Commit Graph

2056 Commits

Author SHA1 Message Date
Justin Cormack
d7d957a59f Force Debian installs to never prompt the user
Sometimes Debian just wants to ask you questions on an install,
this is really not a useful behaviour when there is no one
attached to the process.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 15:31:57 -08:00
Justin Cormack
7489a58c86 Merge pull request #868 from justincormack/consistent-zeropad
Use an image to pad initrd files to 4 bytes
2016-12-12 14:34:00 -08:00
Justin Cormack
6acee5984e Use an image to pad initrd files to 4 bytes
This saves a lot of duplicated nasty Makefile code, means and generally
cleans things up.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 14:12:13 -08:00
Justin Cormack
99a2f248b2 Merge pull request #865 from justincormack/scan-kernel
Kernel scanning now fixed, only needs vmlinuz64
2016-12-12 12:56:31 -08:00
Justin Cormack
aadf539ebd Merge pull request #866 from justincormack/mke2fs-options
Improve mkfs options
2016-12-12 11:22:20 -08:00
Justin Cormack
f19d7b5f03 Merge pull request #867 from justincormack/baseup
Update alpine-base
2016-12-12 11:09:03 -08:00
Justin Cormack
b90fa84385 Update alpine-base
Updates ca-certificates to 20161130

Includes the 20161102 updates see http://metadata.ftp-master.debian.org/changelogs/main/c/ca-certificates/ca-certificates_20161130_changelog

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 10:45:10 -08:00
Justin Cormack
9897241118 Improve mkfs options
- make quiet
- force, so some adjustments are not checked see https://github.com/docker/pinata/issues/6198
- set resize_inode as we do resize partitions on cloud and they could have very few inodes otherwise
- inline all the default options and remove the config file, so script is more standalone

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 10:36:49 -08:00
Justin Cormack
2f558885f0 Kernel scanning now fixed, only needs vmlinuz64
- The scanning process was not ignoring the kernel extraversion before,
so was only sometimes picking up issues.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 09:54:02 -08:00
Justin Cormack
b977169d0a Merge pull request #862 from justincormack/kernelup
Update to Linux 4.8.14
2016-12-10 16:52:09 -08:00
Justin Cormack
4aa8cffb13 Update to Linux 4.8.14
Includes fix for CVE-2016-8655 Linux af_packet.c race condition.

This gives a container escape with default container capabilities.

This now has the slow network namespace patch backported, so this
is removed.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-10 16:18:47 -08:00
Justin Cormack
d5821c6041 Merge pull request #861 from justincormack/split-test
Containerize test suite
2016-12-09 17:46:08 -08:00
Justin Cormack
f3e3a4029b Containerize test suite
- run test suite under containerd
- in future this should be converted to Go not shell see #860
- test suite is now in its own initrd, can be run on any platform not just qemu

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-09 17:13:16 -08:00
Justin Cormack
e6c730f81e Merge pull request #841 from riyazdf/vsyscall-emulate
Set CONFIG_LEGACY_VSYSCALL to NONE
2016-12-09 13:27:15 -08:00
Riyaz Faizullabhoy
a470b655d1 Set CONFIG_LEGACY_VSYSCALL to NONE and vsyscall=emulate
Regenerated the kernel config from container, which bumped the kernel
version and included some other fixes.  Also bumps the check-config
container to check for VSYSCALL_NATIVE

Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-09 12:09:35 -08:00
Justin Cormack
c905f6ce05 Merge pull request #859 from justincormack/run-rm
Add some missing --rm in docker run
2016-12-09 09:52:01 -08:00
Justin Cormack
b8ad52d2e5 Add some missing --rm in docker run
Some of these were missing, leaving strays around.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-09 09:08:22 -08:00
Justin Cormack
98e3f42a1c Merge pull request #857 from justincormack/mksh-buildfix
Add Dockerfile into mksh image for hash calculation
2016-12-08 18:03:38 -08:00
Justin Cormack
255b6dad5a Merge pull request #853 from justincormack/alpine-build-kernel
Install kernel headers in kernel image and upload kernel for scans
2016-12-08 17:53:34 -08:00
Justin Cormack
10dca441d7 Add Dockerfile into mksh image for hash calculation
Caused build errors without it.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-08 17:51:42 -08:00
Justin Cormack
15522201ea Keep kernel headers from build
Also upload some kernel artefacts to a private repo at mobylinux/kernel on Hub for scanning.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-08 17:32:59 -08:00
Justin Cormack
4fa26d14ee Merge pull request #855 from justincormack/mksh
Add base image for mksh
2016-12-08 17:27:14 -08:00
Justin Cormack
9c9ff48e71 Add base image for mksh
This is a minimal standalone statically linked shell for use
for now in converting images to containers.

Plan to phase it out and replace with actual programs later.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-08 15:58:51 -08:00
Justin Cormack
0d650af09e Merge pull request #854 from nathanleclaire/bump_azure-v1.13.0-rc3-beta13
Bump azure v1.13.0 rc3 beta13
2016-12-08 13:27:23 -08:00
Nathan LeClaire
695061e4d0 Bump Azure SHA for v.1.13.0-rc3-beta13
Signed-off-by: Nathan LeClaire <nathan.leclaire@gmail.com>
2016-12-08 12:37:08 -08:00
Justin Cormack
fba9fe52c0 Merge pull request #852 from riyazdf/fix-negative-one
Fix negative one on DOCKER_CONTENT_TRUST
2016-12-07 17:33:39 -08:00
Riyaz Faizullabhoy
8ac566901d Change -1 to 1 in DOCKER_CONTENT_TRUST value
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-07 17:28:52 -08:00
Nathan LeClaire
8142d7f4b6 Merge pull request #813 from FrenchBen/vendor-azure
Added docker image for VHD utils
2016-12-07 16:19:27 -08:00
Justin Cormack
10e4eb84ec Merge pull request #851 from justincormack/push-image
Push a copy of the Moby base image to mobylinux/mobylinux
2016-12-07 13:58:49 -08:00
Justin Cormack
26ffe9f123 Merge pull request #849 from riyazdf/kexec-kernel-config
Disable kexec from kernel_config
2016-12-07 13:55:42 -08:00
Justin Cormack
2897b808bb Push a copy of the Moby base image to mobylinux/mobylinux
This will be used for ongoing security scanning.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-07 12:10:39 -08:00
Riyaz Faizullabhoy
2e8a6143dd Disable kexec from kernel_config, revert sysctl config because key is now unknown
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-07 11:43:10 -08:00
Justin Cormack
dbe24caa57 Merge pull request #840 from riyazdf/kexec-load
Disable kexec load in sysctl config
2016-12-07 10:44:44 -08:00
Justin Cormack
836954ab66 Merge pull request #848 from justincormack/sha-missing
Add some missing sha256 tags
2016-12-07 00:04:04 -08:00
Justin Cormack
b329aee664 Add some missing sha256 tags
These got missed in the previous commits.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-06 18:49:44 -08:00
Justin Cormack
2789f663b5 Merge pull request #846 from justincormack/trim-cond-mac
Only TRIM on Mac if configured via database
2016-12-06 08:58:07 -08:00
Justin Cormack
f2c2534608 Only TRIM on Mac if configured via database
Stops unnecessary log spam.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-06 08:50:45 -08:00
Justin Cormack
63401b8faa Merge pull request #845 from justincormack/15min
Typo in crontab
2016-12-06 08:41:52 -08:00
Justin Cormack
a5fa2fa133 Typo in crontab
Its 15min not 15m

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-06 08:37:04 -08:00
Justin Cormack
5a1925b6fe Merge pull request #844 from djs55/mac-trim
Use TRIM on Mac as well as Windows
2016-12-06 08:13:01 -08:00
David Scott
40e7dbbf8b Use TRIM on Mac as well as Windows
Previously we only ran `fstrim` on Windows. Docker for Mac now supports
TRIM so we should run `fstrim` there too.

Note it's possible to turn off TRIM on the Mac at the virtual hardware
level via the database, but this should be harmless -- the `fstrim`
fails immediately with an obvious error if the device doesn't support it:
`fstrim: ioctl 0xc0185879 failed: Not supported`.

Signed-off-by: David Scott <dave.scott@docker.com>
2016-12-06 12:03:26 +00:00
Justin Cormack
50860750d6 Merge pull request #843 from justincormack/rc3
Update Docker to 1.13.0-rc3
2016-12-05 21:12:20 -08:00
Justin Cormack
5503a0c966 Update Docker to 1.13.0-rc3
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-05 20:31:16 -08:00
Nathan LeClaire
3a4c93118c Merge pull request #746 from justincormack/no-2375
Stop Docker listening on port 2375
2016-12-05 13:43:36 -08:00
Riyaz Faizullabhoy
0b4f1ab5f4 Disable kexec load in sysctl config
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-05 09:26:17 -08:00
Justin Cormack
1db219717c Merge pull request #834 from nathanleclaire/bump_beta12_digest
Bump digest and re-add DOCKER_FOR_IAAS_VERSION for Azure
2016-12-03 01:19:47 -08:00
French Ben
2954bcf1c7 Added docker image for VHD utils
Signed-off-by: French Ben <frenchben@docker.com>
2016-12-02 20:48:59 -08:00
Nathan LeClaire
9d86c3d1c8 Bump digest and re-add DOCKER_FOR_IAAS_VERSION for Azure
Signed-off-by: Nathan LeClaire <nathan.leclaire@gmail.com>
2016-12-02 18:30:33 -08:00
Justin Cormack
733ebcbee2 Merge pull request #831 from justincormack/split-containers
Split the initrd into base and containers
2016-12-02 10:19:03 -08:00
Justin Cormack
e17ff361ee Split the initrd into base and containers
In future this will allow easier customisation of the containers
for each edition.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-02 18:13:45 +00:00