mirror of
git://git.yoctoproject.org/meta-virtualization.git
synced 2025-07-19 12:50:22 +02:00
2efdfa20a4
1944 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Bruce Ashfield
|
2efdfa20a4 |
cni: reproducible builds: pass -trimpath
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Soumya Sambu
|
67b0ef4256 |
kubernetes: Fix CVE-2023-2727, CVE-2023-2728
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers, Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kuberenetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountab'le-secrets` annotation are used teogether with ephemeralcontainers. CVE: CVE-2023-2727, CVE-2023-2728 Affected Versions 1.27.0 - v1.27.2 v1.26.0 - v1.26.5 v1.25.0 - v1.25.10 <= v1.24.14 master branch(kubernetes v1.28.2) is not impacted mickledore branch(kubernetes v1.27.5) is not impacted References: https://nvd.nist.gov/vuln/detail/CVE-2023-2727 https://nvd.nist.gov/vuln/detail/CVE-2023-2728 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Soumya Sambu
|
86126c9b34 |
kubernetes: Fix CVE-2023-2431
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. CVE: CVE-2023-2431 Affected Versions v1.27.0 - v1.27.1 v1.26.0 - v1.26.4 v1.25.0 - v1.25.9 <= v1.24.13 master branch(kubernetes v1.28.2) is not impacted mickledore branch(kubernetes v1.27.5) is not impacted References: https://nvd.nist.gov/vuln/detail/CVE-2023-2431 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Soumya Sambu
|
72ef3ba3b2 |
kubernetes: Adjust patches to resolve error that occur with devtool
Adjust patches and .bb to fix below error which occurs with devtool modify command -
ERROR: Applying patch '0001-hack-lib-golang.sh-use-CC-from-environment.patch' on
target directory
CmdError('sh -c \'PATCHFILE="0001-hack-lib-golang.sh-use-CC-from-environment.patch"
git -c user.name="OpenEmbedded" -c user.email="oe.patch@oe" commit -F /tmp/tmp_ptvioq3
--author="Koen Kooi <koen.kooi@linaro.org>"
--date="Mon, 23 Jul 2018 15:28:02 +0200"\'', 0, 'stdout: On branch devtool
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
(commit or discard the untracked or modified content in submodules)
\tmodified: src/import (modified content)
no changes added to commit (use "git add" and/or "git commit -a")
stderr: ')
This error is not seen on master branch, fixed with below commit -
[https://git.yoctoproject.org/meta-virtualization/commit/?id=d9af46db9aa9060c1ec10118b2cccabfc8264904]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Jörg Sommer
|
478a91800c |
packagegroup-container: require ipv6 for podman
The recipe *podman* requires the distro feature *ipv6*. Using a distro
without it causes the build of *packagegroup-container* fails, even if
*packagegroup-podman* is not used:
ERROR: Nothing RPROVIDES 'podman' (but /build/../work/layers-3rdparty/meta-virtualization/recipes-core/packagegroups/packagegroup-container.bb RDEPENDS on or otherwise requires it)
podman was skipped: missing required distro feature 'ipv6' (not in DISTRO_FEATURES)
NOTE: Runtime target 'podman' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['podman']
NOTE: Runtime target 'packagegroup-docker' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['packagegroup-docker', 'podman']
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Martin Jansa
|
2d8b3cba8f |
nerdctl: fix installed-vs-shipped with usrmerge
* fixes: ERROR: nerdctl-v1.3.0-r0 do_package: QA Issue: nerdctl: Files/directories were installed but not shipped in any package: /bin /bin/nerdctl Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. nerdctl: 2 installed and not shipped files. [installed-vs-shipped] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
9b162d26ee |
nerdctl: update branch to main
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Mingli Yu
|
9e1ba07385 |
go-mux: Switch to main branch
The project has renamed the master branch to main. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Mingli Yu
|
b6f83ff1a0 |
go-context: Switch to main branch
The project has renamed the master branch to main. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Martin Jansa
|
e60f59f356 |
docker-ce: bump SRCREV_docker
* fix my prevous commit where I've missed this update corresponding to SRCREV_moby change in docker-moby recipe. * also re-order the patches in SRC_URI to match docker-moby, so that they are easier to compare Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Martin Jansa
|
36b5b74c89 |
docker: update to v20.10.25 + 58 commits to fix compatibility with go currently in kirkstone
* since this backport:
https://lists.openembedded.org/g/openembedded-core/message/185082
landed in kirkstone:
https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=5dc74138649ab7a2c0158a43225dc7a8fd732355
docker cannot access network and fails with:
"http: invalid Host header"
update to latest commit in 20.10 branch, because latest tag v20.10.25
have the fix yet:
https://github.com/moby/moby/compare/v20.10.21...v20.10.25
so we need couple more commits from upstream:
https://github.com/moby/moby/compare/v20.10.25...791d8ab87747169b4cbfcdf2fd57c81952bae6d5
Adjust the go version revert which was here since the upgrade to v20.10.21:
https://git.yoctoproject.org/meta-virtualization/commit/?h=kirkstone&id=927537108bcf2b98859512ce3eae59a73439994d
and add another revert for the go upgrades from upstream for this older
patch to apply.
* update cli to latest in 20.10 branch as well:
|
||
|
Narpat Mali
|
af02908efd |
docker-distribution: fix for CVE-2023-2253
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution,
which accepts a parameter to control the maximum number of records returned
(query string: `n`). This vulnerability allows a malicious user to submit an
unreasonably large value for `n,` causing the allocation of a massive string
array, possibly causing a denial of service through excessive use of memory.
References:
https://github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw
|
||
|
Hitendra Prajapati
|
b3b3dbc675 |
libvirt: CVE-2023-2700 Memory leak in virPCIVirtualFunctionList cleanup
Upstream-Status: Backport from
|
||
|
Xiangyu Chen
|
9d056f957b |
xtf: chang the old override syntax
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Xiangyu Chen
|
dde0ff9eaa |
ovs: update to 2.17.6
Updating openvswitch from 2.17.1 to 2.17.6, pickup the latest security and bug fixes. Changes: 1. Removed the patch 0001-lldp-Fix-bugs-when-parsing-malformed-AutoAttach.patch. 2. Update SRCREV PV-version and CVE_VERSION Commit short log: a08bb41e3 Set release date for 2.17.6. 27fb5db7f ofproto-dpif-xlate: Always mask ip proto field. c3684a060 conntrack-tp: Fix clang warning. be19308aa netdev-offload-tc: Del ufid mapping if device not exist. 4f41e58bc netdev-tc-offloads: Fix misaligned 8 byte read. d6d1cad6a dpif-netlink: Always create at least 1 handler. 09e6e1de7 ofproto-dpif-upcall: Wait for valid hw flow stats before applying min-revalidate-pps. 691b9e514 system-traffic: Fix conntrack test cases which are failing with af_xdp. 7aa314c9c netdev-windows: Add checking when creating netdev with system type on Windows 215278bde ofproto-dpif-upcall: Include hardware offloaded flows in total flows. 4a3f8845e ofproto-dpif-upcall: Reset ukey's last stats value if the datapath changed. 132fa24b6 classifier: Fix missing masks on a final stage with ports trie. 8661abd4c ofproto: Fix re-creation of tunnel backing interfaces on restart. 638441e98 ovs-actions: Correct typo in ovs-actions man page. 3c4bd63bc ofproto-ipfix: Use per-domain template timeouts. d2583ccb7 ofproto-dpif-upcall: Use last known stats ukey stats on revalidate missed dp flows. 705190d88 conntrack: Properly unNAT inner header of related traffic. d87b6180e dpctl: Fix memory leak in flush conntrack. 6626562c5 sparse: Fix build with DPDK and GCC 12. 82dc71f80 ovsdb-server: Fix handling of DNS name for listener configuration. 9b341844e netdev-offload-tc: If the flow has not been used, report it as such. adac28dcd netdev-offload-tc: Conntrack ALGs are not supported with tc. a1c2abba7 netdev-offload-tc: Fix tc conntrack force commit support. 68a2818b0 ofproto-dpif-upcall: New ukey needs to take the old ukey's dump seq. 2eb7a6066 netdev-offload-tc: Preserve tc statistics when flow gets modified. 4f5140769 sparse: Fix numa.h for libnuma >= 2.0.13. 32853c084 tc: Add TCA_KIND flower to delete and get operation to avoid rtnl_lock(). 037131229 netdev-offload-tc: Fix misaligned access to ct label. 206409bb7 ovsdb: Fix database statistics during the database replacement. 0f55eced1 cirrus: Update to use FreeBSD 12.4. e9336a91f tc: Add support for TCA_STATS_PKT64. ba62a1eae Documentation: Fix links in maintainers.rst. 1b76faf8d Documentation: Fix links in the DPDK guide on physical ports. e1ee9c32a treewide: Don't use non-portable '==' with test command. a7d7c30c4 dpif: Fix tunnel key set for IPv6 tunnels with SLOW_ACTION. 8d055809b ci: Fix overriding OPTS provided from the yml. 0eb2aa46b Prepare for 2.17.6. 08971e4b9 Set release date for 2.17.5. ecaacb01a lldp: Fix bugs when parsing malformed AutoAttach. ee002b351 dpif-netdev: Use unmasked key when adding datapath flows. 18dcfda67 ovsdb-cs: Consider default conditions implicitly acked. 793709a85 rculist: Use rculist_back_protected to access prev. abb9d3482 Prepare for 2.17.5. b6c3788fe Set release date for 2.17.4. b50f4e3d2 odp-util: Fix reporting unknown keys as keys with bad length. 44012fccd ovs-dpctl-top: Fix ovs-dpctl-top via pipe. 118e4349d rculist: Fix iteration macros. c9f10ae33 vswitchd: Publish per iface received multicast packets. 4e3f9951f learn: Fix parsing immediate value for a field match. 282ba24d9 datapath-windows: Check the condition to reset pseudo header checksum on Rx side ee0e1d0a5 netdev-offload-dpdk: Enhance the support of tunnel pop action 4e3d762f0 ci: Update meson requirement for DPDK. 0d1e425c7 ovsdb: transaction: Fix weak reference leak. ceab1ca1e ovsdb: transaction: Refactor assess_weak_refs. fa95bf962 ovs-tcpdump: Cleanup mirror port on SIGHUP/SIGTERM. 7ebef81f9 netdev-linux: Fix inability to apply QoS on ports with custom qdiscs. 037ef6301 tc: Fix misaligned writes while parsing pedit. 869e2e1ba odp-util: Add missing separator in format_odp_conntrack_action(). 0aa55709f vswitch.xml: Fix the name of rstp-path-cost option. af459fa37 mac-learning: Fix learned fdb entries not age out issue. c4336a1f1 ofproto-dpif-xlate: Update tunnel neighbor when receive gratuitous ARP. 683508cd4 bond: Fix crash while logging not yet enabled member. 41b178d52 netdev-dpdk: Fix tx_dropped counters value. d0276481a unaligned: Correct the stats of packet_count and byte_count on Windows. 71401199f tests: Fix filtering of whole-second durations. 3c1c034e5 netdev-offload: Set 'miss_api_supported' to be under netdev. 35615cd37 cmap: Add thread fence for slot update. 5f8ba216a ofproto-dpif-xlate: Do not use zero-weight buckets in select groups. 5e26f88b4 github: Update versions of action dependencies. afce3662f ovs-tcpdump: Fix bond port unable to capture jumbo frames. 602a41bb3 json: Fix deep copy of objects and arrays. 5dde4d748 Prepare for 2.17.4. 2b4b4b868 Set release date for 2.17.3. fbc3b10e9 Add support for OpenSSL 3.0 functions. 5a77d53b8 dhparams: Fix .c file generation with OpenSSL >= 3.0. 09e22fec4 daemon-unix: Fix file descriptor leak when monitor restarts child. 53df50db2 vconn: Allow ECONNREFUSED in refuse connection test. 26a11ca61 dpdk: Use DPDK 21.11.2 release. edf699ec6 m4: Test avx512 for x86 only. 1989caf9e ovsdb-idl: Preserve references for rows deleted in same IDL run as their insertion. db6a612cd python: idl: Fix idl.Row.__str__ method. 73d7bf64a bond: Avoid deadlock while updating post recirculation rules. 70a63391c ofproto-dpif-upcall: Add debug commands to pause/resume revalidators. cf0e12f8a test-list: Fix false-positive build failure with GCC 12. 5cbed27c8 tests: Fix tests with GNU grep 3.8. a5cd60db0 cirrus: Upgrade to FreeBSD 13.1 image. 43ece36f3 netdev-linux: Skip some internal kernel stats gathering. 846d6a0c5 ofproto-dpif-xlate: Fix error messages for nonexistent ports/recirc_ids. e8814c9b8 ofproto-dpif-xlate: Clear tunnel wc bits if original packet is non-tunnel. dfc3e65c8 raft: Fix unnecessary periodic compactions. 6f322ccf8 netdev-offload-tc: Parse tunnel options only for geneve ports. a9f10a2bd netdev-offload-tc: Add missing handling of the tunnel source port. ec2e967c1 netdev-offload-tc: Fix ignoring unknown tunnel keys. 686984d9a netdev-offload-tc: Use masks instead of keys while parsing tunnel attributes. 92c072d94 netdev-offload-tc: Explicitly handle mask for the tunnel destination port. 87f191a3a netdev-offload-tc: Fix the mask for tunnel metadata length. cadcea6fe releases: Mark 2.17 as a new LTS release. 8a1b73448 handlers: Fix handlers mapping. 713072fda handlers: Create additional handler threads when using CPU isolation. 84a8910ff packets: Fix misaligned access to ip6_hdr. fe27e0c88 python: Do not send non-zero flag for a SSL socket. 729a872f1 dpif-netdev: Simplify AVX512 build time checks to enhance readability. 1b566f8b8 github: Move CI to ubuntu 20.04 base image. 86725abe1 netdev-offload-tc: Disable offload of IPv6 fragments. 2276daf88 ovs-save: Use right OpenFlow version for add-tlv-map. c353e757d system-traffic: Fix IPv4 fragmentation test sequence for check-kernel. 6f54dc134 system-traffic: Fix incorrect neigh entry in ipv6 header modification test. 7848ae6ff system-traffic: Don't run IPv6 header modification test on kernels < 5.19. 399185865 netdev-linux: set correct action for packets that passed policer cda60c855 python: Fix E275 missing whitespace after keyword. 3678fb544 tc: Use sparse hex dump while printing inconsistencies. 03a0ec82b netdev-offload-tc: Print unused mask bits on failure. 5b8453a44 dynamic-string: Add function for a sparse hex dump. 8d7cb1daf dpif-netlink: Fix incorrect bit shift in compat mode. d1cec2686 python: Use setuptools instead of distutils. 8d6ecb259 packets: Re-calculate IPv6 checksum only for first frag upon modify. 26dbc822d test-ovsdb: Fix false-positive leaks from LeakSanitizer. 6eab10cf2 m4: Update ax_func_posix_memalign to the latest version. 2f51bfd23 m4: Replace obsolete AC_HELP_STRING with AS_HELP_STRING. 8ad325aab libopenvswitch.pc: Add missing libs for a static build. b64ff3f48 rhel: Stop installing internal headers. b63bbf2db python-c-ext: Handle initialization failures. 4ad02ad04 netdev-linux: Do not touch LAG members if master is not attached to OVS. e6dcd07bc netdev: Clear auto_classified if netdev reopened with the type specified. 1eedf45e8 system-traffic: Properly stop dangling ping after geneve test. fb8e34bdb conntrack: Fix conntrack multiple new state. af37f4118 python-c-ext: Fix a couple of build warnings. b7d9f7610 python-c-ext: Remove Python 2 support. 02fb4bfb8 netdev-offload-dpdk: Setting RSS hash types in RSS action. 8e8fcf7bd lib: Print nw_frag in flow key. 29d8ce1ad ovsdb: Remove extra make target dependency for local-config.5. 13ac0bc7c tc: Fix misaligned access while creating pedit actions. 2c85d737a utilities/bashcomp: Fix incorrect file mode. 05e9d2b7a Pmd.at: fix dpcls and dpif configuration test cases. 45ecaa9e5 ovsdb: Add Local_Config schema. 61d64d389 dpif-netdev: Fix leak of AVX512 DPIF scratch pad. a77ad9693 dpif-netdev: Refactor AVX512 runtime checks. ccea7df57 dpif-netdev-extract-avx512: Protect GCC builtin usage. 807f7f994 ovs-tcpdump: Default to OVS_RUNDIR if present. ec13b03ca ovsdb: Fix memory leak on error path in ovsdb_file_read__(). 8b2dff2e3 odp-util: Ignore unknown attributes in parse_key_and_mask_to_match(). 13d97f663 ofproto-dpif: Avoid unneccesary backer revalidation. 9b4035d69 lldp: Fix lldp memory leak. d9351febc ipfix: Trigger revalidation if ipfix options changes. 5419b1de9 conntrack: Fix incorrect bit shift while hashing nat range. 1ab5f94a1 packets: Fix misaligned write to MPLS lse. 8e00be03c tc: Fix misaligned access to stats and time values. 3a1f5341c odp-util: Fix unaligned access to tunnel id. 0c54c43b8 ofpbuf: Fix offsetting a NULL pointer in ofpbuf_reserve. 98edacb40 drop-stats.at: Fix frequent failures of the recursion too deep test. cbc13ce4f odp_util: Fix parse_key_and_mask_to_match() vlan parsing. 73e6ce492 Prepare for 2.17.3. 95979b0f0 Set release date for 2.17.2. 250e1a6dd ofproto-dpif-xlate: Fix internal CT state for non-recirc traffic. fe870ee07 classifier: Adjust segment boundary to execute prerequisite processing. ec0ec464b ovs-tcpdump: Fix error when stopping ovs-tcpdump. 420823e2a ofproto-dpif: Fix meter use-after-free. c762da262 ovs-rcu: Add ovsrcu_barrier. cd9b6b64f dpif-netdev: Fix ALB 'rebalance_intvl' max hard limit. 64f6c49d2 dpif-netdev: Fix ALB parameters type mismatch. b11b84ea7 dpdk: Use DPDK 21.11.1 release. d3bf48e9a raft: Don't use HMAP_FOR_EACH_SAFE when logging commands. e07377bb4 ovsdb: raft: Fix transaction double commit due to lost leadership. 5da86cb36 dynamic-string: Fix undefined behavior due to offsetting null pointer. 369e68890 Revert "odp-util: Always report ODP_FIT_TOO_LITTLE for IGMP." 18341166e ofproto-dpif-xlate: Fix netdev native tunnel neigh discovery spa. 748e4b2b5 ovs-router: Expose the ovs_router_get_netdev_source_address function. 34390bb35 ofproto-dpif: Trigger revalidation if ct tp changes. 1adb07e20 Carefully release NBL in Windows 1ccaba448 tests: Properly kill ovsdb test processes. 260b091c2 ovs-save: Get highest ofp version error. 7606bb121 netdev-linux: Properly access 32-bit aligned rtnl_link_stats64 structs. 0688b9f27 treewide: Avoid offsetting NULL pointers. 92bcf0a82 treewide: Fix invalid bit shift operations. 7fa76371d utilities: Handle dumping packets in GDB TUI. 8cac8baa8 ofproto-dpif-xlate: Remove mirror assert. e0e8f0c54 netdev-dpdk: Fix tx drops statistic for a down netdev. f9b5f8a78 netdev-dpdk: Remove a leftover lock annotation. 4c3976ff2 netdev-dpdk: Refactor the DPDK transmit path. 410b97c83 netdev-offload-dpdk: Fix ethernet type for VLANs. 7948312fe netdev-offload-dpdk: Use has_vlan match attribute. 522c46884 python: idl: Raise AttributeError from uuid_to_row. cb24c524e ofproto-dpif-xlate: Clear out vlan flow fields while processing native tunnel. a665b75de dpif-netdev-avx512: Fix overflow of UINT32_C(1). 60e7badd6 dpif-netdev-avx512: Fix ubsan shift error in bitmasks. 9cc329ec5 python: Politely handle misuse of table.condition. 0631be2b5 ofproto-xlate: Fix crash when forwarding packet between legacy_l3 tunnels. df9790309 system-traffic: Fix fragment reassembly with L3 L4 protocol information. ba159ee0f cirrus: Update FreeBSD versions. bd1a3b6b4 Prepare for 2.17.2. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
sakib.sajal@windriver.com
|
b0b7e2dd03 |
kubernetes: update to v1.23.17
Bumping kubernetes to version 1.23.17, which comprises of the following commits:
$ git log --no-merges --oneline fbcfa330..953be892
953be892721 (tag: v1.23.17) Release commit for Kubernetes v1.23.17
6e8e51a6e9b releng: Update images, dependencies and version to Go 1.19.6
717b7220f1e Update golang.org/x/net to v0.7.0
7ce32a84313 Pin golang.org/x/net to v0.4.0
39644edd8c5 add scale test for probes
ce58b0469ad use custom dialer for http probes
1045dff13cf use custom dialer for tcp probes
2b17ed30b0e add custom dialer optimized for probes
817b9af22eb Update CHANGELOG/CHANGELOG-1.23.md for v1.23.16
cf0cb75908f (tag: v1.23.17-rc.0) Release commit for Kubernetes v1.23.17-rc.0
60e5135f758 (tag: v1.23.16) Release commit for Kubernetes v1.23.16
dd61fe9127c Fix issue that Audit Server could not correctly encode DeleteOption
da38bf46791 egress_selector: prevent goroutines leak on connect() step.
9f5af83b8fa Always dial using a context
f99efc598c3 tls.Dial() validates hostname, no need to do that manually
c4b42ed0f7d Do not include scheduler name in the preemption event message
9ddf8802962 Do not leak cross namespace pod metadata in preemption events
4dd99967bd7 pkg/controller/job: re-honor exponential backoff
53ae12b797c releng: Update images, dependencies and version to Go 1.19.5
42cc636b84f Bump Konnectivity to v0.0.35
2dae3b969ff Improve vendor verification works for each staging repo
3e3120d5ed3 Licensing: skip modules with fewer subdirs than mods
9963f00a9cc Add .go-version file containing build go version
203d8ac8384 Generate and format files
e55e20ed50a delete hardcode go version in golangci-lint config
ca22f110d65 update golangci-lint for go 1.19
c54219fc231 Update go.mod to go1.19
fd427d821dd Update to go1.19
3be293676bd Adjust for os/exec changes in 1.19
3cab72ac5a7 fix patch_test for gofmt issue
249e05a172b Fix quotes that trip up gofmt
ab0f90f3d27 Update golangci-lint to 1.46.2 and fix errors
7e2e4821dd4 Match go1.17 defaults for SHA-1 and GC
0e2e6b9071a fix e2e coverage package for go 1.18
6179de8dbb0 Regenerate vendor
7c6027a4cd1 Update go.mod files to go1.18, update license vendor script
84fde398c4d Ignore unstructured log warnings
4da1f79f991 enhance and fix log calls
c95a8a17eb4 hack: integrate logcheck into golangci-lint
944176729a8 Fix verify: generated-stable-metrics wrt go 1.18
3aaa70a7c53 Regen mocks using go 1.18
42931a01097 TestWatchRestartsIfTimeoutNotReached: fix
0a782b495fd update golangci-lint to 1.45.0
1eeda2b1c27 Update to golang.org/x/... matching release-1.24
c94870e7a89 Fix SPDY proxy authentication with special chars
a346b14331f Improve error message when proxy connection fails
981b158aaa9 image pull event include duration with waiting
97953921640 kubelet: make the image pull time more accurate in event
bf234d8f0dc Update CHANGELOG/CHANGELOG-1.23.md for v1.23.15
5c4538e0ac3 (tag: v1.23.16-rc.0) Release commit for Kubernetes v1.23.16-rc.0
b84cb8ab293 (tag: v1.23.15) Release commit for Kubernetes v1.23.15
ae80fed2259 change k8s.gcr.io/pause to registry.k8s.io/pause
3ace674c79b Reduce load of Job integration test
1427350c045 Fix endpoint reconciler failing to delete masterlease
974e9492a7e use etcd 3.5.6-0 after promotion
ec2718f11d6 changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14
4eee325a5a7 Limit request retrying to []byte request bodies
16c6800134b Merge pull request #113133 from sxllwx:automated-cherry-pick-of-#113133-upstream-release-1.25
c27b4b9db8c Add CVE-2021-25749 to CHANGELOG-1.23.md
25bc84525e3 Add CVE-2022-3294 to CHANGELOG-1.23.md
64548944d67 e2e: use custom timeouts in GetSnapshotContentFromSnapshot()
c73e13d1309 test/e2e/storage: replace hardcoded value with custom timeout in cleanup routine
65b9cb99755 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.14
92d36466905 (tag: v1.23.15-rc.0) Release commit for Kubernetes v1.23.15-rc.0
3321ffc07d2 (tag: v1.23.14) Release commit for Kubernetes v1.23.14
073dca06ae0 Fix a conflict
65beed7952d StatefulSet: Cleanup the complex defer function updating the status
d737324312e Be sure to update the status of StatefulSet even if the new replica creation fails
bb7c395dd94 fix node address validation
073c05d169d Validate etcd paths
390fc213595 Use CheckAndMarkAsUncertainViaReconstruction for uncertain volumes
23184ed5f68 Remove volume from found during reconstruction if mounted
ac6efc17b96 Add unit test for verifying if processReconstructedVolumes works as expected
386b026d0b1 Address review comments
a44c6b9e317 Fix code to process volumes which were skipped during reconstruction
75b8b1ebfd5 Keep track of each pod that uses a volume during reconstruction
c5a565c69f8 kubelet: fix pod log line corruption when using timestamps and long lines
c33ae96c4b7 hack/scripts: use registry.k8s.io
304eb41e106 kubeadm: mutate ClusterConfiguration.imageRepository to "registry.k8s.io"
f1e3eabb139 add GetAllocatableCPUs test in cpumanager
67309f5422d fix GetAllocatableCPUs in cpumanager
a98d0db2af2 kubeadm: use registry.k8s.io instead of k8s.gcr.io
132565c82e2 do not return err when PodSandbox not exist
589223b64a8 e2e: restore volume lifecycle checks for csi-hostpath driver
4edf6775ef8 kubelet: fix volume reconstruction for CSI ephemeral volumes
6e3601cc720 NodeLifecycleController: Remove race condition
7bc8104ff65 kube-proxy wait for cluster cidr skip delete events
6cca0631918 kube-proxy handle node PodCIDR changs
f9e15b3ac3f etcd: Updated to v3.5.5
c2e5631742f Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for better handling of dial failures. [Agent & Server](https://github.com/kubernetes-sigs/apiserver-network-proxy/commits/v0.0.33) include numerous other fixes.
b6e86eb30ab Merge pull request #109241 from ravisantoshgudimetla/sts-ar-optional
700be498954 service update event should be triggered when appProtocol in port is changed.
d053be81df1 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.13
56453b2f0ae (tag: v1.23.14-rc.0) Release commit for Kubernetes v1.23.14-rc.0
592eca05be2 (tag: v1.23.13) Release commit for Kubernetes v1.23.13
bab054e4568 filter out terminated containers in cadvisor_stats_provider
4c6c616069d Make mount ref search more robust
9ed9ccfd275 CHANGELOG-1.23: Add missing changes for 1.23.12
760a96b2dbc Update CHANGELOG/CHANGELOG-1.23.md for v1.23.12
51c6ad6b97b Fix list estimator for lists that are executed as gets
4634d2f91e0 (tag: v1.23.13-rc.0) Release commit for Kubernetes v1.23.13-rc.0
c6939792865 (tag: v1.23.12) Release commit for Kubernetes v1.23.12
95d3fbc36dc kubeadm: allow RSA and ECDSA format keys in preflight check
9bebb528e09 Limit redirect proxy handling to redirected responses
59571b2f136 Make sure auto-mounted subpath mount source is already mounted
ae6a6dc2f8e Call SetupDevice only if Volume is not globally Mounted
860df6bfc18 Fixes kubelet log compression on Windows
ad16e6bb8c0 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.11
222372b27c7 (tag: v1.23.12-rc.0) Release commit for Kubernetes v1.23.12-rc.0
dc2898b20c6 (tag: v1.23.11) Release commit for Kubernetes v1.23.11
301ea5b8cdb Reduce default gzip compression level from 4 to 1 in apiserver
0e4fc8b0e6c Add an option for aggregator
b69bbf36201 exec auth: support TLS config caching
479f049df90 Fix unit test
62e1ea58c44 Fix problem in updating VolumeAttached in node status
94b41ed31af Call queueSet::boundNextDispatchLocked enough
bc157c71601 Add etcd initialization in openapi tests
087362857b9 Marshal MicroTime to json and proto at the same precision
f58d3f3fe58 Windows: ensure runAsNonRoot does case-insensitive comparison on user name
da7c41caa91 Tolerate sub-microsecond eventTime changes on update
446f23cea45 Improve kubectl display of invalid errors
17335199bab fix unmatch reason when updating pod status
240590c3eaa fix nestedPendingOperations mount and umount parallel bug
091f4f00395 client-go: make retry in Request thread safe
7adf53240c7 Skip "instance not found" error for LB backend address pools
5f4953560cb Remove AttachID matching from Detach
93dedd539c4 update structured-merge-diff to 4.2.3
be5dd1bdc79 regression test for exponential recursion bug on CRDs
7ce504b9281 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.10
b445d7947a8 (tag: v1.23.11-rc.0) Release commit for Kubernetes v1.23.11-rc.0
7e54d50d301 (tag: v1.23.10) Release commit for Kubernetes v1.23.10
431ee1484e2 fix a memory leak problem when calling DryRunPreemption
23e9d632ad6 Fix deleting UIDs tracking expectations
24b8252b105 Fix JobTrackingWithFinalizers when a pod succeeds after the job fails
e1ab1debdba hardens integration job tests
fe8b09dde6a Copy etcd client debug level logic from upstream
61432c1fa21 Give etcd client logger a name
c7399df0a5f Share a single etcd3 client logger across all clients
9a60b0c5f4b Disable the etcd3 client logger
c078600b61d Update Go to 1.17.13
a86b61cf3c9 Update Go to 1.17.12
5f436c0fb35 fix a possible panic because of taking the address of nil
e3a4a91c768 Update naming for a const
f00326d1b46 Add rate limiting when calling STS assume role API
f008acd481e Ensure the dir of --audit-log-path exists
4bc41ee70ca Fix kubelet panic when accessing metrics/resource endpoint
b26a7082ad2 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.9
90ecbd8cf26 (tag: v1.23.10-rc.0) Release commit for Kubernetes v1.23.10-rc.0
c1de2d70269 (tag: v1.23.9) Release commit for Kubernetes v1.23.9
579ca64e444 Fixing logic for kubelet permissions check on windows
71a4c69a211 Do not skip job requeue in conflict error
bf4cb96e0f0 kubeadm: fix the bug that configurable KubernetesVersion not respected during kubeadm join
c67e53398b7 Bump cAdvisor to v0.43.1
3cc22b53887 Fix: filter out unsatisfied nodes when calling AddPod in PodTopologySpread
7d0a546b413 Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers by where pod sandbox won't have HostProcess bit set if pod does not have a security context but containers specify HostProcess.
3d5c2341271 Add retry logic for Unix Domain sockets on Windows
602dd1dbcfd kubeadm: fix the bug that configurable KubernetesVersion not respected during kubeadm join
3d1baf7ff2f GIT-110239: fix activeDeadlineSeconds enforcement bug
2eed3eb9177 fix: --chunk-size with selector returns missing result
3964e236193 Fixed winkernel proxy failing to query v1 endpoints created by dockershim CNIs
c535496be2c Winkernel proxier cache HNS data to improve syncProxyRules performance
938a3203c60 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.8
05a1dd747bd (tag: v1.23.9-rc.0) Release commit for Kubernetes v1.23.9-rc.0
a12b886b1da (tag: v1.23.8) Release commit for Kubernetes v1.23.8
a736f42c3ae apiserver: printers should use int64
99c3de2562d Revert "Automated cherry pick of #109124: Winkernel proxier cache HNS data to improve syncProxyRules"
930092e7153 Add test to check for _v2
e6cce430f9c Prune defaults for CRD serving
e38a625e116 add missing error handling steps
c14aa800f45 add missing error handling steps
d5eeb104cf2 fix image pulling failure when IMDS is unavailalbe in kubelet startup
772494dc74e test: update graceful node shutdown e2e with watch
6041228d192 move the ignore logic higher up to the reconciler
0e1588c7584 Ignore EndpointSlices that are already marked for deletion
96ddfd61755 kubelet: Mark ready condition as false explicitly for terminal pods
57c626299a8 agnhost: bump version 2.39
c796630e8de Update Go to 1.17.11
1f58ea0af02 add service e2e tests
6bdb7a15205 kubelet: add e2e test to verify probe readiness
7061d1f4660 kubelet: only shutdown probes for pods that are terminated
5899d561f34 kubelet: Pod probes should be handled by pod worker
bb09c564009 Enable resize feature
a36ff8366b7 Reject proxy requests to 0.0.0.0 as well
082620e9cb9 ipvs: fix prevent concurrent map read and map write for 1.23
3da57319709 cpu manager policy set to none, no one remove container id from container map, lead memory leak
b24dfdee1e0 fix audit union loop variables in closures
67219f30455 Updating e2e test to check EndpointSlices and Endpoints as well
d5a61580c68 e2e: services with evicted pods doesn't have endpoints
5adb67a7eb3 e2e test for evicted pods
e0fdecef811 endpoints controller: don't consider terminal endpoints
4e9638063f5 endpointslices: terminal pods doesn't receive enpoints
51ef8e3917d add pod util to verify pod is terminal
1eef73e88e4 Update CHANGELOG/CHANGELOG-1.23.md for v1.23.7
782029346ae (tag: v1.23.8-rc.0) Release commit for Kubernetes v1.23.8-rc.0
42c05a54746 (tag: v1.23.7) Release commit for Kubernetes v1.23.7
e90d92fa5b2 Add test for checking ephemeral volume expansion
d6260cf1df9 Fix resizing of ephemeral volumes
51f1da831de Fix requests scope classification
87e74167efe Update Go to 1.17.10
830186c95e8 authn: fix cache mutation by AuthenticatedGroupAdder
131a5090f34 GCE: skip updating and deleting external loadbalancers if service is managed outside of service controller
424dde318ce untangle fix with healthCheck feature
6bf9857f1f0 Winkernel proxier cache HNS data to improve syncProxyRules performance
9b4dee89278 Wait for cache to sync in job's TestWatchOrphanPods
8f4ff396eb3 fix: exclude non-ready nodes and deleted nodes from azure load balancers
fb70875f1a9 Fix OpenAPI loading error caused by empty APIService
88bde765611 Test Foreground deletion in job integration
11e6ec43964 Fix removing finalizer from finished jobs
b6804313363 Don't mark job as failed until expectations are satisfied
d0b5adb539d Integration test for backoff limit and finalizers
43ec5bfa40c tests: Updates the should delete a collection of pods test
fe0da319ad4 component-base: replace url in rest client metrics
21b9e9902e7 fix broken find command
70882c44773 Allow KUBE_TEST_REPO_LIST to be a remote url as well
6d010706ea4 Disable JobTrackingWithFinalizers due to unresolved bug
fa7ac2ece9a Update CHANGELOG/CHANGELOG-1.23.md for v1.23.6
bb18301a5c8 (tag: v1.23.7-rc.0) Release commit for Kubernetes v1.23.7-rc.0
ad3338546da (tag: v1.23.6) Release commit for Kubernetes v1.23.6
3df0ce04724 Update Go to 1.17.9
4d38e6e99c9 Correct event registration for multiple scheduler plugins.
8e1fb52b49b kubelet: rename closeAllConns to onHeartbeatFailure
359ad38d11d kubelet apiserver: be gentle closing connections on heartbeat failures
327e99d3393 Avoid updating Services with stale specs Fix the bug that service specs in servicesToUpdate may have been updated by clients.
727aa48b989 Fix: abort nominating a pod that was already scheduled to a node
f0753a49862 fix: race detected in TestErrConnKilled
51c860863f7 Replace hardcoded kubectl with kubectl.Name()
04d413b92ab kubectl: fix hard-coded value in zsh completion
90539b64efd Fix the overestimated cost of deletaged API requests in P&F
813751ef7a2 omit enums from static openapi snapshots used to generate clients
4d3efbab01d Drop enum tag from certificate request condition
814ae980477 Addresses the issue which caused #109115
6ba5a0bc383 Add test for indexer with multiple values
9342552112d Reduce number of pods in Job+GC tests
e637f54d914 kubeadm: add etcd flag for member data consistency
897eb36396d Adjust validation checks to pass for both client-side and
server-side validation
f75e1b071d4 Remove finalizer when orphaned
56d9c45895c Fix: Clean job tracking finalizer from orphan pods
3b84efd15de Add test for Background delete propagation
8077e58bff1 Add integration test for orphan pods when there is GC
2faf6317075 Fix a bug that out-of-tree plugin is misplaced when using scheduler v1beta3 config
cf4ede44fe7 ipvs: remove port opener
70166f26b89 iptables: remove port opener
8e44552a6f9 kubelet: If the container status is created, we are waiting
02f2986b850 Skip updating Endpoints and EndpointSlice if no relevant fields change
f628706339c client-go: update generated
3de44bd759a default kubernetes agent for generated clients
8d9001df847 generated: make update
f4cd617b74f polish comments of non-enum values.
2538b2ef438 unmark non-validated types as enums.
33a72b11fe8 azure_file: try to get secret namespace from ClaimRef
451afa701bf azure_file: add namespace tests for InTree to CSI conversion
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Chen Qi
|
4ffd2f78e5 |
containerd: upgrade to 1.6.19
1.6.19 is the latest release for 1.6 branch. This upgrade fixes CVEs such as CVE-2023-25173 and CVE-2023-25153. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Xiangyu Chen
|
bfa6727718 |
lxc: add -L and -f for curl in templates-use-curl-instead-of-wget.patch
Add support of redirect option -L for curl, the linuxcontainers.org sometimes redirect to other mirror site such like us.lxd.images.canonical.com, this would cause the lxc-download script report download failed. The version of curl in kirkstone also need to add an option -f to use an error code to tell the caller when http/https has errors. Reproduce and verified on following command: lxc-create -t download -n test -- --dist archlinux --release current --arch arm64 Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Xiangyu Chen
|
a9361e9f81 |
lxc: backport changes from master for templates-use-curl-instead-of-wget.patch
backport the changes of templates-use-curl-instead-of-wget.patch from master in following commits: |
||
|
Chen Qi
|
a517e15529 |
container-host-config: extend to native and nativesdk
skopeo rdepends on it, and skopeo has been extended to native and nativesdk, so container-host-config needs also be extended. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Chen Qi
|
a27ba1b77d |
container-host-config: provide /etc/containers/policy.json
The /etc/containers/policy.json[1] file is used to specify verification policy. For now, we can see it's used by both cri-o and skopeo. To avoid conflict, we use container-host-config to provide this file and make both skopeo and cri-o depend on it. [1] https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Chen Qi
|
b861dd498d |
README: remove some cri-o specific layer dependencies
ostree is in meta-oe, libseccomp is in oe-core. So remove these two. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
83caf2bd76 |
skopeo: use container-host bbclass to provide configuration
Instead of providing storage and registries configuration files in this package, we inherit container-host which will provide a common definition of these configs. This allows multiple packages to ensure that the configuration files are present, and not conflict in their installation. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
30b9887d1c |
containers: add container-host-config recipe
This is a configuration only recipe that produces a package which installs some common configuration files. In this introduction we have both registries.conf and storage.conf. Packages that require these files should RDEPEND on this package (or inherit container-host.bbclass) and the files will be installed. If conflicting requirements for these global configuration files arise, they can be resolved through additions to this recipe, or by providing a higher priority version of the .conf files. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
aae4d38546 |
containers: introduce container-host class
Introducing a small (at the moment) class that represents configuration and processing required to prepare a target image to be a container host. A recipe that requires container configuration should inherit this class, and the container-host-config package will be added as a RDEPENDS, and install common configuration files. In the future, additional functionality or dependencies will be added here to synchronize the configuration of multiple container host packages. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Chen Qi
|
29bf13e5f6 |
cri-o: update crio.conf to match the current version 1.23
The old crio.conf file can cause cri-o start failure. The error message is as below. validating runtime config: runtime validation: failed to \ translate monitor fields for runtime runc: cgroupfs manager \ conmon cgroup should be 'pod' or empty Use new crio.conf file to solve this issue. The file is generated by 'crio --config="" config --default' command, as indicated in the old crio.conf file. With this config file update, the crio.service can now start correctly. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Chen Qi
|
3601181edf |
cri-o: create /var/lib/crio
crio.service now reports the following error messages:
level=error msg="Writing clean shutdown supported file: \
open /var/lib/crio/clean.shutdown.supported: no such file or directory"
level=error msg="Failed to sync parent directory of clean \
shutdown file: open /var/lib/crio: no such file or directory"
Create /var/lib/crio to avoid such error message.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Chen Qi
|
1fe187dba9 |
cri-o: use PACKAGECONFIG to handle selinux
For cri-o, libselinux is optional, this can be seen from its Makefile. So let's make selinux optional by using PACKAGECONFIG, whose default value is determined by the DISTRO_FEATURES. In this way, meta-selinux dependency is not necessary. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Chen Qi
|
b2cd46a302 |
cri-o: remove meta-security check
libseccomp is not in oe-core. There's no need to check meta-security any more. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
a7413c5d75 |
containerd: update to 1.6.12
Bumping containerd to version v1.6.12-2-gccfc27e30, which comprises the following commits:
3595dd04b fix: check for tmpfs when evaluating if userxattr should be used
1899ebcd8 Prepare release notes for v1.6.12
ec5acd4c1 CRI stream server: Fix goroutine leak in Exec
9743dbae8 [release/1.6] update to go1.18.9
3d24d97ba Prepare release notes for v1.6.11
bb96b21e5 fix: support simultaneous create diff for same parent snapshot
15b541238 Fix order of operations when setting lease labels
9fdf713e5 Added nullptr checks to pkg/cri/server and sbserver
56593cca5 cri: add pod uid annotation
8ec051a6b [release/1.6] go.mod: use golang_protobuf_extensions v1.0.4
e639ecd7c Prepare release notes for v1.6.10
5af8d89ce overlayutils: Add fastpath for userxattr check
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
He Zhe
|
ee4c36ade8 |
irqbalance: Use built-in irqbalance.service instead of local one
The local irqbalanced.service was written long before when there wasn't one in
upstream. Then upstream created temporary runtime directory /run/irqbalance in
its irqbalanced.service, but no one did this for this recipe. Which renders the
following error.
/usr/sbin/irqbalance[314]: Daemon couldn't be bound to the file-based socket.
This patch starts to use upstream irqbalance.service instead and remove the
local one.
root@qemux86-64:~# systemctl status irqbalanced
* irqbalanced.service - irqbalance daemon
Loaded: loaded (/lib/systemd/system/irqbalanced.service; enabled; preset: enabled)
Active: active (running) since Mon 2022-08-22 10:10:22 UTC; 3s ago
Docs: man:irqbalance(1)
https://github.com/Irqbalance/irqbalance
Main PID: 208 (irqbalance)
Tasks: 2 (limit: 263)
Memory: 1.4M
CGroup: /system.slice/irqbalanced.service
`-208 /usr/sbin/irqbalance --foreground
Aug 22 10:10:22 qemux86-64 systemd[1]: Started irqbalance daemon.
root@qemux86-64:~# ls -l /run/irqbalance/irqbalance208.sock
srwxr-xr-x 1 root root 0 Aug 22 10:10 /run/irqbalance/irqbalance208.sock
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Xiangyu Chen
|
9a94fa2ad7 |
lxc: backport patch to fix CVE-2022-47952
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Xiangyu Chen
|
79c584eaaa |
openvswitch: backport patch to fix CVE-2022-4337 and CVE-2022-4338
CVE-2022-4337: openvswitch: Out-of-Bounds Read in Organization Specific TLV
CVE-2022-4338: openvswitch: Integer Underflow in Organization Specific TLV
Reference:
https://github.com/openvswitch/ovs/pull/405
|
||
|
Adrian Freihofer
|
927537108b |
moby: update to v20.10.21
Bumping moby to version v20.10.21, which comprises the following commits:
f99cb8297b integration: download busybox-w32 from GitHub Release
3f9dc25f5c update containerd binary to v1.6.9
87ccd38cea vendor: moby/term, Azure/go-ansiterm for golang.org/x/sys/windows compatibility
e83e465ae2 [20.10] vendor: github.com/moby/buildkit eeb7b65ab7d651770a5ec52a06ea7c96eb97a249 (v0.8 branch)
9c84417c1b skip TestImagePullStoredfDigestForOtherRepo() on Windows and rootless
5b5b5c6f13 builder: add missing doc comment
05e25f7892 builder: fix running git commands on Windows
2f3bf18014 [20.10] vendor moby/buildkit v0.8.3-31-gc0149372
6699afa549 registry: allow "allow-nondistributable-artifacts" for Docker Hub
4b9902bad4 Validate digest in repo for pull by digest
c0d1188c14 builder: make git config isolation opt-in
9f5f3abcee builder: isolate git from local system
10db4c2db7 builder: explicitly set CWD for all git commands
8816c3c2aa builder: modernize TestCheckoutGit
11bdbf40b9 [20.10] Update to go 1.18.7 to address CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
66ddb7f91c Fix live-restore w/ restart policies + volume refs
c003392582 contrib: make dockerd-rootless-setuptool.sh more robust
53313be0f3 docker-rootless-setuptools.sh: use context after install
9c486bd267 swagger: update links to logo
fa17fab895 vendor: github.com/containerd/console v1.0.2
481bee51b5 vendor: github.com/armon/go-metrics v0.4.1
39ba2873e8 vendor: github.com/google/btree v1.1.2
c2755f40cd vendor: github.com/hasicorp/memberlist v0.4.0
5ba3208ec7 Dockerfile: Update Dockerfile syntax, switch to bullseye, add missing libseccomp-dev, remove build pack
6d6a236286 [20.10] Update uses of Image platform fields in OCI image-spec
2570784169 [20.10] vendor: github.com/moby/buildkit 3a1eeca59a9263613d996ead67d53a4b7d45723d (v0.8 branch)
fcd4df906b Update some tests for supplementary group permissions
6a0186b357 Wrap local calls to the content and lease service
3d4616f943 Update to go 1.18.6 to address CVE-2022-27664, CVE-2022-32190
23c7d84b84 docs: api: adjust ContainerWaitResponse error as optional
3e9e79d134 docs: api: document ImageSummary fields (api v1.39-v1.41)
fdd438ae03 api: docs: improve documentation of ContainerConfig type (API v1.30-v1.41)
97014a8db5 namesgenerator: remove Valentina Tereshkova
e44d7f735e AdditionalGids must include effective group ID
9e7662e4a7 [20.10] vendor: update containerd to latest of docker-20.10 branch
7dac25a3a9 vendor: update tar-split to v0.11.2
8bd86a0699 update containerd binary to v1.6.8
6c8dd6a6f2 update runc to v1.1.4
418c141e64 [20.10 backport] daemon: kill exec process on ctx cancel
d127287d92 Allow different syscalls from kernels 5.12 -> 5.16
57db169641 seccomp: add support for Landlock syscalls in default policy
reverted by patch: 7ba8ca042c Update golang to 1.18.5
reverted by patch: f2a3c3bcef update golang to 1.18.4
reverted by patch: a99c9cd852 update golang to 1.18.3
reverted by patch: 82939f536b update golang to 1.18.2
reverted by patch: ecd1aa081f update golang to 1.18.1
reverted by patch: 7ba67d05a8 [20.10] vendor: update archive/tar for go 1.18
reverted by patch: 0bc432241e update golang to 1.18.0
bb95d09f9a staticcheck: ignore "SA1019: strings.Title is deprecated"
a7299ae72c Dockerfile: update golangci-lint v1.44.0
d97fd533cf integration-cli: SA5011: possible nil pointer dereference (staticcheck)
e6aee04a88 client.NewClientWithOpts(): remove redundant type assertion (gosimple)
0523323c28 daemon/logger/awslogs: suppress false positive on hardcoded creds (gosec)
adeb29c64c client/request.go:157:8: SA1019: err.Temporary is deprecated (staticcheck)
50361d91a6 registry: trimV1Address(): simplify trimming trailing slash
ae3a9337dd golangci.yml: do not limit max reported issues
9820255a1c golangci.yml: skip some tests
d223f37300 golangci.yml: update regex for ignoring SA1019
ec3bfba89d graphdriver: temporarily ignore unsafeptr: possible misuse of reflect.SliceHeader
f2f387b131 daemon: var-declaration: should omit type bool (revive)
2fb7c9fea7 daemon/config: error strings should not be capitalized
fa6954cb98 reformat "nolint" comments
45fa675a35 if-return: redundant if ...; err != nil check (revive)
9e88f8435a daemon/splunk: ignore G402: TLS MinVersion too low for now
2de90ebbe4 pkg/archive: RebaseArchiveEntries(): ignore G110
14b475d091 daemon/stats: fix notRunningErr / notFoundErr detected as unused (false positive)
db7b3f4737 unused: ignore false positives
b6de0ca7c5 G601: Implicit memory aliasing in for loop
e8b838e99f gosec: G601: Implicit memory aliasing in for loop
2ddf6e598a gosimple: S1039: unnecessary use of fmt.Sprintf
fadf8bbdff staticcheck: SA4001: &*x will be simplified to x. It will not copy x
7573e32577 client: S1031: unnecessary nil check around range (gosimple)
e738a57a6d daemon/logger/journald: fix linting errors
34f6b94255 gosec: G404: Use of weak random number generator
a6d7b61c8b update containerd binary to v1.6.7
b4ba1ee22f update runc binary to v1.1.3
da8828c4b3 api: swagger: fix invalid example value (API v1.39-v1.41)
9501d91e19 api: swagger: document BuildCache fields (API v1.39-v1.41)
61fdea902b api: swagger: document BuildCache fields.
c77432c889 [20.10] Update golang to 1.17.13
2833aa1e4b docs: api: add missing "platform" query-arg on create (v1.41)
a8c28260ad api: swagger: add missing "platform" query-arg on create
cfdc075b1c Fix file capabilities droping in Dockerfile
2daa6bb6b3 Windows: Re-create custom NAT networks after restart if missing from HNS
903cd53ce4 vendor: libnetwork 0dde5c895075df6e3630e76f750a447cf63f4789
eccaf6d368 [20.10] update golang to 1.17.12
ff7feeac37 vendor: github.com/containerd/continuity v0.3.0
Bumping libnetwork to version v0.7.0-dev.3-1841-gdcdf8f17, which comprises the following commits:
5e08bdb1 Revert: Added API to set ephemeral port allocator range
563fe8e2 README.md: repo was moved to https://github.com/moby/moby/tree/master/libnetwork
bea0bcf5 libnetwork: skip firewalld management for rootless
af0c46d8 Apply peformance tuning to new sandboxes also
Bumping docker-cli to version v20.10.21, which comprises the following commits:
3e3677e47d docs: fix links to BuildKit backend
20e3951aeb Remove "experimental" gates around "--platform" in bash completion
75d7ce92a2 fixed the plugin command docker-runc
a12c535f6e [20.10] vendor docker 03df974ae9e6c219862907efdd76ec2e77ec930b (v20.10.20)
d18a3e9004 [20.10] vendor moby/buildkit v0.8.3-31-gc0149372
932ca73874 [20.10] vendor: github.com/docker/docker v20.10.19
7d51e65e72 [20.10] vendor: github.com/moby/buildkit 3a1eeca59a9263613d996ead67d53a4b7d45723d (v0.8 branch)
1ea8d69d6f feat(docker): add context argument completion
e82aa85741 [20.10] vendor: github.com/docker/docker v20.10.18
e9176b36cc [20.10] vendor: github.com/containerd/continuity v0.3.0
bc6ff39e42 docs/reference: run.md update confusing example name
3fa7a8654f docs: update deprecation status for "overlay2.override_kernel_check"
3e06ce8bfa [20.10] Update go 1.18.7 to address CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
93eead45ee Update to go 1.18.6 to address CVE-2022-27664, CVE-2022-32190
45075ea08c [20.10] vendor: github.com/docker/docker v20.10.17
c2dcaecf19 make compose plugin detection in bash completion work on Mac OS
613b9362d0 Detect compose plugin
b30d250320 Add completion for docker-compose plugin
6b25bc3003 fix race condition in TestRemoveForce
bdac0b38d9 Update golang to 1.18.5
c70b01ec1f update golang to 1.18.4
0389090aeb update golang to 1.18.3
c904936d69 update golang to 1.18.2
386d50c2e9 update golang to 1.18.1
990186f2f6 update go to 1.18.0
86bf1966e2 staticcheck: ignore SA1019: strings.Title is deprecated
b3022b91d1 [20.10] Dockerfile.lint: use go install
f14ba9f5d7 [20.10] Dockerfile: use syntax=docker/dockerfile:1
c189c4dbea [20.10] vendor: github.com/json-iterator/go v1.1.12 for Go 1.18 compatibility
0c46ffc1f9 [20.10] vendor: github.com/modern-go/reflect2 v1.0.2 for Go 1.18 compatibility
6be9ce798e [20.10] vendor: github.com/google/gofuzz v1.0.0
779ed309a8 lint: update golangci-lint to v1.45.2
2f7e84be65 linting: fix incorrectly formatted errors (revive)
e628209d9b linting: ignore some "G101: Potential hardcoded credentials" warnings
80a3add604 cli/command/container: unnecessary use of fmt.Sprintf (gosimple)
80fb0d575e [20.10] Update golang to 1.17.13
d72bef2088 [20.10] update golang to 1.17.12
7502d7e560 Fix dead external link
308624c3b1 fix: remove asterisk from docker command suggestions
de7d866b6a [20.10] update golang to 1.17.11
240e4b5501 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
5d4776bd90 [20.10] update golang to 1.17.10
49e9c2ae3d vendor: golang.org/x/sys 63515b42dcdf9544f4e6a02fd7632793fde2f72d (for Go 1.17)
87a3ce2699 vendor: golang.org/x/sys d19ff857e887eacb631721f188c7d365c2331456
1d8abed17d vendor: update x/sys to 134d130e
31dad66f9a [20.10] update golang to 1.17.9
80f673bf9e gofmt with go1.17
3d4cc8e699 [20.10] update remaining files to go1.17.8
30277a8f80 update go to 1.17.8
cfef3a7dc1 docs: deprecated: add entry for "fluent-async-connect" log-opt
53426025c3 [20.10] docs: reformat table for compatibility
573a664639 Describe privileged mode in terms of capabilities
cf0ab7ac4c [20.10] vendor: github.com/docker/distribution v2.8.1
d05fd4ffc8 [20.10] vendor: github.com/opencontainers/image-spec v1.0.2
870f138250 [20.10] vendor: github.com/docker/docker v20.10.14
198d6b8724 [20.10] circleci: update buildx to v0.8.2
55a14ec851 [20.10] update remaining Dockerfiles to go 1.16.15
1f9a0df05a e2e: update docker-compose to 1.29.2
4ae338b33a docs: reference: remove trailing space to fix yaml formatting
6380142dd4 docs: fix (table) formatting, fix some broken links
82f422fcf3 docs: build: fix minor markdown and syntax issues
80fd77903b Update the list of log drivers
c3d4d623c8 Fix CMD --ignored-param1 example
2e82d11def docs: dockerd: fix broken link in blockquote area
738a6ee1cc improve cp documentation with some illustration examples
246d96bb6c docs: unify "docker create" and "docker run" reference
2fd0f17057 docs: add missing documentation for --pull flag
5fa500000a Fix incorrect pointer inputs to `json.Unmarshal`
1e6a8ce2b7 Dockerfile: update xx to 1.1
6f7a931a2d [20.10] use GO_LDFLAGS instead of LDFLAGS to prevent inheriting unrelated options
91bab605f7 [20.10] vendor.conf: don't use git:// protocol
a282e0c5d2 [20.10] update to go 1.16.15 to address CVE-2022-24921
700364e304 Fix mistake with env var example in docker run docs
62d27c32ff Update WORKDIR command information
c0e952cf04 Fix the (dead) link for docs for Dockerfile syntax reference
04104a04d3 Update dockerd.md
b721998b7b Fixing typo (his --> its)
4065e1246e format create.md table
f1002eb9fb Fix typo
e97c7b240e added missing closing parenthese
aa78937634 Update stats.md add example json output
40fe0573aa Update Ubuntu version number references in push.md
c9737e1c37 docs/daemon: replace deprecated '-g' option for '--data-root'
5c6723d080 Correct device syntax to --gpus
fd5fc61ecd [20.10] Update Go to 1.16.14
3624019d83 [20.10] update Go to 1.16.13
f3ff8e6ad6 [20.10] vendor: compose-on-kubernetes v0.5.0 to remove github.com/golang/glog
ee1ac1b319 fix innocuous data-race when config.Load called in parallel
38dd744a11 [20.10] Update Go to 1.16.12
4de40a825e Update Go to 1.16.11
03fa8f92c8 Update Go to 1.16.10
9989fdbc40 Update most links in docs to use https by default
0e20c1fd21 Update Go to 1.16.9
1c0927a041 Dockerfile: update tonistiigi/xx to 1.0.0-rc.2, add XX_VERSION arg
82f9d5921b info: skip client-side warning about seccomp profile on API >= 1.42
adb01ca79d docs: some minor touch-ups in checkpoint reference
8260476a06 docs: remove trailing space to fix generated YAML format
bce2e1f953 docs: create.md: typo fix
44064f51c8 Fix typo in documentation - build.md
292779add5 Add doc for BUILDKIT_PROGRESS env var
f2e79b826c docs: use "console" code-hint for shell examples
fa46b92361 docs: rewrite reference docs for --stop-signal and --stop-timeout
400f81089a experimental: fix broken link to "checkpoint and restore" page
c72057c8db docs: move checkpoint/restore doc from experimental into reference
77db97d595 Use private network address for default-address-pools setting in daemon.json example
cbf0d2b7b7 docs: fix some broken anchors
d0014a86bc docs: fix description of restart-delay to mention max (1 minute)
6c1c8b55aa docs: fix search results by filterd is-official
44fdac11f5 Update Go to 1.16.8
061051c24d docs: add missing redirect, and remove /go/experimental redirect
2012fbf111 Update Go to 1.16.7
42d1c02750 registry: ensure default auth config has address
0b924e51fc Update to go1.16.6
6288e8b1ac change TestNewAPIClientFromFlagsWithHttpProxyEnv to an e2e test
1e9575e81a cli/config/configfile: various test cleanups
c98e9c47ca Use designated test domains (RFC2606) in tests
8437cfefae context: deprecate support for encrypted TLS private keys
68a5ca859f cli/context: ignore linting warnings about RFC 1423 encryption
8a64739631 Update Dockerfiles to latest syntax, remove "experimental"
1d37fb3027 Deprecate Kubernetes context support
0793f96394 Deprecate Kubernetes stack support
b639ea8b89 Deprecate Kubernetes stack support
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
751ddf3677 |
docker/moby: use generic DOCKER_COMMIT in do_compile
do_compile() is shared and shouldn't have been using SRCREV_moby as that is obviously only set in the moby recipe. Switch to using a generic DOCKER_COMMIT variable and set it in both docker_moby and docker-ce. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
51833d0e13 |
docker: add seccomp to default packageconfig settings
Much of meta-virt requires seccomp to function properly, so we update docker to match that common default. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
b4b38e8e43 |
docker: add mobyproject:moby to CVE_PRODUCT
Add mobyproject:moby to CVE_PRODUCT to reflect where the source is coming from for both docker recipes. We keep the old 'docker' designation for compatibility. It is unclear whether or not we should also be adding the cli and libnetwork to the CVE_PRODUCT. But since they are on different SRCREVs and not vendored, we keep them out for now. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
181a754d13 |
containerd: update to v1.6.9
Bumping containerd to version v1.6.9-12-g6c41694da, which comprises the following commits:
5af8d89ce overlayutils: Add fastpath for userxattr check
303f608dd [release/1.6] update to Go 1.18.8 to address CVE-2022-41716
3f9f9508d ctr export strictly match default platform
df73acad5 [release/1.6] go.mod: Bump hcsshim to v0.9.5
658490b78 ctr import: strictly match platform
4907b4d72 Migrate away from GitHub actions set-output
f1493f665 Prepare release notes for v1.6.9
346412f5a adding support of CAP_BPF and CAP_PERFMON
99578d1fc Update mailmap
a956d8415 Add logging volume metrics to Containerd CRI plugin
29e2dea50 fix pusher concurrent close channel
8a9d69385 [release/1.6] Stats() shouldn't assume s.container is non-nil
a9adc7938 cri: PodSandboxStatus should tolerate missing task
b66eb726a migrate from k8s.gcr.io to registry.k8s.io
5b40993a5 [release/1.6] upgrade containerd/continuity from v0.2.2 to v0.3.0
f2376e659 Update container with sandbox metadata after NetNS is created
06f82efef archive: validate digests before use
28324c529 [release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
0aeeb62cb [release/1.6] update golangci-lint to v1.19.0
7db9d1f76 Fix linter warnings
4dc932e62 [release/1.6] gofmt with go1.19
7b8d679ad [release/1.6] integration: remove use of deprecated io/ioutil
926b9c72f retry request on writer reset
b9a35c6af Add integration tests with failpoint
1f29fac48 Persist container and sandbox if resource cleanup fails, like teardownPodNetwork
a85709c6c integration: simplify CNI-fp and add README.md
d89a8d223 pkg/failpoint: add FreeBSD link and update pkg doc
b0ce2965a integration: Add injected failpoint testing for RunPodSandbox
a7f956d86 integration: CNI bridge wrapper with failpoint
07c479471 pkg/failpoint: add DelegatedEval API
4a5bc05aa runtime/v2/shim: return if error in load plugin
71ee7de24 bin/ctr,integration: new runc-shim with failpoint
3e2e77849 runtime/v2: manager supports server interceptor
cb935bf49 pkg/failpoint: init failpoint package
2fdfd564c make xattr EPERM non-fatal in createTarFile
89e49609d remotes/docker/config: Skipping TLS verification for localhost
b720be2ce remove stray .zuul.yaml
6b30bc4b4 .zuul: remove the zuul because it is offline
0f7e258ee Set grpc code for unimplemented cri-api methods
fb753e5cd update intergration
6ee5bb7ea bump cri-api
ae8598615 ContainerStatus to return container resources
d3c7e31c8 Update CRI-API
5b44c5271 vendor: golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
3507d600b update runc binary to v1.1.4
1efd8b947 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
9999f03424 |
runc-docker: update to 1.1.4-tip
Bumping runc to version v1.1.4-8-g974efd2d, which comprises the following commits:
3b958289 Fixes inability to use /dev/null when inside a container
335ec376 cirrus-ci: install EPEL on CentOS 7 conditionally
fb145a2f cirrus-ci: enable EPEL for CentOS 7
276297b6 VERSION: back to development
5fd4c4d1 Release 1.1.4
204c673c [1.1] fix failed exec after systemctl daemon-reload
ec2efc2c ci: fix for codespell 2.2
c778598c [1.1] ci/gha: fix cross-386 job vs go 1.19
d83a861d Fix error from runc run on noexec fs
d614445d [1.1] libct/nsenter: switch to sane_kill()
3ca5673f CI: workaround CentOS Stream 9 criu issue
c3986e53 tests/int: don't use --criu
f46c0dad [1.1] ci: fix delete.bats for GHA
6b94849d tests/int: runc delete: fix flake, enable for rootless
fa3354dc libct: fix mounting via wrong proc fd
eb1552a0 VERSION: back to development
6724737f VERSION: release 1.1.3
91fa032d ci: add basic checks for CHANGELOG.md
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
b0084d6daa |
runc: update to 1.1.4-tip
Bumping runc to version v1.1.4-8-g974efd2d, which comprises the following commits:
3b958289 Fixes inability to use /dev/null when inside a container
335ec376 cirrus-ci: install EPEL on CentOS 7 conditionally
fb145a2f cirrus-ci: enable EPEL for CentOS 7
276297b6 VERSION: back to development
5fd4c4d1 Release 1.1.4
204c673c [1.1] fix failed exec after systemctl daemon-reload
ec2efc2c ci: fix for codespell 2.2
c778598c [1.1] ci/gha: fix cross-386 job vs go 1.19
d83a861d Fix error from runc run on noexec fs
d614445d [1.1] libct/nsenter: switch to sane_kill()
3ca5673f CI: workaround CentOS Stream 9 criu issue
c3986e53 tests/int: don't use --criu
f46c0dad [1.1] ci: fix delete.bats for GHA
6b94849d tests/int: runc delete: fix flake, enable for rootless
fa3354dc libct: fix mounting via wrong proc fd
eb1552a0 VERSION: back to development
6724737f VERSION: release 1.1.3
91fa032d ci: add basic checks for CHANGELOG.md
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Jose Quaresma
|
2d44f8e5bc |
docker/proxy: don't use -linkshared unconditionally
The linkshared is not supported in some machines like riscv64 and when supported we can use the GO_LINKSHARED instaed. So export GO_LINKSHARED on the recipe to be available for Makefile. This is currently only used in libnetwork for the proxy build, but could be used in additional locations in the future. Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
f67902ddfd |
containerd: fix final TMDIR references
restructure the containerd source layout to avoid symlinking vendor dependencies. This avoid go recording paths in the final binaries. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
4bc82a1330 |
docker: reproducibility add -trimpath to go -> $GO patches
With this, we build and package docker without QA warnings due to references to TMPDIR. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
7c811b31dc |
containerd: improve reproducibility
We get the following QA warning on build: WARNING: containerd-opencontainers-v1.6.8+gitAUTOINC+579a6380ec-r0 do_package_qa: QA Issue: File /usr/bin/containerd-shim-runc-v2 in package containerd-opencontainers contains reference to TMPDIR File /usr/bin/containerd-ctr in package containerd-opencontainers contains reference to TMPDIR File /usr/bin/containerd-shim-runc-v1 in package containerd-opencontainers contains reference to TMPDIR File /usr/bin/containerd in package containerd-opencontainers contains reference to TMPDIR File /usr/bin/containerd-shim in package containerd-opencontainers contains reference to TMPDIR [buildpaths] This is the first step in fixing the QA warning, by dropping our debug patch, passing -trimpath and not defining GO_DEBUG. This leaves a final reference similar to: path _/opt/poky/build/tmp/work/core2-64-poky-linux/containerd-opencontainers/v1.6.8+gitAUTOINC+579a6380ec-r0/git/src/import/cmd/ctr That is being stored in the .rodata of the binaries. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
9c1fb8f49b |
containerd: update to 1.6.8
Bumping containerd to version v1.6.8-8-g579a6380e, which comprises the following commits:
1efd8b947 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887
0448673af Do not append []string{""} to command to preserve Docker compatibility
5c230ece0 Fix cleanup in critest
ed9d3dc37 oci: WithDefaultUnixDevices(): remove tun/tap from the default devices
3364f411e Prepare release notes for v1.6.8
390920429 release workflow: remove Go setup action
cf48ba6e8 release workflow: increase timeout to 30 minutes
57873e652 release: rollback Ubuntu to 18.04 (except for riscv64)
eccb82f6d Update release build timeout to 20 minutes
6a854d4b5 Update mailmap
61612e1a2 Prepare release notes for 1.6.7
d199ee462 Update golang to 1.17.13
0578d20c5 Change os.Stderr reassign for Windows service
12cae4961 Update Vagrant CI to macos-12
bc4091aae chore: bump macos runner version
cb73bd050 Windows HostProcess container CRI stats test
ac388525a Add validations for Windows HostProcess CRI configs
0007f40fe [release/1.6] go.mod: Bump hcsshim to v0.9.4
c9607e78c Update Fedora version to 36
2952b66c0 CI: add riscv64 builds
6b2dc9a37 release/Dockerfile: update Ubuntu to 22.04 for supporting riscv64
745dc07c4 seccomp: support riscv64
c2f841f21 Create ppc64le release
86b55bd8d seccomp: allow clock_settime64 when CAP_SYS_TIME is added
f3da3e51f allow ptrace(2) by default for kernel >= 4.8
aa1101068 [release/1.6] update golang to 1.17.12
37dfc5c9d [release/1.6] Fix WWW-Authenticate parsing
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
8bc4cf804f |
docker: ensure that sysvinit and systemd are exclusive
The sysvinit functionality conflicts with the docker daemon settings required for the systemd docker.socket. Ensure that the sysvinit capabilities are only enabled if systemd is not present. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> |
||
|
Bruce Ashfield
|
e8ff0486ad |
docker-ce: update to 20.10.17
Bumping moby to version v20.10.17-2-g3949ff121e, which comprises the following commits:
ff7feeac37 vendor: github.com/containerd/continuity v0.3.0
6f3f2b6d08 update containerd binary to v1.6.6
b3bcb15da8 update containerd binary to v1.6.5
f55b030fa0 system: unbreak build for darwin
63ab12cd3a Port pkg/system/mknod.go to FreeBSD
081e538fbd vendor: libnetwork f6ccccb1c082a432c2a5814aaedaca56af33d9ea
8e9d647c01 [20.10] update golang to 1.17.11
87ead7fd2a vendor: hcsshim a11a2c44e8a4aa9d66314b1d759ef582df5ab5e8
27f8322324 vendor: libnetwork 2dab5620d4462865c6151e573b3e7fa5d3b8458b
829951ec19 docs: api: /containers/{id}/attach/ws: remove unsupported query-args < v1.42
6cbe73bfc0 Rename Reservation to Reservations in the open API
d9ed3d7e28 update runc binary to v1.1.2
a15acb4bd6 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
5f2e0b79ad [20.10] update golang to 1.17.10
Bumping libnetwork to version v0.7.0-dev.3-1835-gf6ccccb1, which comprises the following commits:
af0c46d8 Apply peformance tuning to new sandboxes also
23ffb31f Set ExternalPortReserved for dummy proxy
9b82e422 Bump hcsshim
9db86fb7 Only check if route overlaps routes with scope: LINK
Bumping docker-cli to version v20.10.17, which comprises the following commits:
7502d7e56 Fix dead external link
308624c3b fix: remove asterisk from docker command suggestions
de7d866b6 [20.10] update golang to 1.17.11
240e4b550 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
5d4776bd9 [20.10] update golang to 1.17.10
49e9c2ae3 vendor: golang.org/x/sys 63515b42dcdf9544f4e6a02fd7632793fde2f72d (for Go 1.17)
87a3ce269 vendor: golang.org/x/sys d19ff857e887eacb631721f188c7d365c2331456
1d8abed17 vendor: update x/sys to 134d130e
31dad66f9 [20.10] update golang to 1.17.9
80f673bf9 gofmt with go1.17
3d4cc8e69 [20.10] update remaining files to go1.17.8
30277a8f8 update go to 1.17.8
cfef3a7dc docs: deprecated: add entry for "fluent-async-connect" log-opt
53426025c [20.10] docs: reformat table for compatibility
573a66463 Describe privileged mode in terms of capabilities
cf0ab7ac4 [20.10] vendor: github.com/docker/distribution v2.8.1
d05fd4ffc [20.10] vendor: github.com/opencontainers/image-spec v1.0.2
870f13825 [20.10] vendor: github.com/docker/docker v20.10.14
198d6b872 [20.10] circleci: update buildx to v0.8.2
55a14ec85 [20.10] update remaining Dockerfiles to go 1.16.15
1f9a0df05 e2e: update docker-compose to 1.29.2
4ae338b33 docs: reference: remove trailing space to fix yaml formatting
6380142dd docs: fix (table) formatting, fix some broken links
82f422fcf docs: build: fix minor markdown and syntax issues
80fd77903 Update the list of log drivers
c3d4d623c Fix CMD --ignored-param1 example
2e82d11de docs: dockerd: fix broken link in blockquote area
738a6ee1c improve cp documentation with some illustration examples
246d96bb6 docs: unify "docker create" and "docker run" reference
2fd0f1705 docs: add missing documentation for --pull flag
5fa500000 Fix incorrect pointer inputs to `json.Unmarshal`
1e6a8ce2b Dockerfile: update xx to 1.1
6f7a931a2 [20.10] use GO_LDFLAGS instead of LDFLAGS to prevent inheriting unrelated options
91bab605f [20.10] vendor.conf: don't use git:// protocol
a282e0c5d [20.10] update to go 1.16.15 to address CVE-2022-24921
700364e30 Fix mistake with env var example in docker run docs
62d27c32f Update WORKDIR command information
c0e952cf0 Fix the (dead) link for docs for Dockerfile syntax reference
04104a04d Update dockerd.md
b721998b7 Fixing typo (his --> its)
4065e1246 format create.md table
f1002eb9f Fix typo
e97c7b240 added missing closing parenthese
aa7893763 Update stats.md add example json output
40fe0573a Update Ubuntu version number references in push.md
c9737e1c3 docs/daemon: replace deprecated '-g' option for '--data-root'
5c6723d08 Correct device syntax to --gpus
fd5fc61ec [20.10] Update Go to 1.16.14
3624019d8 [20.10] update Go to 1.16.13
f3ff8e6ad [20.10] vendor: compose-on-kubernetes v0.5.0 to remove github.com/golang/glog
ee1ac1b31 fix innocuous data-race when config.Load called in parallel
38dd744a1 [20.10] Update Go to 1.16.12
4de40a825 Update Go to 1.16.11
03fa8f92c Update Go to 1.16.10
9989fdbc4 Update most links in docs to use https by default
0e20c1fd2 Update Go to 1.16.9
1c0927a04 Dockerfile: update tonistiigi/xx to 1.0.0-rc.2, add XX_VERSION arg
82f9d5921 info: skip client-side warning about seccomp profile on API >= 1.42
adb01ca79 docs: some minor touch-ups in checkpoint reference
8260476a0 docs: remove trailing space to fix generated YAML format
bce2e1f95 docs: create.md: typo fix
44064f51c Fix typo in documentation - build.md
292779add Add doc for BUILDKIT_PROGRESS env var
f2e79b826 docs: use "console" code-hint for shell examples
fa46b9236 docs: rewrite reference docs for --stop-signal and --stop-timeout
400f81089 experimental: fix broken link to "checkpoint and restore" page
c72057c8d docs: move checkpoint/restore doc from experimental into reference
77db97d59 Use private network address for default-address-pools setting in daemon.json example
cbf0d2b7b docs: fix some broken anchors
d0014a86b docs: fix description of restart-delay to mention max (1 minute)
6c1c8b55a docs: fix search results by filterd is-official
44fdac11f Update Go to 1.16.8
061051c24 docs: add missing redirect, and remove /go/experimental redirect
2012fbf11 Update Go to 1.16.7
42d1c0275 registry: ensure default auth config has address
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
a38a62ec98 |
docker-moby: update to 20.10.17
Bumping moby to version v20.10.17-2-g3949ff121e, which comprises the following commits:
ff7feeac37 vendor: github.com/containerd/continuity v0.3.0
6f3f2b6d08 update containerd binary to v1.6.6
b3bcb15da8 update containerd binary to v1.6.5
f55b030fa0 system: unbreak build for darwin
63ab12cd3a Port pkg/system/mknod.go to FreeBSD
081e538fbd vendor: libnetwork f6ccccb1c082a432c2a5814aaedaca56af33d9ea
8e9d647c01 [20.10] update golang to 1.17.11
87ead7fd2a vendor: hcsshim a11a2c44e8a4aa9d66314b1d759ef582df5ab5e8
27f8322324 vendor: libnetwork 2dab5620d4462865c6151e573b3e7fa5d3b8458b
829951ec19 docs: api: /containers/{id}/attach/ws: remove unsupported query-args < v1.42
6cbe73bfc0 Rename Reservation to Reservations in the open API
d9ed3d7e28 update runc binary to v1.1.2
a15acb4bd6 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
5f2e0b79ad [20.10] update golang to 1.17.10
Bumping libnetwork to version v0.7.0-dev.3-1835-gf6ccccb1, which comprises the following commits:
af0c46d8 Apply peformance tuning to new sandboxes also
23ffb31f Set ExternalPortReserved for dummy proxy
9b82e422 Bump hcsshim
9db86fb7 Only check if route overlaps routes with scope: LINK
Bumping docker-cli to version v20.10.17, which comprises the following commits:
7502d7e56 Fix dead external link
308624c3b fix: remove asterisk from docker command suggestions
de7d866b6 [20.10] update golang to 1.17.11
240e4b550 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
5d4776bd9 [20.10] update golang to 1.17.10
49e9c2ae3 vendor: golang.org/x/sys 63515b42dcdf9544f4e6a02fd7632793fde2f72d (for Go 1.17)
87a3ce269 vendor: golang.org/x/sys d19ff857e887eacb631721f188c7d365c2331456
1d8abed17 vendor: update x/sys to 134d130e
31dad66f9 [20.10] update golang to 1.17.9
80f673bf9 gofmt with go1.17
3d4cc8e69 [20.10] update remaining files to go1.17.8
30277a8f8 update go to 1.17.8
cfef3a7dc docs: deprecated: add entry for "fluent-async-connect" log-opt
53426025c [20.10] docs: reformat table for compatibility
573a66463 Describe privileged mode in terms of capabilities
cf0ab7ac4 [20.10] vendor: github.com/docker/distribution v2.8.1
d05fd4ffc [20.10] vendor: github.com/opencontainers/image-spec v1.0.2
870f13825 [20.10] vendor: github.com/docker/docker v20.10.14
198d6b872 [20.10] circleci: update buildx to v0.8.2
55a14ec85 [20.10] update remaining Dockerfiles to go 1.16.15
1f9a0df05 e2e: update docker-compose to 1.29.2
4ae338b33 docs: reference: remove trailing space to fix yaml formatting
6380142dd docs: fix (table) formatting, fix some broken links
82f422fcf docs: build: fix minor markdown and syntax issues
80fd77903 Update the list of log drivers
c3d4d623c Fix CMD --ignored-param1 example
2e82d11de docs: dockerd: fix broken link in blockquote area
738a6ee1c improve cp documentation with some illustration examples
246d96bb6 docs: unify "docker create" and "docker run" reference
2fd0f1705 docs: add missing documentation for --pull flag
5fa500000 Fix incorrect pointer inputs to `json.Unmarshal`
1e6a8ce2b Dockerfile: update xx to 1.1
6f7a931a2 [20.10] use GO_LDFLAGS instead of LDFLAGS to prevent inheriting unrelated options
91bab605f [20.10] vendor.conf: don't use git:// protocol
a282e0c5d [20.10] update to go 1.16.15 to address CVE-2022-24921
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
e68f03fbc9 |
runc-docker: update to 1.1.3
Bumping runc to version v1.1.3-2-g1e7bb5b7, which comprises the following commits:
eb1552a0 VERSION: back to development
6724737f VERSION: release 1.1.3
91fa032d ci: add basic checks for CHANGELOG.md
7219387e cgroups: systemd: skip adding device paths that don't exist
93d1807b libcontainer: relax getenv_int sanity check
8242c05d script/seccomp.sh: check tarball sha256
017cb29b Dockerfile,scripts/release: bump libseccomp to v2.5.4
51649a7d Allow mounting of /proc/sys/kernel/ns_last_pid
3a09da6b ci: drop docker layer caching from release job
8b93f9fb seccomp: enosys: always return -ENOSYS for setup(2) on s390(x)
fc2a8fe1 libct/cg/sd: check dbus.ErrClosed instead of isDbusError
d105e052 libct/seccomp/config: add missing KillThread, KillProcess
e4474ef8 [1.1] vendor: bump seccomp/libseccomp-golang to f33da4d
dc083b2b fix deprecated ActKill
bf1cd884 ci: use golangci-lint-action v3, GO_VERSION
1feafc31 ci: bump golangci-lint to v1.44
89f79ff0 libct: StartInitialization: fix %w related warning
3b7f2605 Format sources using gofumpt 0.2.1
eeac4e77 build(deps): bump actions/checkout from 2 to 3
cd7fa00d Vagrantfile.fedora: fix build wrt new git
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|
||
|
Bruce Ashfield
|
2bc6173b83 |
runc: update to 1.1.3
Bumping runc to version v1.1.3-2-g1e7bb5b7, which comprises the following commits:
eb1552a0 VERSION: back to development
6724737f VERSION: release 1.1.3
91fa032d ci: add basic checks for CHANGELOG.md
7219387e cgroups: systemd: skip adding device paths that don't exist
93d1807b libcontainer: relax getenv_int sanity check
8242c05d script/seccomp.sh: check tarball sha256
017cb29b Dockerfile,scripts/release: bump libseccomp to v2.5.4
51649a7d Allow mounting of /proc/sys/kernel/ns_last_pid
3a09da6b ci: drop docker layer caching from release job
8b93f9fb seccomp: enosys: always return -ENOSYS for setup(2) on s390(x)
fc2a8fe1 libct/cg/sd: check dbus.ErrClosed instead of isDbusError
d105e052 libct/seccomp/config: add missing KillThread, KillProcess
e4474ef8 [1.1] vendor: bump seccomp/libseccomp-golang to f33da4d
dc083b2b fix deprecated ActKill
bf1cd884 ci: use golangci-lint-action v3, GO_VERSION
1feafc31 ci: bump golangci-lint to v1.44
89f79ff0 libct: StartInitialization: fix %w related warning
3b7f2605 Format sources using gofumpt 0.2.1
eeac4e77 build(deps): bump actions/checkout from 2 to 3
cd7fa00d Vagrantfile.fedora: fix build wrt new git
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
|