github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
370be0c18f
containerd/contrib/Dockerfile.test
Sebastiaan van Stijn 0fb2d91322
update go to go1.20.3, go1.19.8 
go1.20.3 (released 2023-04-04) includes security fixes to the go/parser,
html/template, mime/multipart, net/http, and net/textproto packages, as well
as bug fixes to the compiler, the linker, the runtime, and the time package.
See the Go 1.20.3 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.3+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.20.2...go1.20.3

go1.19.8 (released 2023-04-04) includes security fixes to the go/parser,
html/template, mime/multipart, net/http, and net/textproto packages, as well as
bug fixes to the linker, the runtime, and the time package. See the Go 1.19.8
milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.19.8+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.19.7...go1.19.8

Further details from the announcement on the mailing list:

We have just released Go versions 1.20.3 and 1.19.8, minor point releases.
These minor releases include 4 security fixes following the security policy:

- go/parser: infinite loop in parsing

  Calling any of the Parse functions on Go source code which contains `//line`
  directives with very large line numbers can cause an infinite loop due to
  integer overflow.
  Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
  This is CVE-2023-24537 and Go issue https://go.dev/issue/59180.

- html/template: backticks not treated as string delimiters

  Templates did not properly consider backticks (`) as Javascript string
  delimiters, and as such did not escape them as expected. Backticks are
  used, since ES6, for JS template literals. If a template contained a Go
  template action within a Javascript template literal, the contents of the
  action could be used to terminate the literal, injecting arbitrary Javascript
  code into the Go template.

  As ES6 template literals are rather complex, and themselves can do string
  interpolation, we've decided to simply disallow Go template actions from being
  used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe
  way to allow this behavior. This takes the same approach as
  github.com/google/safehtml. Template.Parse will now return an Error when it
  encounters templates like this, with a currently unexported ErrorCode with a
  value of 12. This ErrorCode will be exported in the next major release.

  Users who rely on this behavior can re-enable it using the GODEBUG flag
  jstmpllitinterp=1, with the caveat that backticks will now be escaped. This
  should be used with caution.

  Thanks to Sohom Datta, Manipal Institute of Technology, for reporting this issue.

  This is CVE-2023-24538 and Go issue https://go.dev/issue/59234.

- net/http, net/textproto: denial of service from excessive memory allocation

  HTTP and MIME header parsing could allocate large amounts of memory, even when
  parsing small inputs.

  Certain unusual patterns of input data could cause the common function used to
  parse HTTP and MIME headers to allocate substantially more memory than
  required to hold the parsed headers. An attacker can exploit this behavior to
  cause an HTTP server to allocate large amounts of memory from a small request,
  potentially leading to memory exhaustion and a denial of service.
  Header parsing now correctly allocates only the memory required to hold parsed
  headers.

  Thanks to Jakob Ackermann (@das7pad) for discovering this issue.

  This is CVE-2023-24534 and Go issue https://go.dev/issue/58975.

- net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

  Multipart form parsing can consume large amounts of CPU and memory when
  processing form inputs containing very large numbers of parts. This stems from
  several causes:

  mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form
  can consume. ReadForm could undercount the amount of memory consumed, leading
  it to accept larger inputs than intended. Limiting total memory does not
  account for increased pressure on the garbage collector from large numbers of
  small allocations in forms with many parts. ReadForm could allocate a large
  number of short-lived buffers, further increasing pressure on the garbage
  collector. The combination of these factors can permit an attacker to cause an
  program that parses multipart forms to consume large amounts of CPU and
  memory, potentially resulting in a denial of service. This affects programs
  that use mime/multipart.Reader.ReadForm, as well as form parsing in the
  net/http package with the Request methods FormFile, FormValue,
  ParseMultipartForm, and PostFormValue.

  ReadForm now does a better job of estimating the memory consumption of parsed
  forms, and performs many fewer short-lived allocations.

  In addition, mime/multipart.Reader now imposes the following limits on the
  size of parsed forms:

  Forms parsed with ReadForm may contain no more than 1000 parts. This limit may
  be adjusted with the environment variable GODEBUG=multipartmaxparts=. Form
  parts parsed with NextPart and NextRawPart may contain no more than 10,000
  header fields. In addition, forms parsed with ReadForm may contain no more
  than 10,000 header fields across all parts. This limit may be adjusted with
  the environment variable GODEBUG=multipartmaxheaders=.

  Thanks to Jakob Ackermann for discovering this issue.

  This is CVE-2023-24536 and Go issue https://go.dev/issue/59153.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-04-05 16:03:25 +02:00

144 lines
6.1 KiB
Docker
Raw Blame History

# This dockerfile is used to test containerd within a container
#
# usage:
# 1.) docker build -t containerd-test -f Dockerfile.test ../
# 2.) docker run -it --privileged -v /tmp:/tmp --tmpfs /var/lib/containerd-test containerd-test bash
# 3.) $ make binaries install test
#
# Use the RUNC_VERSION build-arg to build with a custom version of runc, for example,
# to build runc v1.0.0-rc94, use:
#
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
# ------------------------------------------------------------------------------
# Public stages:
# "integration": for running integration tests:
# docker build -t containerd-test -f Dockerfile.test --target integration ../
# docker run --privileged containerd-test
#
# "cri-integration": for running cri-integration tests:
# docker build -t containerd-test -f Dockerfile.test --target cri-integration ../
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
#
# "critest: for running critest:
# docker build -t containerd-test -f Dockerfile.test --target critest ../
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
#
# "cri-in-userns": for running critest with "CRI-in-UserNS" mode; needs Rootless Docker/Podman/nerdctl:
# docker build -t containerd-test -f Dockerfile.test --target cri-in-userns ../
# docker run --privileged containerd-test
# ------------------------------------------------------------------------------
ARG GOLANG_VERSION=1.20.3
ARG GOLANG_IMAGE=golang
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
# Install runc
FROM golang AS runc
RUN apt-get update && apt-get install -y --no-install-recommends \
libseccomp-dev \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/runc-version script/setup/install-runc ./
# Allow overriding the version of runc to install through build-args
ARG RUNC_VERSION
ARG GOPROXY=direct
ARG DESTDIR=/build
RUN ./install-runc
FROM golang AS build-env
RUN apt-get update && apt-get install -y --no-install-recommends \
btrfs-progs \
libseccomp-dev \
xfsprogs \
&& rm -rf /var/lib/apt/lists/*
RUN mkdir -p /go/src/github.com/containerd/containerd
WORKDIR /go/src/github.com/containerd/containerd
FROM golang AS cni
ENV DESTDIR=/build
COPY script/setup/install-cni go.mod /
RUN DESTDIR=/build /install-cni
FROM golang AS critools
ARG DESTDIR=/build
COPY script/setup/install-critools script/setup/critools-version ./
RUN GOBIN=$DESTDIR/usr/local/bin ./install-critools
# integration stage is for running integration tests.
FROM build-env AS integration
RUN apt-get update && apt-get install -y --no-install-recommends \
lsof \
&& rm -rf /var/lib/apt/lists/*
COPY --from=runc /build/ /
COPY contrib/Dockerfile.test.d/docker-entrypoint.sh /docker-entrypoint.sh
COPY . .
RUN make BUILDTAGS="no_btrfs no_devmapper" binaries install
VOLUME /tmp
# TestMain wants to unlink /var/lib/containerd-test, so the entire /var/lib has to be volumified.
VOLUME /var/lib
# The entrypoint script is needed for nesting cgroup v2.
ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["make", "integration"]
# cri-integration stage is for running cri-integration tests.
FROM integration AS cri-integration
RUN apt-get update && apt-get install -y --no-install-recommends \
sudo iptables \
&& rm -rf /var/lib/apt/lists/*
COPY --from=cni /build/ /
COPY --from=critools /build/ /
RUN make BUILDTAGS="no_btrfs no_devmapper" bin/cri-integration.test
# install-failpoint-binaries cannot be easily executed in a substage as it does not support custom DESTDIR.
RUN ./script/setup/install-failpoint-binaries
# The test scripts need these env vars to be explicitly set
ENV GITHUB_WORKSPACE=""
ENV ENABLE_CRI_SANDBOXES=""
ENV CONTAINERD_RUNTIME="io.containerd.runc.v2"
CMD ["make", "cri-integration"]
# critest stage is for running critest.
FROM cri-integration AS critest
# critest wants to create mounts under this directory, so it has to be volumified.
VOLUME /go/src/github.com/containerd/containerd
ENV TEST_RUNTIME="io.containerd.runc.v2"
CMD ["script/critest.sh", "/tmp"]
# cri-in-userns stage is for testing "CRI-in-UserNS", which should be used in conjunction with
# "Kubelet-in-UserNS": https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
# This feature is mostly expected to be used for `kind` and `minikube`.
#
# Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/
# (Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves)
FROM critest AS cri-in-userns
COPY contrib/Dockerfile.test.d/cri-in-userns/etc_containerd_config.toml /etc/containerd/config.toml
COPY contrib/Dockerfile.test.d/cri-in-userns/docker-entrypoint.sh /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]
# Skip "runtime should support unsafe sysctls": `container init caused: write sysctl key fs.mqueue.msg_max: open /proc/sys/fs/mqueue/msg_max: permission denied`
# Skip "runtime should support safe sysctls": `container init caused: write sysctl key kernel.shm_rmid_forced: open /proc/sys/kernel/shm_rmid_forced: permission denied`
# Skip "should allow privilege escalation when (NoNewPrivis is) false": expected log "Effective uid: 0\n" (stream="stdout") not found in logs [{timestamp:{wall:974487519 ext:63761339984 loc:<nil>} stream:stdout log:Effective uid: 1000) }]
CMD ["critest", "--ginkgo.skip=should support unsafe sysctls|should support safe sysctls|should allow privilege escalation when false"]
# Install proto3
FROM golang AS proto3
ARG DESTDIR=/build
RUN apt-get update && apt-get install -y --no-install-recommends \
autoconf \
automake \
g++ \
libtool \
unzip \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/install-protobuf install-protobuf
RUN ./install-protobuf \
&& mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
&& mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
&& mv /usr/local/include/google $DESTDIR/usr/local/include/google
FROM build-env AS dev
COPY --from=proto3 /build/ /
COPY --from=runc /build/ /
COPY . .
Reference in New Issue View Git Blame Copy Permalink