Synchronize append on the `removed` slice with mutex because
containerRemoveFunc is called in parallel for each removed container by
`container rm` cli command.
Also reduced the shared access area by separating the scopes of test
cases.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit b811057181)
Add also `exec_die` event.
Signed-off-by: Melroy van den Berg <melroy@melroy.org>
(cherry picked from commit 946bb9471b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 720a6a8239)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This fix tries to address issues raised in moby/moby#44346.
The max-concurrent-downloads and max-concurrent-uploads limits are applied for the whole engine and not for each pull/push command.
Signed-off-by: Luis Henrique Mulinari <luis.mulinari@gmail.com>
I think the cli code block misses a backslash to brevent line break when copy/pasting it to a terminal.
I doubt that this is intentional, if it is, feel free to reject the pr.
Signed-off-by: Julian <gitea+julian@ic.thejulian.uk>
(cherry picked from commit 895e7a3df8)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
With dual logging enabled by default, `docker logs` works regardless of the logging driver used
Signed-off-by: Mathieu Rollet <matletix@gmail.com>
(cherry picked from commit 1158788c8c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: David Karlsson <david.karlsson@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit e064f893a6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: David Karlsson <david.karlsson@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 802c53fa9d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
> Security options with `:` as a separator are deprecated and will be completely unsupported in 17.04, use `=` instead.
Signed-off-by: Felix Geyer <debfx@fobos.de>
(cherry picked from commit 4648c00848)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `DEBIAN_FRONTEND` environment variable is used to control the interface by which debconf questions are presented to the user (see [`man 7 debconf`][1]). In `DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y`, the `DEBIAN_FRONTEND` environment variable is only set for the `apt-get update` command which does not ask debconf questions, and will not affect the `apt-get install` command where these questions are actually asked. It should be the other way around.
[1]: https://manpages.debian.org/debconf.7.html
Signed-off-by: Murukesh Mohanan <murukesh.mohanan@gmail.com>
(cherry picked from commit 7227c0145d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the "default output" section into the description, and
describe the section that can be found in the output.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 99bb525f98)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Includes security fixes for net/http (CVE-2022-41717, CVE-2022-41720),
and os (CVE-2022-41720).
These minor releases include 2 security fixes following the security policy:
- os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
The os.DirFS function and http.Dir type provide access to a tree of files
rooted at a given directory. These functions permitted access to Windows
device files under that root. For example, os.DirFS("C:/tmp").Open("COM1")
would open the COM1 device.
Both os.DirFS and http.Dir only provide read-only filesystem access.
In addition, on Windows, an os.DirFS for the directory \(the root of the
current drive) can permit a maliciously crafted path to escape from the
drive and access any path on the system.
The behavior of os.DirFS("") has changed. Previously, an empty root was
treated equivalently to "/", so os.DirFS("").Open("tmp") would open the
path "/tmp". This now returns an error.
This is CVE-2022-41720 and Go issue https://go.dev/issue/56694.
- net/http: limit canonical header cache by bytes, not entries
An attacker can cause excessive memory growth in a Go server accepting
HTTP/2 requests.
HTTP/2 server connections contain a cache of HTTP header keys sent by
the client. While the total number of entries in this cache is capped,
an attacker sending very large keys can cause the server to allocate
approximately 64 MiB per open connection.
This issue is also fixed in golang.org/x/net/http2 vX.Y.Z, for users
manually configuring HTTP/2.
Thanks to Josselin Costanzi for reporting this issue.
This is CVE-2022-41717 and Go issue https://go.dev/issue/56350.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.18.9
And the milestone on the issue tracker:
https://github.com/golang/go/issues?q=milestone%3AGo1.18.9+label%3ACherryPickApproved
Full diff: https://github.com/golang/go/compare/go1.18.8...go1.18.9
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This allows us to pin to a specific version of Alpine, in case the
golang:alpine image switches to a newer version, which may at times
be incompatible, e.g. see https://github.com/moby/moby/issues/44570
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1b0d6fc804)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
On Windows, syscall.StartProcess and os/exec.Cmd did not properly
check for invalid environment variable values. A malicious
environment variable value could exploit this behavior to set a
value for a different environment variable. For example, the
environment variable string "A=B\x00C=D" set the variables "A=B" and
"C=D".
Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this
issue.
This is CVE-2022-41716 and Go issue https://go.dev/issue/56284.
This Go release also fixes https://github.com/golang/go/issues/56309, a
runtime bug which can cause random memory corruption when a goroutine
exits with runtime.LockOSThread() set. This fix is necessary to unblock
work to replace certain uses of pkg/reexec with unshared OS threads.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `--platform` flag has been out of experimental for a while now. 🎉
Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
(cherry picked from commit 9505330b07)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This example was mounting `/dev/zero` as `/dev/nulo` inside the container.
The `nulo` name was intended to be a "made up / custom" name, but various
readers thought it to be a typo for `/dev/null`.
This patch updates the example to use `/dev/foobar` as name, which should
make it more clear that it's a custom name.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit aea2a8c410)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn
Paweł Gronowski
Melroy van den Berg
Luis Henrique Mulinari
Sebastiaan van Stijn
Julian
Mathieu Rollet
David Karlsson
Felix Geyer
Murukesh Mohanan
Akihiro Suda
CrazyMax
Tianon Gravi
Bishal Das
acouvreur