Set's an apparmor profile on the OCI spec if one is configred on the
worker.
Adds selinux labels to containers (only added if selinux is enabled on
the system).
This assumes that the specified apparmor profile is already loaded on
the system and does not try to load it or even check if it is loaded.
SELinux support requires the `selinux` build tag to be added.
Likewise, `runc` would require both the `apparmor` and `selinux` build
tags.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Vendored go-selinux to v1.8.0
Fixed tests
Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 68bb095353)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The git repo of github.com/containerd/stargz-snapshotter now has two go.mod modules:
- github.com/containerd/stargz-snapshotter
- github.com/containerd/stargz-snapshotter/estargz
So we need to have the following `replace` directive in `go.mod`:
```
github.com/containerd/stargz-snapshotter/estargz => github.com/containerd/stargz-snapshotter/estargz <VERSION>
```
Otherwise `go mod tidy` fails with the following error:
```
go: github.com/containerd/stargz-snapshotter@v0.2.1-0.20201217071531-2b97b583765b requires
github.com/containerd/stargz-snapshotter/estargz@v0.0.0-00010101000000-000000000000: invalid version: unknown revision 000000000000
```
ref: https://github.com/containerd/stargz-snapshotter/pull/195
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
full diff: 75b288015a...c1f2f97bff
relevant changes:
- ssh: improve error message for KeyboardInteractiveChallenge
- ssh: remove slow unnecessary diffie-hellman-group-exchange primality check
other changes (not in vendor);
- ssh/terminal: replace with a golang.org/x/term wrapper
- Deprecates ssh/terminal in favor of golang.org/x/term
- ssh/terminal: add support for zos
- ssh/terminal: bump x/term dependency to fix js/nacl
- pkcs12: document that we use the wrong PEM type
- pkcs12: drop PKCS#12 attributes with unknown OIDs
- nacl/auth: use Size instead of KeySize for Sum output
- ocsp: Improve documentation for ParseResponse and ParseResponseForCert
- sha3: remove go:nocheckptr annotation
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: c3ed55f3b4...0834f99b7b
- copy: use Clonefileat from golang.org/x/sys/unix on macOS
- go.mod: update opencontainers/go-digest v1.0.0
- Add github action CI
- github: test go1.15
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
github.com/Microsoft/go-winio v0.4.15 was tagged; same commit as was
already vendored, so no code-changes.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
mountinfo v0.4.0
------------------------
Breaking changes:
* `PidMountInfo` is now deprecated and will be removed before v1.0; users should
switch to `GetMountsFromReader`
Fixes and improvements:
* run filter after all fields are parsed
* correct handling errors from `bufio.Scan`
* documentation formatting fixes
mountinfo v0.3.1
------------------------
Breaking changes:
* `FstypeFilter` is changed to `FSTypeFilter` to be in-line with the field name.
Fixes and improvements:
* Fixed `FilterFunc` doc.
mountinfo v0.3.0
------------------------
Breaking changes:
* Some field names of `struct Mountinfo` are changed to be more in-line with Go
naming conventions. Users need to be converted.
Fixes and improvements:
* Fixed per-package doc to be shown by `go doc`
* Make `GetMountsFromReader` Linux-specific.
* OpenBSD support added (same code as FreeBSD; not tested).
mountinfo v0.2.0
------------------------
Bug fixes:
* Fix path unescaping for paths with double quotes
Improvements:
* `Mounted`: speed up by adding fast paths using `openat2` (Linux-only, #29) and `stat`
* `Mounted`: relax path requirements (allow relative, non-cleaned paths, symlinks)
* Unescape `fstype` and `source` fields
* Documentation improvements
Testing/CI:
* Unit tests: exclude darwin
* CI: run tests under Fedora 32 to test openat2
* `TestGetMounts`: fix for Ubuntu build system
* Makefile: fix ignoring test failures
* CI: add cross build
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
mount v0.1.1
------------------------
Improvements:
- `RecursiveUnmount`: add a fast path
- `Unmount`: improve doc
- fix CI linter warning on Windows
Testing/CI:
- Unit tests: exclude darwin
- Makefile: fix ignoring test failures
- CI: add cross build
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: 4634ce647c...c2cc352355
also adds github.com/cilium/ebpf as a dependency, which I set to the same
version as is set in containerd/cgroups version
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Current stargz snapshotter pkg doesn't contain registry configuration and the
client of that pkg needs to pass it to that pkg. So this commit includes changes
of propagating buildkitd's registry configuration to stargz snapshotter.
But this is a partial integration of registry logic between buildkitd and stargz
snapshotter because buildkitd's session-based authentication logic is still not
applied to stargz snapshotter. This means private images that require
`~/.docker/config.json` creds can't be lazily pulled yet.
Signed-off-by: ktock <ktokunaga.mail@gmail.com>
full diff: https://github.com/sirupsen/logrus/compare/v1.6.0...v1.7.0
removes dependency on github.com/konsorten/go-windows-terminal-sequences
Features:
* a new buffer pool management API has been added
* a set of `<LogLevel>Fn()` functions have been added
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/pkg/profile/compare/v1.2.1...v1.5.0
v1.5.0
-------------------------
- Add MemProfileType to allow overriding type of memory profile
- Make Go 1.13 the minimum supported Go version.
v1.4.0
-------------------------
- Added goroutine profiling
v1.3.0
-------------------------
- Add ThreadcreationProfile
- Bump Go versions
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/gofrs/flock/compare/v0.7.0...v0.7.3
v0.7.3
-------------------------
- Fix issues in the license file, update year.
v0.7.2
-------------------------
- Ensure we release file handle if we failed to take an exclusive lock
v0.7.1
-------------------------
- Fix linting issues and add goreportcard badge
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Windows API is completely different, so the common code cannot
create the unique identifier, but must accept what the OS-specific code
does.
For Linux, it's a pathname. In Windows, it's a GUID string.
This pulls in direct usage of Microsoft/hcsshim, which previously was
only an indirect usage via containerd calls from, e.g., localMounter on
Windows.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
While real overlayfs is available only in Ubuntu and Debian kernels,
fuse-overlayfs is universally available for kernel >= 4.18.
For dockerized deployment, `--device /dev/fuse` needs to be added to
`docker run` flags.
Kubernetes deployment needs a custom device plugin that enables
`/dev/fuse`, e.g. https://github.com/honkiko/k8s-hostdev-plugin
Instead of a device plugin, the device can be also enabled by setting
`securityContext.privileged` to `true`.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
full diff: 3d2716dd0a...0f039a052c
- tonistiigi/fsutil#68 fix gocrypto commit
- tonistiigi/fsutil#69 receive: use filter on receive diff
- prevents incremental transfers with userns because the metadata
on disk is always different than the one being transferred.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
To update containerd with go mod, it is NOT possible to simply do:
```
go get github.com/containerd/containerd@7c1e88399ec0
```
because it would result in:
```
v1.2.1-0.20190507210959-7c1e88399ec0
```
which is an incorrect version prefix as we want the commit 7c1e88399
from master to have higher priority than a tagged version such as v1.2.*
We want to use a `v1.3.0-0.` prefix even though v1.3.* tags do not exist,
so that when they do, those do have higher priority compared to 7c1e88399.
In other words, containerd's master branch corresponds to a v1.3 dev branch.
The following was thus used to update containerd:
```
go get -d github.com/containerd/containerd@v1.3.0-0.20190507210959-7c1e88399ec0
go get -d github.com/opencontainers/runc@v1.0.0-rc8
make vendor
```
Signed-off-by: Tibor Vass <tibor@docker.com>
go get -u github.com/tiborvass/gomod
GO111MODULE=on gomod init
GO111MODULE=on go mod tidy
GO111MODULE=on go mod vendor
Signed-off-by: Tibor Vass <tibor@docker.com>
Tonis Tiigi
Brian Goff
ktock
Akihiro Suda
Sebastiaan van Stijn
Cory Bennett
Akihiro Suda
Ilya Dmitrichenko
Paul "TBBle" Hampson
Sam Whited
Xiaofan Zhang
Zach Badgett
Derek McGowan
Tibor Vass
Akihiro Suda