kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
39,224 Commits 10 Branches 356 Tags 299 MiB
Go 97.5%
Shell 1.3%
Dockerfile 0.6%
PowerShell 0.3%
Makefile 0.1%
Go to file
Sebastiaan van Stijn 1640d7b986
Fix daemon panic when starting container with invalid device cgroup rule 
This fixes a panic when an invalid "device cgroup rule" is passed, resulting
in an "index out of range".

This bug was introduced in the original implementation in 1756af6faf,
but was not reproducible when using the CLI, because the same commit also added
client-side validation on the flag before making an API request. The following
example, uses an invalid rule (`c *:*  rwm` - two spaces before the permissions);

```console
$ docker run --rm --network=host --device-cgroup-rule='c *:*  rwm' busybox
invalid argument "c *:*  rwm" for "--device-cgroup-rule" flag: invalid device cgroup format 'c *:*  rwm'
```

Doing the same, but using the API results in a daemon panic when starting the container;

Create a container with an invalid device cgroup rule:

```console
curl -v \
  --unix-socket /var/run/docker.sock \
  "http://localhost/v1.41/containers/create?name=foobar" \
  -H "Content-Type: application/json" \
  -d '{"Image":"busybox:latest", "HostConfig":{"DeviceCgroupRules": ["c *:*  rwm"]}}'
```

Start the container:

```console
curl -v \
  --unix-socket /var/run/docker.sock \
  -X POST \
  "http://localhost/v1.41/containers/foobar/start"
```

Observe the daemon logs:

```
2021-01-22 12:53:03.313806 I | http: panic serving @: runtime error: index out of range [0] with length 0
goroutine 571 [running]:
net/http.(*conn).serve.func1(0xc000cb2d20)
	/usr/local/go/src/net/http/server.go:1795 +0x13b
panic(0x2f32380, 0xc000aebfc0)
	/usr/local/go/src/runtime/panic.go:679 +0x1b6
github.com/docker/docker/oci.AppendDevicePermissionsFromCgroupRules(0xc000175c00, 0x8, 0x8, 0xc0000bd380, 0x1, 0x4, 0x0, 0x0, 0xc0000e69c0, 0x0, ...)
	/go/src/github.com/docker/docker/oci/oci.go:34 +0x64f
```

This patch:

- fixes the panic, allowing the daemon to return an error on container start
- adds a unit-test to validate various permutations
- adds a "todo" to verify the regular expression (and handling) of the "a" (all) value

We should also consider performing this validation when _creating_ the container,
so that an error is produced early.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 5cc1753f2c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 		2021-02-17 21:16:01 +01:00
.github
…
api testutil: remove remaining use of deprecated pkg/mount 2020-11-10 14:46:59 +01:00
builder Use golang.org/x/sys/execabs 2021-01-28 21:33:12 +00:00
cli remove uses of deprecated pkg/term 2020-04-21 16:29:27 +02:00
client Update documentation to reflect deprecation of "NewEnvClient" 2020-10-03 15:12:30 +02:00
cmd/dockerd buildkit: Apply apparmor profile 2021-01-28 21:33:12 +00:00
container replace pkg/symlink with github.com/moby/sys/symlink 2020-11-03 11:17:12 +01:00
contrib rootless: set systemd KillMode to mixed 2021-02-02 14:26:47 +09:00
daemon docker info: adjust warning strings for cgroup v2 2021-02-02 14:32:13 +09:00
distribution pull: Validate layer digest format 2021-01-28 21:33:12 +00:00
dockerversion
…
docs docs: add API v1.41 2020-12-10 15:28:38 +01:00
errdefs Implement Unwrap to errors 2020-11-21 16:36:35 +01:00
hack testing: update docker-py 4.4.1 2021-02-03 13:54:22 +01:00
image replace pkg/symlink with github.com/moby/sys/symlink 2020-11-03 11:17:12 +01:00
integration Merge pull request #41970 from thaJeztah/20.10_backport_testing_fixes 2021-02-17 09:37:19 -08:00
integration-cli Move use of debian:buster frozen image to debian:bullseye 2020-12-19 17:59:36 +01:00
internal/test/suite
…
layer replace pkg/locker with github.com/moby/locker 2020-09-10 22:15:40 +02:00
libcontainerd Added container ID to containerd task delete event messages 2020-10-30 20:58:57 -07:00
oci Fix daemon panic when starting container with invalid device cgroup rule 2021-02-17 21:16:01 +01:00
opts opts: unify host-options, and use consts 2020-10-31 16:44:21 +01:00
patches Remove blurb about fixed in go1.11 in patch file 2020-04-24 11:23:14 -07:00
pkg pkg/archive: allow mknodding FIFO inside userns 2021-02-02 14:29:49 +09:00
plugin plugin/manager_linux_test: Skip privileged tests when non-root 2020-12-15 09:48:06 +07:00
profiles seccomp: Add pidfd_getfd syscall 2020-11-12 15:31:07 +02:00
project vendor: opencontainers/selinux v1.8.0, and remove selinux build-tag and stubs 2020-12-24 00:47:16 +01:00
quota quota: move test helper functions to extra file 2020-10-05 13:28:25 +00:00
reference fix goimports 2020-02-11 22:16:54 +09:00
registry registry.loginV2(): minor cleanup 2020-10-29 22:26:57 +01:00
reports
…
restartmanager
…
rootless rootless: support `--exec-opt native.cgroupdriver=systemd` 2020-02-14 15:32:31 +09:00
runconfig pkg/sysinfo: rm duplicates 2020-06-26 16:19:52 -07:00
testutil Merge pull request #41817 from simonferquel/desktop-startup-hang 2020-12-23 23:22:00 -08:00
vendor Use golang.org/x/sys/execabs 2021-01-28 21:33:12 +00:00
volume Use real root with 0701 perms 2021-01-26 17:23:32 +00:00
.DEREK.yml
…
.dockerignore update .dockerignore to prevent '-unsupported' builds 2020-01-13 12:55:15 +01:00
.gitignore
…
.mailmap Update authors and mailmap 2020-08-06 01:57:12 +02:00
AUTHORS Update authors and mailmap 2020-08-06 01:57:12 +02:00
CHANGELOG.md
…
CONTRIBUTING.md
…
Dockerfile vendor: opencontainers/selinux v1.8.0, and remove selinux build-tag and stubs 2020-12-24 00:47:16 +01:00
Dockerfile.buildx Dockerfile.buildx: update buildx to v0.5.1 2021-02-03 13:54:27 +01:00
Dockerfile.e2e Move use of debian:buster frozen image to debian:bullseye 2020-12-19 17:59:36 +01:00
Dockerfile.simple Bump Golang 1.13.15 2020-08-10 12:13:38 +02:00
Dockerfile.windows Force Download-File function to use TLS 1.2 2020-09-20 23:18:16 +03:00
Jenkinsfile Jenkinsfile: add cgroup2 2021-02-16 09:22:30 +01:00
LICENSE
…
MAINTAINERS
…
Makefile Makefile: remove empty targets, and slight refactor 2020-05-01 16:48:07 +02:00
NOTICE
…
README.md
…
ROADMAP.md
…
SECURITY.md
…
TESTING.md TESTING.md: note that integration-cli is deprecated 2020-12-18 07:51:46 +01:00
VENDORING.md
…
codecov.yml
…
poule.yml
…
vendor.conf Use golang.org/x/sys/execabs 2021-01-28 21:33:12 +00:00

README.md

The Moby Project

Moby Project logo

Moby is an open-source project created by Docker to enable and accelerate software containerization.

It provides a "Lego set" of toolkit components, the framework for assembling them into custom container-based systems, and a place for all container enthusiasts and professionals to experiment and exchange ideas. Components include container build tools, a container registry, orchestration tools, a runtime and more, and these can be used as building blocks in conjunction with other tools and projects.

Principles

Moby is an open project guided by strong principles, aiming to be modular, flexible and without too strong an opinion on user experience. It is open to the community to help set its direction.

  • Modular: the project includes lots of components that have well-defined functions and APIs that work together.
  • Batteries included but swappable: Moby includes enough components to build fully featured container system, but its modular architecture ensures that most of the components can be swapped by different implementations.
  • Usable security: Moby provides secure defaults without compromising usability.
  • Developer focused: The APIs are intended to be functional and useful to build powerful tools. They are not necessarily intended as end user tools but as components aimed at developers. Documentation and UX is aimed at developers not end users.

Audience

The Moby Project is intended for engineers, integrators and enthusiasts looking to modify, hack, fix, experiment, invent and build systems based on containers. It is not for people looking for a commercially supported system, but for people who want to work and learn with open source code.

Relationship with Docker

The components and tools in the Moby Project are initially the open source components that Docker and the community have built for the Docker Project. New projects can be added if they fit with the community goals. Docker is committed to using Moby as the upstream for the Docker Product. However, other projects are also encouraged to use Moby as an upstream, and to reuse the components in diverse ways, and all these uses will be treated in the same way. External maintainers and contributors are welcomed.

The Moby project is not intended as a location for support or feature requests for Docker products, but as a place for contributors to work on open source code, fix bugs, and make the code more useful. The releases are supported by the maintainers, community and users, on a best efforts basis only, and are not intended for customers who want enterprise or commercial support; Docker EE is the appropriate product for these use cases.

Legal

Brought to you courtesy of our legal counsel. For more context, please see the NOTICE document in this repo.

Use and transfer of Moby may be subject to certain restrictions by the United States and other governments.

It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.

For more information, please see https://www.bis.doc.gov

Licensing

Moby is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.