Add Secret sorting prior to request to prevent flakiness in CI
Signed-off-by: Phong Tran <tran.pho@northeastern.edu>
Co-authored-by: Sebastiaan van Stijn <thaJeztah@users.noreply.github.com>
Signed-off-by: Phong Tran <tran.pho@northeastern.edu>
go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand,
crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
compiler, and the crypto/tls and text/template/parse packages. See the Go
1.18.3 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved
Hello gophers,
We have just released Go versions 1.18.3 and 1.17.11, minor point releases.
These minor releases include 4 security fixes following the security policy:
- crypto/rand: rand.Read hangs with extremely large buffers
On Windows, rand.Read will hang indefinitely if passed a buffer larger than
1 << 32 - 1 bytes.
Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
for reporting this issue.
This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561.
- crypto/tls: session tickets lack random ticket_age_add
Session tickets generated by crypto/tls did not contain a randomly generated
ticket_age_add. This allows an attacker that can observe TLS handshakes to
correlate successive connections by comparing ticket ages during session
resumption.
Thanks to GitHub user nervuri for reporting this.
This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814.
- `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows
If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput`
are executed when Cmd.Path is unset and, in the working directory, there are
binaries named either "..com" or "..exe", they will be executed.
Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
this.
This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574.
- `path/filepath`: Clean(`.\c:`) returns `c:` on Windows
On Windows, the `filepath.Clean` function could convert an invalid path to a
valid, absolute path. For example, Clean(`.\c:`) returned `c:`.
Thanks to Unrud for reporting this issue.
This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476.
[CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634
[CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629
[CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580
[CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This updates the pretty-print format of docker info to provide more
details on installed plugins, to help users find where a specific
plugin is installed (e.g. to update it, or to uninstall it).
Before this patch:
```bash
Client:
Context: desktop-linux
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc., v0.8.2)
compose: Docker Compose (Docker Inc., v2.4.1)
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
scan: Docker Scan (Docker Inc., v0.17.0)
Server:
...
```
With this patch applied:
```bash
docker info
Client:
Context: desktop-linux
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.8.2
Path: /usr/local/lib/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.4.1
Path: /usr/local/lib/docker/cli-plugins/docker-compose
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /usr/local/lib/docker/cli-plugins/docker-sbom
scan: Docker Scan (Docker Inc.)
Version: v0.17.0
Path: /usr/local/lib/docker/cli-plugins/docker-scan
Server:
...
```
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
no changes in vendored code other than a typo-fix, just aligning with latest master
8abb84c734...cb01202de8
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Notable changes:
- introduce CreateMountpoint for parity between binds and mounts
full diff: c9d04033d4...d633169483
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This makes the containers have an expected console size not only for
`run` but also for `create`. Also remove the comment, as this is no
longer ignored on Linux daemon since e994efcf64c133de799f16f5cd6feb1fc41fade4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
We should consider removing this file, but it's still used in some
scripts, so let's keep that one for later.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Wording and documentation still need to be updated, but will do
so in a follow-up.
Also removing the default "10 seconds" from the timeout flags, as
this default is not actually used, and may not match the actual
default (which is defined on the daemon side).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Formatting stats runs in a loop to refresh the stats for each container. This
patch makes some small performance improvments by reducing the use of Sprintf
in favor of concatenating strings, and using strconv directly where possible.
Benchmark can be run with:
GO111MODULE=off go test -test.v -test.bench '^BenchmarkStatsFormat' -test.run '^$' ./cli/command/container/
Before/after:
BenchmarkStatsFormatOld-8 2655 428064 ns/op 62432 B/op 5600 allocs/op
BenchmarkStatsFormat-8 3338 335822 ns/op 52832 B/op 4700 allocs/op
Average of 5 runs;
benchstat old.txt new.txt
name old time/op new time/op delta
StatsFormat-8 432µs ± 1% 344µs ± 5% -20.42% (p=0.008 n=5+5)
name old alloc/op new alloc/op delta
StatsFormat-8 62.4kB ± 0% 52.8kB ± 0% -15.38% (p=0.000 n=5+4)
name old allocs/op new allocs/op delta
StatsFormat-8 5.60k ± 0% 4.70k ± 0% -16.07% (p=0.008 n=5+5)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
```
cli/command/container/hijack.go:188:1⚠️ nolint directive did not match any issue (nolint)
cli/command/image/trust.go:346:1⚠️ nolint directive did not match any issue (nolint)
cli/command/manifest/push.go:211:1⚠️ nolint directive did not match any issue (nolint)
cli/command/trust/signer_remove.go:79:1⚠️ nolint directive did not match any issue (nolint)
internal/pkg/containerized/snapshot.go:95:1⚠️ nolint directive did not match any issue (nolint)
internal/pkg/containerized/snapshot.go:138:1⚠️ nolint directive did not match any issue (nolint)
```
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This hides the flags when connecting to an older engine, or if
swarm is not enabled, and is also used to add badges in the
documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Prevent completion on "create" subcommands to prevent them
from completing with local filenames
- Add completion for "docker image save"
- Add completion for "docker image tag"
- Disable completion for "docker login"
- Exclude "paused" containers for "docker container attach" and
"docker container exec"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn
Sebastiaan van Stijn
Phong Tran
Nicolas De loof
Paweł Gronowski
ollypom
Brian Goff
Drew Erny