mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-18 21:11:08 +02:00
app-emulation: bump docker-runc to 1.0.0_rc10
Upgrade docker-runc to 1.0.0-rc10 to get rid of unnecessary patches. Remove old docker-runc version 1.0.0-rc2_p136.
This commit is contained in:
Dongsu Park
parent
d39e3f04e0
commit
646a24c608
@ -21,7 +21,7 @@ SLOT="0"
|
||||
IUSE="hardened +seccomp"
|
||||
|
||||
DEPEND=""
|
||||
RDEPEND="~app-emulation/docker-runc-1.0.0_rc2
|
||||
RDEPEND="~app-emulation/docker-runc-1.0.0_rc10
|
||||
seccomp? ( sys-libs/libseccomp )"
|
||||
|
||||
S=${WORKDIR}/${P}/src/${COREOS_GO_PACKAGE}
|
||||
|
||||
@ -29,7 +29,7 @@ SLOT="0"
|
||||
IUSE="+btrfs hardened"
|
||||
|
||||
DEPEND="btrfs? ( sys-fs/btrfs-progs )"
|
||||
RDEPEND="~app-emulation/docker-runc-1.0.0_rc5_p22
|
||||
RDEPEND="~app-emulation/docker-runc-1.0.0_rc10
|
||||
sys-libs/libseccomp"
|
||||
|
||||
S=${WORKDIR}/${P}/src/${COREOS_GO_PACKAGE}
|
||||
|
||||
@ -1,2 +1 @@
|
||||
DIST docker-runc-1.0.0_rc2_p136.tar.gz 561705 BLAKE2B 4dd5dc689db1ac632bf10a5060f5681c7e44716caf8d3730683aad9df29c7b2628fa9e7253d86d87e9dfd7d27b545713154fa0f2984ca52908b16ab089be5646 SHA512 6052b95042082c3345caf25d3646f47b82c151ff3aca2ca4510dbf72ee80056d8c4077f2a1b48a9f4178c41185835ff51461e52ad47969534ea6febf7cac74f1
|
||||
DIST docker-runc-1.0.0_rc5_p22.tar.gz 1187716 BLAKE2B 008401c389b0db1aed63f7044ca51bb681d5498358eedac98b6103dd75d3c44ef9f9d3dcd60f01b7ecb5d4a5420efc8ed737acf95d62b439abb10ae0b50a7aa7 SHA512 4b45d5f899ece2c017e93bdb211436ccea84c14ac99f3104baa5728b188536d390036f0defd40dab9514a529e48f39d093cbcc15fa98012e70c8e4f560168f9f
|
||||
DIST docker-runc-1.0.0_rc10.tar.gz 1929802 BLAKE2B 8399c3d62726bbb6256efef7e15b7496a7172bf25170b12beb60be498967dec4fde2aebd073de4265e132ff864bafc4d2499ab677390a4f7c0a1605d83ae55e5 SHA512 598221071ef07d18bf34bf5d5c68b8ad78ee71716177fc3ce5b6909cd841d5aed93f17ebf1f3d134707d29eef1f54a4ddc21e79621a9bd957df28a8d2e028ab7
|
||||
|
||||
@ -11,8 +11,8 @@ COREOS_GO_VERSION="go1.10"
|
||||
# Update the patch number when this commit is changed (i.e. the _p in the ebuild).
|
||||
# The patch version is arbitrarily the number of commits since the tag version
|
||||
# specified in the ebuild name. For example:
|
||||
# $ git log --oneline v1.0.0-rc5..${COMMIT_ID} | wc -l
|
||||
COMMIT_ID="a592beb5bc4c4092b1b1bac971afed27687340c5"
|
||||
# $ git log --oneline v1.0.0-rc10..${COMMIT_ID} | wc -l
|
||||
COMMIT_ID="dc9208a3303feef5b3839f4323d9beb36df0a9dd"
|
||||
|
||||
inherit eutils flag-o-matic coreos-go vcs-snapshot
|
||||
|
||||
@ -60,7 +60,7 @@ src_compile() {
|
||||
)
|
||||
|
||||
GOPATH="${WORKDIR}/${P}" emake BUILDTAGS="${options[*]}" \
|
||||
VERSION=1.0.0-rc5+dev.docker-19.03 \
|
||||
VERSION=1.0.0-rc10+dev.docker-19.03 \
|
||||
COMMIT="${COMMIT_ID}"
|
||||
}
|
||||
|
||||
@ -1,72 +0,0 @@
|
||||
# Copyright 1999-2017 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
GITHUB_URI="github.com/docker/runc"
|
||||
COREOS_GO_PACKAGE="${GITHUB_URI}"
|
||||
COREOS_GO_VERSION="go1.7"
|
||||
# the commit of runc that docker uses.
|
||||
# see https://github.com/moby/moby/blob/v17.03.2-ce/hack/dockerfile/binaries-commits#L6
|
||||
# Note: this commit is only really present in the `docker/runc` repository.
|
||||
# Update the patch number when this commit is changed (i.e. the _p in the ebuild).
|
||||
# The patch version is arbitrarily the number of commits since the tag version
|
||||
# spcified in the ebuild name. For example:
|
||||
# $ git log --oneline v1.0.0-rc2..${COMMIT_ID} | wc -l
|
||||
COMMIT_ID="54296cf40ad8143b62dbcaa1d90e520a2136ddfe"
|
||||
|
||||
inherit eutils flag-o-matic coreos-go vcs-snapshot
|
||||
|
||||
SRC_URI="https://${GITHUB_URI}/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz"
|
||||
KEYWORDS="amd64 arm64"
|
||||
|
||||
DESCRIPTION="runc container cli tools (docker fork)"
|
||||
HOMEPAGE="http://runc.io"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
IUSE="apparmor hardened +seccomp selinux"
|
||||
|
||||
RDEPEND="
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
!app-emulation/runc
|
||||
"
|
||||
|
||||
S=${WORKDIR}/${P}/src/${COREOS_GO_PACKAGE}
|
||||
|
||||
RESTRICT="test"
|
||||
|
||||
src_unpack() {
|
||||
mkdir -p "${S}"
|
||||
tar --strip-components=1 -C "${S}" -xf "${DISTDIR}/${A}"
|
||||
}
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}-1.0.0_rc2-mount-propagation.patch"
|
||||
"${FILESDIR}/0001-nsenter-clone-proc-self-exe-to-avoid-exposing-host-b.patch"
|
||||
)
|
||||
|
||||
src_compile() {
|
||||
# Taken from app-emulation/docker-1.7.0-r1
|
||||
export CGO_CFLAGS="-I${ROOT}/usr/include"
|
||||
export CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')
|
||||
-L${ROOT}/usr/$(get_libdir)"
|
||||
|
||||
# build up optional flags
|
||||
local options=(
|
||||
$(usex apparmor 'apparmor')
|
||||
$(usex seccomp 'seccomp')
|
||||
$(usex selinux 'selinux')
|
||||
)
|
||||
|
||||
# CoreOS: Don't try to install dependencies.
|
||||
sed -i 's/go build -i /go build /' Makefile
|
||||
|
||||
emake BUILDTAGS="${options[*]}" \
|
||||
COMMIT="${COMMIT_ID}"
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin runc
|
||||
}
|
||||
@ -21,13 +21,13 @@ index 0ad68834..5100698a 100644
|
||||
* some old kernel versions where clone(CLONE_PARENT | CLONE_NEWPID)
|
||||
* was broken, so we'll just do it the long way anyway.
|
||||
*/
|
||||
- if (unshare(config.cloneflags) < 0)
|
||||
- if (unshare(config.cloneflags & ~CLONE_NEWCGROUP) < 0)
|
||||
+ uint32_t apply_cloneflags = config.cloneflags;
|
||||
+ if ((config.cloneflags & CLONE_NEWUSER) && (config.cloneflags & CLONE_NEWIPC)) {
|
||||
+ apply_cloneflags &= ~CLONE_NEWIPC;
|
||||
+ }
|
||||
+
|
||||
+ if (unshare(apply_cloneflags) < 0)
|
||||
+ if (unshare(apply_cloneflags & ~CLONE_NEWCGROUP) < 0)
|
||||
bail("failed to unshare namespaces");
|
||||
|
||||
/*
|
||||
@ -40,6 +40,6 @@ index 0ad68834..5100698a 100644
|
||||
+ bail("unshare ipc failed");
|
||||
+ }
|
||||
+
|
||||
s = SYNC_CHILD_READY;
|
||||
if (write(syncfd, &s, sizeof(s)) != sizeof(s))
|
||||
bail("failed to sync with patent: write(SYNC_CHILD_READY)");
|
||||
/* ... wait until our topmost parent has finished cgroup setup in p.manager.Apply() ... */
|
||||
if (config.cloneflags & CLONE_NEWCGROUP) {
|
||||
uint8_t value;
|
||||
|
||||
@ -1,337 +0,0 @@
|
||||
From 2d069bb79260e594870ce3e7466477e54a0c5307 Mon Sep 17 00:00:00 2001
|
||||
From: Aleksa Sarai <asarai@suse.de>
|
||||
Date: Wed, 9 Jan 2019 13:40:01 +1100
|
||||
Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary
|
||||
to container
|
||||
|
||||
There are quite a few circumstances where /proc/self/exe pointing to a
|
||||
pretty important container binary is a _bad_ thing, so to avoid this we
|
||||
have to make a copy (preferably doing self-clean-up and not being
|
||||
writeable).
|
||||
|
||||
We require memfd_create(2) -- though there is an O_TMPFILE fallback --
|
||||
but we can always extend this to use a scratch MNT_DETACH overlayfs or
|
||||
tmpfs. The main downside to this approach is no page-cache sharing for
|
||||
the runc binary (which overlayfs would give us) but this is far less
|
||||
complicated.
|
||||
|
||||
This is only done during nsenter so that it happens transparently to the
|
||||
Go code, and any libcontainer users benefit from it. This also makes
|
||||
ExtraFiles and --preserve-fds handling trivial (because we don't need to
|
||||
worry about it).
|
||||
|
||||
Fixes: CVE-2019-5736
|
||||
Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com>
|
||||
Signed-off-by: Aleksa Sarai <asarai@suse.de>
|
||||
---
|
||||
libcontainer/nsenter/cloned_binary.c | 268 +++++++++++++++++++++++++++
|
||||
libcontainer/nsenter/nsexec.c | 11 ++
|
||||
2 files changed, 279 insertions(+)
|
||||
create mode 100644 libcontainer/nsenter/cloned_binary.c
|
||||
|
||||
diff --git a/libcontainer/nsenter/cloned_binary.c b/libcontainer/nsenter/cloned_binary.c
|
||||
new file mode 100644
|
||||
index 000000000000..c8a42c23f73f
|
||||
--- /dev/null
|
||||
+++ b/libcontainer/nsenter/cloned_binary.c
|
||||
@@ -0,0 +1,268 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2019 Aleksa Sarai <cyphar@cyphar.com>
|
||||
+ * Copyright (C) 2019 SUSE LLC
|
||||
+ *
|
||||
+ * Licensed under the Apache License, Version 2.0 (the "License");
|
||||
+ * you may not use this file except in compliance with the License.
|
||||
+ * You may obtain a copy of the License at
|
||||
+ *
|
||||
+ * http://www.apache.org/licenses/LICENSE-2.0
|
||||
+ *
|
||||
+ * Unless required by applicable law or agreed to in writing, software
|
||||
+ * distributed under the License is distributed on an "AS IS" BASIS,
|
||||
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
+ * See the License for the specific language governing permissions and
|
||||
+ * limitations under the License.
|
||||
+ */
|
||||
+
|
||||
+#define _GNU_SOURCE
|
||||
+#include <unistd.h>
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <stdbool.h>
|
||||
+#include <string.h>
|
||||
+#include <limits.h>
|
||||
+#include <fcntl.h>
|
||||
+#include <errno.h>
|
||||
+
|
||||
+#include <sys/types.h>
|
||||
+#include <sys/stat.h>
|
||||
+#include <sys/vfs.h>
|
||||
+#include <sys/mman.h>
|
||||
+#include <sys/sendfile.h>
|
||||
+#include <sys/syscall.h>
|
||||
+
|
||||
+/* Use our own wrapper for memfd_create. */
|
||||
+#if !defined(SYS_memfd_create) && defined(__NR_memfd_create)
|
||||
+# define SYS_memfd_create __NR_memfd_create
|
||||
+#endif
|
||||
+#ifdef SYS_memfd_create
|
||||
+# define HAVE_MEMFD_CREATE
|
||||
+/* memfd_create(2) flags -- copied from <linux/memfd.h>. */
|
||||
+# ifndef MFD_CLOEXEC
|
||||
+# define MFD_CLOEXEC 0x0001U
|
||||
+# define MFD_ALLOW_SEALING 0x0002U
|
||||
+# endif
|
||||
+int memfd_create(const char *name, unsigned int flags)
|
||||
+{
|
||||
+ return syscall(SYS_memfd_create, name, flags);
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
+/* This comes directly from <linux/fcntl.h>. */
|
||||
+#ifndef F_LINUX_SPECIFIC_BASE
|
||||
+# define F_LINUX_SPECIFIC_BASE 1024
|
||||
+#endif
|
||||
+#ifndef F_ADD_SEALS
|
||||
+# define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9)
|
||||
+# define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
|
||||
+#endif
|
||||
+#ifndef F_SEAL_SEAL
|
||||
+# define F_SEAL_SEAL 0x0001 /* prevent further seals from being set */
|
||||
+# define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */
|
||||
+# define F_SEAL_GROW 0x0004 /* prevent file from growing */
|
||||
+# define F_SEAL_WRITE 0x0008 /* prevent writes */
|
||||
+#endif
|
||||
+
|
||||
+#define RUNC_SENDFILE_MAX 0x7FFFF000 /* sendfile(2) is limited to 2GB. */
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+# define RUNC_MEMFD_COMMENT "runc_cloned:/proc/self/exe"
|
||||
+# define RUNC_MEMFD_SEALS \
|
||||
+ (F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
|
||||
+#endif
|
||||
+
|
||||
+static void *must_realloc(void *ptr, size_t size)
|
||||
+{
|
||||
+ void *old = ptr;
|
||||
+ do {
|
||||
+ ptr = realloc(old, size);
|
||||
+ } while(!ptr);
|
||||
+ return ptr;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Verify whether we are currently in a self-cloned program (namely, is
|
||||
+ * /proc/self/exe a memfd). F_GET_SEALS will only succeed for memfds (or rather
|
||||
+ * for shmem files), and we want to be sure it's actually sealed.
|
||||
+ */
|
||||
+static int is_self_cloned(void)
|
||||
+{
|
||||
+ int fd, ret, is_cloned = 0;
|
||||
+
|
||||
+ fd = open("/proc/self/exe", O_RDONLY|O_CLOEXEC);
|
||||
+ if (fd < 0)
|
||||
+ return -ENOTRECOVERABLE;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ ret = fcntl(fd, F_GET_SEALS);
|
||||
+ is_cloned = (ret == RUNC_MEMFD_SEALS);
|
||||
+#else
|
||||
+ struct stat statbuf = {0};
|
||||
+ ret = fstat(fd, &statbuf);
|
||||
+ if (ret >= 0)
|
||||
+ is_cloned = (statbuf.st_nlink == 0);
|
||||
+#endif
|
||||
+ close(fd);
|
||||
+ return is_cloned;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Basic wrapper around mmap(2) that gives you the file length so you can
|
||||
+ * safely treat it as an ordinary buffer. Only gives you read access.
|
||||
+ */
|
||||
+static char *read_file(char *path, size_t *length)
|
||||
+{
|
||||
+ int fd;
|
||||
+ char buf[4096], *copy = NULL;
|
||||
+
|
||||
+ if (!length)
|
||||
+ return NULL;
|
||||
+
|
||||
+ fd = open(path, O_RDONLY | O_CLOEXEC);
|
||||
+ if (fd < 0)
|
||||
+ return NULL;
|
||||
+
|
||||
+ *length = 0;
|
||||
+ for (;;) {
|
||||
+ int n;
|
||||
+
|
||||
+ n = read(fd, buf, sizeof(buf));
|
||||
+ if (n < 0)
|
||||
+ goto error;
|
||||
+ if (!n)
|
||||
+ break;
|
||||
+
|
||||
+ copy = must_realloc(copy, (*length + n) * sizeof(*copy));
|
||||
+ memcpy(copy + *length, buf, n);
|
||||
+ *length += n;
|
||||
+ }
|
||||
+ close(fd);
|
||||
+ return copy;
|
||||
+
|
||||
+error:
|
||||
+ close(fd);
|
||||
+ free(copy);
|
||||
+ return NULL;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * A poor-man's version of "xargs -0". Basically parses a given block of
|
||||
+ * NUL-delimited data, within the given length and adds a pointer to each entry
|
||||
+ * to the array of pointers.
|
||||
+ */
|
||||
+static int parse_xargs(char *data, int data_length, char ***output)
|
||||
+{
|
||||
+ int num = 0;
|
||||
+ char *cur = data;
|
||||
+
|
||||
+ if (!data || *output != NULL)
|
||||
+ return -1;
|
||||
+
|
||||
+ while (cur < data + data_length) {
|
||||
+ num++;
|
||||
+ *output = must_realloc(*output, (num + 1) * sizeof(**output));
|
||||
+ (*output)[num - 1] = cur;
|
||||
+ cur += strlen(cur) + 1;
|
||||
+ }
|
||||
+ (*output)[num] = NULL;
|
||||
+ return num;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * "Parse" out argv and envp from /proc/self/cmdline and /proc/self/environ.
|
||||
+ * This is necessary because we are running in a context where we don't have a
|
||||
+ * main() that we can just get the arguments from.
|
||||
+ */
|
||||
+static int fetchve(char ***argv, char ***envp)
|
||||
+{
|
||||
+ char *cmdline = NULL, *environ = NULL;
|
||||
+ size_t cmdline_size, environ_size;
|
||||
+
|
||||
+ cmdline = read_file("/proc/self/cmdline", &cmdline_size);
|
||||
+ if (!cmdline)
|
||||
+ goto error;
|
||||
+ environ = read_file("/proc/self/environ", &environ_size);
|
||||
+ if (!environ)
|
||||
+ goto error;
|
||||
+
|
||||
+ if (parse_xargs(cmdline, cmdline_size, argv) <= 0)
|
||||
+ goto error;
|
||||
+ if (parse_xargs(environ, environ_size, envp) <= 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ return 0;
|
||||
+
|
||||
+error:
|
||||
+ free(environ);
|
||||
+ free(cmdline);
|
||||
+ return -EINVAL;
|
||||
+}
|
||||
+
|
||||
+static int clone_binary(void)
|
||||
+{
|
||||
+ int binfd, memfd;
|
||||
+ ssize_t sent = 0;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ memfd = memfd_create(RUNC_MEMFD_COMMENT, MFD_CLOEXEC | MFD_ALLOW_SEALING);
|
||||
+#else
|
||||
+ memfd = open("/tmp", O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0711);
|
||||
+#endif
|
||||
+ if (memfd < 0)
|
||||
+ return -ENOTRECOVERABLE;
|
||||
+
|
||||
+ binfd = open("/proc/self/exe", O_RDONLY | O_CLOEXEC);
|
||||
+ if (binfd < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ sent = sendfile(memfd, binfd, NULL, RUNC_SENDFILE_MAX);
|
||||
+ close(binfd);
|
||||
+ if (sent < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ int err = fcntl(memfd, F_ADD_SEALS, RUNC_MEMFD_SEALS);
|
||||
+ if (err < 0)
|
||||
+ goto error;
|
||||
+#else
|
||||
+ /* Need to re-open "memfd" as read-only to avoid execve(2) giving -EXTBUSY. */
|
||||
+ int newfd;
|
||||
+ char *fdpath = NULL;
|
||||
+
|
||||
+ if (asprintf(&fdpath, "/proc/self/fd/%d", memfd) < 0)
|
||||
+ goto error;
|
||||
+ newfd = open(fdpath, O_RDONLY | O_CLOEXEC);
|
||||
+ free(fdpath);
|
||||
+ if (newfd < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ close(memfd);
|
||||
+ memfd = newfd;
|
||||
+#endif
|
||||
+ return memfd;
|
||||
+
|
||||
+error:
|
||||
+ close(memfd);
|
||||
+ return -EIO;
|
||||
+}
|
||||
+
|
||||
+int ensure_cloned_binary(void)
|
||||
+{
|
||||
+ int execfd;
|
||||
+ char **argv = NULL, **envp = NULL;
|
||||
+
|
||||
+ /* Check that we're not self-cloned, and if we are then bail. */
|
||||
+ int cloned = is_self_cloned();
|
||||
+ if (cloned > 0 || cloned == -ENOTRECOVERABLE)
|
||||
+ return cloned;
|
||||
+
|
||||
+ if (fetchve(&argv, &envp) < 0)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ execfd = clone_binary();
|
||||
+ if (execfd < 0)
|
||||
+ return -EIO;
|
||||
+
|
||||
+ fexecve(execfd, argv, envp);
|
||||
+ return -ENOEXEC;
|
||||
+}
|
||||
diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
|
||||
index 28269dfc027f..7750af35ea92 100644
|
||||
--- a/libcontainer/nsenter/nsexec.c
|
||||
+++ b/libcontainer/nsenter/nsexec.c
|
||||
@@ -534,6 +534,9 @@ void join_namespaces(char *nslist)
|
||||
free(namespaces);
|
||||
}
|
||||
|
||||
+/* Defined in cloned_binary.c. */
|
||||
+extern int ensure_cloned_binary(void);
|
||||
+
|
||||
void nsexec(void)
|
||||
{
|
||||
int pipenum;
|
||||
@@ -549,6 +552,14 @@ void nsexec(void)
|
||||
if (pipenum == -1)
|
||||
return;
|
||||
|
||||
+ /*
|
||||
+ * We need to re-exec if we are not in a cloned binary. This is necessary
|
||||
+ * to ensure that containers won't be able to access the host binary
|
||||
+ * through /proc/self/exe. See CVE-2019-5736.
|
||||
+ */
|
||||
+ if (ensure_cloned_binary() < 0)
|
||||
+ bail("could not ensure we are a cloned binary");
|
||||
+
|
||||
/* Parse all of the netlink configuration. */
|
||||
nl_parse(pipenum, &config);
|
||||
|
||||
--
|
||||
2.20.1
|
||||
|
||||
@ -63,7 +63,7 @@ RDEPEND="
|
||||
>=app-arch/xz-utils-4.9
|
||||
|
||||
~app-emulation/containerd-0.2.6[seccomp?]
|
||||
~app-emulation/docker-runc-1.0.0_rc2_p136[apparmor?,seccomp?]
|
||||
~app-emulation/docker-runc-1.0.0_rc10[apparmor?,seccomp?]
|
||||
~app-emulation/docker-proxy-0.8.0_p20161019
|
||||
container-init? ( >=sys-process/tini-0.13.0 )
|
||||
"
|
||||
|
||||
@ -65,7 +65,7 @@ RDEPEND="
|
||||
>=app-arch/xz-utils-4.9
|
||||
dev-libs/libltdl
|
||||
~app-emulation/containerd-1.1.2
|
||||
~app-emulation/docker-runc-1.0.0_rc5_p22[apparmor?,seccomp?]
|
||||
~app-emulation/docker-runc-1.0.0_rc10[apparmor?,seccomp?]
|
||||
~app-emulation/docker-proxy-0.8.0_p20180709
|
||||
container-init? ( >=sys-process/tini-0.13.1 )
|
||||
"
|
||||
|
||||
@ -14,7 +14,7 @@ RDEPEND="
|
||||
~app-emulation/docker-17.03.2
|
||||
~app-emulation/containerd-0.2.6
|
||||
~app-emulation/docker-proxy-0.8.0_p20161019
|
||||
~app-emulation/docker-runc-1.0.0_rc2_p136
|
||||
~app-emulation/docker-runc-1.0.0_rc10
|
||||
=sys-process/tini-0.13.2
|
||||
"
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ RDEPEND="
|
||||
~app-emulation/docker-19.03.5
|
||||
~app-emulation/containerd-1.1.2
|
||||
~app-emulation/docker-proxy-0.8.0_p20180709
|
||||
~app-emulation/docker-runc-1.0.0_rc5_p22
|
||||
~app-emulation/docker-runc-1.0.0_rc10
|
||||
=dev-libs/libltdl-2.4.6
|
||||
=sys-process/tini-0.18.0
|
||||
"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user