Currently the default seccomp profile is fixed. This changes it
so that it varies depending on the Linux capabilities selected with
the --cap-add and --cap-drop options. Without this, if a user adds
privileges, eg to allow ptrace with --cap-add sys_ptrace then still
cannot actually use ptrace as it is still blocked by seccomp, so
they will probably disable seccomp or use --privileged. With this
change the syscalls that are needed for the capability are also
allowed by the seccomp profile based on the selected capabilities.
While this patch makes it easier to do things with for example
cap_sys_admin enabled, as it will now allow creating new namespaces
and use of mount, it still allows less than --cap-add cap_sys_admin
--security-opt seccomp:unconfined would have previously. It is not
recommended that users run containers with cap_sys_admin as this does
give full access to the host machine.
It also cleans up some architecture specific system calls to be
only selected when needed.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: a01c4dc8f85827f32d88522e5153dddc02f11806
Component: engine
Fixes the negative networking test to include the new error string
from recent Windows builds.
Signed-off-by: Justin Terry <juterry@microsoft.com>
Upstream-commit: 47ef6d7969a3396f6ecc3bb27aac425b1a65b344
Component: engine
The path we're trying to remove doesn't exist after a successful
chroot+chdir because a / is only appended after pivot_root is
successful and so we can't cleanup anymore with the old path.
Also fix leaking .pivot_root dirs under /var/lib/docker/tmp/docker-builder*
on error.
Fix https://github.com/docker/docker/issues/22587
Introduced by https://github.com/docker/docker/pull/22506
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 5248f5c3d1d91ea4235ffe57962e38293af18f34
Component: engine
This syncs the protobuf version with the one that is used with
containerd.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: 4e290986cdf08a34ad508473bab702793503fa6b
Component: engine
Since 1.9, Docker Content Trust Offline key has been renamed to
Root key and the Tagging key has been renamed to Repository key.
The corresponding environment variables
`DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE`
`DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE`
have also been deprecated and renamed to
`DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE`
`DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE`
This fix removed the deprecated ENV passphrase variables for
1.12 and updated the docs.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 1f0d5aba50803ff401197f96f6a830384d0c04c5
Component: engine
The colon separator(`:`) of `--security-opt` flag was deprecated
in 1.11.0. However, the subtitle in deprecated docs is missing
so it is placed under the same subtitle as the deprecated `-e` and
`--email` flags.
This fix adds the missing subtitle in deprecated docs.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Upstream-commit: 018c22880d594b1de06216aa05186f2ebe9a1e9c
Component: engine
The jsonlog logger currently allows specifying envs and labels that
should be propagated to the log message, however there has been no way
to read that back.
This adds a new API option to enable inserting these attrs back to the
log reader.
With timestamps, this looks like so:
```
92016-04-08T15:28:09.835913720Z foo=bar,hello=world hello
```
The extra attrs are comma separated before the log message but after
timestamps.
Without timestaps it looks like so:
```
foo=bar,hello=world hello
```
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: bd9d14a07b9f1c82625dc8483245caf3fa7fe9e6
Component: engine
Auto-creation of host-paths has been un-deprecated,
so to have feature-parity between Linux and Windows,
this feature should also be present on Windows.
This enables auto-creation on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 4e080347af657ca3a0c103c6bc6cd6a8157d20d8
Component: engine
Removes seccomp from ppc64le as a buildtag
Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
Upstream-commit: 31cc7dc135b606410471a553247ef75b42c3f181
Component: engine
the documentations says that you can drop "a file" into the
`docker.service.d` directory, but does not note that the file must end
with `.conf` in order to be recognized by systemd. This can lead to
some [confusion][] if readers are not previously familiar with
systemd.
[confusion]: https://botbot.me/freenode/docker/2016-05-06/?msg=65605541&page=11
Signed-off-by: Lars Kellogg-Stedman <lars@redhat.com>
Upstream-commit: 987b03054af8bfa5147465d4fe5d5a554cd5fee3
Component: engine
- Update now returns only an error
- NewNotaryRepository now takes a trustpinning configuration - we will provide an empty one for now.
Signed-off-by: cyli <cyli@twistedmatrix.com>
Upstream-commit: d869d2b0a07105c80a24755ac6dd12476a085453
Component: engine
is still on the Go 1.4 library, whereas the Notary Yubikey library needs interfaces from
Go 1.5
Signed-off-by: cyli <cyli@twistedmatrix.com>
Upstream-commit: 4710ed6304b8456060f4cb4401b2ed47343991e4
Component: engine
Justin Cormack
Alexander Morozov
Sebastiaan van Stijn
John Howard
Sebastiaan van Stijn
Justin Terry
Antonio Murdaca
Michael Crosby
Tonis Tiigi
cyli
Brian Goff
Tibor Vass
Kenfe-Mickael Laventure
Vincent Demeester
Wen Cheng Ma
Doug Davis
Yong Tang
Yuan Sun
allencloud
Christopher Jones
unclejack
Lars Kellogg-Stedman
Aaron Lehmann