Hello community, here is the log from the commit of package docker for openSUSE:Factory checked in at 2017-05-23 10:18:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/docker (Old) and /work/SRC/openSUSE:Factory/.docker.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "docker" Tue May 23 10:18:53 2017 rev:54 rq:495655 version:17.04.0_ce Changes: -------- --- /work/SRC/openSUSE:Factory/docker/docker.changes 2017-04-17 10:26:35.327855973 +0200 +++ /work/SRC/openSUSE:Factory/.docker.new/docker.changes 2017-05-23 10:18:59.332239279 +0200 @@ -1,0 +2,63 @@ +Wed May 17 14:41:29 UTC 2017 - asa...@suse.com + +- Fix bsc#1037607 which was causing read-only issues on Kubic, this is a + backport of https://github.com/moby/moby/pull/33250. + + bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch + +------------------------------------------------------------------- +Wed May 10 13:54:44 UTC 2017 - asa...@suse.com + +- Add a partial fix for boo#1038493. +- Fixed bsc#1037436 where execids were being leaked due to bad error handling. + This is a backport of https://github.com/docker/cli/pull/52. + + bsc1037436-0001-client-check-tty-before-creating-exec-job.patch + +------------------------------------------------------------------- +Thu May 4 19:03:40 UTC 2017 - jmassaguer...@suse.com + +- Fix golang requirements in the subpackages + +------------------------------------------------------------------- +Mon May 1 07:57:35 UTC 2017 - fcaste...@suse.com + +- Update golang build requirements to use golang(API) symbol: this is + needed to solve a conflict between multiple versions of Go being available + +------------------------------------------------------------------- +Tue Apr 18 15:38:11 UTC 2017 - jmassaguer...@suse.com + +- Fix secrets-0002-SUSE-implement-SUSE-container-secrets.patch: + substitute docker/distribution/digest by opencontainers/digest + +------------------------------------------------------------------- +Thu Apr 13 14:34:35 UTC 2017 - jmassaguer...@suse.com + +- Update to version 17.04.0-ce (fix bsc#1034053 ) + +- Patches removed because have been merged into this version: + * pr31549-cmd-docker-fix-TestDaemonCommand.patch + * pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch +- Patches rebased: + * integration-cli-fix-TestInfoEnsureSucceeds.patch +- Build man pages for all archs (bsc#953182) +- Containers cannot resolve DNS if docker host uses 127.0.0.1 as resolver (bsc#1034063) + +see /usr/share/doc/packages/docker/CHANGELOG.md + +------------------------------------------------------------------- +Wed Apr 12 09:54:18 UTC 2017 - jmassaguer...@suse.com + +- Make sure this is being built with go 1.7 + +------------------------------------------------------------------- +Wed Apr 12 09:14:35 UTC 2017 - jmassaguer...@suse.com + +- remove the go_arches macro because we are using go1.7 which + is available in all archs + +- remove gcc specific patches + * gcc-go-patches.patch + * netlink_netns_powerpc.patch + * boltdb_bolt_add_brokenUnaligned.patch + +------------------------------------------------------------------- Old: ---- boltdb_bolt_add_brokenUnaligned.patch docker-1.13.0.tar.xz gcc-go-patches.patch netlink_netns_powerpc.patch pr31549-cmd-docker-fix-TestDaemonCommand.patch pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch New: ---- bsc1037436-0001-client-check-tty-before-creating-exec-job.patch bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch docker-17.04.0_ce.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ docker.spec ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.300102830 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.304102266 +0200 @@ -17,26 +17,12 @@ # nodebuginfo -# Check if go_arches is defined in the project configuration -# Otherwise, define it here -# In order to define it in the project configuration, see -# -# https://en.opensuse.org/openSUSE:Build%20Service%20prjconf#Macros -# -# The Macros tag is the one that defines the go_arches variable to be used -# in the spec file. -# The "define" one is to help the specfile parser of the buildservice -# to see what packages are being built. You also want to define it here -# for keeping things consistent. - -%{!?go_arches: %global go_arches %ix86 x86_64 aarch64 ppc64le} - %global docker_store %{_localstatedir}/lib/docker %global docker_migration_testfile %{docker_store}/.suse-image-migration-v1to2-complete %global docker_migration_warnfile %{docker_store}/docker-update-message.txt %define docker_graph %{docker_store}/graph %define git_version 78d1802 -%define version_unconverted 1.13.0 +%define version_unconverted 17.04.0_ce %define __arch_install_post export NO_BRP_STRIP_DEBUG=true # When upgrading to a new version requires the service not to be restarted # Due to a long migration process update last_migration_version to the new version @@ -44,7 +30,7 @@ # 1.10.1 %global last_migration_version 1.10.1 Name: docker -Version: 1.13.0 +Version: 17.04.0_ce Release: 0 Summary: The Linux container runtime License: Apache-2.0 @@ -60,10 +46,6 @@ Source9: docker-update-message.txt Source10: tests.sh Source11: docker_service_helper.sh -# Fixes for architecture-specific issues (gcc-go). -Patch100: gcc-go-patches.patch -Patch102: netlink_netns_powerpc.patch -Patch103: boltdb_bolt_add_brokenUnaligned.patch # SUSE-FEATURE: Adds the /run/secrets mountpoint inside all Docker containers # which is not snapshotted when images are committed. Note that if you modify # this patch, please also modify the patch in the suse-secrets-v<version> @@ -72,8 +54,10 @@ Patch201: secrets-0002-SUSE-implement-SUSE-container-secrets.patch # PATCH-FIX-UPSTREAM: Backports. Patch300: integration-cli-fix-TestInfoEnsureSucceeds.patch -Patch301: pr31549-cmd-docker-fix-TestDaemonCommand.patch -Patch302: pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch +# PATCH-FIX-UPSTREAM: Backport of https://github.com/docker/cli/pull/52 (bsc#1037436). +Patch400: bsc1037436-0001-client-check-tty-before-creating-exec-job.patch +# PATCH-FIX-UPSTREAM: Backport of https://github.com/moby/moby/pull/33250 (bsc#1037607). +Patch401: bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch BuildRequires: audit BuildRequires: bash-completion BuildRequires: ca-certificates @@ -97,13 +81,13 @@ Requires: apparmor-parser Requires: bridge-utils Requires: ca-certificates-mozilla -Requires: docker-libnetwork = 0.0.0+git20161019.0f53435 +Requires: docker-libnetwork = 0.0.0+git20170119.7b2b1fe # Containerd and runC are required as they are the only currently supported # execdrivers of Docker. NOTE: The version pinning here matches upstream's # Dockerfile to ensure that we don't use a slightly incompatible version of # runC or containerd (which would be bad). -Requires: containerd = 0.2.5+gitr608_03e5862 -Requires: runc = 0.1.1+gitr2942_2f7393a +Requires: containerd = 0.2.5+gitr639_422e31c +Requires: runc = 0.1.1+gitr2947_9c2d8d1 # Provides mkfs.ext4 - used by Docker when devicemapper storage driver is used Requires: e2fsprogs Requires: git-core >= 1.7 @@ -124,12 +108,9 @@ Conflicts: lxc < 1.0 BuildRoot: %{_tmppath}/%{name}-%{version}-build ExcludeArch: %ix86 s390 ppc -%ifarch %{go_arches} -BuildRequires: go >= 1.5 +# Make sure we build with go 1.7 BuildRequires: go-go-md2man -%else -BuildRequires: gcc6-go >= 6.1 -%endif +BuildRequires: golang(API) = 1.7 %description Docker complements LXC with a high-level API which operates at the process @@ -169,15 +150,12 @@ Requires: bash-completion Requires: device-mapper-devel >= 1.2.68 Requires: glibc-devel-static +# Make sure we require go 1.7 Requires: libapparmor-devel Requires: libbtrfs-devel >= 3.8 Requires: procps Requires: sqlite3-devel -%ifarch %{go_arches} -Requires: go >= 1.4 -%else -Requires: gcc6-go >= 6.1 -%endif +Requires: golang(API) = 1.7 %description test Test package for docker. It contains the source code and the tests. @@ -190,25 +168,13 @@ %patch200 -p1 %patch201 -p1 %endif -%ifnarch %{go_arches} -%patch100 -p1 -%patch102 -p1 -%patch103 -p1 -%endif %patch300 -p1 -%patch301 -p1 -%patch302 -p1 +%patch400 -p1 +%patch401 -p1 cp %{SOURCE7} . cp %{SOURCE10} . %build -%ifnarch %{go_arches} -tmphack=/tmp/dirty-hack -[ -e $tmphack ] && rm -rf $tmphack -mkdir $tmphack -ln -s %{_bindir}/go-6 $tmphack/go -export PATH=$tmphack:$PATH -%endif BUILDTAGS="exclude_graphdriver_aufs apparmor selinux pkcs11" %if 0%{?with_libseccomp} @@ -226,16 +192,15 @@ export AUTO_GOPATH=1 export DOCKER_BUILDTAGS="$BUILDTAGS" export DOCKER_GITCOMMIT=%{git_version} +# Until boo#1038493 is fixed properly we need to do this hack to get the +# compiled-into-the-binary GOROOT. +export GOROOT="$(GOROOT= go env GOROOT)" EOF ) > docker_build_env . ./docker_build_env -%ifarch %{go_arches} ./hack/make.sh dynbinary man/md2man-all.sh -%else -./hack/make.sh dyngccgo -%endif # build the tests binary GOPATH=$(pwd)/vendor:$(pwd)/.gopath/ go test \ @@ -246,7 +211,6 @@ # otherwise the resulting package will have extra requires rm -rf hack/make/.build-deb -%ifarch %go_arches %check . ./docker_build_env @@ -304,18 +268,12 @@ %endif go test -cover -ldflags -w -tags "$DOCKER_BUILDTAGS" -a -test.timeout=10m $PKG_LIST -%endif %install install -d %{buildroot}%{go_contribdir} install -d %{buildroot}%{_bindir} -%ifarch %{go_arches} install -D -m755 bundles/latest/dynbinary-client/%{name} %{buildroot}/%{_bindir}/%{name} install -D -m755 bundles/latest/dynbinary-daemon/%{name}d %{buildroot}/%{_bindir}/%{name}d -%else -install -D -m755 bundles/latest/dyngccgo/%{name} %{buildroot}/%{_bindir}/%{name} -install -D -m755 bundles/latest/dyngccgo/%{name}d %{buildroot}/%{_bindir}/%{name}d -%endif install -d %{buildroot}/%{_prefix}/lib/docker install -Dd -m 0755 \ %{buildroot}%{_sysconfdir}/init.d \ @@ -356,7 +314,6 @@ # sysconfig file install -D -m 644 %{SOURCE4} %{buildroot}%{_localstatedir}/adm/fillup-templates/sysconfig.docker -%ifarch %{go_arches} # install manpages install -d %{buildroot}%{_mandir}/man1 install -p -m 644 man/man1/*.1 %{buildroot}%{_mandir}/man1 @@ -364,7 +321,6 @@ install -p -m 644 man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5 install -d %{buildroot}%{_mandir}/man8 install -p -m 644 man/man8/*.8 %{buildroot}%{_mandir}/man8 -%endif install -D -m 0644 %{SOURCE9} %{buildroot}%{docker_migration_warnfile} @@ -424,7 +380,7 @@ %files %defattr(-,root,root) -%doc README.md LICENSE README_SUSE.md +%doc README.md LICENSE README_SUSE.md CHANGELOG.md %{_bindir}/docker %{_bindir}/dockerd %{_sbindir}/rcdocker @@ -434,12 +390,10 @@ %{_udevrulesdir}/80-%{name}.rules %{_localstatedir}/adm/fillup-templates/sysconfig.docker %{_localstatedir}/lib/docker/ -%ifarch %{go_arches} %{_mandir}/man1/docker-*.1%{ext_man} %{_mandir}/man1/docker.1%{ext_man} %{_mandir}/man5/Dockerfile.5%{ext_man} %{_mandir}/man8/dockerd.8%{ext_man} -%endif %files bash-completion %defattr(-,root,root) ++++++ _service ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.380091554 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.380091554 +0200 @@ -3,8 +3,8 @@ <param name="url">https://github.com/docker/docker.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="versionformat">1.13.0</param> - <param name="revision">v1.13.0</param> + <param name="versionformat">17.04.0_ce</param> + <param name="revision">v17.04.0-ce</param> </service> <service name="recompress" mode="disabled"> <param name="file">docker-*.tar</param> ++++++ bsc1037436-0001-client-check-tty-before-creating-exec-job.patch ++++++ >From c117441b1a74affb013a42ee8225d69ecfaf4d72 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Tue, 9 May 2017 23:31:46 +1000 Subject: [PATCH] client: check tty before creating exec job This is necessary in order to avoid execId leaks in the case where a `docker exec -it` is run without a terminal available for the client. You can reproduce this issue by running the following command many times. % nohup docker exec -it some_container true The container `some_container` will have execIDs that will never normally be cleaned up (because the client died before they were started). In addition, this patch adds a docker-inspect step to ensure that we give "container does not exist" errors consistently. [SUSE: Fixes bsc#1037436.] Signed-off-by: Valentin Rothberg <vrothb...@suse.com> Signed-off-by: Aleksa Sarai <asa...@suse.de> --- cli/command/container/exec.go | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/cli/command/container/exec.go b/cli/command/container/exec.go index 676708c77b91..d85113259242 100644 --- a/cli/command/container/exec.go +++ b/cli/command/container/exec.go @@ -79,6 +79,19 @@ func runExec(dockerCli *command.DockerCli, opts *execOptions, container string, ctx := context.Background() client := dockerCli.Client() + // We need to check the tty _before_ we do the ContainerExecCreate, because + // otherwise if we error out we will leak execIDs on the server (and + // there's no easy way to clean those up). But also in order to make "not + // exist" errors take precedence we do a dummy inspect first. + if _, err := client.ContainerInspect(ctx, container); err != nil { + return err + } + if !execConfig.Detach { + if err := dockerCli.In().CheckTty(execConfig.AttachStdin, execConfig.Tty); err != nil { + return err + } + } + response, err := client.ContainerExecCreate(ctx, container, *execConfig) if err != nil { return err @@ -90,12 +103,8 @@ func runExec(dockerCli *command.DockerCli, opts *execOptions, container string, return nil } - //Temp struct for execStart so that we don't need to transfer all the execConfig - if !execConfig.Detach { - if err := dockerCli.In().CheckTty(execConfig.AttachStdin, execConfig.Tty); err != nil { - return err - } - } else { + // Temp struct for execStart so that we don't need to transfer all the execConfig. + if execConfig.Detach { execStartCheck := types.ExecStartCheck{ Detach: execConfig.Detach, Tty: execConfig.Tty, -- 2.12.2 ++++++ bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch ++++++ >From 9783e1791fc438751b327023b0cd7d392e54084f Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Thu, 18 May 2017 00:02:00 +1000 Subject: [PATCH] apparmor: make pkg/aaparser work on read-only root This is necessary because normally `apparmor_parser -r` will try to create a temporary directory on the host (which is not allowed if the host has a rootfs). However, the -K option bypasses saving things to the cache (which avoids this issue). % apparmor_parser -r /tmp/docker-profile mkstemp: Read-only file system % apparmor_parser -Kr /tmp/docker-profile % In addition, add extra information to the ensureDefaultAppArmorProfile errors so that problems like this are easier to debug. Fixes: 2f7596aaef3a ("apparmor: do not save profile to /etc/apparmor.d") Signed-off-by: Aleksa Sarai <asa...@suse.de> --- daemon/apparmor_default.go | 2 +- pkg/aaparser/aaparser.go | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/daemon/apparmor_default.go b/daemon/apparmor_default.go index 09dd0541b872..2a418b25c241 100644 --- a/daemon/apparmor_default.go +++ b/daemon/apparmor_default.go @@ -28,7 +28,7 @@ func ensureDefaultAppArmorProfile() error { // Load the profile. if err := aaprofile.InstallDefault(defaultApparmorProfile); err != nil { - return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", defaultApparmorProfile) + return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded: %s", defaultApparmorProfile, err) } } diff --git a/pkg/aaparser/aaparser.go b/pkg/aaparser/aaparser.go index e794c4c729e2..5de4a4d79b35 100644 --- a/pkg/aaparser/aaparser.go +++ b/pkg/aaparser/aaparser.go @@ -22,10 +22,11 @@ func GetVersion() (int, error) { return parseVersion(output) } -// LoadProfile runs `apparmor_parser -r` on a specified apparmor profile to -// replace the profile. +// LoadProfile runs `apparmor_parser -Kr` on a specified apparmor profile to +// replace the profile. The `-K` is necessary to make sure that apparmor_parser +// doesn't try to write to a read-only filesystem. func LoadProfile(profilePath string) error { - _, err := cmd("", "-r", profilePath) + _, err := cmd("", "-Kr", profilePath) return err } -- 2.12.2 ++++++ integration-cli-fix-TestInfoEnsureSucceeds.patch ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.480077457 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.480077457 +0200 @@ -1,13 +1,13 @@ diff --git a/integration-cli/docker_cli_info_test.go b/integration-cli/docker_cli_info_test.go -index 62ce7e2..46516f9 100644 +index 5eb2f0f..39f93bd 100644 --- a/integration-cli/docker_cli_info_test.go +++ b/integration-cli/docker_cli_info_test.go -@@ -40,7 +40,7 @@ func (s *DockerSuite) TestInfoEnsureSucceeds(c *check.C) { +@@ -41,7 +41,7 @@ func (s *DockerSuite) TestInfoEnsureSucceeds(c *check.C) { } - if DaemonIsLinux.Condition() { + if DaemonIsLinux() { - stringsToCheck = append(stringsToCheck, "Runtimes:", "Default Runtime: runc") + stringsToCheck = append(stringsToCheck, "Runtimes:", "Default Runtime: oci") } - if experimentalDaemon { + if testEnv.ExperimentalDaemon() { ++++++ secrets-0002-SUSE-implement-SUSE-container-secrets.patch ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.496075203 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.496075203 +0200 @@ -66,7 +66,7 @@ + "syscall" + + "github.com/Sirupsen/logrus" -+ "github.com/docker/distribution/digest" ++ "github.com/opencontainers/go-digest" + "github.com/docker/docker/container" + + swarmtypes "github.com/docker/docker/api/types/swarm"
