trust.md) UCP feature, run into problems as each UCP operates an independent set of users. +Images](/ee/ucp/admin/configure/run-only-the-images-you-trust.md) UCP feature, run into problems as each UCP operates an independent set of users. Docker Content Trust (DCT) gets around this problem, since users from a remote UCP are able to sign images in the central DTR and still apply runtime @@ -27,7 +27,7 @@ cluster separately. > Before attempting this guide, familiarize yourself with [Docker Content > Trust](engine/security/trust/content_trust/#signing-images-with-docker-content-trust) > and [Only Run Signed -> Images](../.../../ucp/admin/configure/run-only-the-images-you-trust.md) on a +> Images](/ee/ucp/admin/configure/run-only-the-images-you-trust.md) on a > single UCP. Many of the concepts within this guide may be new without that > background. @@ -42,7 +42,7 @@ cluster separately. - The DTR TLS Certificate needs be properly configured, ensuring that the **Loadbalancer/Public Address** field has been configured, with this address included [within the - certificate](../../../admin/configure/use-your-own-tls-certificates/). + certificate](/ee/dtr/admin/configure/use-your-own-tls-certificates/). - A machine with the [Docker Client](/ee/ucp/user-access/cli/) (CE 17.12 / EE 1803 or newer) installed, as this contains the relevant `$ docker trust` commands. @@ -62,7 +62,7 @@ a local UCP, or cluster 1. > if the repository is private. See > [Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-in-the-cluster-that-holds-your-authorization-token) > or [Docker -> Swarm](https://docs.docker.com/engine/swarm/services/#create-a-service-using-an-image-on-a-private-registry) examples. +> Swarm](/engine/swarm/services/#create-a-service-using-an-image-on-a-private-registry) examples. To add a new registry, retrieve the Certificate Authority (CA) used to sign the DTR TLS Certificate through the DTR URL's @@ -220,9 +220,7 @@ nqsph0n6lv9u laughing_lamarr replicated 1/1 If the image is stored in a private repository within DTR, you need to pass credentials to the Orchestrator as there is no SSO between cluster 2 and DTR. See the relevant -[Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-in-the-cluster-that-holds-your-authorization-token) or [Docker - Swarm](https://docs.docker.com/engine/swarm/services/#create-a-service-using-an-image-on-a-private-registry) - documentation for more details. +[Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-in-the-cluster-that-holds-your-authorization-token) or [Docker Swarm](/engine/swarm/services/#create-a-service-using-an-image-on-a-private-registry) documentation for more details. ### Example Errors diff --git a/ee/ucp/authorization/reset-user-password.md b/ee/ucp/authorization/reset-user-password.md index 76221397f0..b471db645c 100644 --- a/ee/ucp/authorization/reset-user-password.md +++ b/ee/ucp/authorization/reset-user-password.md @@ -28,8 +28,8 @@ User passwords managed with an LDAP service must be changed on the LDAP server. Administrators who need to update their passwords can ask another administrator for help or SSH into a Docker Enterprise [manager node](/engine/swarm/how-swarm-mode-works/nodes/#manager-nodes) and run: -```none {% raw %} +```bash docker run --net=host -v ucp-auth-api-certs:/tls -it "$(docker inspect --format '{{ .Spec.TaskTemplate.ContainerSpec.Image }}' ucp-auth-api)" "$(docker inspect --format '{{ index .Spec.TaskTemplate.ContainerSpec.Args 0 }}' ucp-auth-api)" passwd -i {% endraw %} ``` diff --git a/engine/examples/running_ssh_service.md b/engine/examples/running_ssh_service.md index 9cb294af75..8f7b74fde3 100644 --- a/engine/examples/running_ssh_service.md +++ b/engine/examples/running_ssh_service.md @@ -18,7 +18,7 @@ quick access to a test container. __Note: Replace "THEPASSWORDYOUCREATED" with the password that you created in the previous step.__ -> ** Note**: Use `without-password` instead of `prohibit-password` for Ubuntu 14.04. +> **Note**: Use `without-password` instead of `prohibit-password` for Ubuntu 14.04. ```Dockerfile FROM ubuntu:16.04 @@ -38,6 +38,16 @@ EXPOSE 22 CMD ["/usr/sbin/sshd", "-D"] ``` +<<<<<<< HEAD +<<<<<<< HEAD +<<<<<<< HEAD +======= +NOTE: use `without-password` instead of `prohibit-password` for Ubuntu 14.04. +>>>>>>> 9de3c4e47c... Update running_ssh_service.md +======= +>>>>>>> 2ebcae3230... Update running_ssh_service.md +======= +>>>>>>> b2ec3a6611dbb418d70c5b4082b9e118bfac3c7b Build the image using: diff --git a/engine/security/trust/trust_delegation.md b/engine/security/trust/trust_delegation.md index f9cf72fca3..12533b020d 100644 --- a/engine/security/trust/trust_delegation.md +++ b/engine/security/trust/trust_delegation.md @@ -75,7 +75,8 @@ Failed to add signer to: dtr.example.com/user/repo ``` If you are using DTR and would like to work with a remote UCP's signing policy, -you must [register your DTR instance with that remote UCP](/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp/#registering-dtr-with-a-remote-universal-control-plane). See [Using Docker Content Trust with a Remote UCP Cluster](/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp/) for more details. +you must [register your DTR instance with that remote UCP](/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp/#registering-dtr-with-a-remote-universal-control-plane). +See [Using Docker Content Trust with a Remote UCP Cluster](/ee/dtr/user/manage-images/sign-images/trust-with-remote-ucp/) for more details. ## Configuring the Notary Client @@ -369,7 +370,7 @@ Successfully removed ben from dtr.example.com/admin/demo #### Troubleshooting -1) If you see an error that there are no useable keys in `targets/releases`, you +1) If you see an error that there are no usable keys in `targets/releases`, you will need to add additional delegations using `docker trust signer add` before resigning images. From 06d00cc3bd38a648189bfa10dc3cc36a0b21b573 Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Mon, 1 Apr 2019 12:02:31 -0700 Subject: [PATCH 07/10] Remove merge conflict --- engine/examples/running_ssh_service.md | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/engine/examples/running_ssh_service.md b/engine/examples/running_ssh_service.md index 8f7b74fde3..96ce7072d2 100644 --- a/engine/examples/running_ssh_service.md +++ b/engine/examples/running_ssh_service.md @@ -14,11 +14,10 @@ Using a static password for root access is dangerous. Create a random password b The following `Dockerfile` sets up an SSHd service in a container that you can use to connect to and inspect other container's volumes, or to get -quick access to a test container. +quick access to a test container. Make the following substitutions: -__Note: Replace "THEPASSWORDYOUCREATED" with the password that you created in the previous step.__ - -> **Note**: Use `without-password` instead of `prohibit-password` for Ubuntu 14.04. +- With `RUN echo 'root:THEPASSWORDYOUCREATED' | chpasswd`, replace "THEPASSWORDYOUCREATED" with the password you've previously generated. +- With `RUN sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config`, use `without-password` instead of `prohibit-password` for Ubuntu 14.04. ```Dockerfile FROM ubuntu:16.04 @@ -38,16 +37,6 @@ EXPOSE 22 CMD ["/usr/sbin/sshd", "-D"] ``` -<<<<<<< HEAD -<<<<<<< HEAD -<<<<<<< HEAD -======= -NOTE: use `without-password` instead of `prohibit-password` for Ubuntu 14.04. ->>>>>>> 9de3c4e47c... Update running_ssh_service.md -======= ->>>>>>> 2ebcae3230... Update running_ssh_service.md -======= ->>>>>>> b2ec3a6611dbb418d70c5b4082b9e118bfac3c7b Build the image using: From d749399706cb26fcd271b71426ba1e683c2dcc6c Mon Sep 17 00:00:00 2001 From: Darwin Traver Date: Mon, 1 Apr 2019 20:55:36 -0400 Subject: [PATCH 08/10] Adding Azure note (#8566) * Adding Azure note * Rephrase additional line and update link --- reference/ucp/3.1/cli/install.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/reference/ucp/3.1/cli/install.md b/reference/ucp/3.1/cli/install.md index 5528f1cdc3..9835357c67 100644 --- a/reference/ucp/3.1/cli/install.md +++ b/reference/ucp/3.1/cli/install.md @@ -38,6 +38,8 @@ If you have SELinux policies enabled for your Docker install, you will need to use `docker container run --rm -it --security-opt label=disable ...` when running this command. +If you are installing on Azure, see [Install UCP on Azure](/ee/ucp/admin/install/install-on-azure/). + ## Options | Option | Description | From 7e7297cc9dd2f0b8e46c939bd8b87154998b0236 Mon Sep 17 00:00:00 2001 From: hacktivista Date: Tue, 2 Apr 2019 09:08:02 -0300 Subject: [PATCH 09/10] Update configs.md --- engine/swarm/configs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/engine/swarm/configs.md b/engine/swarm/configs.md index 5127c47de1..9be45cc8bc 100644 --- a/engine/swarm/configs.md +++ b/engine/swarm/configs.md @@ -122,8 +122,8 @@ Docker configs. ### Defining and using configs in compose files -`docker stack` command supports defining configs in a compose file, though -`docker compose` will ignore the `configs` key as is not supported. See +The `docker stack` command supports defining configs in a compose file. +However, the 'configs' key is not supported for `docker compose`. See [the Compose file reference](/compose/compose-file/#configs) for details. ### Simple example: Get started with configs From 41dfff114babdcc6776bf808195ab067c6cd6775 Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Tue, 2 Apr 2019 09:09:51 -0700 Subject: [PATCH 10/10] Final edit --- engine/swarm/configs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/engine/swarm/configs.md b/engine/swarm/configs.md index 9be45cc8bc..d2aec6673d 100644 --- a/engine/swarm/configs.md +++ b/engine/swarm/configs.md @@ -122,8 +122,8 @@ Docker configs. ### Defining and using configs in compose files -The `docker stack` command supports defining configs in a compose file. -However, the 'configs' key is not supported for `docker compose`. See +The `docker stack` command supports defining configs in a Compose file. +However, the `configs` key is not supported for `docker compose`. See [the Compose file reference](/compose/compose-file/#configs) for details. ### Simple example: Get started with configs