Signed-off-by: Lucas Chi <lucas@teacherspayteachers.com>
(cherry picked from commit 7b3ac47fa4c2dd6850959c3c230289eefbc4dbe3)
Signed-off-by: Tibor Vass <tibor@docker.com>
This fix tries to address the issue raised in #24374 where
`docker info` outputs seccomp support in Ubuntu 14.04 but
the seccomp wass not actually supported.
The issue is that in the current docker implementation, seccomp
support is only checked against the kernel by inspect CONFIG_SECCOMP
and CONFIG_SECCOMP_FILTER. However, seccomp might not be enabled
when building docker (through golang build flag).
This fix adds a supportSeccomp boolean variable. The supportSeccomp
is only set to true when seccomp is enabled when building docker.
This fix fixes#24374.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
(cherry picked from commit a3b9dd89a1b19e7f84617b91f3756ae816c11035)
Signed-off-by: Tibor Vass <tibor@docker.com>
This fix adds a couple of missed release tag reference links in deprecated.md
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
(cherry picked from commit bc20354b095906eedd346fb45bbbf9ad5e82145d)
Signed-off-by: Tibor Vass <tibor@docker.com>
Fixes `make test` and fix#24380 on aarch64
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit d37a7394acd7842f588ef423fb076b05fccd1da2)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Harald Albers <github@albersweb.de>
(cherry picked from commit 009d50e2d8c4f74f38ebefe89b8dd44b69b46660)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Harald Albers <github@albersweb.de>
(cherry picked from commit 715754ee61a83a710f5c0c3974cfed6b453d5595)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Harald Albers <github@albersweb.de>
(cherry picked from commit 2b34fa0511a5193b1cb07493555872cfd6b70442)
Signed-off-by: Tibor Vass <tibor@docker.com>
Fix#24357
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
(cherry picked from commit 253933220965574422aa6679255359d8bd15d435)
Signed-off-by: Tibor Vass <tibor@docker.com>
This patch makes sure daemon resources are cleaned up on shutdown if
there are no running containers.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 2d5dc94b9b547a9ba73f7b613e358b03fdfb2b84)
Signed-off-by: Tibor Vass <tibor@docker.com>
This was missed in #23312 even though the other parts of
this were fixed.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 47ace5cd989103f7d646282fce66434b5a3c13f6)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit 59162641cc20640afb785540b5f47178835de656)
Signed-off-by: Tibor Vass <tibor@docker.com>
This is now up to date with contents of 1.12 tgz
Also change usage to `dockerd` not `docker daemon`
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 7102e09f29822e4bb0e375738c5194ded8b716ca)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Charles Smith <charles.smith@docker.com>
(cherry picked from commit 093817031acd2b8dc17cba5c3c994b2d6d19dc0e)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1255e53e2890149df3c919af7aac88237069e1bb)
Signed-off-by: Tibor Vass <tibor@docker.com>
Needed for libnetwork vendoring
Update Secret API name change correspondingly
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit d428a7a425f071ee9e5707c7319d3197540adc19)
Signed-off-by: Tibor Vass <tibor@docker.com>
Update now that the changes in https://github.com/docker/libnetwork/pull/1230
have been merged
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 3ae0c664507e0d8da5e3151f28b8d00316569e47)
Signed-off-by: Tibor Vass <tibor@docker.com>
This reduces memory usage with a lot of docker proxy processes.
On Docker for Mac we are currently carrying a patch to replace
the binary as we modify it to forward ports to the Mac rather
than the Linux VM, this allows us to simply replace this binary
in our packaging with one that has a compatible interface. This
patch does not provide an easy way to substitute a binary as
the interface is complex and there are few use cases, but where
needed this can be done.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 0682468431867e3382a759402eb92df5877e310b)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: John Howard <jhoward@microsoft.com>
(cherry picked from commit fd4f5c23650799a7e76e193614bf82454b375fe3)
Signed-off-by: Tibor Vass <tibor@docker.com>
- Update ps with `--last` flag
- Update commands with current output
- Make sure hugo does not detect the wrong language
- Update usage for `tag` command to be more coherent with the other ones
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
(cherry picked from commit f4cfc6b9830ed236eb588d6a4dddca7455145e70)
Signed-off-by: Tibor Vass <tibor@docker.com>
The current behavior of `docker swarm init` is to set up a swarm that
has no secret for joining, and does not require manual acceptance for
workers. Since workers may sometimes receive sensitive data such as pull
credentials, it makes sense to harden the defaults.
This change makes `docker swarm init` generate a random secret if none
is provided, and print it to the terminal. This secret will be needed to
join workers or managers to the swarm. In addition to improving access
control to the cluster, this setup removes an avenue for
denial-of-service attacks, since the secret is necessary to even create
an entry in the node list.
`docker swarm init --secret ""` will set up a swarm without a secret,
matching the old behavior. `docker swarm update --secret ""` removes the
automatically generated secret after `docker swarm init`.
Closes#23785
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 7342e42fcecbc243bcb8723b8422879662452017)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
(cherry picked from commit a859a336475f39c7b7d7739c58a1dae40df86a86)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
(cherry picked from commit 6ec4a640de492e2f3c7b8268b5258d76b38b094b)
Signed-off-by: Tibor Vass <tibor@docker.com>
In the API:
`Writable` changed to `ReadOnly`
`Populate` changed to `NoCopy`
Corresponding CLI options updated to:
`volume-writable` changed to `volume-readonly`
`volume-populate` changed to `volume-nocopy`
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 56f3422468a0b43da7bae7a01762ce4f0a92d9ff)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit db271b8833fc0b55998afababdaad60a67e3a982)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 140ec59db6e413de5025fb8686b97bf80b66c519)
Signed-off-by: Tibor Vass <tibor@docker.com>
In #24159, the title field of `docker node ls` has been
changed from NAME to HOSTNAME. However, in the docs the
NAMEs are still used for the output of `docker node ls`.
This fix updates docs so that NAME field is changed to
HOSTNAME for all `docker node ls`.
This fix is related to #24159 and #24090.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
(cherry picked from commit 668b8a998f5ebbe66c7376c432a5fd87208add73)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Jonathan Lomas <jonathan@floatinglomas.ca>
(cherry picked from commit 7631dc80a6b1549b857192f44322fcee5e754254)
Signed-off-by: Tibor Vass <tibor@docker.com>
This is done in a hacky way as currently there is no better way.
Uses known implementation details about how tasks are scheduled to be
able to operate on the underlying container.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit e5ec575b32d6979914dce576f1b8bb71f3057cea)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit a0c8970df1f013a51684f82dd86815dcf773a250)
Signed-off-by: Tibor Vass <tibor@docker.com>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit 8aa37bdbb76a781d73c24800c2bc5373d2289c28)
Signed-off-by: Tibor Vass <tibor@docker.com>
In order to keep a little bit of "sanity" on the API side, validate
hostname only starting from v1.24 API version.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
(cherry picked from commit 6daf3d2a783fd042e870c8af8bbd19fc28989505)
Signed-off-by: Tibor Vass <tibor@docker.com>
The image spec did not match the regexp that validates tags. It
neglected to mention that period and dash characters are allowed in
tags, as long as they are not the first character. It also did not
mention the length limit for tags.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 2f19e910bdeee94a2962ce8457325e92aa21ce0e)
Signed-off-by: Tibor Vass <tibor@docker.com>
* Detect name conflicts on network creation
* Detect and prevent network connect/disconnect for managed containers
Signed-off-by: Madhu Venugopal <madhu@docker.com>
(cherry picked from commit 0ce5158a2a9a3f10a62d3c1ea289c55e524cdac5)
Signed-off-by: Tibor Vass <tibor@docker.com>
There is a not-insignificant performance overhead for all containers (if
containerd is a child of Docker, which is the current setup) if systemd
sets rlimits on the main Docker daemon process (because the limits
propogate to all children).
Signed-off-by: Aleksa Sarai <asarai@suse.de>
(cherry picked from commit 8db61095a3d0bcb0733580734ba5d54bc27a614d)
Signed-off-by: Tibor Vass <tibor@docker.com>
The libtrust keyfile which is used to set the "ID" property of a daemon must be generated or loaded on every startup.
If the process crashes during startup this could cause the file to be incomplete causing future startup errors.
Ensure that the file is written atomically to ensure the file is never in an incomplete state.
Fixes#23985
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
(cherry picked from commit 9836162446bd0deadecbf0eed38ef3c134754f16)
Signed-off-by: Tibor Vass <tibor@docker.com>
… on `docker node tasks` and `docker service tasks` commands.
This changes is mainly server-side (between engine api and
swarmkit). There is just a check in `api/client/service/tasks.go` to
handle the special *self* meaning.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
(cherry picked from commit b0fc5a21f1138f48e0431a550c936e8908d72840)
Signed-off-by: Tibor Vass <tibor@docker.com>
Lucas Chi