github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
Files
420503072e58f27a7192ddea4e6e41dced911cb9
containerd/contrib/Dockerfile.test
Sebastiaan van Stijn 313f514fdd update to go1.21.3. gp1.20.10 
go1.21.3 (released 2023-10-10) includes a security fix to the net/http package.
See the Go 1.21.3 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.21.3+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.21.2...go1.21.3

From the security mailing:

[security] Go 1.21.3 and Go 1.20.10 are released

Hello gophers,

We have just released Go versions 1.21.3 and 1.20.10, minor point releases.

These minor releases include 1 security fixes following the security policy:

- net/http: rapid stream resets can cause excessive work

  A malicious HTTP/2 client which rapidly creates requests and
  immediately resets them can cause excessive server resource consumption.
  While the total number of requests is bounded to the
  http2.Server.MaxConcurrentStreams setting, resetting an in-progress
  request allows the attacker to create a new request while the existing
  one is still executing.

  HTTP/2 servers now bound the number of simultaneously executing
  handler goroutines to the stream concurrency limit. New requests
  arriving when at the limit (which can only happen after the client
  has reset an existing, in-flight request) will be queued until a
  handler exits. If the request queue grows too large, the server
  will terminate the connection.

  This issue is also fixed in golang.org/x/net/http2 v0.17.0,
  for users manually configuring HTTP/2.

  The default stream concurrency limit is 250 streams (requests)
  per HTTP/2 connection. This value may be adjusted using the
  golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
  setting and the ConfigureServer function.

  This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
  This is also tracked by CVE-2023-44487.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-10-11 20:29:07 +02:00

144 lines
6.1 KiB
Docker
Raw Blame History

# This dockerfile is used to test containerd within a container
#
# usage:
# 1.) docker build -t containerd-test -f Dockerfile.test ../
# 2.) docker run -it --privileged -v /tmp:/tmp --tmpfs /var/lib/containerd-test containerd-test bash
# 3.) $ make binaries install test
#
# Use the RUNC_VERSION build-arg to build with a custom version of runc, for example,
# to build runc v1.0.0-rc94, use:
#
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
# ------------------------------------------------------------------------------
# Public stages:
# "integration": for running integration tests:
# docker build -t containerd-test -f Dockerfile.test --target integration ../
# docker run --privileged containerd-test
#
# "cri-integration": for running cri-integration tests:
# docker build -t containerd-test -f Dockerfile.test --target cri-integration ../
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
#
# "critest: for running critest:
# docker build -t containerd-test -f Dockerfile.test --target critest ../
# docker run --privileged --sysctl net.ipv6.conf.all.disable_ipv6=0 containerd-test
#
# "cri-in-userns": for running critest with "CRI-in-UserNS" mode; needs Rootless Docker/Podman/nerdctl:
# docker build -t containerd-test -f Dockerfile.test --target cri-in-userns ../
# docker run --privileged containerd-test
# ------------------------------------------------------------------------------
ARG GOLANG_VERSION=1.21.3
ARG GOLANG_IMAGE=golang
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
# Install runc
FROM golang AS runc
RUN apt-get update && apt-get install -y --no-install-recommends \
libseccomp-dev \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/runc-version script/setup/install-runc ./
# Allow overriding the version of runc to install through build-args
ARG RUNC_VERSION
ARG GOPROXY=direct
ARG DESTDIR=/build
RUN ./install-runc
FROM golang AS build-env
RUN apt-get update && apt-get install -y --no-install-recommends \
btrfs-progs \
libseccomp-dev \
xfsprogs \
&& rm -rf /var/lib/apt/lists/*
RUN mkdir -p /go/src/github.com/containerd/containerd
WORKDIR /go/src/github.com/containerd/containerd
FROM golang AS cni
ENV DESTDIR=/build
COPY script/setup/install-cni go.mod /
RUN DESTDIR=/build /install-cni
FROM golang AS critools
ARG DESTDIR=/build
COPY script/setup/install-critools script/setup/critools-version ./
RUN GOBIN=$DESTDIR/usr/local/bin ./install-critools
# integration stage is for running integration tests.
FROM build-env AS integration
RUN apt-get update && apt-get install -y --no-install-recommends \
lsof \
&& rm -rf /var/lib/apt/lists/*
COPY --from=runc /build/ /
COPY contrib/Dockerfile.test.d/docker-entrypoint.sh /docker-entrypoint.sh
COPY . .
RUN make BUILDTAGS="no_btrfs no_devmapper" binaries install
VOLUME /tmp
# TestMain wants to unlink /var/lib/containerd-test, so the entire /var/lib has to be volumified.
VOLUME /var/lib
# The entrypoint script is needed for nesting cgroup v2.
ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["make", "integration"]
# cri-integration stage is for running cri-integration tests.
FROM integration AS cri-integration
RUN apt-get update && apt-get install -y --no-install-recommends \
sudo iptables \
&& rm -rf /var/lib/apt/lists/*
COPY --from=cni /build/ /
COPY --from=critools /build/ /
RUN make BUILDTAGS="no_btrfs no_devmapper" bin/cri-integration.test
# install-failpoint-binaries cannot be easily executed in a substage as it does not support custom DESTDIR.
RUN ./script/setup/install-failpoint-binaries
# The test scripts need these env vars to be explicitly set
ENV GITHUB_WORKSPACE=""
ENV DISABLE_CRI_SANDBOXES=""
ENV CONTAINERD_RUNTIME="io.containerd.runc.v2"
CMD ["make", "cri-integration"]
# critest stage is for running critest.
FROM cri-integration AS critest
# critest wants to create mounts under this directory, so it has to be volumified.
VOLUME /go/src/github.com/containerd/containerd
ENV TEST_RUNTIME="io.containerd.runc.v2"
CMD ["script/critest.sh", "/tmp"]
# cri-in-userns stage is for testing "CRI-in-UserNS", which should be used in conjunction with
# "Kubelet-in-UserNS": https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
# This feature is mostly expected to be used for `kind` and `minikube`.
#
# Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/
# (Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves)
FROM critest AS cri-in-userns
COPY contrib/Dockerfile.test.d/cri-in-userns/etc_containerd_config.toml /etc/containerd/config.toml
COPY contrib/Dockerfile.test.d/cri-in-userns/docker-entrypoint.sh /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]
# Skip "runtime should support unsafe sysctls": `container init caused: write sysctl key fs.mqueue.msg_max: open /proc/sys/fs/mqueue/msg_max: permission denied`
# Skip "runtime should support safe sysctls": `container init caused: write sysctl key kernel.shm_rmid_forced: open /proc/sys/kernel/shm_rmid_forced: permission denied`
# Skip "should allow privilege escalation when (NoNewPrivis is) false": expected log "Effective uid: 0\n" (stream="stdout") not found in logs [{timestamp:{wall:974487519 ext:63761339984 loc:<nil>} stream:stdout log:Effective uid: 1000) }]
CMD ["critest", "--ginkgo.skip=should support unsafe sysctls|should support safe sysctls|should allow privilege escalation when false"]
# Install proto3
FROM golang AS proto3
ARG DESTDIR=/build
RUN apt-get update && apt-get install -y --no-install-recommends \
autoconf \
automake \
g++ \
libtool \
unzip \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/install-protobuf install-protobuf
RUN ./install-protobuf \
&& mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
&& mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
&& mv /usr/local/include/google $DESTDIR/usr/local/include/google
FROM build-env AS dev
COPY --from=proto3 /build/ /
COPY --from=runc /build/ /
COPY . .
Reference in New Issue View Git Blame Copy Permalink