1. Revendors github.com/Microsoft/hcsshim to the latest known good commit.
This includes numerous bug fixes and improvements.
2. Vendors indirect dependency on go.opencensus.io since hcsshim now uses trace
correlation.
Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
We are separating out the encryption code and have designed a few new
interfaces and APIs for processing content streams. This keep the core
clean of encryption code but enables not only encryption but support of
multiple content types ( custom media types ).
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
bump go-runc to 9007c2405372fe28918845901a3276c0915689a1
in order to support get actually error log if checkpint fail, this
version get two new diff
Add common project content/checks:
8e51df4212
Fix Method of judging command execution
failure:4e99c72acd
Signed-off-by: Ace-Tang <aceapril@126.com>
This also refactors the lcow and windows
snapshotters to use go-winio's utility functions for checking the
filesystem type.
Signed-off-by: Eric Hotinger <ehotinger@gmail.com>
full diff: 32f571b700...689e3c1541
Release notes:
* Version 0.9.1 - May 21, 2019
- Minimum supported version of libseccomp bumped to v2.2.0 (fc0298087f)
- PowerPC and S390(x) architectures are unavailable below library version v2.3.0 and will return errors if used with incompatible libraries
- Use Libseccomp's `seccomp_version` API to retrieve library version
- Unconditionally set TSync attribute for filters, due to Go's heavily threaded nature
- Fix [CVE-2017-18367](https://nvd.nist.gov/vuln/detail/CVE-2017-18367) - Multiple syscall arguments were incorrectly combined with logical-OR, instead of logical-AND (06e7a29f36)
- Fix a failure to build on Debian-based distributions due to CGo code
- Fix unit test failures on 32-bit architectures
- Improve several errors to be more verbose about their causes
- Add support for SCMP_ACT_LOG (with libseccomp versions 2.4.x and higher), permitting syscalls but logging their execution
- Add support for SCMP_FLTATR_CTL_LOG (with libseccomp versions 2.4.x and higher), logging not-allowed actions when they are denied
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Full diff: https://github.com/sirupsen/logrus/compare/v1.3.0...v1.4.1
Fixes:
- Remove dependency on golang.org/x/crypto
- Fix wrong method calls Logger.Print and Logger.Warningln
- Update Entry.Logf to not do string formatting unless the log level is enabled
- Fix infinite recursion on unknown Level.String()
- Fix race condition in getCaller
- Fix Entry.WithContext method to return a copy of the initial entry
New:
- Add DeferExitHandler, similar to RegisterExitHandler but prepending the handler to the list of handlers (semantically like defer)
- Add CallerPrettyfier to JSONFormatter and `TextFormatter`
- Add Entry.WithContext() and Entry.Context, to set a context on entries to be used e.g. in hooks
- Enhance TextFormatter to not print caller information when they are empty
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Docker registries return errors in a know format so this change now checks for these
errors and returns the message field. If the error is not in the expected format fall
back to the original behaviour.
https://github.com/containerd/containerd/issues/3076
Signed-off-by: Jack Baines <jack.baines@uk.ibm.com>
This includes an improved fix for CVE-2019-5736 to reduce the
increased memory-consumption introduced by the original patch,
RHEL 7.6 getting into a loop due to a kernel bug in those kernels,
and improve compatibility with older kernels.
changes included:
- opencontainers/runc#1973 Vendor opencontainers/runtime-spec 29686dbc
- opencontainers/runc#1978 Remove detection for scope properties, which have always been broken
- opencontainers/runc#1963 Vendor in go-criu and use it for CRIU's RPC definition
- opencontainers/runc#1995 exec: expose --preserve-fds
- opencontainers/runc#2000 fix preserve-fds flag may cause runc hang
- opencontainers/runc#1968 Create bind mount mountpoints during restore
- opencontainers/runc#1984 nsenter: cloned_binary: "memfd" cleanups
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Includes 6635b4f0c6,
which fixes a vulnerability in runc that allows a container escape (CVE-2019-5736)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
```
1152b960fcee041f50df15cdc67c29dbccf801ef (HEAD -> master, origin/master)
Merge pull request #73 from gliptak/gofmt1
afd5981a16647b45b6dba3a50a88418b576cc17d Gofmt cgroup_test
65ce98b3dfeb0a9a8fecd7e4ebffb24ad0bfe28f Merge pull request #69 from
cclerget/master-weight-pointer
0f372c6d4a65a49c72b0afbd1aee6214637958bf Merge pull request #71 from
JoeWrightss/patch-1
f48bd85c9cbc306fada0cebc3a646a1f1fe99afe Fixs return error message
10cd53efd916e22b9bdea67223d287684f57f1f4 Merge pull request #70 from
gliptak/patch-1
64bade4cea6c438ee51a7a12528225946b42c6ca Take value instead of pointer
value
b49c4713f3824e81bfa67faddcdde1414171b54e Correct ineffassign warning
3bc6dde829bc2dc8d4097ce8ad5acc275de3df06 Merge pull request #68 from
cclerget/master-net_prio-typo
6b552a86e60e31903d3f8f3f494eda71f562cc54 Fix net_prio typo
c0437c3dd5958f74d7f54e9f5def749850b9d6a1 Merge pull request #67 from
gpanouts/get-all-cgroup-tasks
a31a0ff985237eddf30d9fe30a3643c7da4ae912 Add functionality for
retrieving all tasks of a cgroup
82cb49fc1779971dfef4ad696f1453f6f44987b1 Merge pull request #63 from
ChrsMark/lenient-subsystems-checking
7d825b29aecc02bb1e9bede427f8ed62bbc3030d Add test for cgroups load when
missing hierarchy in one subsystem
f6cbfb45aec6a2590c7e7f4b84a080602b3e642d Change Load function in order
to be more lenient on subsystems' checking
965bb1da4db7c8ce2690108c5a081562ce7493cb Merge pull request #66 from
crosbymichael/systemdci
ab9ec0e4abde2c2cb999719ff43af2d3b5830f75 (fork/systemdci, systemdci) Add
go-systemd dep for CI testing
0e94a83b6eb6cf4bc05d7f91ec1eaad57a77d3b6 Merge pull request #59 from
gliptak/patch-1
4479d118c89b5500a08cce7a78bbe822229c1e65 Merge pull request #62 from
estesp/fix-gofmt
9beb998c23f510b1e6670ad7791807eb9aff6741 Merge pull request #61 from
gliptak/patch-3
9a09e5899acc95fabcc620d6489fec674e6dddfa Fix gofmt of systemd.go
84e6e6ed2afdf661cd9dbf47c6f3412b546bc67f Merge pull request #60 from
gliptak/patch-2
e13f6cc3b9637c36e6a8af393b561127498f4be5 Add GoReportCard badge to
README
d124595ee85c245e7c1443fe402adf7ce4f7f6a4 Add Go 1.11 to Travis
d961ab930c38eb8bedcded479f1708b2ef4984c5 Correct typo
d2400726cfa7904fb79e3b896ec0e6ae500a76bd Merge pull request #57 from
estesp/project-update
e4cf832b95deb7ce898ece716307abc35cbd0a09 Add project references and use
common project travis
8baeff6b9d069acde48ef1bedec7e0f8ba684f05 Merge pull request #56 from
grantseltzer/patch-1
9de57ffeb46f6179333d7939436d92dcb5631e5f Add godoc badge to README.md
5017d4e9a9cf2d4381db99eacd9baf84b95bfb14 Merge pull request #54 from
WeiZhang555/bugfix
13aaafdc37e772059d3234ec762303537f440c5b Bugfix: can't write to cpuset
cgroup
58556f5ad8448d99a6f7bea69ea4bdb7747cfeb0 Merge pull request #53 from
baude/systemdslicedelegate
15ed73c1c075e6590ecf56170acedcba0da8167e systemd-239+ no longer allows
delegate slice
3024bc7cc0c88af4b32d38a14444f38e65ab169f Merge pull request #52 from
Sykomaniac/bugfix/slice-name
2596f332e449ea374f0f24a977437116714ce7ef Remove call to unitName
2e2922e146ed53ccf4481c245187b6afe244fded Merge pull request #51 from
containerd/type
0f3de2f77d3b76b3871242fbab2a6116179229af (type) Fix empty device type
```
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
logrus v1.0.3 was the first release that include the change in
terminal_windows.go that stops exec'ing "cmd ver" to obtain the version
information and rather uses the x/sys/crypto/terminal.IsTerminal on the
console fd. On Windows this is a significant performance difference to
avoid the additional process activation of the "cmd ver" for each
invocation of the shim/runhcs executables.
Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
This includes fixes for user namespaces as well as a long standing bug
for running docker and containerd inside an lxc container.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This change no longer requires the use of a UtlityVM on Windows to convert the
layer tar to an ext4 vhd for LCOW. This has a significant performance boost
that makes linux/amd64 layer extraction comparable to native Linux performance.
Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
Revendors to Microsoft/hcsshim v0.7.5 that added support for logging all
runhcs.exe commands via Windows named pipes. This now launches all runhcs.exe
commands and forwards debug logging to the containerd-shim-runhcs log when
with --debug.
Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
Signed-off-by: John Howard <jhoward@microsoft.com>
This is the maintained version of boltdb, which includes the Windows-specific fix
detailed in https://github.com/etcd-io/bbolt/pull/122
This makes sure that runc does not get any valid IO for the pipe. Some
builds and other containers will be stuck if they inspect stdin
expecially and its a pipe but not connected to any user input.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Some images like `criu` will have extra libs that it requires. This
adds lib support via LD_LIBRARY_PATH and InstallOpts
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
github.com/gotestyourself/gotestyourself moved to gotest.tools with
version 2.0.0. Moving to that one, bumping it to v2.1.0.
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
This change allows implementations to resolve the location of the actual data
using OCI descriptor fields such as MediaType.
No OCI descriptor field is written to the store.
No change on gRPC API.
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
This seems to pickup a bunch of *.c files and some other changes which follow
from having included some new packages because of that.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
This renames the license file (so automated tooling can find it, which I care
about) and also pulls in some documentation and comment changes, plus some
functional changes:
PR#33 -- future-proof the algorithm field.
PR#34 -- disallow upper case in hex portion.
No changes appear to be required to containerd code.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
We move from having our own generated version of the googleapis files to
an upstream version that is present in gogo. As part of this, we update
the protobuf package to 1.0 and make some corrections for slight
differences in the generated code.
The impact of this change is very low.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
Allows the client to choose the context to finish the lease.
This allows the client to switch contexts when the main context
used to the create the lease may have been cancelled.
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
I noticed this file showed up when revendoring dependencies
with vndr.
Also removed `github.com/Microsoft/opengcs` from vendor.conf
as it was not used;
2017/12/05 22:41:58 WARNING: package github.com/Microsoft/opengcs is unused, consider removing it from vendor.conf
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Because of a side-effect import, we have the possibility of pulling in
several unnecessary packages that are used by the plugin and not at
runtime to implement protobuf structures. Setting these imports to
`weak` prevents this from happening, reducing the total import set,
reducing memory usage and binary size.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
This bumps the runc version to 74a17296470088de3805e138d3d87c62e613dfc4
that includes various fixes.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This change removes the ClearONLCR from the console package providing
a console with the default settings from the console package.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Depends on https://github.com/containerd/go-runc/pull/24
The is currently a race with the reaper where you could miss some exit
events from processes.
The problem before and why the reaper was so complex was because
processes could fork, getting a pid, and then fail on an execve before
we would have time to register the process with the reaper. This could
cause pids to fill up in a map as a way to reduce the race.
This changes makes the reaper handle multiple subscribers so that the
caller can handle locking, for when they want to wait for a specific
pid, without affecting other callers using the reaper code.
Exit events are broadcast to multiple subscribers, in the case, the runc
commands and container pids that we get from a pid-file. Locking while
the entire container stats no longs affects runc commands where you want
to call `runc create` and wait until that has been completed.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This resolves logrus issues with containerd not being in sync with the
version runc is using.
This also updates the OCI runtime spec to v1.0.0
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
The race usually happens when `closeHandle()` and `prepareIo()` are called
concurrently; the former tries to set `closing` to `true` the latter tries
to read its value.
In order to avoid this issue, we added a lock around the variable.
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: update events package to include emitter and use envelope proto
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: add events service
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: enable events service and update ctr events to use events service
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
event listeners
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: helper func for emitting in services
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: improved cli for containers and tasks
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
create event envelope with poster
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: introspect event data to use for type url
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: use pb encoding; add event types
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: instrument content and snapshot services with events
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: instrument image service with events
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: instrument namespace service with events
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: add namespace support
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: only send events from namespace requested from client
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
events: switch to go-events for broadcasting
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
Updates content service to handle lock errors and return
them to the client. The client remote handler has been
updated to retry when a resource is locked until the
resource is unlocked or the expected resource exists.
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Update go-runc to 49b2a02ec1ed3e4ae52d30b54a291b75
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Add shim to restore creation
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Keep checkpoint path in service
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Add C/R to non-shim build
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Checkpoint rw and image
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Pause container on bind checkpoints
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Return dump.log in error on checkpoint failure
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Pause container for checkpoint
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Update runc to 639454475cb9c8b861cc599f8bcd5c8c790ae402
For checkpoint into to work you need runc version
639454475cb9c8b861cc599f8bcd5c8c790ae402 + and criu 3.0 as this is what
I have been testing with.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Move restore behind create calls
This remove the restore RPCs in favor of providing the checkpoint
information to the `Create` calls of a container. If provided, the
container will be created/restored from the checkpoint instead of an
existing container.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Regen protos after rebase
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
For runtime and image spec from OCI, reference the actual versions
instead of a git hash for clarity on versions in use.
Actual impact was zero; runtime spec was the exact hash of the released
rc5 already, image spec was one commit behind the tagged release, but
made no code changes other than version string.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
Update go-runc to master with portability fixes.
Subreaper only exists on Linux, and only Linux runs the shim in a
mount namespace.
With these changes the shim compiles on Darwin, which means the
whole build compiles without errors now.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
This updates containerd to use the latest versions of cgroups, fifo,
console, and go-runc from the containerd org.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This mainly fixes Linux vs generic Unix differences, with some
differences between Darwin and Freebsd (which are close bit not
identical). Should make fixing for other Unix platforms easier.
Note there are not yet `runc` equivalents for these platforms;
my current use case is image manipulation for the `moby` tool.
However there is interest in OCI runtime ports for both platforms.
Current status is that MacOS can build and run `ctr`, `dist`
and `containerd` and some operations are supported. FreeBSD 11
still needs some more fixes to continuity for extended attributes.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Adjust paths that were not canonical.
Add nested vendors that are required.
Now no errors with latest `vndr`.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
This fixes the ugly build errors on Alpine Linux which the old version gave
from C type mismatches, and now gives a nice neat line of whales on build...
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Also remove the comment fields in the vndr script, they are too hard to
keep up to date and add little value when we have the git commit
timestamps
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
That is, e55af28bae.
Since f77ece9cb5
the license files regex is case insensitive which picks up one more file.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
Updates to the gogo/protobuf dependency are required to correctly
generate time types. We also remove an unused windows dependency.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
This adds a config file for containerd configuration. It is hard to
have structure data on cli flags and the config file should be used for
the majority of fields when configuring containerd.
There are still a few flags on the daemon that override config file
values but flags should take a back seat going forward and should be
kept at a minimum.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
We now include btrfs in the snapshot driver test suite. This includes
the addition of parent links and name hashing into the btrfs driver.
We'll probably endup replacing this with a common metadata store, as
these relationships are generally identical between implementations.
A small bug was discovered in the delete implementation in the course
testing, so the btrfs package has been updated with a fix.
The overlay driver was modified accordingly with the btrfs driver to use
`Driver` as the exported type of each driver packge.
Signed-off-by: Stephen J Day <stephen.day@docker.com>
github.com/docker/docker/pkg/archive requires Sirupsen/logrus.
So let's remove sirupsen/logrus at the moment.
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Initial vendor list validated with empty $GOPATH
and only master checked out; followed by `make`
and verified that all binaries build properly.
Updates require github.com/LK4D4/vndr tool.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
