github/linuxkit
1
0
Fork 0
mirror of https://github.com/linuxkit/linuxkit.git synced 2025-12-05 12:24:47 +00:00
Code Issues Projects Releases Wiki Activity
1,684 Commits 1 Branch 31 Tags
ad87c3b93b0ab78b1c702946e36667bea3577dbc
Commit Graph

1212 Commits

Author SHA1 Message Date
Justin Cormack
ad87c3b93b Update alpine-base 
Updates ca-certificates to 20161130

Includes the 20161102 updates see http://metadata.ftp-master.debian.org/changelogs/main/c/ca-certificates/ca-certificates_20161130_changelog

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-12 10:45:10 -08:00
Justin Cormack
2be21dcc78 Update to Linux 4.8.14 
Includes fix for CVE-2016-8655 Linux af_packet.c race condition.

This gives a container escape with default container capabilities.

This now has the slow network namespace patch backported, so this
is removed.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-10 16:18:47 -08:00
Justin Cormack
a7f57526a5 Containerize test suite 
- run test suite under containerd
- in future this should be converted to Go not shell see #860
- test suite is now in its own initrd, can be run on any platform not just qemu

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-09 17:13:16 -08:00
Riyaz Faizullabhoy
6db87549c4 Set CONFIG_LEGACY_VSYSCALL to NONE and vsyscall=emulate 
Regenerated the kernel config from container, which bumped the kernel
version and included some other fixes.  Also bumps the check-config
container to check for VSYSCALL_NATIVE

Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-09 12:09:35 -08:00
Justin Cormack
f190512e2e Add some missing --rm in docker run 
Some of these were missing, leaving strays around.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-09 09:08:22 -08:00
Justin Cormack
66ac858d2f Merge pull request #857 from justincormack/mksh-buildfix 
Add Dockerfile into mksh image for hash calculation
 2016-12-08 18:03:38 -08:00
Justin Cormack
e3eeadabb6 Merge pull request #853 from justincormack/alpine-build-kernel 
Install kernel headers in kernel image and upload kernel for scans
 2016-12-08 17:53:34 -08:00
Justin Cormack
e67de1bb6c Add Dockerfile into mksh image for hash calculation 
Caused build errors without it.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-08 17:51:42 -08:00
Justin Cormack
5fb7594217 Keep kernel headers from build 
Also upload some kernel artefacts to a private repo at mobylinux/kernel on Hub for scanning.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-08 17:32:59 -08:00
Justin Cormack
2598a33494 Merge pull request #855 from justincormack/mksh 
Add base image for mksh
 2016-12-08 17:27:14 -08:00
Justin Cormack
f7fcdc5776 Add base image for mksh 
This is a minimal standalone statically linked shell for use
for now in converting images to containers.

Plan to phase it out and replace with actual programs later.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-08 15:58:51 -08:00
Nathan LeClaire
fbf1f435aa Bump Azure SHA for v.1.13.0-rc3-beta13 
Signed-off-by: Nathan LeClaire <nathan.leclaire@gmail.com>
 2016-12-08 12:37:08 -08:00
Riyaz Faizullabhoy
44a5cfb874 Change -1 to 1 in DOCKER_CONTENT_TRUST value 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-07 17:28:52 -08:00
Nathan LeClaire
949df4f11c Merge pull request #813 from FrenchBen/vendor-azure 
Added docker image for VHD utils
 2016-12-07 16:19:27 -08:00
Justin Cormack
7ef813e667 Merge pull request #851 from justincormack/push-image 
Push a copy of the Moby base image to mobylinux/mobylinux
 2016-12-07 13:58:49 -08:00
Justin Cormack
ba50adfc36 Push a copy of the Moby base image to mobylinux/mobylinux 
This will be used for ongoing security scanning.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-07 12:10:39 -08:00
Riyaz Faizullabhoy
9284759f2c Disable kexec from kernel_config, revert sysctl config because key is now unknown 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-07 11:43:10 -08:00
Justin Cormack
5794640a04 Merge pull request #840 from riyazdf/kexec-load 
Disable kexec load in sysctl config
 2016-12-07 10:44:44 -08:00
Justin Cormack
1656e53324 Add some missing sha256 tags 
These got missed in the previous commits.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-06 18:49:44 -08:00
Justin Cormack
085a2f7fbd Only TRIM on Mac if configured via database 
Stops unnecessary log spam.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-06 08:50:45 -08:00
Justin Cormack
ccec51c2ca Typo in crontab 
Its 15min not 15m

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-06 08:37:04 -08:00
David Scott
f570ef6dac Use TRIM on Mac as well as Windows 
Previously we only ran `fstrim` on Windows. Docker for Mac now supports
TRIM so we should run `fstrim` there too.

Note it's possible to turn off TRIM on the Mac at the virtual hardware
level via the database, but this should be harmless -- the `fstrim`
fails immediately with an obvious error if the device doesn't support it:
`fstrim: ioctl 0xc0185879 failed: Not supported`.

Signed-off-by: David Scott <dave.scott@docker.com>
 2016-12-06 12:03:26 +00:00
Justin Cormack
6d8925f012 Update Docker to 1.13.0-rc3 
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-05 20:31:16 -08:00
Nathan LeClaire
82d92fd11b Merge pull request #746 from justincormack/no-2375 
Stop Docker listening on port 2375
 2016-12-05 13:43:36 -08:00
Riyaz Faizullabhoy
23c895a3d3 Disable kexec load in sysctl config 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-05 09:26:17 -08:00
French Ben
1fe0abc70f Added docker image for VHD utils 
Signed-off-by: French Ben <frenchben@docker.com>
 2016-12-02 20:48:59 -08:00
Nathan LeClaire
5bca9e0192 Bump digest and re-add DOCKER_FOR_IAAS_VERSION for Azure 
Signed-off-by: Nathan LeClaire <nathan.leclaire@gmail.com>
 2016-12-02 18:30:33 -08:00
Justin Cormack
960f52d18c Split the initrd into base and containers 
In future this will allow easier customisation of the containers
for each edition.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 18:13:45 +00:00
Justin Cormack
c6163f7ffd Merge pull request #762 from simonferquel/vsudd_dontretry_on_dockerd 
[vsudd] Don't retry when dockerd is not running
 2016-12-02 08:23:23 -08:00
Justin Cormack
ab522f6106 Merge pull request #830 from justincormack/initrd-align-4 
Align compressed initrd to 4 bytes
 2016-12-02 08:14:36 -08:00
Justin Cormack
72d4d5aefc Align compressed initrd to 4 bytes 
Allows appending another initrd.

Also build initrd on tmpfs as should be a bit faster now we have to do
another copy.

Fix #618

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 16:05:49 +00:00
Justin Cormack
06cf2b5d12 Merge pull request #829 from justincormack/linuxup 
Update to Linux 4.8.12
 2016-12-02 06:52:22 -08:00
Justin Cormack
9916e7510d Merge pull request #828 from justincormack/azure-quoting 
Missing quote in azure init script
 2016-12-02 06:12:54 -08:00
Justin Cormack
f870b6641b Update to Linux 4.8.12 
- security update

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 14:12:06 +00:00
Justin Cormack
6e10fa9399 Missing quote in azure init script 
Fix #826

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 14:03:21 +00:00
Justin Cormack
933372e45a Run rngd inside a system container 
- this needs an init as it does not respond to stop signals, so include tini
- needs CAP_SYS_ADMIN to write to kernel entropy estimate
- set kernel.random.write_wakeup_threshold so that rngd does not need sysctl write access
- build patches from Alpine, but statically linked
- remove rngd from base image, means we no longer need community repository

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 14:00:12 +00:00
Justin Cormack
842527996c Merge pull request #825 from justincormack/go-up 
Update to Go 1.7.4
 2016-12-02 01:59:39 -08:00
Justin Cormack
1ecdeeed44 Update to Go 1.7.4 
Security update.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-02 09:51:36 +00:00
Justin Cormack
5608dfbf5d Merge pull request #819 from riyazdf/lynis-sysctl-changes 
Add sysctl changes as suggested by lynis
 2016-12-02 01:30:55 -08:00
Riyaz Faizullabhoy
aa4e996d16 Bump windows azure linux agent to include openssl config swapping logic 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-01 19:15:50 -08:00
Riyaz Faizullabhoy
0eefa15623 Add sysctl changes as suggested by lynis 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-01 15:41:57 -08:00
Justin Cormack
cb486e5cc5 Merge pull request #820 from riyazdf/digests-and-trust 
Use digests for external images and scripts where possible
 2016-12-01 12:57:32 -08:00
Justin Cormack
c004fb5efa Merge pull request #822 from riyazdf/dct-in-pull 
Use DCT in library/docker run command
 2016-12-01 10:34:33 -08:00
Riyaz Faizullabhoy
4011d4842a Use digests instead of tags where possible 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-01 09:39:02 -08:00
Riyaz Faizullabhoy
4068e792fd Use DCT in library run command 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
 2016-12-01 09:27:01 -08:00
Justin Cormack
19e3dd4c60 Makefile cleanup for binfmt 
Remove duplication and simplify.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-12-01 15:23:03 +00:00
Nathan LeClaire
b5ea59e122 Merge pull request #788 from justincormack/small-ami 
Use a 1G AMI
 2016-11-30 16:22:41 -08:00
Justin Cormack
ae885bd714 Use DOCKER_CONTENT_TRUST=1 when pulling library images 
When building the base images always test signatures.

This will be the default at some point.

Add a test that content trust is working.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-11-30 13:35:38 +00:00
Justin Cormack
8d3691fabb Containerize binfmt_misc 
- statically make containerd symlinks so rootfs can be read only
- run binfmt_misc in a containerd container
- ship arm, aarch64, ppc64le qemu static versions that always "just work" as this is supported in Linux 4.8

fix #53

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2016-11-30 12:49:37 +00:00
Simon Ferquel
641669cafb Redirect vsudd stdout/stderr to console 
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
 2016-11-30 10:31:11 +01:00