Set's an apparmor profile on the OCI spec if one is configred on the
worker.
Adds selinux labels to containers (only added if selinux is enabled on
the system).
This assumes that the specified apparmor profile is already loaded on
the system and does not try to load it or even check if it is loaded.
SELinux support requires the `selinux` build tag to be added.
Likewise, `runc` would require both the `apparmor` and `selinux` build
tags.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Vendored go-selinux to v1.8.0
Fixed tests
Signed-off-by: Tibor Vass <tibor@docker.com>
full diff: 75b288015a...c1f2f97bff
relevant changes:
- ssh: improve error message for KeyboardInteractiveChallenge
- ssh: remove slow unnecessary diffie-hellman-group-exchange primality check
other changes (not in vendor);
- ssh/terminal: replace with a golang.org/x/term wrapper
- Deprecates ssh/terminal in favor of golang.org/x/term
- ssh/terminal: add support for zos
- ssh/terminal: bump x/term dependency to fix js/nacl
- pkcs12: document that we use the wrong PEM type
- pkcs12: drop PKCS#12 attributes with unknown OIDs
- nacl/auth: use Size instead of KeySize for Sum output
- ocsp: Improve documentation for ParseResponse and ParseResponseForCert
- sha3: remove go:nocheckptr annotation
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While we try to keep the containerd and docker seccomp profiles in sync,
they may not always be; this switches the executor to use the docker
seccomp profile, so that buildkit (when vendored in docker) will use
the same default seccomp profile as is used for containers.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: c3ed55f3b4...0834f99b7b
- copy: use Clonefileat from golang.org/x/sys/unix on macOS
- go.mod: update opencontainers/go-digest v1.0.0
- Add github action CI
- github: test go1.15
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
github.com/Microsoft/go-winio v0.4.15 was tagged; same commit as was
already vendored, so no code-changes.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
mountinfo v0.4.0
------------------------
Breaking changes:
* `PidMountInfo` is now deprecated and will be removed before v1.0; users should
switch to `GetMountsFromReader`
Fixes and improvements:
* run filter after all fields are parsed
* correct handling errors from `bufio.Scan`
* documentation formatting fixes
mountinfo v0.3.1
------------------------
Breaking changes:
* `FstypeFilter` is changed to `FSTypeFilter` to be in-line with the field name.
Fixes and improvements:
* Fixed `FilterFunc` doc.
mountinfo v0.3.0
------------------------
Breaking changes:
* Some field names of `struct Mountinfo` are changed to be more in-line with Go
naming conventions. Users need to be converted.
Fixes and improvements:
* Fixed per-package doc to be shown by `go doc`
* Make `GetMountsFromReader` Linux-specific.
* OpenBSD support added (same code as FreeBSD; not tested).
mountinfo v0.2.0
------------------------
Bug fixes:
* Fix path unescaping for paths with double quotes
Improvements:
* `Mounted`: speed up by adding fast paths using `openat2` (Linux-only, #29) and `stat`
* `Mounted`: relax path requirements (allow relative, non-cleaned paths, symlinks)
* Unescape `fstype` and `source` fields
* Documentation improvements
Testing/CI:
* Unit tests: exclude darwin
* CI: run tests under Fedora 32 to test openat2
* `TestGetMounts`: fix for Ubuntu build system
* Makefile: fix ignoring test failures
* CI: add cross build
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
mount v0.1.1
------------------------
Improvements:
- `RecursiveUnmount`: add a fast path
- `Unmount`: improve doc
- fix CI linter warning on Windows
Testing/CI:
- Unit tests: exclude darwin
- Makefile: fix ignoring test failures
- CI: add cross build
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: 4634ce647c...c2cc352355
also adds github.com/cilium/ebpf as a dependency, which I set to the same
version as is set in containerd/cgroups version
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Current stargz snapshotter pkg doesn't contain registry configuration and the
client of that pkg needs to pass it to that pkg. So this commit includes changes
of propagating buildkitd's registry configuration to stargz snapshotter.
But this is a partial integration of registry logic between buildkitd and stargz
snapshotter because buildkitd's session-based authentication logic is still not
applied to stargz snapshotter. This means private images that require
`~/.docker/config.json` creds can't be lazily pulled yet.
Signed-off-by: ktock <ktokunaga.mail@gmail.com>
full diff: https://github.com/sirupsen/logrus/compare/v1.6.0...v1.7.0
removes dependency on github.com/konsorten/go-windows-terminal-sequences
Features:
* a new buffer pool management API has been added
* a set of `<LogLevel>Fn()` functions have been added
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/pkg/profile/compare/v1.2.1...v1.5.0
v1.5.0
-------------------------
- Add MemProfileType to allow overriding type of memory profile
- Make Go 1.13 the minimum supported Go version.
v1.4.0
-------------------------
- Added goroutine profiling
v1.3.0
-------------------------
- Add ThreadcreationProfile
- Bump Go versions
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/gofrs/flock/compare/v0.7.0...v0.7.3
v0.7.3
-------------------------
- Fix issues in the license file, update year.
v0.7.2
-------------------------
- Ensure we release file handle if we failed to take an exclusive lock
v0.7.1
-------------------------
- Fix linting issues and add goreportcard badge
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The Windows API is completely different, so the common code cannot
create the unique identifier, but must accept what the OS-specific code
does.
For Linux, it's a pathname. In Windows, it's a GUID string.
This pulls in direct usage of Microsoft/hcsshim, which previously was
only an indirect usage via containerd calls from, e.g., localMounter on
Windows.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
Akihiro Suda
Brian Goff
Tõnis Tiigi
Sebastiaan van Stijn
Edgar Lee
ktock
Cory Bennett
Akihiro Suda
Ilya Dmitrichenko
Paul "TBBle" Hampson
Sam Whited