Commit Graph

34 Commits

Author SHA1 Message Date
Sebastiaan van Stijn 9e1f8d646e
image/build: use "nolint" comment to work around gosec regression
Latest gosec linter has a regression in parsing "nosec" comments;
see https://github.com/securego/gosec/issues/1046

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-10-24 11:10:51 +02:00
Sebastiaan van Stijn c2535aa467
build: error if Dockerfile name is passed with Dockerfile from stdin
When passing a Dockerfile through stdin, it's not possible to specify the
name of the Dockerfile (using the `-f` option). When building with BuildKit
enabled, an error is already produced for this case, but the classic builder
silently ignored it.

This patch adds an error for this situation:

    echo -e 'FROM busybox' | DOCKER_BUILDKIT=0 docker build -f some.Dockerfile -
    DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
    BuildKit is currently disabled; enable it by removing the DOCKER_BUILDKIT=0
    environment-variable.

    unable to prepare context: ambiguous Dockerfile source: both stdin and flag correspond to Dockerfiles

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-06-13 14:03:03 +02:00
Sebastiaan van Stijn 4cf04988ae
remove uses of golang.org/x/sys/execabs
the "golang.org/x/sys/execabs" package was introduced to address a security
issue on Windows, and changing the default behavior of os/exec was considered
a breaking change. go1.19 applied the behavior that was previously implemented
in the execabs package;

from the release notes: https://go.dev/doc/go1.19#os-exec-path

> Command and LookPath no longer allow results from a PATH search to be found
> relative to the current directory. This removes a common source of security
> problems but may also break existing programs that depend on using, say,
> exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe)
> in the current directory. See the os/exec package documentation for information
> about how best to update such programs.
>
> On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath
> environment variable, making it possible to disable the default implicit search
> of “.” in PATH lookups on Windows systems.

With those changes, we no longer need to use the execabs package, and we can
switch back to os/exec.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-26 02:03:45 +02:00
Sebastiaan van Stijn 2b7bfb3994
cli/command/image/build: GetContextFromReader: rename var that collided
This var collided with the `archive/tar` import.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-03 17:02:12 +02:00
Sebastiaan van Stijn 8a19043cc7
Merge pull request #3798 from thaJeztah/gofumpt_linting
Use gofumpt if available, and enable gofumpt linter
2022-11-04 19:04:51 +01:00
Sebastiaan van Stijn 6fe31557cb
vendor: docker v20.10.3-0.20221006185438-87d9d96ab0b6 (v22.06-dev)
full diff: e143eed8bc...87d9d96ab0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-10-21 15:15:11 +02:00
Sebastiaan van Stijn 616124525e
format go with gofumpt (with -lang=1.19)
Looks like the linter uses an explicit -lang, which (for go1.19)
results in some additional formatting for octal values.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-30 19:14:36 +02:00
Sebastiaan van Stijn d3d9301d2d
linting: use consts from stdlib (usestdlibvars)
cli/command/image/build/context.go:238:23: "400" can be replaced by http.StatusBadRequest (usestdlibvars)
        if resp.StatusCode < 400 {
                             ^
    cli/trust/trust.go:139:30: "GET" can be replaced by http.MethodGet (usestdlibvars)
        req, err := http.NewRequest("GET", endpointStr, nil)
                                    ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-03 21:25:32 +02:00
Sebastiaan van Stijn dc9e069ff2
vendor: github.com/docker/docker v20.10.3-0.20220309172631-83b51522df43
Changed `matcher.Matches(file)` to `matcher.MatchesOrParentMatches(file)`:

    cli/command/image/build/context.go:95:9: SA1019: matcher.Matches is deprecated: This implementation is buggy (it only checks a single parent dir against the pattern) and will be removed soon. Use either MatchesOrParentMatches or MatchesUsingParentResults instead.  (staticcheck)
        return matcher.Matches(file)
               ^

And updated a test to match the JSON omitting empty RootFS.Type fields (in
practice, this field should never be empty in real situations, and always
be "layer"). Changed the test to use subtests to easier find which case
is failing.

full diff: 343665850e...83b51522df

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-09 18:45:37 +01:00
Sebastiaan van Stijn d14b5bff80
cli/command/image: remove deprecated io/ioutil and use t.TempDir()
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-02-25 15:41:55 +01:00
Sebastiaan van Stijn 847aef321e
build: fix AddDockerfileToBuildContext not de-referencing tar header template
Commit 73aef6edfe
modified archive.ReplaceFileTarWrapper to set the Name field in the tar header,
if the field was not set.

That change exposed an issue in how a Dockerfile from stdin was sent to the daemon.
When attempting to build using a build-context, and a Dockerfile from stdin, the
following happened:

```bash
mkdir build-stdin && cd build-stdin && echo hello > hello.txt

DOCKER_BUILDKIT=0 docker build --no-cache -t foo -f- . <<'EOF'
FROM alpine
COPY . .
EOF

Sending build context to Docker daemon  2.607kB
Error response from daemon: dockerfile parse error line 1: unknown instruction: .DOCKERIGNORE
```

Removing the `-t foo`, oddly lead to a different failure:

```bash
DOCKER_BUILDKIT=0 docker build --no-cache -f- . <<'EOF'
FROM alpine
COPY . .
EOF

Sending build context to Docker daemon  2.581kB
Error response from daemon: Cannot locate specified Dockerfile: .dockerfile.701d0d71fb1497d6a7ce
```

From the above, it looks like the tar headers got mangled, causing (in the first
case) the daemon to use the build-context tar as a plain-text file, and therefore
parsing it as Dockerfile, and in the second case, causing it to not being able to
find the Dockerfile in the context.

I noticed that both TarModifierFuncs were using the same `hdrTmpl` struct, which
looks to caused them to step on each other's toes. Changing them to each initialize
their own struct made the issue go away.

After this change:

```bash
DOCKER_BUILDKIT=0 docker build --no-cache -t foo -f- . <<'EOF'
FROM alpine
COPY . .
EOF
Sending build context to Docker daemon  2.607kB
Step 1/2 : FROM alpine
 ---> d4ff818577bc
Step 2/2 : COPY . .
 ---> 556f745e6938
Successfully built 556f745e6938
Successfully tagged foo:latest

DOCKER_BUILDKIT=0 docker build --no-cache -f- . <<'EOF'
FROM alpine
COPY . .
EOF

Sending build context to Docker daemon  2.607kB
Step 1/2 : FROM alpine
 ---> d4ff818577bc
Step 2/2 : COPY . .
 ---> aaaee43bec5e
Successfully built aaaee43bec5e
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-10 23:19:14 +02:00
Tibor Vass 8d199d5bba Use golang.org/x/sys/execabs
On Windows, the os/exec.{Command,CommandContext,LookPath} functions
resolve command names that have neither path separators nor file extension
(e.g., "git") by first looking in the current working directory before
looking in the PATH environment variable.
Go maintainers intended to match cmd.exe's historical behavior.

However, this is pretty much never the intended behavior and as an abundance of precaution
this patch prevents that when executing commands.
Example of commands that docker.exe may execute: `git`, `docker-buildx` (or other cli plugin), `docker-credential-wincred`, `docker`.

Note that this was prompted by the [Go 1.15.7 security fixes](https://blog.golang.org/path-security), but unlike in `go.exe`,
the windows path lookups in docker are not in a code path allowing remote code execution, thus there is no security impact on docker.

Signed-off-by: Tibor Vass <tibor@docker.com>
2021-01-26 17:18:04 +00:00
Sebastiaan van Stijn 612d83d6df
cli: remove unnecessary newlines (whitespace)
```
cli/config/config_test.go:465: unnecessary trailing newline (whitespace)

}
cli/compose/interpolation/interpolation.go:56: unnecessary leading newline (whitespace)
	switch value := value.(type) {

cli/compose/interpolation/interpolation.go:94: unnecessary trailing newline (whitespace)

	}
cli/command/image/build/context.go:348: unnecessary trailing newline (whitespace)

		}
internal/licenseutils/client_test.go:98: unnecessary leading newline (whitespace)
func (c *fakeLicensingClient) LoadLocalLicense(ctx context.Context, dclnt licensing.WrappedDockerClient) (*model.Subscription, error) {

cli/registry/client/fetcher.go:211: unnecessary leading newline (whitespace)
	for _, endpoint := range endpoints {
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-31 19:22:36 +01:00
Sebastiaan van Stijn 0e4bd30cfe
cli/command/image/build: G107: Potential HTTP request made with variable url (gosec)
cli/command/image/build/context.go:235: G107: Potential HTTP request made with variable url (gosec)
    	if resp, err = http.Get(url); err != nil {

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-31 19:22:28 +01:00
Sam ee76ac8f93 fix formatting issue of encoded urlSigned-off-by: Sam <samashah@microsoft.com> 2019-09-25 22:58:04 +00:00
Nao YONASHIRO 446762dc19 test: add filepathMatches test
Signed-off-by: Nao YONASHIRO <owan.orisano@gmail.com>
2019-03-28 01:22:11 +09:00
Nao YONASHIRO b41ddc6058 feat: improves ValidateContextDirectory performance
Signed-off-by: Nao YONASHIRO <owan.orisano@gmail.com>
2019-03-28 01:20:42 +09:00
Kir Kolyshkin 0c20554f69 image build: fix archive detection
As pointed out in #1459, docker cli fails to detect that the input is a tarball,
in case it is generated by `git archive --format=tgz`.

This happens because `git archive` adds some metadata to the initial tar header,
and so it is more than 1 block (of 512 bytes) long, while we only provide 1 block
to archive/tar.Next() and it fails.

To fix, give it 2 blocks :)

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2019-03-21 15:38:07 -07:00
Tibor Vass b3a5c153d5 build: address some review nits
Signed-off-by: Tibor Vass <tibor@docker.com>
2018-06-13 22:40:31 +00:00
Tibor Vass 00792d1704 build: ensure temporary folder is removed in error case
Signed-off-by: Tibor Vass <tibor@docker.com>
2018-06-13 18:32:29 +00:00
Tibor Vass 5919e8a30f build: fix lint issues + refactor
Signed-off-by: Tibor Vass <tibor@docker.com>
2018-06-13 18:32:28 +00:00
Tibor Vass 15674d9ee9 build: simplify Close logic in WriteTempDockerfile
Signed-off-by: Tibor Vass <tibor@docker.com>
2018-06-13 18:32:28 +00:00
Tibor Vass e0b3921a03 build: Add support for using context from stdin with buildkit
Signed-off-by: Tibor Vass <tibor@docker.com>
2018-06-09 20:51:34 +00:00
Justyn Temme c2a35cfa1a Change error message for unreadable files
Fix for https://github.com/docker/for-linux/issues/44

Signed-off-by: Justyn Temme <justyntemme@gmail.com>
2018-05-11 13:03:19 -05:00
Sebastiaan van Stijn a1048523d2
Allow Dockerfile from outside build-context
Historically, the Dockerfile had to be insde the build-context, because it was
sent as part of the build-context.

3f6dc81e10
added support for passing the Dockerfile through stdin, in which case the
contents of the Dockerfile is injected into the build-context.

This patch uses the same mechanism for situations where the location of the
Dockerfile is passed, and its path is outside of the build-context.

Before this change:

    $ mkdir -p myproject/context myproject/dockerfiles && cd myproject
    $ echo "hello" > context/hello
    $ echo -e "FROM busybox\nCOPY /hello /\nRUN cat /hello" > dockerfiles/Dockerfile
    $ docker build --no-cache -f $PWD/dockerfiles/Dockerfile $PWD/context

    unable to prepare context: the Dockerfile (/Users/sebastiaan/projects/test/dockerfile-outside/myproject/dockerfiles/Dockerfile) must be within the build context

After this change:

    $ mkdir -p myproject/context myproject/dockerfiles && cd myproject
    $ echo "hello" > context/hello
    $ echo -e "FROM busybox\nCOPY /hello /\nRUN cat /hello" > dockerfiles/Dockerfile
    $ docker build --no-cache -f $PWD/dockerfiles/Dockerfile $PWD/context

    Sending build context to Docker daemon  2.607kB
    Step 1/3 : FROM busybox
     ---> 6ad733544a63
    Step 2/3 : COPY /hello /
     ---> 9a5ae1c7be9e
    Step 3/3 : RUN cat /hello
     ---> Running in 20dfef2d180f
    hello
    Removing intermediate container 20dfef2d180f
     ---> ce1748f91bb2
    Successfully built ce1748f91bb2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-02-20 16:50:49 +01:00
Daniel Nephin a04aa8fe28 Compress after rewriting the archive.
Write a test showing compress failure.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-06-29 13:18:10 -04:00
Daniel Nephin 0310de5213 Move IsArchive and HeaderSize to build/context
Previously these were in docker/docker/pkg/archive, but unused

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-06-08 16:08:11 -04:00
Vincent Demeester 44ac80881f
Update vendoring of docker/docker
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-06-06 00:23:21 +02:00
Daniel Nephin 779012af69 Refacator pkg/streamformatter
StreamFormatter suffered was two distinct structs mixed into a single struct
without any overlap.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-05-03 18:49:14 -07:00
Daniel Nephin 36a7842089 Fix goimports failure on master.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-05-03 15:58:39 -04:00
Daniel Nephin a5044b4982 Move addDockerfileToBuildContext to the build package.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-04-28 15:11:36 -04:00
Daniel Nephin b98e03d3b0 Extract dockerfile handling functions.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-04-28 15:11:36 -04:00
Daniel Nephin 59983759c2 Cleanup handling of the - for stdin
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-04-28 15:11:36 -04:00
Daniel Nephin 1630fc40f8 Import docker/docker/cli
Signed-off-by: Daniel Nephin <dnephin@gmail.com>
2017-04-17 17:40:59 -04:00