mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-07 04:56:58 +02:00
app-containers: use upstream docker, containerd, runc
This change removes Flatcar specific builds of docker[-cli], containerd, runc, and cri-tools and instead switches to upstream Gentoo ebuilds added to portage-stable. The change updates docker to 24.0.6. NOTE that there currently is no upstream ebuild for containerd-1.7.7, so this change adds that ebuild based on the upstream containerd-1.7.6 ebuild. Flatcar customisations like systemd units etc. are now applied in the manglefs script of the respective sysexts, based on file system trees in coreos-overlay/coreos/sysext/(containerd|docker). The build_sysext script has been extended by an option to strip all binaries in a sysext; the option is active by default. This takes care of removing debug symbols from docker and containerd - which are not removed by the default Gentoo build. The overall size of both containerd and docker sysext is reduced by ~50%. Lastly, the sysext command line syntax of build_image has been extended to allow specifying multiple packages for a sysext. This was necessary because docker-cli and docker do not have any runtime relationships and therefore must both be specified for installation to correctly mirror Flatcar's own docker packaging. Signed-off-by: Thilo Fromm <thilofromm@microsoft.com>
This commit is contained in:
Thilo Fromm
parent
bc0afaad1d
commit
9f45ea05e9
@ -33,8 +33,8 @@ DEFINE_string base_pkg "coreos-base/coreos" \
|
||||
"The base portage package to base the build off of (only applies to prod images)"
|
||||
DEFINE_string base_dev_pkg "coreos-base/coreos-dev" \
|
||||
"The base portage package to base the build off of (only applies to dev containers)"
|
||||
DEFINE_string base_sysexts "containerd-flatcar:app-containers/containerd,docker-flatcar:app-containers/docker" \
|
||||
"Comma-separated list of name:package - build 'package' into sysext 'name', and include with OS image and update payload. Must be in order of dependencies, base sysexts come first."
|
||||
DEFINE_string base_sysexts "containerd-flatcar:app-containers/containerd,docker-flatcar:app-containers/docker&app-containers/docker-cli" \
|
||||
"Comma-separated list of name:package[&package[&package]] - build 'package' (a single package or a list of packages separated by '&') into sysext 'name', and include with OS image and update payload. Must be in order of dependencies, base sysexts come first."
|
||||
DEFINE_string output_root "${DEFAULT_BUILD_ROOT}/images" \
|
||||
"Directory in which to place image result directories (named by version)"
|
||||
DEFINE_string disk_layout "" \
|
||||
|
||||
@ -3,5 +3,16 @@
|
||||
set -euo pipefail
|
||||
rootfs="${1}"
|
||||
|
||||
|
||||
# No manpages on Flatcar, no need to ship "stress" tool
|
||||
echo ">>> NOTICE: $0: removing 'gen-manpages', 'containerd-stress' from sysext"
|
||||
rm -f "${rootfs}/usr/bin/gen-manpages" "${rootfs}/usr/bin/containerd-stress"
|
||||
|
||||
script_root="$(cd "$(dirname "$0")/../"; pwd)"
|
||||
files_dir="${script_root}/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd"
|
||||
|
||||
echo ">>> NOTICE $0: installing extra files from '${files_dir}'"
|
||||
cp -va "${files_dir}/"* "${rootfs}"
|
||||
|
||||
mkdir -p "${rootfs}/usr/lib/systemd/system/multi-user.target.d"
|
||||
{ echo "[Unit]"; echo "Upholds=containerd.service"; } > "${rootfs}/usr/lib/systemd/system/multi-user.target.d/10-containerd-service.conf"
|
||||
|
||||
@ -3,5 +3,15 @@
|
||||
set -euo pipefail
|
||||
rootfs="${1}"
|
||||
|
||||
# Remove debug and contrib
|
||||
echo ">>> NOTICE: $0: removing '/usr/lib/debug/', '/usr/share/docker/contrib' from sysext"
|
||||
rm -rf "${rootfs}/usr/lib/debug/" "${rootfs}/usr/share/docker/contrib/"
|
||||
|
||||
script_root="$(cd "$(dirname "$0")/../"; pwd)"
|
||||
files_dir="${script_root}/sdk_container/src/third_party/coreos-overlay/coreos/sysext/docker"
|
||||
|
||||
echo ">>> NOTICE $0: installing extra files from '${files_dir}'"
|
||||
cp -va "${files_dir}/"* "${rootfs}"
|
||||
|
||||
mkdir -p "${rootfs}/usr/lib/systemd/system/sockets.target.d"
|
||||
{ echo "[Unit]"; echo "Upholds=docker.socket"; } > "${rootfs}/usr/lib/systemd/system/sockets.target.d/10-docker-socket.conf"
|
||||
|
||||
@ -30,12 +30,14 @@ create_prod_sysext() {
|
||||
local base_sysext="$4"
|
||||
local install_root="$5"
|
||||
local name="$6"
|
||||
local grp_pkg="$7"
|
||||
local grp_pkgs="$7"
|
||||
local pkginfo="${8:-}"
|
||||
|
||||
local -a build_sysext_opts=()
|
||||
|
||||
local msg="Installing ${grp_pkg}' in sysext ${name}.raw"
|
||||
local grp_pkg="${grp_pkgs//&/ }"
|
||||
|
||||
local msg="Installing ${grp_pkg} in sysext ${name}.raw"
|
||||
|
||||
# Include previous sysexts' pkginfo if supplied
|
||||
if [[ -n "${pkginfo}" ]] ; then
|
||||
@ -60,7 +62,7 @@ create_prod_sysext() {
|
||||
--squashfs_base="${base_sysext}" \
|
||||
--generate_pkginfo \
|
||||
"${build_sysext_opts[@]}" \
|
||||
"${name}" "${grp_pkg}"
|
||||
"${name}" ${grp_pkg}
|
||||
|
||||
sudo mv "${workdir}/sysext-build/${name}.raw" "${workdir}/sysext-build/${name}_pkginfo.raw" \
|
||||
"${workdir}/sysext-build/${name}"_*.txt "${output_dir}"
|
||||
|
||||
18
build_sysext
18
build_sysext
@ -25,6 +25,8 @@ DEFINE_string squashfs_base '' \
|
||||
"The path to the squashfs base image. Defaults to the most current image built in '${default_imagedir}/${FLATCAR_PRODUCTION_IMAGE_SYSEXT_BASE}'."
|
||||
DEFINE_string image_builddir '' \
|
||||
"Custom directory to build the sysext in. Defaults to a 'sysext' sub-directory of the directory the squashfs base image resides in; '${default_imagedir}/sysext' by default."
|
||||
DEFINE_boolean strip_binaries "${FLAGS_TRUE}" \
|
||||
"After installation, scan sysext root for unstripped binaries and strip these."
|
||||
DEFINE_string manglefs_script '' \
|
||||
"A path to executable that will customize the rootfs of the sysext image."
|
||||
DEFINE_boolean generate_pkginfo "${FLAGS_FALSE}" \
|
||||
@ -231,6 +233,22 @@ info "Writing ${SYSEXTNAME}_packages.txt"
|
||||
ROOT="${BUILD_DIR}/install-root" PORTAGE_CONFIGROOT="${BUILD_DIR}/install-root" \
|
||||
equery --no-color list --format '$cpv::$repo' '*' > "${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
|
||||
|
||||
|
||||
if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then
|
||||
chost="$("portageq-${BOARD}" envvar CHOST)"
|
||||
strip="${chost}-strip"
|
||||
|
||||
info "Stripping all non-stripped binaries in sysext using '${strip}'"
|
||||
|
||||
# Find all non-stripped binaries, remove ':' from filepath, and strip 'em
|
||||
find "${BUILD_DIR}/install-root" -exec file \{\} \; \
|
||||
| awk '/not stripped/ {print substr($1, 1, length($1)-1)}' \
|
||||
| while read bin; do
|
||||
info " ${strip} ${bin}"
|
||||
"${strip}" "${bin}"
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n "${FLAGS_manglefs_script}" ]]; then
|
||||
if [[ ! -x "${FLAGS_manglefs_script}" ]]; then
|
||||
die "${FLAGS_manglefs_script} is not executable"
|
||||
|
||||
@ -1 +0,0 @@
|
||||
DIST containerd-1.7.7.tar.gz 9910424 BLAKE2B 623315962233fe3ce965c17c37c950dc1ded8b381012ed50d2bee8b1cea134bc9ef5a1cf5599b6bcd121cabe204fe61015526226131954364a976ebb08d8c353 SHA512 a44e901b017522639963bb415f666599af04335d8ccbd28899712606a4692c1601e95eaa2f1db32a3c077ad2c3f332f37393154ad6c2660646b7e8365a6ab720
|
||||
@ -1 +0,0 @@
|
||||
containerd-9999.ebuild
|
||||
@ -1,69 +0,0 @@
|
||||
# Copyright 1999-2018 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
GITHUB_URI="github.com/containerd/containerd"
|
||||
COREOS_GO_PACKAGE="${GITHUB_URI}"
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
|
||||
if [[ ${PV} == *9999 ]]; then
|
||||
EGIT_REPO_URI="https://${GITHUB_URI}.git"
|
||||
inherit git-r3
|
||||
else
|
||||
MY_PV="${PV/_rc/-rc.}"
|
||||
EGIT_COMMIT="v${MY_PV}"
|
||||
CONTAINERD_COMMIT="c676287c3e99d785927d9775eb4bcf9facdd4159"
|
||||
SRC_URI="https://${GITHUB_URI}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
|
||||
KEYWORDS="amd64 arm64"
|
||||
inherit vcs-snapshot
|
||||
fi
|
||||
|
||||
inherit coreos-go systemd
|
||||
|
||||
DESCRIPTION="A daemon to control runC"
|
||||
HOMEPAGE="https://containerd.tools"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
IUSE="+btrfs hardened"
|
||||
|
||||
DEPEND="btrfs? ( sys-fs/btrfs-progs )"
|
||||
RDEPEND="~app-containers/runc-1.1.9
|
||||
sys-libs/libseccomp"
|
||||
|
||||
S=${WORKDIR}/${P}/src/${COREOS_GO_PACKAGE}
|
||||
|
||||
RESTRICT="test"
|
||||
|
||||
src_unpack() {
|
||||
mkdir -p "${S}"
|
||||
tar --strip-components=1 -C "${S}" -xf "${DISTDIR}/${A}"
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
coreos-go_src_prepare
|
||||
if [[ ${PV} != *9999* ]]; then
|
||||
sed -i -e "s/git describe --match.*$/echo ${PV})/"\
|
||||
-e "s/git rev-parse HEAD.*$/echo $CONTAINERD_COMMIT)/"\
|
||||
-e "s/-s -w//" \
|
||||
Makefile || die
|
||||
fi
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local options=( $(usex btrfs "" "no_btrfs") )
|
||||
export GOPATH="${WORKDIR}/${P}" # ${PWD}/vendor
|
||||
export GO111MODULE=on
|
||||
export GOFLAGS="-v -x -mod=vendor"
|
||||
LDFLAGS=$(usex hardened '-extldflags -fno-PIC' '') emake BUILDTAGS="${options[*]}"
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin bin/containerd{-shim,-shim-runc-v*,} bin/ctr
|
||||
systemd_newunit "${FILESDIR}/${PN}-1.0.0.service" "${PN}.service"
|
||||
systemd_enable_service multi-user.target "${PN}.service"
|
||||
insinto /usr/share/containerd
|
||||
doins "${FILESDIR}/config.toml"
|
||||
doins "${FILESDIR}/config-cgroupfs.toml"
|
||||
}
|
||||
@ -1,24 +0,0 @@
|
||||
[Unit]
|
||||
Description=containerd container runtime
|
||||
Documentation=https://containerd.io
|
||||
After=network.target local-fs.target
|
||||
|
||||
[Service]
|
||||
ExecStartPre=-/sbin/modprobe overlay
|
||||
ExecStart=/usr/bin/containerd --listen unix:///var/run/docker/libcontainerd/docker-containerd.sock --shim /usr/bin/containerd-shim --state-dir /var/run/docker/libcontainerd/containerd --start-timeout 2m
|
||||
|
||||
Type=notify
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
LimitNOFILE=infinity
|
||||
TasksMax=infinity
|
||||
OOMScoreAdjust=-999
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target early-docker.target
|
||||
@ -1 +0,0 @@
|
||||
DIST cri-tools-1.24.2.tar.gz 5968560 BLAKE2B 8dce8d16d5218aa73705b4a49b31391eaa25b21deb97f3dfe553f43d7371adf58206d9198f3e22e1c9cbcb7f41b832b0600b324d7c0f943ef313dc89900da46d SHA512 9b5907b37bb5f00295eff4fa4207ae55d930feae7e0f48fa130c7ecc936bcd259a11d59ed240684a3e12c8bcee40f2c67d7f4af52c2a76df3d7bf82e5e388a75
|
||||
@ -1,46 +0,0 @@
|
||||
# Copyright 2021-2022 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
|
||||
# Flatcar: remove bash-completion, inherit coreos-go
|
||||
inherit go-module coreos-go
|
||||
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
COREOS_GO_PACKAGE="github.com/kubernetes-sigs/cri-tools"
|
||||
COREOS_GO_MOD="vendor"
|
||||
|
||||
MY_PV="v${PV/_beta/-beta.}"
|
||||
|
||||
EGO_PN="${COREOS_GO_PACKAGE}"
|
||||
DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
|
||||
HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
|
||||
SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
|
||||
SLOT="0"
|
||||
# Flatcar: keyword arm64
|
||||
KEYWORDS="amd64 arm64"
|
||||
|
||||
S=${WORKDIR}/cri-tools-${PV}
|
||||
|
||||
RESTRICT+=" test"
|
||||
|
||||
src_compile() {
|
||||
# Flatcar: make use of the existing helpers provided by `coreos-go.eclass`.
|
||||
# To optimize the binary size of crictl, add "-X" to GO_LDFLAGS,
|
||||
# like "-X $(PROJECT)/pkg/version.Version=$(VERSION)" in the original
|
||||
# Makefile of cri-tools. We cannot follow way of Gentoo ebuilds like `emake`,
|
||||
# because Makefile of cri-tools does not allow users to pass in ${GOARCH}.
|
||||
# Remove shell completions.
|
||||
GO_LDFLAGS="-s -w -extldflags=-Wl,-z,now,-z,relro,-z,defs "
|
||||
GO_LDFLAGS+="-X ${COREOS_GO_PACKAGE}/pkg/version.Version=${PV} "
|
||||
go_build "${COREOS_GO_PACKAGE}/cmd/crictl"
|
||||
}
|
||||
|
||||
src_install() {
|
||||
# Flatcar: install only crictl binary, remove shell completions.
|
||||
dobin "${GOBIN}/crictl"
|
||||
|
||||
dodoc -r docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md
|
||||
}
|
||||
@ -1 +0,0 @@
|
||||
DIST docker-cli-20.10.24.tar.gz 7589761 BLAKE2B 353298fba483dc9ce2797397398bb99f9194302e09f943614b5101f24d7a6b404c5e8a1890acf76450e85d295e623f18fb21ab55a3faabfd04596ca520f740c5 SHA512 5996c24070986e18c0530d0db1a9b4a2c0188c1d22b4c0d99161b2f69bb9cecd4221b628afc0db3078d17918a6e312c6b6ca63f889e634006d4e04c677257a27
|
||||
@ -1,104 +0,0 @@
|
||||
From 5d4e44df90bb913f30a1f0215f9715cb60e17d75 Mon Sep 17 00:00:00 2001
|
||||
Message-Id: <5d4e44df90bb913f30a1f0215f9715cb60e17d75.1689769748.git.dpark@linux.microsoft.com>
|
||||
From: Sebastiaan van Stijn <github@gone.nl>
|
||||
Date: Mon, 17 Jul 2023 16:48:27 +0200
|
||||
Subject: [PATCH] [20.10] vendor: docker v20.10.25-45-g0d4b9ed98b
|
||||
(v20.10.26-dev)
|
||||
|
||||
full diff: https://github.com/docker/docker/compare/v20.10.25...0d4b9ed98be2aecf27e8dd014bef7bad0be15457
|
||||
|
||||
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
||||
---
|
||||
.../github.com/docker/docker/client/client.go | 30 +++++++++++++++++++
|
||||
.../github.com/docker/docker/client/hijack.go | 6 +++-
|
||||
.../docker/docker/client/request.go | 14 ++++-----
|
||||
vendor/github.com/docker/docker/vendor.conf | 2 +-
|
||||
5 files changed, 43 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/vendor/github.com/docker/docker/client/client.go b/vendor/github.com/docker/docker/client/client.go
|
||||
index 0d3614d5..d0ce09ae 100644
|
||||
--- a/vendor/github.com/docker/docker/client/client.go
|
||||
+++ b/vendor/github.com/docker/docker/client/client.go
|
||||
@@ -56,6 +56,36 @@ import (
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
+// DummyHost is a hostname used for local communication.
|
||||
+//
|
||||
+// It acts as a valid formatted hostname for local connections (such as "unix://"
|
||||
+// or "npipe://") which do not require a hostname. It should never be resolved,
|
||||
+// but uses the special-purpose ".localhost" TLD (as defined in [RFC 2606, Section 2]
|
||||
+// and [RFC 6761, Section 6.3]).
|
||||
+//
|
||||
+// [RFC 7230, Section 5.4] defines that an empty header must be used for such
|
||||
+// cases:
|
||||
+//
|
||||
+// If the authority component is missing or undefined for the target URI,
|
||||
+// then a client MUST send a Host header field with an empty field-value.
|
||||
+//
|
||||
+// However, [Go stdlib] enforces the semantics of HTTP(S) over TCP, does not
|
||||
+// allow an empty header to be used, and requires req.URL.Scheme to be either
|
||||
+// "http" or "https".
|
||||
+//
|
||||
+// For further details, refer to:
|
||||
+//
|
||||
+// - https://github.com/docker/engine-api/issues/189
|
||||
+// - https://github.com/golang/go/issues/13624
|
||||
+// - https://github.com/golang/go/issues/61076
|
||||
+// - https://github.com/moby/moby/issues/45935
|
||||
+//
|
||||
+// [RFC 2606, Section 2]: https://www.rfc-editor.org/rfc/rfc2606.html#section-2
|
||||
+// [RFC 6761, Section 6.3]: https://www.rfc-editor.org/rfc/rfc6761#section-6.3
|
||||
+// [RFC 7230, Section 5.4]: https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
|
||||
+// [Go stdlib]: https://github.com/golang/go/blob/6244b1946bc2101b01955468f1be502dbadd6807/src/net/http/transport.go#L558-L569
|
||||
+const DummyHost = "api.moby.localhost"
|
||||
+
|
||||
// ErrRedirect is the error returned by checkRedirect when the request is non-GET.
|
||||
var ErrRedirect = errors.New("unexpected redirect in response")
|
||||
|
||||
diff --git a/vendor/github.com/docker/docker/client/hijack.go b/vendor/github.com/docker/docker/client/hijack.go
|
||||
index e1dc49ef..b8fac0be 100644
|
||||
--- a/vendor/github.com/docker/docker/client/hijack.go
|
||||
+++ b/vendor/github.com/docker/docker/client/hijack.go
|
||||
@@ -62,7 +62,11 @@ func fallbackDial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
|
||||
}
|
||||
|
||||
func (cli *Client) setupHijackConn(ctx context.Context, req *http.Request, proto string) (net.Conn, error) {
|
||||
- req.Host = cli.addr
|
||||
+ req.URL.Host = cli.addr
|
||||
+ if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
+ // Override host header for non-tcp connections.
|
||||
+ req.Host = DummyHost
|
||||
+ }
|
||||
req.Header.Set("Connection", "Upgrade")
|
||||
req.Header.Set("Upgrade", proto)
|
||||
|
||||
diff --git a/vendor/github.com/docker/docker/client/request.go b/vendor/github.com/docker/docker/client/request.go
|
||||
index d3d9a3fe..66530d4b 100644
|
||||
--- a/vendor/github.com/docker/docker/client/request.go
|
||||
+++ b/vendor/github.com/docker/docker/client/request.go
|
||||
@@ -88,15 +88,13 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers hea
|
||||
return nil, err
|
||||
}
|
||||
req = cli.addHeaders(req, headers)
|
||||
-
|
||||
- if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
- // For local communications, it doesn't matter what the host is. We just
|
||||
- // need a valid and meaningful host name. (See #189)
|
||||
- req.Host = "docker"
|
||||
- }
|
||||
-
|
||||
- req.URL.Host = cli.addr
|
||||
req.URL.Scheme = cli.scheme
|
||||
+ req.URL.Host = cli.addr
|
||||
+
|
||||
+ if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
+ // Override host header for non-tcp connections.
|
||||
+ req.Host = DummyHost
|
||||
+ }
|
||||
|
||||
if expectedPayload && req.Header.Get("Content-Type") == "" {
|
||||
req.Header.Set("Content-Type", "text/plain")
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -1 +0,0 @@
|
||||
DIST docker-20.10.24.tar.gz 11235129 BLAKE2B abeae0ff9e2d03bd7c901a9e3c1f5a3ccf84afefb034ce032f4e559349ea01ab69ebe120d6c0992885aafa153a784a8c253ed3f7345b921860b758da8e0474ef SHA512 2e82d8048fbf53e3d8ac87eb155d2e321378ca9c9ee038d13bb1b510db31df0f9951db51df81bad28a64c25285e21f8e541b4ce58a68af81fa66d5c07dd3f4d3
|
||||
@ -1,332 +0,0 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
EGO_PN=github.com/docker/docker
|
||||
MY_PV=${PV/_/-}
|
||||
GIT_COMMIT=d6cbf44b8c
|
||||
inherit linux-info systemd udev golang-vcs-snapshot
|
||||
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
COREOS_GO_GO111MODULE="off"
|
||||
|
||||
inherit coreos-go-depend
|
||||
|
||||
DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
|
||||
HOMEPAGE="https://www.docker.com/"
|
||||
SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
|
||||
# Flatcar: default enable required USE flags
|
||||
IUSE="apparmor aufs +btrfs +cli +container-init +device-mapper +hardened
|
||||
+overlay +seccomp selinux"
|
||||
|
||||
DEPEND="
|
||||
acct-group/docker
|
||||
>=dev-db/sqlite-3.7.9:3
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
|
||||
device-mapper? ( >=sys-fs/lvm2-2.02.89[thin] )
|
||||
seccomp? ( >=sys-libs/libseccomp-2.2.1 )
|
||||
"
|
||||
|
||||
# Flatcar:
|
||||
# For CoreOS builds coreos-kernel must be installed because this ebuild
|
||||
# checks the kernel config. The kernel config is left by the kernel compile
|
||||
# or an explicit copy when installing binary packages. See coreos-kernel.eclass
|
||||
DEPEND+="
|
||||
sys-kernel/coreos-kernel
|
||||
"
|
||||
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
|
||||
# https://github.com/moby/moby/tree/master//hack/dockerfile/install
|
||||
# make sure docker-proxy is pinned to exact version from ^,
|
||||
# for appropriate branchch/version of course
|
||||
# Flatcar:
|
||||
# containerd ebuild doesn't support apparmor, device-mapper and seccomp use flags
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
>=net-firewall/iptables-1.4
|
||||
sys-process/procps
|
||||
>=dev-vcs/git-1.7
|
||||
>=app-arch/xz-utils-4.9
|
||||
dev-libs/libltdl
|
||||
>=app-containers/containerd-1.6.16[btrfs?]
|
||||
~app-containers/docker-proxy-0.8.0_p20230118
|
||||
cli? ( ~app-containers/docker-cli-${PV} )
|
||||
container-init? ( >=sys-process/tini-0.19.0[static] )
|
||||
selinux? ( sec-policy/selinux-docker )
|
||||
"
|
||||
|
||||
# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
|
||||
# Flatcar: drop go-md2man
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.16.12
|
||||
virtual/pkgconfig
|
||||
"
|
||||
# tests require running dockerd as root and downloading containers
|
||||
RESTRICT="installsources strip test"
|
||||
|
||||
S="${WORKDIR}/${P}/src/${EGO_PN}"
|
||||
|
||||
# Flatcar: Dropped outdated bug links, dropped openrc init script patch,
|
||||
# backport upstream patches for fixing invalid headers issue when building
|
||||
# with Go 1.19.11+.
|
||||
PATCHES=(
|
||||
"${FILESDIR}/ppc64-buildmode.patch"
|
||||
"${FILESDIR}/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch"
|
||||
"${FILESDIR}/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch"
|
||||
)
|
||||
|
||||
# see "contrib/check-config.sh" from upstream's sources
|
||||
CONFIG_CHECK="
|
||||
~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
|
||||
~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
|
||||
~CGROUP_NET_PRIO
|
||||
~KEYS
|
||||
~VETH ~BRIDGE ~BRIDGE_NETFILTER
|
||||
~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE ~NETFILTER_XT_MARK
|
||||
~NETFILTER_NETLINK ~NETFILTER_XT_MATCH_ADDRTYPE ~NETFILTER_XT_MATCH_CONNTRACK ~NETFILTER_XT_MATCH_IPVS
|
||||
~IP_NF_NAT ~NF_NAT
|
||||
~POSIX_MQUEUE
|
||||
|
||||
~USER_NS
|
||||
~SECCOMP
|
||||
~CGROUP_PIDS
|
||||
|
||||
~BLK_CGROUP ~BLK_DEV_THROTTLING
|
||||
~CGROUP_PERF
|
||||
~CGROUP_HUGETLB
|
||||
~NET_CLS_CGROUP
|
||||
~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
|
||||
~IP_VS ~IP_VS_PROTO_TCP ~IP_VS_PROTO_UDP ~IP_VS_NFCT ~IP_VS_RR
|
||||
|
||||
~VXLAN
|
||||
~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH ~XFRM_ALGO ~XFRM_USER
|
||||
~IPVLAN
|
||||
~MACVLAN ~DUMMY
|
||||
|
||||
~OVERLAY_FS ~!OVERLAY_FS_REDIRECT_DIR
|
||||
~EXT4_FS_SECURITY
|
||||
~EXT4_FS_POSIX_ACL
|
||||
"
|
||||
|
||||
ERROR_KEYS="CONFIG_KEYS: is mandatory"
|
||||
ERROR_MEMCG_SWAP="CONFIG_MEMCG_SWAP: is required if you wish to limit swap usage of containers"
|
||||
ERROR_RESOURCE_COUNTERS="CONFIG_RESOURCE_COUNTERS: is optional for container statistics gathering"
|
||||
|
||||
ERROR_BLK_CGROUP="CONFIG_BLK_CGROUP: is optional for container statistics gathering"
|
||||
ERROR_IOSCHED_CFQ="CONFIG_IOSCHED_CFQ: is optional for container statistics gathering"
|
||||
ERROR_CGROUP_PERF="CONFIG_CGROUP_PERF: is optional for container statistics gathering"
|
||||
ERROR_CFS_BANDWIDTH="CONFIG_CFS_BANDWIDTH: is optional for container statistics gathering"
|
||||
ERROR_XFRM_ALGO="CONFIG_XFRM_ALGO: is optional for secure networks"
|
||||
ERROR_XFRM_USER="CONFIG_XFRM_USER: is optional for secure networks"
|
||||
|
||||
pkg_setup() {
|
||||
|
||||
if kernel_is lt 4 5; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_KMEM
|
||||
"
|
||||
ERROR_MEMCG_KMEM="CONFIG_MEMCG_KMEM: is optional"
|
||||
fi
|
||||
|
||||
if kernel_is lt 4 7; then
|
||||
CONFIG_CHECK+="
|
||||
~DEVPTS_MULTIPLE_INSTANCES
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 5 1; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_IPV4
|
||||
~IOSCHED_CFQ
|
||||
~CFQ_GROUP_IOSCHED
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 5 2; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_NEEDED
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 5 8; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP_ENABLED
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 6 1; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP
|
||||
"
|
||||
fi
|
||||
|
||||
if use aufs; then
|
||||
CONFIG_CHECK+="
|
||||
~AUFS_FS
|
||||
~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
|
||||
"
|
||||
ERROR_AUFS_FS="CONFIG_AUFS_FS: is required to be set if and only if aufs is patched to kernel instead of using standalone"
|
||||
fi
|
||||
|
||||
if use btrfs; then
|
||||
CONFIG_CHECK+="
|
||||
~BTRFS_FS
|
||||
~BTRFS_FS_POSIX_ACL
|
||||
"
|
||||
fi
|
||||
|
||||
if use device-mapper; then
|
||||
CONFIG_CHECK+="
|
||||
~BLK_DEV_DM ~DM_THIN_PROVISIONING ~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
|
||||
"
|
||||
fi
|
||||
|
||||
linux-info_pkg_setup
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
# Flatcar: for cross-compilation
|
||||
go_export
|
||||
export DOCKER_GITCOMMIT="${GIT_COMMIT}"
|
||||
export GOPATH="${WORKDIR}/${P}"
|
||||
export VERSION=${PV}
|
||||
|
||||
# setup CFLAGS and LDFLAGS for separate build target
|
||||
# see https://github.com/tianon/docker-overlay/pull/10
|
||||
# Flatcar: allow injecting CFLAGS/LDFLAGS, which is needed for torcx rpath
|
||||
export CGO_CFLAGS="${CGO_CFLAGS} -I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="${CGO_LDFLAGS} -L${ESYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# let's set up some optional features :)
|
||||
export DOCKER_BUILDTAGS=''
|
||||
for gd in aufs btrfs device-mapper overlay; do
|
||||
if ! use $gd; then
|
||||
DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
|
||||
fi
|
||||
done
|
||||
|
||||
for tag in apparmor seccomp; do
|
||||
if use $tag; then
|
||||
DOCKER_BUILDTAGS+=" $tag"
|
||||
fi
|
||||
done
|
||||
# Flatcar: Add journald to build tags.
|
||||
DOCKER_BUILDTAGS+=' journald'
|
||||
|
||||
# Flatcar:
|
||||
# inject LDFLAGS for torcx
|
||||
if use hardened; then
|
||||
sed -i "s#EXTLDFLAGS_STATIC='#&-fno-PIC $LDFLAGS #" hack/make.sh || die
|
||||
grep -q -- '-fno-PIC' hack/make.sh || die 'hardened sed failed'
|
||||
sed "s#LDFLAGS_STATIC_DOCKER='#&-extldflags \"-fno-PIC $LDFLAGS\" #" \
|
||||
-i hack/make/dynbinary-daemon || die
|
||||
grep -q -- '-fno-PIC' hack/make/dynbinary-daemon || die 'hardened sed failed'
|
||||
fi
|
||||
|
||||
# build daemon
|
||||
./hack/make.sh dynbinary || die 'dynbinary failed'
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dosym containerd /usr/bin/docker-containerd
|
||||
dosym containerd-shim /usr/bin/docker-containerd-shim
|
||||
dosym runc /usr/bin/docker-runc
|
||||
use container-init && dosym tini /usr/bin/docker-init
|
||||
newbin bundles/dynbinary-daemon/dockerd dockerd
|
||||
|
||||
newinitd contrib/init/openrc/docker.initd docker
|
||||
newconfd contrib/init/openrc/docker.confd docker
|
||||
|
||||
# Flatcar:
|
||||
# install our systemd units/network config and our wrapper into
|
||||
# /usr/lib/flatcar/docker for backwards compatibility instead of
|
||||
# the units from contrib/init/systemd directory.
|
||||
#
|
||||
# systemd_dounit contrib/init/systemd/docker.{service,socket}
|
||||
exeinto /usr/lib/flatcar
|
||||
doexe "${FILESDIR}/dockerd"
|
||||
|
||||
systemd_dounit "${FILESDIR}/docker.service"
|
||||
systemd_dounit "${FILESDIR}/docker.socket"
|
||||
|
||||
insinto /usr/lib/systemd/network
|
||||
doins "${FILESDIR}/50-docker.network"
|
||||
doins "${FILESDIR}/90-docker-veth.network"
|
||||
|
||||
udev_dorules contrib/udev/*.rules
|
||||
|
||||
dodoc AUTHORS CONTRIBUTING.md CHANGELOG.md NOTICE README.md
|
||||
dodoc -r docs/*
|
||||
|
||||
# Flatcar:
|
||||
# don't install contrib bits
|
||||
# # note: intentionally not using "doins" so that we preserve +x bits
|
||||
# dodir /usr/share/${PN}/contrib
|
||||
# cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
udev_reload
|
||||
|
||||
elog
|
||||
elog "To use Docker, the Docker daemon must be running as root. To automatically"
|
||||
elog "start the Docker daemon at boot:"
|
||||
if systemd_is_booted || has_version sys-apps/systemd; then
|
||||
elog " systemctl enable docker.service"
|
||||
else
|
||||
elog " rc-update add docker default"
|
||||
fi
|
||||
elog
|
||||
elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
|
||||
elog ' usermod -aG docker <youruser>'
|
||||
elog
|
||||
|
||||
if use device-mapper; then
|
||||
elog " Devicemapper storage driver has been deprecated"
|
||||
elog " It will be removed in a future release"
|
||||
elog
|
||||
fi
|
||||
|
||||
if use overlay; then
|
||||
elog " Overlay storage driver/USEflag has been deprecated"
|
||||
elog " in favor of overlay2 (enabled unconditionally)"
|
||||
elog
|
||||
fi
|
||||
|
||||
if has_version sys-fs/zfs; then
|
||||
elog " ZFS storage driver is available"
|
||||
elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
|
||||
elog
|
||||
fi
|
||||
|
||||
if use cli; then
|
||||
ewarn "Starting with docker 20.10.2, docker has been split into"
|
||||
ewarn "two packages upstream, so Gentoo has followed suit."
|
||||
ewarn
|
||||
ewarn "app-containers/docker contains the daemon and"
|
||||
ewarn "app-containers/docker-cli contains the docker command."
|
||||
ewarn
|
||||
ewarn "docker currently installs docker-cli using the cli use flag."
|
||||
ewarn
|
||||
ewarn "This use flag is temporary, so you need to take the"
|
||||
ewarn "following actions:"
|
||||
ewarn
|
||||
ewarn "First, disable the cli use flag for app-containers/docker"
|
||||
ewarn
|
||||
ewarn "Then, if you need docker-cli and docker on the same machine,"
|
||||
ewarn "run the following command:"
|
||||
ewarn
|
||||
ewarn "# emerge --noreplace docker-cli"
|
||||
ewarn
|
||||
fi
|
||||
}
|
||||
|
||||
pkg_postrm() {
|
||||
udev_reload
|
||||
}
|
||||
@ -1,161 +0,0 @@
|
||||
From 74b4974cb7e7e81e57661f93b03c94a95a15472e Mon Sep 17 00:00:00 2001
|
||||
Message-Id: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
|
||||
From: Sebastiaan van Stijn <github@gone.nl>
|
||||
Date: Wed, 12 Jul 2023 14:15:38 +0200
|
||||
Subject: [PATCH 1/2] client: define a "dummy" hostname to use for local
|
||||
connections
|
||||
|
||||
For local communications (npipe://, unix://), the hostname is not used,
|
||||
but we need valid and meaningful hostname.
|
||||
|
||||
The current code used the client's `addr` as hostname in some cases, which
|
||||
could contain the path for the unix-socket (`/var/run/docker.sock`), which
|
||||
gets rejected by go1.20.6 and go1.19.11 because of a security fix for
|
||||
[CVE-2023-29406 ][1], which was implemented in https://go.dev/issue/60374.
|
||||
|
||||
Prior versions go Go would clean the host header, and strip slashes in the
|
||||
process, but go1.20.6 and go1.19.11 no longer do, and reject the host
|
||||
header.
|
||||
|
||||
This patch introduces a `DummyHost` const, and uses this dummy host for
|
||||
cases where we don't need an actual hostname.
|
||||
|
||||
Before this patch (using go1.20.6):
|
||||
|
||||
make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration
|
||||
=== RUN TestAttachWithTTY
|
||||
attach_test.go:46: assertion failed: error is not nil: http: invalid Host header
|
||||
--- FAIL: TestAttachWithTTY (0.11s)
|
||||
=== RUN TestAttachWithoutTTy
|
||||
attach_test.go:46: assertion failed: error is not nil: http: invalid Host header
|
||||
--- FAIL: TestAttachWithoutTTy (0.02s)
|
||||
FAIL
|
||||
|
||||
With this patch applied:
|
||||
|
||||
make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration
|
||||
INFO: Testing against a local daemon
|
||||
=== RUN TestAttachWithTTY
|
||||
--- PASS: TestAttachWithTTY (0.12s)
|
||||
=== RUN TestAttachWithoutTTy
|
||||
--- PASS: TestAttachWithoutTTy (0.02s)
|
||||
PASS
|
||||
|
||||
[1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx
|
||||
|
||||
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
||||
(cherry picked from commit 92975f0c11f0566cc3c36659f5e3bb9faf5cb176)
|
||||
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
||||
---
|
||||
client/client.go | 30 ++++++++++++++++++++++++++++++
|
||||
client/hijack.go | 6 +++++-
|
||||
client/request.go | 14 ++++++--------
|
||||
client/request_test.go | 4 ++--
|
||||
4 files changed, 43 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/client/client.go b/client/client.go
|
||||
index 0d3614d5..d0ce09ae 100644
|
||||
--- a/client/client.go
|
||||
+++ b/client/client.go
|
||||
@@ -56,6 +56,36 @@ import (
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
+// DummyHost is a hostname used for local communication.
|
||||
+//
|
||||
+// It acts as a valid formatted hostname for local connections (such as "unix://"
|
||||
+// or "npipe://") which do not require a hostname. It should never be resolved,
|
||||
+// but uses the special-purpose ".localhost" TLD (as defined in [RFC 2606, Section 2]
|
||||
+// and [RFC 6761, Section 6.3]).
|
||||
+//
|
||||
+// [RFC 7230, Section 5.4] defines that an empty header must be used for such
|
||||
+// cases:
|
||||
+//
|
||||
+// If the authority component is missing or undefined for the target URI,
|
||||
+// then a client MUST send a Host header field with an empty field-value.
|
||||
+//
|
||||
+// However, [Go stdlib] enforces the semantics of HTTP(S) over TCP, does not
|
||||
+// allow an empty header to be used, and requires req.URL.Scheme to be either
|
||||
+// "http" or "https".
|
||||
+//
|
||||
+// For further details, refer to:
|
||||
+//
|
||||
+// - https://github.com/docker/engine-api/issues/189
|
||||
+// - https://github.com/golang/go/issues/13624
|
||||
+// - https://github.com/golang/go/issues/61076
|
||||
+// - https://github.com/moby/moby/issues/45935
|
||||
+//
|
||||
+// [RFC 2606, Section 2]: https://www.rfc-editor.org/rfc/rfc2606.html#section-2
|
||||
+// [RFC 6761, Section 6.3]: https://www.rfc-editor.org/rfc/rfc6761#section-6.3
|
||||
+// [RFC 7230, Section 5.4]: https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
|
||||
+// [Go stdlib]: https://github.com/golang/go/blob/6244b1946bc2101b01955468f1be502dbadd6807/src/net/http/transport.go#L558-L569
|
||||
+const DummyHost = "api.moby.localhost"
|
||||
+
|
||||
// ErrRedirect is the error returned by checkRedirect when the request is non-GET.
|
||||
var ErrRedirect = errors.New("unexpected redirect in response")
|
||||
|
||||
diff --git a/client/hijack.go b/client/hijack.go
|
||||
index e1dc49ef..b8fac0be 100644
|
||||
--- a/client/hijack.go
|
||||
+++ b/client/hijack.go
|
||||
@@ -62,7 +62,11 @@ func fallbackDial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
|
||||
}
|
||||
|
||||
func (cli *Client) setupHijackConn(ctx context.Context, req *http.Request, proto string) (net.Conn, error) {
|
||||
- req.Host = cli.addr
|
||||
+ req.URL.Host = cli.addr
|
||||
+ if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
+ // Override host header for non-tcp connections.
|
||||
+ req.Host = DummyHost
|
||||
+ }
|
||||
req.Header.Set("Connection", "Upgrade")
|
||||
req.Header.Set("Upgrade", proto)
|
||||
|
||||
diff --git a/client/request.go b/client/request.go
|
||||
index d3d9a3fe..66530d4b 100644
|
||||
--- a/client/request.go
|
||||
+++ b/client/request.go
|
||||
@@ -88,15 +88,13 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers hea
|
||||
return nil, err
|
||||
}
|
||||
req = cli.addHeaders(req, headers)
|
||||
-
|
||||
- if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
- // For local communications, it doesn't matter what the host is. We just
|
||||
- // need a valid and meaningful host name. (See #189)
|
||||
- req.Host = "docker"
|
||||
- }
|
||||
-
|
||||
- req.URL.Host = cli.addr
|
||||
req.URL.Scheme = cli.scheme
|
||||
+ req.URL.Host = cli.addr
|
||||
+
|
||||
+ if cli.proto == "unix" || cli.proto == "npipe" {
|
||||
+ // Override host header for non-tcp connections.
|
||||
+ req.Host = DummyHost
|
||||
+ }
|
||||
|
||||
if expectedPayload && req.Header.Get("Content-Type") == "" {
|
||||
req.Header.Set("Content-Type", "text/plain")
|
||||
diff --git a/client/request_test.go b/client/request_test.go
|
||||
index a3be507b..c1a10923 100644
|
||||
--- a/client/request_test.go
|
||||
+++ b/client/request_test.go
|
||||
@@ -27,12 +27,12 @@ func TestSetHostHeader(t *testing.T) {
|
||||
}{
|
||||
{
|
||||
"unix:///var/run/docker.sock",
|
||||
- "docker",
|
||||
+ DummyHost,
|
||||
"/var/run/docker.sock",
|
||||
},
|
||||
{
|
||||
"npipe:////./pipe/docker_engine",
|
||||
- "docker",
|
||||
+ DummyHost,
|
||||
"//./pipe/docker_engine",
|
||||
},
|
||||
{
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -1,72 +0,0 @@
|
||||
From 1603196c5bc3e3b826c841e599bc45fc33562633 Mon Sep 17 00:00:00 2001
|
||||
Message-Id: <1603196c5bc3e3b826c841e599bc45fc33562633.1689689028.git.dpark@linux.microsoft.com>
|
||||
In-Reply-To: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
|
||||
References: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
|
||||
From: Sebastiaan van Stijn <github@gone.nl>
|
||||
Date: Wed, 12 Jul 2023 15:07:59 +0200
|
||||
Subject: [PATCH 2/2] pkg/plugins: use a dummy hostname for local connections
|
||||
|
||||
For local communications (npipe://, unix://), the hostname is not used,
|
||||
but we need valid and meaningful hostname.
|
||||
|
||||
The current code used the socket path as hostname, which gets rejected by
|
||||
go1.20.6 and go1.19.11 because of a security fix for [CVE-2023-29406 ][1],
|
||||
which was implemented in https://go.dev/issue/60374.
|
||||
|
||||
Prior versions go Go would clean the host header, and strip slashes in the
|
||||
process, but go1.20.6 and go1.19.11 no longer do, and reject the host
|
||||
header.
|
||||
|
||||
Before this patch, tests would fail on go1.20.6:
|
||||
|
||||
=== FAIL: pkg/authorization TestAuthZRequestPlugin (15.01s)
|
||||
time="2023-07-12T12:53:45Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 1s"
|
||||
time="2023-07-12T12:53:46Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 2s"
|
||||
time="2023-07-12T12:53:48Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 4s"
|
||||
time="2023-07-12T12:53:52Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 8s"
|
||||
authz_unix_test.go:82: Failed to authorize request Post "http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq": http: invalid Host header
|
||||
|
||||
[1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx
|
||||
|
||||
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
||||
(cherry picked from commit 6b7705d5b29e226a24902a8dcc488836faaee33c)
|
||||
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
||||
---
|
||||
pkg/plugins/client.go | 14 ++++++++++++--
|
||||
1 file changed, 12 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/pkg/plugins/client.go b/pkg/plugins/client.go
|
||||
index 752fecd0..e683eb77 100644
|
||||
--- a/pkg/plugins/client.go
|
||||
+++ b/pkg/plugins/client.go
|
||||
@@ -18,6 +18,12 @@ import (
|
||||
|
||||
const (
|
||||
defaultTimeOut = 30
|
||||
+
|
||||
+ // dummyHost is a hostname used for local communication.
|
||||
+ //
|
||||
+ // For local communications (npipe://, unix://), the hostname is not used,
|
||||
+ // but we need valid and meaningful hostname.
|
||||
+ dummyHost = "plugin.moby.localhost"
|
||||
)
|
||||
|
||||
func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transport, error) {
|
||||
@@ -44,8 +50,12 @@ func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transpor
|
||||
return nil, err
|
||||
}
|
||||
scheme := httpScheme(u)
|
||||
-
|
||||
- return transport.NewHTTPTransport(tr, scheme, socket), nil
|
||||
+ hostName := u.Host
|
||||
+ if hostName == "" || u.Scheme == "unix" || u.Scheme == "npipe" {
|
||||
+ // Override host header for non-tcp connections.
|
||||
+ hostName = dummyHost
|
||||
+ }
|
||||
+ return transport.NewHTTPTransport(tr, scheme, hostName), nil
|
||||
}
|
||||
|
||||
// NewClient creates a new plugin client (http).
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From c4135e37e54a6480abfe18746f227f05cb9269ab Mon Sep 17 00:00:00 2001
|
||||
From: Georgy Yakovlev <gyakovlev@gentoo.org>
|
||||
Date: Thu, 10 Jun 2021 16:19:22 -0700
|
||||
Subject: [PATCH] don't use buildmode=pie on ppc64
|
||||
|
||||
It's already omitted for ppc64 in
|
||||
hack/dockerfile/install/install.sh
|
||||
not using wildcard, because GOARCH=ppc64le supports pie
|
||||
|
||||
Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>
|
||||
---
|
||||
hack/make/.binary | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/hack/make/.binary b/hack/make/.binary
|
||||
index 5ea3e373f2..7a911de15a 100644
|
||||
--- a/hack/make/.binary
|
||||
+++ b/hack/make/.binary
|
||||
@@ -70,7 +70,7 @@ hash_files() {
|
||||
if [[ " $BUILDFLAGS " != *" -race "* ]]; then
|
||||
# -buildmode=pie is not supported on Windows and Linux on mips and riscv64.
|
||||
case "$(go env GOOS)/$(go env GOARCH)" in
|
||||
- windows/* | linux/mips* | linux/riscv*) ;;
|
||||
+ windows/* | linux/mips* | linux/riscv* | linux/ppc64) ;;
|
||||
|
||||
*)
|
||||
BUILDFLAGS+=("-buildmode=pie")
|
||||
--
|
||||
2.32.0
|
||||
|
||||
@ -1 +0,0 @@
|
||||
DIST runc-1.1.9.tar.gz 2514790 BLAKE2B dec0766c96fb2d264ee8d693adafd2b1f94a2f30329b41f966441f1632ceda83835f4aa8ad46966a04d890cb4c5107f6880ad911ed2b879d2c72565ba5d513e6 SHA512 722ed7d58eccfb37357d85e69b2a8f7fa23ed3553e3b6541e9f26946896dc0c2955e5e4708ee77765ad2d3e4dd9c9722fbcefce1f2a96111240edd445cf902ba
|
||||
@ -1,46 +0,0 @@
|
||||
From ab3a3b89d712bb1c6ca2e09ffc375f4b837e9401 Mon Sep 17 00:00:00 2001
|
||||
From: Mrunal Patel <mrunalp@gmail.com>
|
||||
Date: Thu, 2 Feb 2017 11:23:26 -0800
|
||||
Subject: [PATCH] Delay unshare of CLONE_NEWIPC for SELinux
|
||||
|
||||
We ensure that mqueue is owned by user namespace root
|
||||
by unsharing CLONE_NEWIPC after we become user namespace
|
||||
root. This allows us to apply the container SELinux label
|
||||
to mqueue.
|
||||
|
||||
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
|
||||
(dpark: Adjust the logic according to the new code of v1.1.5)
|
||||
Signed-off-by: Dongsu Park <dpark@linux.microsoft.com>
|
||||
---
|
||||
libcontainer/nsenter/nsexec.c | 12 +++++++++++-
|
||||
1 file changed, 11 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
|
||||
index 2d224bab..4865261f 100644
|
||||
--- a/libcontainer/nsenter/nsexec.c
|
||||
+++ b/libcontainer/nsenter/nsexec.c
|
||||
@@ -1241,7 +1241,12 @@ void nsexec(void)
|
||||
* some old kernel versions where clone(CLONE_PARENT | CLONE_NEWPID)
|
||||
* was broken, so we'll just do it the long way anyway.
|
||||
*/
|
||||
- try_unshare(config.cloneflags & ~CLONE_NEWCGROUP, "remaining namespaces (except cgroupns)");
|
||||
+ uint32_t apply_cloneflags = config.cloneflags;
|
||||
+ if ((config.cloneflags & CLONE_NEWUSER) && (config.cloneflags & CLONE_NEWIPC)) {
|
||||
+ apply_cloneflags &= ~CLONE_NEWIPC;
|
||||
+ }
|
||||
+
|
||||
+ try_unshare(apply_cloneflags & ~CLONE_NEWCGROUP, "remaining namespaces (except cgroupns)");
|
||||
|
||||
/* Ask our parent to send the mount sources fds. */
|
||||
if (config.mountsources) {
|
||||
@@ -1362,6 +1367,10 @@ void nsexec(void)
|
||||
try_unshare(CLONE_NEWCGROUP, "cgroup namespace");
|
||||
}
|
||||
|
||||
+ if ((config.cloneflags & CLONE_NEWUSER) && (config.cloneflags & CLONE_NEWIPC)) {
|
||||
+ try_unshare(CLONE_NEWIPC, "ipc namespace");
|
||||
+ }
|
||||
+
|
||||
write_log(DEBUG, "signal completion to stage-0");
|
||||
s = SYNC_CHILD_FINISH;
|
||||
if (write(syncfd, &s, sizeof(s)) != sizeof(s))
|
||||
@ -1,334 +0,0 @@
|
||||
From 2d069bb79260e594870ce3e7466477e54a0c5307 Mon Sep 17 00:00:00 2001
|
||||
From: Aleksa Sarai <asarai@suse.de>
|
||||
Date: Wed, 9 Jan 2019 13:40:01 +1100
|
||||
Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary
|
||||
to container
|
||||
|
||||
There are quite a few circumstances where /proc/self/exe pointing to a
|
||||
pretty important container binary is a _bad_ thing, so to avoid this we
|
||||
have to make a copy (preferably doing self-clean-up and not being
|
||||
writeable).
|
||||
|
||||
We require memfd_create(2) -- though there is an O_TMPFILE fallback --
|
||||
but we can always extend this to use a scratch MNT_DETACH overlayfs or
|
||||
tmpfs. The main downside to this approach is no page-cache sharing for
|
||||
the runc binary (which overlayfs would give us) but this is far less
|
||||
complicated.
|
||||
|
||||
This is only done during nsenter so that it happens transparently to the
|
||||
Go code, and any libcontainer users benefit from it. This also makes
|
||||
ExtraFiles and --preserve-fds handling trivial (because we don't need to
|
||||
worry about it).
|
||||
|
||||
Fixes: CVE-2019-5736
|
||||
Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com>
|
||||
Signed-off-by: Aleksa Sarai <asarai@suse.de>
|
||||
---
|
||||
libcontainer/nsenter/cloned_binary.c | 268 +++++++++++++++++++++++++++
|
||||
libcontainer/nsenter/nsexec.c | 11 ++
|
||||
2 files changed, 279 insertions(+)
|
||||
create mode 100644 libcontainer/nsenter/cloned_binary.c
|
||||
|
||||
diff --git a/libcontainer/nsenter/cloned_binary.c b/libcontainer/nsenter/cloned_binary.c
|
||||
new file mode 100644
|
||||
index 000000000000..c8a42c23f73f
|
||||
--- /dev/null
|
||||
+++ b/libcontainer/nsenter/cloned_binary.c
|
||||
@@ -0,0 +1,268 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2019 Aleksa Sarai <cyphar@cyphar.com>
|
||||
+ * Copyright (C) 2019 SUSE LLC
|
||||
+ *
|
||||
+ * Licensed under the Apache License, Version 2.0 (the "License");
|
||||
+ * you may not use this file except in compliance with the License.
|
||||
+ * You may obtain a copy of the License at
|
||||
+ *
|
||||
+ * http://www.apache.org/licenses/LICENSE-2.0
|
||||
+ *
|
||||
+ * Unless required by applicable law or agreed to in writing, software
|
||||
+ * distributed under the License is distributed on an "AS IS" BASIS,
|
||||
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
+ * See the License for the specific language governing permissions and
|
||||
+ * limitations under the License.
|
||||
+ */
|
||||
+
|
||||
+#define _GNU_SOURCE
|
||||
+#include <unistd.h>
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <stdbool.h>
|
||||
+#include <string.h>
|
||||
+#include <limits.h>
|
||||
+#include <fcntl.h>
|
||||
+#include <errno.h>
|
||||
+
|
||||
+#include <sys/types.h>
|
||||
+#include <sys/stat.h>
|
||||
+#include <sys/vfs.h>
|
||||
+#include <sys/mman.h>
|
||||
+#include <sys/sendfile.h>
|
||||
+#include <sys/syscall.h>
|
||||
+
|
||||
+/* Use our own wrapper for memfd_create. */
|
||||
+#if !defined(SYS_memfd_create) && defined(__NR_memfd_create)
|
||||
+# define SYS_memfd_create __NR_memfd_create
|
||||
+#endif
|
||||
+#ifdef SYS_memfd_create
|
||||
+# define HAVE_MEMFD_CREATE
|
||||
+/* memfd_create(2) flags -- copied from <linux/memfd.h>. */
|
||||
+# ifndef MFD_CLOEXEC
|
||||
+# define MFD_CLOEXEC 0x0001U
|
||||
+# define MFD_ALLOW_SEALING 0x0002U
|
||||
+# endif
|
||||
+int memfd_create(const char *name, unsigned int flags)
|
||||
+{
|
||||
+ return syscall(SYS_memfd_create, name, flags);
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
+/* This comes directly from <linux/fcntl.h>. */
|
||||
+#ifndef F_LINUX_SPECIFIC_BASE
|
||||
+# define F_LINUX_SPECIFIC_BASE 1024
|
||||
+#endif
|
||||
+#ifndef F_ADD_SEALS
|
||||
+# define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9)
|
||||
+# define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
|
||||
+#endif
|
||||
+#ifndef F_SEAL_SEAL
|
||||
+# define F_SEAL_SEAL 0x0001 /* prevent further seals from being set */
|
||||
+# define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */
|
||||
+# define F_SEAL_GROW 0x0004 /* prevent file from growing */
|
||||
+# define F_SEAL_WRITE 0x0008 /* prevent writes */
|
||||
+#endif
|
||||
+
|
||||
+#define RUNC_SENDFILE_MAX 0x7FFFF000 /* sendfile(2) is limited to 2GB. */
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+# define RUNC_MEMFD_COMMENT "runc_cloned:/proc/self/exe"
|
||||
+# define RUNC_MEMFD_SEALS \
|
||||
+ (F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
|
||||
+#endif
|
||||
+
|
||||
+static void *must_realloc(void *ptr, size_t size)
|
||||
+{
|
||||
+ void *old = ptr;
|
||||
+ do {
|
||||
+ ptr = realloc(old, size);
|
||||
+ } while(!ptr);
|
||||
+ return ptr;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Verify whether we are currently in a self-cloned program (namely, is
|
||||
+ * /proc/self/exe a memfd). F_GET_SEALS will only succeed for memfds (or rather
|
||||
+ * for shmem files), and we want to be sure it's actually sealed.
|
||||
+ */
|
||||
+static int is_self_cloned(void)
|
||||
+{
|
||||
+ int fd, ret, is_cloned = 0;
|
||||
+
|
||||
+ fd = open("/proc/self/exe", O_RDONLY|O_CLOEXEC);
|
||||
+ if (fd < 0)
|
||||
+ return -ENOTRECOVERABLE;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ ret = fcntl(fd, F_GET_SEALS);
|
||||
+ is_cloned = (ret == RUNC_MEMFD_SEALS);
|
||||
+#else
|
||||
+ struct stat statbuf = {0};
|
||||
+ ret = fstat(fd, &statbuf);
|
||||
+ if (ret >= 0)
|
||||
+ is_cloned = (statbuf.st_nlink == 0);
|
||||
+#endif
|
||||
+ close(fd);
|
||||
+ return is_cloned;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Basic wrapper around mmap(2) that gives you the file length so you can
|
||||
+ * safely treat it as an ordinary buffer. Only gives you read access.
|
||||
+ */
|
||||
+static char *read_file(char *path, size_t *length)
|
||||
+{
|
||||
+ int fd;
|
||||
+ char buf[4096], *copy = NULL;
|
||||
+
|
||||
+ if (!length)
|
||||
+ return NULL;
|
||||
+
|
||||
+ fd = open(path, O_RDONLY | O_CLOEXEC);
|
||||
+ if (fd < 0)
|
||||
+ return NULL;
|
||||
+
|
||||
+ *length = 0;
|
||||
+ for (;;) {
|
||||
+ int n;
|
||||
+
|
||||
+ n = read(fd, buf, sizeof(buf));
|
||||
+ if (n < 0)
|
||||
+ goto error;
|
||||
+ if (!n)
|
||||
+ break;
|
||||
+
|
||||
+ copy = must_realloc(copy, (*length + n) * sizeof(*copy));
|
||||
+ memcpy(copy + *length, buf, n);
|
||||
+ *length += n;
|
||||
+ }
|
||||
+ close(fd);
|
||||
+ return copy;
|
||||
+
|
||||
+error:
|
||||
+ close(fd);
|
||||
+ free(copy);
|
||||
+ return NULL;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * A poor-man's version of "xargs -0". Basically parses a given block of
|
||||
+ * NUL-delimited data, within the given length and adds a pointer to each entry
|
||||
+ * to the array of pointers.
|
||||
+ */
|
||||
+static int parse_xargs(char *data, int data_length, char ***output)
|
||||
+{
|
||||
+ int num = 0;
|
||||
+ char *cur = data;
|
||||
+
|
||||
+ if (!data || *output != NULL)
|
||||
+ return -1;
|
||||
+
|
||||
+ while (cur < data + data_length) {
|
||||
+ num++;
|
||||
+ *output = must_realloc(*output, (num + 1) * sizeof(**output));
|
||||
+ (*output)[num - 1] = cur;
|
||||
+ cur += strlen(cur) + 1;
|
||||
+ }
|
||||
+ (*output)[num] = NULL;
|
||||
+ return num;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * "Parse" out argv and envp from /proc/self/cmdline and /proc/self/environ.
|
||||
+ * This is necessary because we are running in a context where we don't have a
|
||||
+ * main() that we can just get the arguments from.
|
||||
+ */
|
||||
+static int fetchve(char ***argv, char ***envp)
|
||||
+{
|
||||
+ char *cmdline = NULL, *environ = NULL;
|
||||
+ size_t cmdline_size, environ_size;
|
||||
+
|
||||
+ cmdline = read_file("/proc/self/cmdline", &cmdline_size);
|
||||
+ if (!cmdline)
|
||||
+ goto error;
|
||||
+ environ = read_file("/proc/self/environ", &environ_size);
|
||||
+ if (!environ)
|
||||
+ goto error;
|
||||
+
|
||||
+ if (parse_xargs(cmdline, cmdline_size, argv) <= 0)
|
||||
+ goto error;
|
||||
+ if (parse_xargs(environ, environ_size, envp) <= 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ return 0;
|
||||
+
|
||||
+error:
|
||||
+ free(environ);
|
||||
+ free(cmdline);
|
||||
+ return -EINVAL;
|
||||
+}
|
||||
+
|
||||
+static int clone_binary(void)
|
||||
+{
|
||||
+ int binfd, memfd;
|
||||
+ ssize_t sent = 0;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ memfd = memfd_create(RUNC_MEMFD_COMMENT, MFD_CLOEXEC | MFD_ALLOW_SEALING);
|
||||
+#else
|
||||
+ memfd = open("/tmp", O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0711);
|
||||
+#endif
|
||||
+ if (memfd < 0)
|
||||
+ return -ENOTRECOVERABLE;
|
||||
+
|
||||
+ binfd = open("/proc/self/exe", O_RDONLY | O_CLOEXEC);
|
||||
+ if (binfd < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ sent = sendfile(memfd, binfd, NULL, RUNC_SENDFILE_MAX);
|
||||
+ close(binfd);
|
||||
+ if (sent < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+#ifdef HAVE_MEMFD_CREATE
|
||||
+ int err = fcntl(memfd, F_ADD_SEALS, RUNC_MEMFD_SEALS);
|
||||
+ if (err < 0)
|
||||
+ goto error;
|
||||
+#else
|
||||
+ /* Need to re-open "memfd" as read-only to avoid execve(2) giving -EXTBUSY. */
|
||||
+ int newfd;
|
||||
+ char *fdpath = NULL;
|
||||
+
|
||||
+ if (asprintf(&fdpath, "/proc/self/fd/%d", memfd) < 0)
|
||||
+ goto error;
|
||||
+ newfd = open(fdpath, O_RDONLY | O_CLOEXEC);
|
||||
+ free(fdpath);
|
||||
+ if (newfd < 0)
|
||||
+ goto error;
|
||||
+
|
||||
+ close(memfd);
|
||||
+ memfd = newfd;
|
||||
+#endif
|
||||
+ return memfd;
|
||||
+
|
||||
+error:
|
||||
+ close(memfd);
|
||||
+ return -EIO;
|
||||
+}
|
||||
+
|
||||
+int ensure_cloned_binary(void)
|
||||
+{
|
||||
+ int execfd;
|
||||
+ char **argv = NULL, **envp = NULL;
|
||||
+
|
||||
+ /* Check that we're not self-cloned, and if we are then bail. */
|
||||
+ int cloned = is_self_cloned();
|
||||
+ if (cloned > 0 || cloned == -ENOTRECOVERABLE)
|
||||
+ return cloned;
|
||||
+
|
||||
+ if (fetchve(&argv, &envp) < 0)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ execfd = clone_binary();
|
||||
+ if (execfd < 0)
|
||||
+ return -EIO;
|
||||
+
|
||||
+ fexecve(execfd, argv, envp);
|
||||
+ return -ENOEXEC;
|
||||
+}
|
||||
diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
|
||||
index 28269dfc027f..7750af35ea92 100644
|
||||
--- a/libcontainer/nsenter/nsexec.c
|
||||
+++ b/libcontainer/nsenter/nsexec.c
|
||||
@@ -534,6 +534,9 @@ void join_namespaces(char *nslist)
|
||||
free(namespaces);
|
||||
}
|
||||
|
||||
+/* Defined in cloned_binary.c. */
|
||||
+extern int ensure_cloned_binary(void);
|
||||
+
|
||||
void nsexec(void)
|
||||
{
|
||||
int pipenum;
|
||||
@@ -549,6 +552,14 @@ void nsexec(void)
|
||||
if (pipenum == -1)
|
||||
return;
|
||||
|
||||
+ /*
|
||||
+ * We need to re-exec if we are not in a cloned binary. This is necessary
|
||||
+ * to ensure that containers won't be able to access the host binary
|
||||
+ * through /proc/self/exe. See CVE-2019-5736.
|
||||
+ */
|
||||
+ if (ensure_cloned_binary() < 0)
|
||||
+ bail("could not ensure we are a cloned binary");
|
||||
+
|
||||
/* Parse all of the netlink configuration. */
|
||||
nl_parse(pipenum, &config);
|
||||
|
||||
@ -1,41 +0,0 @@
|
||||
From db55cd4f29298ae08b20f92b8953735723ee2167 Mon Sep 17 00:00:00 2001
|
||||
From: Euan Kemp <euan.kemp@coreos.com>
|
||||
Date: Fri, 22 Sep 2017 02:31:17 -0700
|
||||
Subject: [PATCH] libcontainer: default mount propagation correctly
|
||||
|
||||
The code in prepareRoot (https://github.com/opencontainers/runc/blob/e385f67a0e45fa1d8ef8154e2aea5128ea1d331b/libcontainer/rootfs_linux.go#L599-L605)
|
||||
attempts to default the rootfs mount to `rslave`. However, since the spec
|
||||
conversion has already defaulted it to `rprivate`, that code doesn't
|
||||
actually ever do anything.
|
||||
|
||||
This changes the spec conversion code to accept "" and treat it as 0.
|
||||
|
||||
Implicitly, this makes rootfs propagation default to `rslave`, which is
|
||||
a part of fixing the moby bug https://github.com/moby/moby/issues/34672
|
||||
|
||||
Alternate implementatoins include changing this defaulting to be
|
||||
`rslave` and removing the defaulting code in prepareRoot, or skipping
|
||||
the mapping entirely for "", but I think this change is the cleanest of
|
||||
those options.
|
||||
|
||||
Signed-off-by: Euan Kemp <euan.kemp@coreos.com>
|
||||
---
|
||||
libcontainer/specconv/spec_linux.go | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
|
||||
index 1575ae03..8a2947f6 100644
|
||||
--- a/libcontainer/specconv/spec_linux.go
|
||||
+++ b/libcontainer/specconv/spec_linux.go
|
||||
@@ -36,7 +36,7 @@ var mountPropagationMapping = map[string]int{
|
||||
"slave": syscall.MS_SLAVE,
|
||||
"rshared": syscall.MS_SHARED | syscall.MS_REC,
|
||||
"shared": syscall.MS_SHARED,
|
||||
- "": syscall.MS_PRIVATE | syscall.MS_REC,
|
||||
+ "": 0,
|
||||
}
|
||||
|
||||
var allowedDevices = []*configs.Device{
|
||||
--
|
||||
2.13.5
|
||||
|
||||
@ -1,19 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<longdescription lang="en">
|
||||
runc is a CLI tool for spawning and running containers according
|
||||
to the OCF (Open Container Format) specification.
|
||||
</longdescription>
|
||||
<maintainer type="person">
|
||||
<email>mrueg@gentoo.org</email>
|
||||
<name>Manuel Rüger</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="ambient">Enable support for ambient capability</flag>
|
||||
<flag name="apparmor">Enable AppArmor support</flag>
|
||||
</use>
|
||||
<upstream>
|
||||
<remote-id type="github">docker/runc</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
@ -1,64 +0,0 @@
|
||||
# Copyright 1999-2018 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
GITHUB_URI="github.com/opencontainers/runc"
|
||||
COREOS_GO_PACKAGE="${GITHUB_URI}"
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
# the commit of runc that docker uses.
|
||||
# see https://github.com/docker/docker-ce/blob/v19.03.15/components/engine/hack/dockerfile/install/runc.installer#L4
|
||||
COMMIT_ID="f1136b082cc1c2840cdb3e0debf45e7ef832c918"
|
||||
|
||||
inherit eutils flag-o-matic coreos-go vcs-snapshot
|
||||
|
||||
SRC_URI="https://${GITHUB_URI}/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz"
|
||||
KEYWORDS="amd64 arm64"
|
||||
|
||||
DESCRIPTION="runc container cli tools (docker fork)"
|
||||
HOMEPAGE="http://runc.io"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
IUSE="ambient apparmor hardened +seccomp selinux"
|
||||
|
||||
RDEPEND="
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
"
|
||||
|
||||
S=${WORKDIR}/${P}/src/${COREOS_GO_PACKAGE}
|
||||
|
||||
RESTRICT="test"
|
||||
|
||||
src_unpack() {
|
||||
mkdir -p "${S}"
|
||||
tar --strip-components=1 -C "${S}" -xf "${DISTDIR}/${A}"
|
||||
}
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/0001-Delay-unshare-of-clone-newipc-for-selinux.patch"
|
||||
)
|
||||
|
||||
src_compile() {
|
||||
# Taken from app-containers/docker-1.7.0-r1
|
||||
export CGO_CFLAGS="-I${SYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')
|
||||
-L${SYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# build up optional flags
|
||||
local options=(
|
||||
$(usex ambient 'ambient' '')
|
||||
$(usex apparmor 'apparmor' '')
|
||||
$(usex seccomp 'seccomp' '')
|
||||
$(usex selinux 'selinux' '')
|
||||
)
|
||||
|
||||
GOPATH="${WORKDIR}/${P}" emake BUILDTAGS="${options[*]}" \
|
||||
VERSION=1.1.9+dev.docker-20.10 \
|
||||
COMMIT="${COMMIT_ID}"
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin runc
|
||||
}
|
||||
@ -31,6 +31,7 @@ RDEPEND="
|
||||
)
|
||||
app-containers/containerd
|
||||
app-containers/docker
|
||||
app-containers/docker-cli
|
||||
app-emulation/amazon-ssm-agent
|
||||
app-emulation/wa-linux-agent
|
||||
coreos-base/coreos
|
||||
|
||||
@ -0,0 +1 @@
|
||||
../containerd.service
|
||||
@ -96,3 +96,13 @@
|
||||
|
||||
# Accept unstable host Rust compilers.
|
||||
=virtual/rust-1.73.0 ~amd64 ~arm64
|
||||
|
||||
|
||||
# Gentoo upstream package stabilisation
|
||||
# (the following packages are "unstable" upstream; we're stabilising these)
|
||||
|
||||
=app-containers/containerd-1.7.7 ~amd64 ~arm64 # NOTE this doesn't even exist upstream; Gentoo is on 1.7.6.
|
||||
=app-containers/cri-tools-1.27.0 ~amd64 ~arm64
|
||||
=app-containers/docker-24.0.6 ~amd64 ~arm64
|
||||
=app-containers/docker-cli-24.0.6 ~amd64 ~arm64
|
||||
=app-containers/runc-1.1.9 ~amd64 ~arm64
|
||||
|
||||
@ -148,3 +148,8 @@ net-analyzer/tcpdump -ssl -smi -samba
|
||||
|
||||
# selinux: to find files with a particular SElinux label
|
||||
sys-apps/findutils selinux
|
||||
|
||||
# Flatcar defaults formerly defined in coreos-overlay ebuilds
|
||||
app-containers/containerd btrfs device-mapper
|
||||
app-containers/docker btrfs device-mapper overlay seccomp
|
||||
app-containers/docker-cli hardened
|
||||
|
||||
4
sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
vendored
Normal file
4
sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
vendored
Normal file
@ -0,0 +1,4 @@
|
||||
DIST containerd-1.7.1.tar.gz 9682254 BLAKE2B f168070caf2b76f0be350a98f41bfdbfe6d78344d68821fb92a29f839a6e847d795e5b79436e36f985aa88028ff1c3f44f134cf6bd502ddac22453a457bd952b SHA512 e9b00ba8f4dd1b5b1088060d3822f684611d43b367ddfeb1bee1660140af85f31e9c9bfc600a67e8fc8645a625dc4e1919d9af7291bdeaa607bff7065a4fc945
|
||||
DIST containerd-1.7.2.tar.gz 9688701 BLAKE2B d31cd0e96bb2675390cc63d06114e37d532b7c666b3ffc5b0087dfcef8de23559471f08bf8a52b164c5f645faf1b8102ab2ccdd8ec417a1c74336097f0c3a899 SHA512 c0d4c02991b7e9fc341c4ef3df2d93097f5854a51b99596ed95436a79f7a586820bb8bb7c17fc43b5f38d97ea942e59490fbbf6c9710391ef9caae3d34627bc5
|
||||
DIST containerd-1.7.6.tar.gz 9714550 BLAKE2B 863df1a8ab0f0fe6ec62893ed64824763c1b5230fe830fa268820ce0d6254c79e1ac62ab1261a74785b86b01dff83ea9109a899857fa47a48f2cf2eaf298fea8 SHA512 8b7e13c6ea544754ba7d53092d143f3fd2224b9bc874a33d8a00b781e719927f1b22ad5cd1e35b7b95e4890e630f4b92308549a970587ccdf9dbb8eb470e2703
|
||||
DIST containerd-1.7.7.tar.gz 9910424 BLAKE2B 623315962233fe3ce965c17c37c950dc1ded8b381012ed50d2bee8b1cea134bc9ef5a1cf5599b6bcd121cabe204fe61015526226131954364a976ebb08d8c353 SHA512 a44e901b017522639963bb415f666599af04335d8ccbd28899712606a4692c1601e95eaa2f1db32a3c077ad2c3f332f37393154ad6c2660646b7e8365a6ab720
|
||||
@ -0,0 +1,86 @@
|
||||
# Copyright 2022-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module systemd
|
||||
GIT_REVISION=2806fc1057397dbaeefbea0e4e17bddfbd388f38
|
||||
|
||||
DESCRIPTION="A daemon to control runC"
|
||||
HOMEPAGE="https://containerd.io/"
|
||||
SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
|
||||
|
||||
DEPEND="
|
||||
btrfs? ( sys-fs/btrfs-progs )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
"
|
||||
|
||||
# recommended version of runc is found in script/setup/runc-version
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
~app-containers/runc-1.1.7[apparmor?,seccomp?]
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
# tests require root or docker
|
||||
RESTRICT+="test"
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
sed -i \
|
||||
-e "s/-s -w//" \
|
||||
-e "s/-mod=readonly//" \
|
||||
Makefile || die
|
||||
sed -i \
|
||||
-e "s:/usr/local:/usr:" \
|
||||
containerd.service || die
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usex btrfs "" "no_btrfs")
|
||||
$(usex cri "" "no_cri")
|
||||
$(usex device-mapper "" "no_devmapper")
|
||||
$(usev seccomp)
|
||||
$(usev selinux)
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
|
||||
REVISION="${GIT_REVISION}"
|
||||
VERSION=v${PV}
|
||||
)
|
||||
|
||||
# race condition in man target https://bugs.gentoo.org/765100
|
||||
# we need to explicitly specify GOFLAGS for "go run" to use vendor source
|
||||
emake "${myemakeargs[@]}" man -j1 #nowarn
|
||||
emake "${myemakeargs[@]}" all
|
||||
|
||||
}
|
||||
|
||||
src_install() {
|
||||
rm "${D}"/bin/gen-manpages
|
||||
dobin bin/*
|
||||
doman man/*
|
||||
newconfd "${FILESDIR}"/${PN}.confd "${PN}"
|
||||
newinitd "${FILESDIR}"/${PN}.initd "${PN}"
|
||||
systemd_dounit containerd.service
|
||||
keepdir /var/lib/containerd
|
||||
|
||||
# we already installed manpages, remove markdown source
|
||||
# before installing docs directory
|
||||
rm -r docs/man || die
|
||||
|
||||
local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.2.ebuild
vendored
Normal file
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.2.ebuild
vendored
Normal file
@ -0,0 +1,86 @@
|
||||
# Copyright 2022-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module systemd
|
||||
GIT_REVISION=0cae528dd6cb557f7201036e9f43420650207b58
|
||||
|
||||
DESCRIPTION="A daemon to control runC"
|
||||
HOMEPAGE="https://containerd.io/"
|
||||
SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
|
||||
|
||||
DEPEND="
|
||||
btrfs? ( sys-fs/btrfs-progs )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
"
|
||||
|
||||
# recommended version of runc is found in script/setup/runc-version
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
~app-containers/runc-1.1.7[apparmor?,seccomp?]
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
# tests require root or docker
|
||||
RESTRICT+="test"
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
sed -i \
|
||||
-e "s/-s -w//" \
|
||||
-e "s/-mod=readonly//" \
|
||||
Makefile || die
|
||||
sed -i \
|
||||
-e "s:/usr/local:/usr:" \
|
||||
containerd.service || die
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usex btrfs "" "no_btrfs")
|
||||
$(usex cri "" "no_cri")
|
||||
$(usex device-mapper "" "no_devmapper")
|
||||
$(usev seccomp)
|
||||
$(usev selinux)
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
|
||||
REVISION="${GIT_REVISION}"
|
||||
VERSION=v${PV}
|
||||
)
|
||||
|
||||
# race condition in man target https://bugs.gentoo.org/765100
|
||||
# we need to explicitly specify GOFLAGS for "go run" to use vendor source
|
||||
emake "${myemakeargs[@]}" man -j1 #nowarn
|
||||
emake "${myemakeargs[@]}" all
|
||||
|
||||
}
|
||||
|
||||
src_install() {
|
||||
rm "${D}"/bin/gen-manpages
|
||||
dobin bin/*
|
||||
doman man/*
|
||||
newconfd "${FILESDIR}"/${PN}.confd "${PN}"
|
||||
newinitd "${FILESDIR}"/${PN}.initd "${PN}"
|
||||
systemd_dounit containerd.service
|
||||
keepdir /var/lib/containerd
|
||||
|
||||
# we already installed manpages, remove markdown source
|
||||
# before installing docs directory
|
||||
rm -r docs/man || die
|
||||
|
||||
local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.6.ebuild
vendored
Normal file
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.6.ebuild
vendored
Normal file
@ -0,0 +1,86 @@
|
||||
# Copyright 2022-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module systemd
|
||||
GIT_REVISION=091922f03c2762540fd057fba91260237ff86acb
|
||||
|
||||
DESCRIPTION="A daemon to control runC"
|
||||
HOMEPAGE="https://containerd.io/"
|
||||
SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
|
||||
|
||||
DEPEND="
|
||||
btrfs? ( sys-fs/btrfs-progs )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
"
|
||||
|
||||
# recommended version of runc is found in script/setup/runc-version
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
~app-containers/runc-1.1.9[apparmor?,seccomp?]
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
# tests require root or docker
|
||||
RESTRICT+="test"
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
sed -i \
|
||||
-e "s/-s -w//" \
|
||||
-e "s/-mod=readonly//" \
|
||||
Makefile || die
|
||||
sed -i \
|
||||
-e "s:/usr/local:/usr:" \
|
||||
containerd.service || die
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usex btrfs "" "no_btrfs")
|
||||
$(usex cri "" "no_cri")
|
||||
$(usex device-mapper "" "no_devmapper")
|
||||
$(usev seccomp)
|
||||
$(usev selinux)
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
|
||||
REVISION="${GIT_REVISION}"
|
||||
VERSION=v${PV}
|
||||
)
|
||||
|
||||
# race condition in man target https://bugs.gentoo.org/765100
|
||||
# we need to explicitly specify GOFLAGS for "go run" to use vendor source
|
||||
emake "${myemakeargs[@]}" man -j1 #nowarn
|
||||
emake "${myemakeargs[@]}" all
|
||||
|
||||
}
|
||||
|
||||
src_install() {
|
||||
rm "${D}"/bin/gen-manpages
|
||||
dobin bin/*
|
||||
doman man/*
|
||||
newconfd "${FILESDIR}"/${PN}.confd "${PN}"
|
||||
newinitd "${FILESDIR}"/${PN}.initd "${PN}"
|
||||
systemd_dounit containerd.service
|
||||
keepdir /var/lib/containerd
|
||||
|
||||
# we already installed manpages, remove markdown source
|
||||
# before installing docs directory
|
||||
rm -r docs/man || die
|
||||
|
||||
local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.7.ebuild
vendored
Normal file
86
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-1.7.7.ebuild
vendored
Normal file
@ -0,0 +1,86 @@
|
||||
# Copyright 2022-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module systemd
|
||||
GIT_REVISION=091922f03c2762540fd057fba91260237ff86acb
|
||||
|
||||
DESCRIPTION="A daemon to control runC"
|
||||
HOMEPAGE="https://containerd.io/"
|
||||
SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
|
||||
|
||||
DEPEND="
|
||||
btrfs? ( sys-fs/btrfs-progs )
|
||||
seccomp? ( sys-libs/libseccomp )
|
||||
"
|
||||
|
||||
# recommended version of runc is found in script/setup/runc-version
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
~app-containers/runc-1.1.9[apparmor?,seccomp?]
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
# tests require root or docker
|
||||
RESTRICT+="test"
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
sed -i \
|
||||
-e "s/-s -w//" \
|
||||
-e "s/-mod=readonly//" \
|
||||
Makefile || die
|
||||
sed -i \
|
||||
-e "s:/usr/local:/usr:" \
|
||||
containerd.service || die
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usex btrfs "" "no_btrfs")
|
||||
$(usex cri "" "no_cri")
|
||||
$(usex device-mapper "" "no_devmapper")
|
||||
$(usev seccomp)
|
||||
$(usev selinux)
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
|
||||
REVISION="${GIT_REVISION}"
|
||||
VERSION=v${PV}
|
||||
)
|
||||
|
||||
# race condition in man target https://bugs.gentoo.org/765100
|
||||
# we need to explicitly specify GOFLAGS for "go run" to use vendor source
|
||||
emake "${myemakeargs[@]}" man -j1 #nowarn
|
||||
emake "${myemakeargs[@]}" all
|
||||
|
||||
}
|
||||
|
||||
src_install() {
|
||||
rm "${D}"/bin/gen-manpages
|
||||
dobin bin/*
|
||||
doman man/*
|
||||
newconfd "${FILESDIR}"/${PN}.confd "${PN}"
|
||||
newinitd "${FILESDIR}"/${PN}.initd "${PN}"
|
||||
systemd_dounit containerd.service
|
||||
keepdir /var/lib/containerd
|
||||
|
||||
# we already installed manpages, remove markdown source
|
||||
# before installing docs directory
|
||||
rm -r docs/man || die
|
||||
|
||||
local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
@ -0,0 +1,3 @@
|
||||
# This is the delay to be used in the start_post function to wait for
|
||||
# the socket to be active.
|
||||
#containerd_socket_delay=5
|
||||
26
sdk_container/src/third_party/portage-stable/app-containers/containerd/files/containerd.initd
vendored
Normal file
26
sdk_container/src/third_party/portage-stable/app-containers/containerd/files/containerd.initd
vendored
Normal file
@ -0,0 +1,26 @@
|
||||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2020 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
description="Containerd container runtime"
|
||||
command="/usr/bin/containerd"
|
||||
command_args="${command_args:-}"
|
||||
command_background="true"
|
||||
pidfile="${pidfile:-/run/${RC_SVCNAME}.pid}"
|
||||
start_stop_daemon_args="--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log --stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
|
||||
|
||||
start_pre() {
|
||||
checkpath -m 0750 -d "/var/log/${RC_SVCNAME}"
|
||||
|
||||
ulimit -n 1048576
|
||||
|
||||
# Having non-zero limits causes performance problems due to accounting overhead
|
||||
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||
ulimit -u unlimited
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start_post() {
|
||||
ewaitfile ${containerd_socket_delay:-5} /run/containerd/containerd.sock
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<longdescription>
|
||||
Containerd is a daemon with an API and a command line client, to manage
|
||||
@ -8,22 +8,21 @@
|
||||
and user namespace support as well as checkpoint and restore for cloning
|
||||
and live migration of containers.
|
||||
</longdescription>
|
||||
<maintainer type="person">
|
||||
<email>admwiggin@gmail.com</email>
|
||||
<name>Tianon</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>mrueg@gentoo.org</email>
|
||||
<name>Manuel Rüger</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>williamh@gentoo.org</email>
|
||||
<name>William Hubbs</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>gyakovlev@gentoo.org</email>
|
||||
<name>Georgy Yakovlev</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="btrfs">Support for BTRFS snapshot driver</flag>
|
||||
<flag name="cri">Support for Kubernetes CRI</flag>
|
||||
<flag name="device-mapper">Support for device mapper snapshot driver</flag>
|
||||
</use>
|
||||
<upstream>
|
||||
<remote-id type="github">docker/containerd</remote-id>
|
||||
<remote-id type="github">containerd/containerd</remote-id>
|
||||
<remote-id type="cpe">cpe:/a:linuxfoundation:containerd</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
2
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
vendored
Normal file
2
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
DIST cri-tools-1.25.0.tar.gz 7905707 BLAKE2B 79595f31fc22aff608406bad4319a60dddcabda5f4dab8706305f11500b3db43f1d7021a340a096227d4580212953f32a95b05bbf81c1236f8fa8cf635017abb SHA512 dc04359320d59d6b3789e4e81fb613f3795b7e82dbad681393eaeff2c876e5b0393dd9384d7857d24ada5de34d03e151f7cf121367cc20e71d0b78607372b3a1
|
||||
DIST cri-tools-1.27.0.tar.gz 8465050 BLAKE2B d6c0429271ebc4085e75b54d7f3b9f75ab796e63bc9ae7562105296b13bbad8b512293a7d25abf1ab946f4bf54e672016fdb72696c12c730d21ac74724da465c SHA512 b94122e6401eb0c33b9c3d112274b7ab20cbbad05e76a54933e79d2e42ded2d684771cb9ed703a6c1afa381844142b6f1b4dc77d17e915f9a42c236fd8426b9b
|
||||
34
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.25.0.ebuild
vendored
Normal file
34
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.25.0.ebuild
vendored
Normal file
@ -0,0 +1,34 @@
|
||||
# Copyright 2021-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
|
||||
inherit bash-completion-r1 go-module
|
||||
|
||||
DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
|
||||
HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
|
||||
SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm64"
|
||||
|
||||
DEPEND="dev-lang/go"
|
||||
|
||||
RESTRICT+=" test"
|
||||
|
||||
src_compile() {
|
||||
emake VERSION="${PV}"
|
||||
./build/bin/crictl completion bash > "crictl.bash" || die
|
||||
./build/bin/crictl completion zsh > "crictl.zsh" || die
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin ./build/bin/crictl
|
||||
|
||||
newbashcomp crictl.bash crictl
|
||||
insinto /usr/share/zsh/site-functions
|
||||
newins crictl.zsh _crictl
|
||||
|
||||
dodoc -r docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md
|
||||
}
|
||||
33
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.27.0.ebuild
vendored
Normal file
33
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.27.0.ebuild
vendored
Normal file
@ -0,0 +1,33 @@
|
||||
# Copyright 2021-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
inherit bash-completion-r1 go-module
|
||||
|
||||
DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
|
||||
HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
|
||||
SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm64"
|
||||
RESTRICT="test"
|
||||
|
||||
DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
|
||||
|
||||
src_compile() {
|
||||
emake VERSION="${PV}"
|
||||
find build/ -name crictl -exec cp {} build/bin/ \; || die
|
||||
./build/bin/crictl completion bash > "crictl.bash" || die
|
||||
./build/bin/crictl completion zsh > "crictl.zsh" || die
|
||||
}
|
||||
|
||||
src_install() {
|
||||
einstalldocs
|
||||
|
||||
dobin ./build/bin/crictl
|
||||
newbashcomp crictl.bash crictl
|
||||
insinto /usr/share/zsh/site-functions
|
||||
newins crictl.zsh _crictl
|
||||
}
|
||||
4
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
vendored
Normal file
4
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
vendored
Normal file
@ -0,0 +1,4 @@
|
||||
DIST docker-cli-24.0.5-man.tar.xz 82496 BLAKE2B f3295b684dbf8d251ba13a19b9bad9b828fce7d2f76b6643b1cf579cd297b770e8f7304bd3fce823badfbe97e9b760a108b819ca3c760a55e352cf3c5235d815 SHA512 683b0f131902e0a57512207daa49534d73aac6db99dc8621ac6b48eeef26b873e2ba03fe4afe6f1e84c5922e4c60bf0e80e24cc95cdbf2a4953d1c11b80d56ad
|
||||
DIST docker-cli-24.0.5.tar.gz 6243993 BLAKE2B a7ce84ecf329bc74e48f3a6e1b12a9e310a8f27ac68918ffeb40ab9c4eab8b79e753265b48220fcd3ab40b4136de5ebd44607831f642664eaf732111bd8f41b1 SHA512 765c67634d91d248b156d3e407398b98b7a0a89507bbac0310d4a68b95aa1a05e3af43c8b90bc10166748749d8cc36670619fc9efca110beefbdcd4385dc96be
|
||||
DIST docker-cli-24.0.6-man.tar.xz 82600 BLAKE2B 9e39bf200d252a0d91b0b6f17680a4c1b34e55cc9f357a59f124138cef39c5ff10fb104c51efe3010bca9a4f72447764ced1c02e3bb3924051fa6f1f01a8f6fa SHA512 5e972647961899e438b765f53afff570b9f0c1742c7c72a3a424887719c3a6afbd467d15884d44ac64b752c984261967f304afa5c168466fe6f611967d18a578
|
||||
DIST docker-cli-24.0.6.tar.gz 6244014 BLAKE2B c5f2082e44a568d3f6ee2ff5df9e9b727808f0b70d7d0c6c18b9769c1c4d0f49d371cbd08c95e748d441dc0ef011b66446527b0eeb33368ee59b85496185ba12 SHA512 55c56ae08eb314cce5f4c93544c6748586eadb3abe502d39d4d297e14d274af37346b38695a20a91dcfe51d3d35a77ddd7aa69d170b525e5e6ba345161869cd8
|
||||
@ -1,35 +1,36 @@
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
GIT_COMMIT=e78084afe5
|
||||
GIT_COMMIT=ced0996600
|
||||
EGO_PN="github.com/docker/cli"
|
||||
|
||||
COREOS_GO_PACKAGE="${EGO_PN}"
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
|
||||
inherit bash-completion-r1 golang-vcs-snapshot coreos-go-depend
|
||||
MY_PV=${PV/_/-}
|
||||
inherit bash-completion-r1 golang-vcs-snapshot
|
||||
|
||||
DESCRIPTION="the command line binary for docker"
|
||||
HOMEPAGE="https://www.docker.com/"
|
||||
MY_PV=${PV/_/-}
|
||||
SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 arm64"
|
||||
IUSE="hardened"
|
||||
KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
|
||||
IUSE="hardened selinux"
|
||||
|
||||
RDEPEND="!<app-containers/docker-20.10.1"
|
||||
RDEPEND="!<app-containers/docker-20.10.1
|
||||
selinux? ( sec-policy/selinux-docker )"
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.16.6"
|
||||
|
||||
RESTRICT="installsources strip"
|
||||
RESTRICT="installsources strip test"
|
||||
|
||||
S="${WORKDIR}/${P}/src/${EGO_PN}"
|
||||
|
||||
# Flatcar: fix invalid headers issue when building with Go 1.19.11+.
|
||||
PATCHES=(
|
||||
"${FILESDIR}/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch"
|
||||
)
|
||||
src_unpack() {
|
||||
golang-vcs-snapshot_src_unpack
|
||||
set -- ${A}
|
||||
unpack ${2}
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
@ -37,16 +38,12 @@ src_prepare() {
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
# Flatcar: override go version
|
||||
go_export
|
||||
|
||||
export DISABLE_WARN_OUTSIDE_CONTAINER=1
|
||||
export GOPATH="${WORKDIR}/${P}"
|
||||
# setup CFLAGS and LDFLAGS for separate build target
|
||||
# see https://github.com/tianon/docker-overlay/pull/10
|
||||
# FLatcar: inject our own CFLAGS/LDFLAGS for torcx
|
||||
export CGO_CFLAGS="${CGO_CFLAGS} -I${SYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="${CGO_LDFLAGS} -L${SYSROOT}/usr/$(get_libdir)"
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
emake \
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
|
||||
VERSION="${PV}" \
|
||||
@ -56,6 +53,7 @@ src_compile() {
|
||||
|
||||
src_install() {
|
||||
dobin build/docker
|
||||
doman "${WORKDIR}"/man/man?/*
|
||||
dobashcomp contrib/completion/bash/*
|
||||
bashcomp_alias docker dockerd
|
||||
insinto /usr/share/fish/vendor_completions.d/
|
||||
@ -63,3 +61,10 @@ src_install() {
|
||||
insinto /usr/share/zsh/site-functions
|
||||
doins contrib/completion/zsh/_*
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
has_version "app-containers/docker-buildx" && return
|
||||
ewarn "the 'docker build' command is deprecated and will be removed in a"
|
||||
ewarn "future release. If you need this functionality, install"
|
||||
ewarn "app-containers/docker-buildx."
|
||||
}
|
||||
70
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-24.0.6.ebuild
vendored
Normal file
70
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-24.0.6.ebuild
vendored
Normal file
@ -0,0 +1,70 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
GIT_COMMIT=ed223bc820
|
||||
EGO_PN="github.com/docker/cli"
|
||||
MY_PV=${PV/_/-}
|
||||
inherit bash-completion-r1 golang-vcs-snapshot
|
||||
|
||||
DESCRIPTION="the command line binary for docker"
|
||||
HOMEPAGE="https://www.docker.com/"
|
||||
SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
|
||||
IUSE="hardened selinux"
|
||||
|
||||
RDEPEND="!<app-containers/docker-20.10.1
|
||||
selinux? ( sec-policy/selinux-docker )"
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.16.6"
|
||||
|
||||
RESTRICT="installsources strip test"
|
||||
|
||||
S="${WORKDIR}/${P}/src/${EGO_PN}"
|
||||
|
||||
src_unpack() {
|
||||
golang-vcs-snapshot_src_unpack
|
||||
set -- ${A}
|
||||
unpack ${2}
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
export DISABLE_WARN_OUTSIDE_CONTAINER=1
|
||||
export GOPATH="${WORKDIR}/${P}"
|
||||
# setup CFLAGS and LDFLAGS for separate build target
|
||||
# see https://github.com/tianon/docker-overlay/pull/10
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
emake \
|
||||
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
|
||||
VERSION="${PV}" \
|
||||
GITCOMMIT="${GIT_COMMIT}" \
|
||||
dynbinary
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin build/docker
|
||||
doman "${WORKDIR}"/man/man?/*
|
||||
dobashcomp contrib/completion/bash/*
|
||||
bashcomp_alias docker dockerd
|
||||
insinto /usr/share/fish/vendor_completions.d/
|
||||
doins contrib/completion/fish/docker.fish
|
||||
insinto /usr/share/zsh/site-functions
|
||||
doins contrib/completion/zsh/_*
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
has_version "app-containers/docker-buildx" && return
|
||||
ewarn "the 'docker build' command is deprecated and will be removed in a"
|
||||
ewarn "future release. If you need this functionality, install"
|
||||
ewarn "app-containers/docker-buildx."
|
||||
}
|
||||
15
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/metadata.xml
vendored
Normal file
15
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/metadata.xml
vendored
Normal file
@ -0,0 +1,15 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="person">
|
||||
<email>williamh@gentoo.org</email>
|
||||
<name>William Hubbs</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>gyakovlev@gentoo.org</email>
|
||||
<name>Georgy Yakovlev</name>
|
||||
</maintainer>
|
||||
<upstream>
|
||||
<remote-id type="github">docker/cli</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
@ -6,13 +6,6 @@ EGO_PN=github.com/moby/libnetwork
|
||||
GIT_COMMIT=05b93e0d3a95952f70c113b0bc5bdb538d7afdd7
|
||||
inherit golang-vcs-snapshot
|
||||
|
||||
# Flatcar: Add coreos go goo.
|
||||
COREOS_GO_PACKAGE="${EGO_PN}"
|
||||
COREOS_GO_VERSION="go1.19"
|
||||
COREOS_GO_GO111MODULE="off"
|
||||
|
||||
inherit coreos-go
|
||||
|
||||
DESCRIPTION="Docker container networking"
|
||||
HOMEPAGE="https://github.com/docker/libnetwork"
|
||||
SRC_URI="https://github.com/moby/libnetwork/archive/${GIT_COMMIT}.tar.gz -> ${P}.tar.gz"
|
||||
@ -26,13 +19,12 @@ S=${WORKDIR}/${P}/src/${EGO_PN}
|
||||
# needs dockerd
|
||||
RESTRICT="strip test"
|
||||
|
||||
# Flatcar: Rewrite src_compile
|
||||
src_compile() {
|
||||
go_build "${COREOS_GO_PACKAGE}/cmd/proxy"
|
||||
GO111MODULE=auto GOPATH="${WORKDIR}/${P}" \
|
||||
go build -o "bin/docker-proxy" ./cmd/proxy || die
|
||||
}
|
||||
|
||||
# Flatcar: Rewrite src_install
|
||||
src_install() {
|
||||
dobin bin/docker-proxy
|
||||
dodoc README.md CHANGELOG.md
|
||||
newbin "${GOBIN}"/proxy docker-proxy
|
||||
}
|
||||
2
sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
vendored
Normal file
2
sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
DIST docker-24.0.5.tar.gz 14456089 BLAKE2B be13a4256787152cb35ddb96d80e97a5e5b587094f1c61d18158737a037c4e81b88c186098ba7416eb7778022ece07bc31ee55af13d3e3da8e0bbd5452ad027f SHA512 cde2e47e7658b153399ee29154ec21eebf54b292185e07d43b968895dcfdfead95e4507fefb713859a4540f21d8007116d3ebeaa1fb7ba305fb2a0449ba1bee6
|
||||
DIST docker-24.0.6.tar.gz 14462378 BLAKE2B bced8e687abac59254a9969df46f323a835627a724889e5966bea08df8766b4291914442001d1b573280c45ac4d357a673e98e8fba2b8d116a1dbd65424ccf78 SHA512 d9bf0ba756b1ebe69a44819d7c6aa5d66dad8db5bcc41233e2bfce8131334a2fe1af3972de7f602b7911231288d29aaea797b7a05b335c2d7214a613b27c4b63
|
||||
330
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-24.0.5.ebuild
vendored
Normal file
330
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-24.0.5.ebuild
vendored
Normal file
@ -0,0 +1,330 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
EGO_PN=github.com/docker/docker
|
||||
MY_PV=${PV/_/-}
|
||||
inherit linux-info systemd udev golang-vcs-snapshot
|
||||
GIT_COMMIT=4ffc61430bbe6d3d405bdf357b766bf303ff3cc5
|
||||
|
||||
DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
|
||||
HOMEPAGE="https://www.docker.com/"
|
||||
SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs +container-init device-mapper overlay seccomp selinux"
|
||||
|
||||
DEPEND="
|
||||
acct-group/docker
|
||||
>=dev-db/sqlite-3.7.9:3
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
|
||||
device-mapper? ( >=sys-fs/lvm2-2.02.89[thin] )
|
||||
seccomp? ( >=sys-libs/libseccomp-2.2.1 )
|
||||
"
|
||||
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
>=net-firewall/iptables-1.4
|
||||
sys-process/procps
|
||||
>=dev-vcs/git-1.7
|
||||
>=app-arch/xz-utils-4.9
|
||||
dev-libs/libltdl
|
||||
>=app-containers/containerd-1.7.1[apparmor?,btrfs?,device-mapper?,seccomp?]
|
||||
!app-containers/docker-proxy
|
||||
container-init? ( >=sys-process/tini-0.19.0[static] )
|
||||
selinux? ( sec-policy/selinux-docker )
|
||||
"
|
||||
|
||||
# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.16.12
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
# tests require running dockerd as root and downloading containers
|
||||
RESTRICT="installsources strip test"
|
||||
|
||||
S="${WORKDIR}/${P}/src/${EGO_PN}"
|
||||
|
||||
# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
|
||||
PATCHES=(
|
||||
"${FILESDIR}/0001-Openrc-Depend-on-containerd-init-script.patch"
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
# this is based on "contrib/check-config.sh" from upstream's sources
|
||||
# required features.
|
||||
CONFIG_CHECK="
|
||||
~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
|
||||
~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
|
||||
~KEYS
|
||||
~VETH ~BRIDGE ~BRIDGE_NETFILTER
|
||||
~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
|
||||
~NETFILTER_XT_MATCH_ADDRTYPE
|
||||
~NETFILTER_XT_MATCH_CONNTRACK
|
||||
~NETFILTER_XT_MATCH_IPVS
|
||||
~NETFILTER_XT_MARK
|
||||
~IP_NF_NAT ~NF_NAT
|
||||
~POSIX_MQUEUE
|
||||
"
|
||||
WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
|
||||
|
||||
if kernel_is lt 4 8; then
|
||||
CONFIG_CHECK+="
|
||||
~DEVPTS_MULTIPLE_INSTANCES
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 1; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_IPV4
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 2; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_NEEDED
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is ge 4 15; then
|
||||
CONFIG_CHECK+="
|
||||
~CGROUP_BPF
|
||||
"
|
||||
fi
|
||||
|
||||
# optional features
|
||||
CONFIG_CHECK+="
|
||||
~USER_NS
|
||||
"
|
||||
|
||||
if use seccomp; then
|
||||
CONFIG_CHECK+="
|
||||
~SECCOMP ~SECCOMP_FILTER
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~CGROUP_PIDS
|
||||
"
|
||||
|
||||
if kernel_is lt 6 1; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 8; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP_ENABLED
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~!LEGACY_VSYSCALL_NATIVE
|
||||
"
|
||||
if kernel_is lt 5 19; then
|
||||
CONFIG_CHECK+="
|
||||
~LEGACY_VSYSCALL_EMULATE
|
||||
"
|
||||
fi
|
||||
CONFIG_CHECK+="
|
||||
~!LEGACY_VSYSCALL_NONE
|
||||
"
|
||||
WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
|
||||
Containers with <=glibc-2.13 will not work"
|
||||
|
||||
if kernel_is le 4 5; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_KMEM
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 5; then
|
||||
CONFIG_CHECK+="
|
||||
~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~BLK_CGROUP ~BLK_DEV_THROTTLING
|
||||
~CGROUP_PERF
|
||||
~CGROUP_HUGETLB
|
||||
~NET_CLS_CGROUP ~CGROUP_NET_PRIO
|
||||
~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
|
||||
~IP_NF_TARGET_REDIRECT
|
||||
~IP_VS
|
||||
~IP_VS_NFCT
|
||||
~IP_VS_PROTO_TCP
|
||||
~IP_VS_PROTO_UDP
|
||||
~IP_VS_RR
|
||||
"
|
||||
|
||||
if use selinux; then
|
||||
CONFIG_CHECK+="
|
||||
~SECURITY_SELINUX
|
||||
"
|
||||
fi
|
||||
|
||||
if use apparmor; then
|
||||
CONFIG_CHECK+="
|
||||
~SECURITY_APPARMOR
|
||||
"
|
||||
fi
|
||||
|
||||
# if ! is_set EXT4_USE_FOR_EXT2; then
|
||||
# check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
|
||||
# if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
|
||||
# echo " $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
|
||||
# fi
|
||||
# fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
|
||||
"
|
||||
|
||||
# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
|
||||
# if is_set EXT4_USE_FOR_EXT2; then
|
||||
# echo " $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
|
||||
# else
|
||||
# echo " $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
|
||||
# fi
|
||||
# fi
|
||||
|
||||
# network drivers
|
||||
CONFIG_CHECK+="
|
||||
~VXLAN ~BRIDGE_VLAN_FILTERING
|
||||
~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
|
||||
~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
|
||||
"
|
||||
if kernel_is le 5 3; then
|
||||
CONFIG_CHECK+="
|
||||
~INET_XFRM_MODE_TRANSPORT
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~IPVLAN
|
||||
"
|
||||
CONFIG_CHECK+="
|
||||
~MACVLAN ~DUMMY
|
||||
"
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
|
||||
"
|
||||
|
||||
# storage drivers
|
||||
if use btrfs; then
|
||||
CONFIG_CHECK+="
|
||||
~BTRFS_FS
|
||||
~BTRFS_FS_POSIX_ACL
|
||||
"
|
||||
fi
|
||||
|
||||
if use device-mapper; then
|
||||
CONFIG_CHECK+="
|
||||
~BLK_DEV_DM ~DM_THIN_PROVISIONING
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~OVERLAY_FS
|
||||
"
|
||||
|
||||
linux-info_pkg_setup
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
export DOCKER_GITCOMMIT="${GIT_COMMIT}"
|
||||
export GOPATH="${WORKDIR}/${P}"
|
||||
export VERSION=${PV}
|
||||
|
||||
# setup CFLAGS and LDFLAGS for separate build target
|
||||
# see https://github.com/tianon/docker-overlay/pull/10
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# let's set up some optional features :)
|
||||
export DOCKER_BUILDTAGS=''
|
||||
for gd in btrfs device-mapper overlay; do
|
||||
if ! use $gd; then
|
||||
DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
|
||||
fi
|
||||
done
|
||||
|
||||
for tag in apparmor seccomp; do
|
||||
if use $tag; then
|
||||
DOCKER_BUILDTAGS+=" $tag"
|
||||
fi
|
||||
done
|
||||
|
||||
# build binaries
|
||||
./hack/make.sh dynbinary || die 'dynbinary failed'
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dosym containerd /usr/bin/docker-containerd
|
||||
dosym containerd-shim /usr/bin/docker-containerd-shim
|
||||
dosym runc /usr/bin/docker-runc
|
||||
use container-init && dosym tini /usr/bin/docker-init
|
||||
dobin bundles/dynbinary-daemon/dockerd
|
||||
dobin bundles/dynbinary-daemon/docker-proxy
|
||||
|
||||
newinitd contrib/init/openrc/docker.initd docker
|
||||
newconfd contrib/init/openrc/docker.confd docker
|
||||
|
||||
systemd_dounit contrib/init/systemd/docker.{service,socket}
|
||||
|
||||
udev_dorules contrib/udev/*.rules
|
||||
|
||||
dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
|
||||
dodoc -r docs/*
|
||||
|
||||
# note: intentionally not using "doins" so that we preserve +x bits
|
||||
dodir /usr/share/${PN}/contrib
|
||||
cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
udev_reload
|
||||
|
||||
elog
|
||||
elog "To use Docker, the Docker daemon must be running as root. To automatically"
|
||||
elog "start the Docker daemon at boot:"
|
||||
if systemd_is_booted || has_version sys-apps/systemd; then
|
||||
elog " systemctl enable docker.service"
|
||||
else
|
||||
elog " rc-update add docker default"
|
||||
fi
|
||||
elog
|
||||
elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
|
||||
elog ' usermod -aG docker <youruser>'
|
||||
elog
|
||||
|
||||
if use device-mapper; then
|
||||
elog " Devicemapper storage driver has been deprecated"
|
||||
elog " It will be removed in a future release"
|
||||
elog
|
||||
fi
|
||||
|
||||
if use overlay; then
|
||||
elog " Overlay storage driver/USEflag has been deprecated"
|
||||
elog " in favor of overlay2 (enabled unconditionally)"
|
||||
elog
|
||||
fi
|
||||
|
||||
if has_version sys-fs/zfs; then
|
||||
elog " ZFS storage driver is available"
|
||||
elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
|
||||
elog
|
||||
fi
|
||||
}
|
||||
|
||||
pkg_postrm() {
|
||||
udev_reload
|
||||
}
|
||||
331
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-24.0.6.ebuild
vendored
Normal file
331
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-24.0.6.ebuild
vendored
Normal file
@ -0,0 +1,331 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
EGO_PN=github.com/docker/docker
|
||||
MY_PV=${PV/_/-}
|
||||
inherit linux-info systemd udev golang-vcs-snapshot
|
||||
GIT_COMMIT=1a7969545d73537545645f5cd2c79b7a77e7d39f
|
||||
|
||||
DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
|
||||
HOMEPAGE="https://www.docker.com/"
|
||||
SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor btrfs +container-init device-mapper overlay seccomp selinux"
|
||||
|
||||
DEPEND="
|
||||
acct-group/docker
|
||||
>=dev-db/sqlite-3.7.9:3
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
|
||||
device-mapper? ( >=sys-fs/lvm2-2.02.89[thin] )
|
||||
seccomp? ( >=sys-libs/libseccomp-2.2.1 )
|
||||
"
|
||||
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
|
||||
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
>=net-firewall/iptables-1.4
|
||||
sys-process/procps
|
||||
>=dev-vcs/git-1.7
|
||||
>=app-arch/xz-utils-4.9
|
||||
dev-libs/libltdl
|
||||
>=app-containers/containerd-1.7.3[apparmor?,btrfs?,device-mapper?,seccomp?]
|
||||
>=app-containers/runc-1.1.9[apparmor?,seccomp?]
|
||||
!app-containers/docker-proxy
|
||||
container-init? ( >=sys-process/tini-0.19.0[static] )
|
||||
selinux? ( sec-policy/selinux-docker )
|
||||
"
|
||||
|
||||
# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.16.12
|
||||
dev-go/go-md2man
|
||||
virtual/pkgconfig
|
||||
"
|
||||
# tests require running dockerd as root and downloading containers
|
||||
RESTRICT="installsources strip test"
|
||||
|
||||
S="${WORKDIR}/${P}/src/${EGO_PN}"
|
||||
|
||||
# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
|
||||
PATCHES=(
|
||||
"${FILESDIR}/0001-Openrc-Depend-on-containerd-init-script.patch"
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
# this is based on "contrib/check-config.sh" from upstream's sources
|
||||
# required features.
|
||||
CONFIG_CHECK="
|
||||
~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
|
||||
~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
|
||||
~KEYS
|
||||
~VETH ~BRIDGE ~BRIDGE_NETFILTER
|
||||
~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
|
||||
~NETFILTER_XT_MATCH_ADDRTYPE
|
||||
~NETFILTER_XT_MATCH_CONNTRACK
|
||||
~NETFILTER_XT_MATCH_IPVS
|
||||
~NETFILTER_XT_MARK
|
||||
~IP_NF_NAT ~NF_NAT
|
||||
~POSIX_MQUEUE
|
||||
"
|
||||
WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
|
||||
|
||||
if kernel_is lt 4 8; then
|
||||
CONFIG_CHECK+="
|
||||
~DEVPTS_MULTIPLE_INSTANCES
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 1; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_IPV4
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 2; then
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_NEEDED
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is ge 4 15; then
|
||||
CONFIG_CHECK+="
|
||||
~CGROUP_BPF
|
||||
"
|
||||
fi
|
||||
|
||||
# optional features
|
||||
CONFIG_CHECK+="
|
||||
~USER_NS
|
||||
"
|
||||
|
||||
if use seccomp; then
|
||||
CONFIG_CHECK+="
|
||||
~SECCOMP ~SECCOMP_FILTER
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~CGROUP_PIDS
|
||||
"
|
||||
|
||||
if kernel_is lt 6 1; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is le 5 8; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_SWAP_ENABLED
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~!LEGACY_VSYSCALL_NATIVE
|
||||
"
|
||||
if kernel_is lt 5 19; then
|
||||
CONFIG_CHECK+="
|
||||
~LEGACY_VSYSCALL_EMULATE
|
||||
"
|
||||
fi
|
||||
CONFIG_CHECK+="
|
||||
~!LEGACY_VSYSCALL_NONE
|
||||
"
|
||||
WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
|
||||
Containers with <=glibc-2.13 will not work"
|
||||
|
||||
if kernel_is le 4 5; then
|
||||
CONFIG_CHECK+="
|
||||
~MEMCG_KMEM
|
||||
"
|
||||
fi
|
||||
|
||||
if kernel_is lt 5; then
|
||||
CONFIG_CHECK+="
|
||||
~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~BLK_CGROUP ~BLK_DEV_THROTTLING
|
||||
~CGROUP_PERF
|
||||
~CGROUP_HUGETLB
|
||||
~NET_CLS_CGROUP ~CGROUP_NET_PRIO
|
||||
~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
|
||||
~IP_NF_TARGET_REDIRECT
|
||||
~IP_VS
|
||||
~IP_VS_NFCT
|
||||
~IP_VS_PROTO_TCP
|
||||
~IP_VS_PROTO_UDP
|
||||
~IP_VS_RR
|
||||
"
|
||||
|
||||
if use selinux; then
|
||||
CONFIG_CHECK+="
|
||||
~SECURITY_SELINUX
|
||||
"
|
||||
fi
|
||||
|
||||
if use apparmor; then
|
||||
CONFIG_CHECK+="
|
||||
~SECURITY_APPARMOR
|
||||
"
|
||||
fi
|
||||
|
||||
# if ! is_set EXT4_USE_FOR_EXT2; then
|
||||
# check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
|
||||
# if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
|
||||
# echo " $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
|
||||
# fi
|
||||
# fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
|
||||
"
|
||||
|
||||
# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
|
||||
# if is_set EXT4_USE_FOR_EXT2; then
|
||||
# echo " $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
|
||||
# else
|
||||
# echo " $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
|
||||
# fi
|
||||
# fi
|
||||
|
||||
# network drivers
|
||||
CONFIG_CHECK+="
|
||||
~VXLAN ~BRIDGE_VLAN_FILTERING
|
||||
~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
|
||||
~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
|
||||
"
|
||||
if kernel_is le 5 3; then
|
||||
CONFIG_CHECK+="
|
||||
~INET_XFRM_MODE_TRANSPORT
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~IPVLAN
|
||||
"
|
||||
CONFIG_CHECK+="
|
||||
~MACVLAN ~DUMMY
|
||||
"
|
||||
CONFIG_CHECK+="
|
||||
~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
|
||||
"
|
||||
|
||||
# storage drivers
|
||||
if use btrfs; then
|
||||
CONFIG_CHECK+="
|
||||
~BTRFS_FS
|
||||
~BTRFS_FS_POSIX_ACL
|
||||
"
|
||||
fi
|
||||
|
||||
if use device-mapper; then
|
||||
CONFIG_CHECK+="
|
||||
~BLK_DEV_DM ~DM_THIN_PROVISIONING
|
||||
"
|
||||
fi
|
||||
|
||||
CONFIG_CHECK+="
|
||||
~OVERLAY_FS
|
||||
"
|
||||
|
||||
linux-info_pkg_setup
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
export DOCKER_GITCOMMIT="${GIT_COMMIT}"
|
||||
export GOPATH="${WORKDIR}/${P}"
|
||||
export VERSION=${PV}
|
||||
|
||||
# setup CFLAGS and LDFLAGS for separate build target
|
||||
# see https://github.com/tianon/docker-overlay/pull/10
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# let's set up some optional features :)
|
||||
export DOCKER_BUILDTAGS=''
|
||||
for gd in btrfs device-mapper overlay; do
|
||||
if ! use $gd; then
|
||||
DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
|
||||
fi
|
||||
done
|
||||
|
||||
for tag in apparmor seccomp; do
|
||||
if use $tag; then
|
||||
DOCKER_BUILDTAGS+=" $tag"
|
||||
fi
|
||||
done
|
||||
|
||||
# build binaries
|
||||
./hack/make.sh dynbinary || die 'dynbinary failed'
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dosym containerd /usr/bin/docker-containerd
|
||||
dosym containerd-shim /usr/bin/docker-containerd-shim
|
||||
dosym runc /usr/bin/docker-runc
|
||||
use container-init && dosym tini /usr/bin/docker-init
|
||||
dobin bundles/dynbinary-daemon/dockerd
|
||||
dobin bundles/dynbinary-daemon/docker-proxy
|
||||
|
||||
newinitd contrib/init/openrc/docker.initd docker
|
||||
newconfd contrib/init/openrc/docker.confd docker
|
||||
|
||||
systemd_dounit contrib/init/systemd/docker.{service,socket}
|
||||
|
||||
udev_dorules contrib/udev/*.rules
|
||||
|
||||
dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
|
||||
dodoc -r docs/*
|
||||
|
||||
# note: intentionally not using "doins" so that we preserve +x bits
|
||||
dodir /usr/share/${PN}/contrib
|
||||
cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
udev_reload
|
||||
|
||||
elog
|
||||
elog "To use Docker, the Docker daemon must be running as root. To automatically"
|
||||
elog "start the Docker daemon at boot:"
|
||||
if systemd_is_booted || has_version sys-apps/systemd; then
|
||||
elog " systemctl enable docker.service"
|
||||
else
|
||||
elog " rc-update add docker default"
|
||||
fi
|
||||
elog
|
||||
elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
|
||||
elog ' usermod -aG docker <youruser>'
|
||||
elog
|
||||
|
||||
if use device-mapper; then
|
||||
elog " Devicemapper storage driver has been deprecated"
|
||||
elog " It will be removed in a future release"
|
||||
elog
|
||||
fi
|
||||
|
||||
if use overlay; then
|
||||
elog " Overlay storage driver/USEflag has been deprecated"
|
||||
elog " in favor of overlay2 (enabled unconditionally)"
|
||||
elog
|
||||
fi
|
||||
|
||||
if has_version sys-fs/zfs; then
|
||||
elog " ZFS storage driver is available"
|
||||
elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
|
||||
elog
|
||||
fi
|
||||
}
|
||||
|
||||
pkg_postrm() {
|
||||
udev_reload
|
||||
}
|
||||
@ -0,0 +1,28 @@
|
||||
From bb69104381805014eb7675682d204fe460a52388 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Breig <git@pygos.space>
|
||||
Date: Mon, 16 May 2022 14:58:36 +0200
|
||||
Subject: [PATCH] Openrc: Depend on containerd init script
|
||||
|
||||
Signed-off-by: Jan Breig <git@pygos.space>
|
||||
---
|
||||
contrib/init/openrc/docker.initd | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/contrib/init/openrc/docker.initd b/contrib/init/openrc/docker.initd
|
||||
index 3229223bad..57defb8f57 100644
|
||||
--- a/contrib/init/openrc/docker.initd
|
||||
+++ b/contrib/init/openrc/docker.initd
|
||||
@@ -17,6 +17,10 @@ rc_ulimit="${DOCKER_ULIMIT:--c unlimited -n 1048576 -u unlimited}"
|
||||
|
||||
retry="${DOCKER_RETRY:-TERM/60/KILL/10}"
|
||||
|
||||
+depend() {
|
||||
+ need containerd
|
||||
+}
|
||||
+
|
||||
start_pre() {
|
||||
checkpath -f -m 0644 -o root:docker "$DOCKER_LOGFILE"
|
||||
}
|
||||
--
|
||||
2.35.1
|
||||
|
||||
@ -17,19 +17,9 @@
|
||||
<name>Georgy Yakovlev</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="aufs">
|
||||
Enables dependencies for the "aufs" graph driver, including
|
||||
necessary kernel flags.
|
||||
</flag>
|
||||
<flag name="btrfs">
|
||||
Enables dependencies for the "btrfs" graph driver, including
|
||||
necessary kernel flags.
|
||||
</flag>
|
||||
<flag name="cli">
|
||||
This is a temporary use flag which pulls in
|
||||
<pkg>app-containers/docker-cli</pkg>, the docker command line client.
|
||||
This flag is here to assist in the transition to split packages
|
||||
and will be removed in a future release.
|
||||
</flag>
|
||||
<flag name="container-init">
|
||||
Makes the a staticly-linked init system tini available inside a
|
||||
2
sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
vendored
Normal file
2
sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
DIST runc-1.1.7.tar.gz 2511464 BLAKE2B 63f09052659636b62185abbb178f7e104d22125190899e80e71ed2ba35567eb855abf786d3c7fff3dd9a1ab43ee282fcaecb6650cd8a1ce49c05acefd7c12cde SHA512 e3a18f04ac2c3553a815074ca64e04cfd71af54d78edbd4a13819f187476f96d7311c23bb63fb5c311b91865db4540985a6f9daa84819b0bac5f023b3b2a832c
|
||||
DIST runc-1.1.9.tar.gz 2512231 BLAKE2B 4e8e2a454231492f83de34bf66ba25a02b8925b6ef0af2206cdf4ab3299173d3452cea4d51fcfeb02026df288dd8ca6c44ecd35fb075f25f56fd7bc07f873af7 SHA512 020986f2df49c45394d0acbfa4da62663353004550d9b4409f6cfe8369972a090fb8020e4a05342754bde5c1fbe9fcf3868faed2dceed5d54460c3373cdd2278
|
||||
25
sdk_container/src/third_party/portage-stable/app-containers/runc/metadata.xml
vendored
Normal file
25
sdk_container/src/third_party/portage-stable/app-containers/runc/metadata.xml
vendored
Normal file
@ -0,0 +1,25 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<longdescription lang="en">
|
||||
runc is a CLI tool for spawning and running containers according
|
||||
to the OCF (Open Container Format) specification.
|
||||
</longdescription>
|
||||
<maintainer type="person">
|
||||
<email>williamh@gentoo.org</email>
|
||||
<name>William Hubbs</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>gyakovlev@gentoo.org</email>
|
||||
<name>Georgy Yakovlev</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="kmem">
|
||||
Enable Kernel Memory Accounting.
|
||||
</flag>
|
||||
</use>
|
||||
<upstream>
|
||||
<remote-id type="github">opencontainers/runc</remote-id>
|
||||
<remote-id type="cpe">cpe:/a:linuxfoundation:runc</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
78
sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.7.ebuild
vendored
Normal file
78
sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.7.ebuild
vendored
Normal file
@ -0,0 +1,78 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module linux-info
|
||||
|
||||
# update on bump, look for https://github.com/docker\
|
||||
# docker-ce/blob/<docker ver OR branch>/components/engine/hack/dockerfile/install/runc.installer
|
||||
RUNC_COMMIT=4ffc61430bbe6d3d405bdf357b766bf303ff3cc5
|
||||
CONFIG_CHECK="~USER_NS"
|
||||
|
||||
DESCRIPTION="runc container cli tools"
|
||||
HOMEPAGE="http://github.com/opencontainers/runc/"
|
||||
MY_PV="${PV/_/-}"
|
||||
SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0 BSD-2 BSD MIT"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor hardened +kmem +seccomp selinux test"
|
||||
|
||||
DEPEND="seccomp? ( sys-libs/libseccomp )"
|
||||
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
!app-emulation/docker-runc
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
selinux? ( sec-policy/selinux-container )
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
test? ( "${RDEPEND}" )
|
||||
"
|
||||
|
||||
# tests need busybox binary, and portage namespace
|
||||
# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
|
||||
# majority of tests pass
|
||||
RESTRICT+=" test"
|
||||
|
||||
S="${WORKDIR}/${PN}-${MY_PV}"
|
||||
|
||||
src_compile() {
|
||||
# Taken from app-containers/docker-1.7.0-r1
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')
|
||||
-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# build up optional flags
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usev seccomp)
|
||||
$(usex kmem '' 'nokmem')
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
COMMIT="${RUNC_COMMIT}"
|
||||
)
|
||||
|
||||
emake "${myemakeargs[@]}" runc man
|
||||
}
|
||||
|
||||
src_install() {
|
||||
myemakeargs+=(
|
||||
PREFIX="${ED}/usr"
|
||||
BINDIR="${ED}/usr/bin"
|
||||
MANDIR="${ED}/usr/share/man"
|
||||
)
|
||||
emake "${myemakeargs[@]}" install install-man install-bash
|
||||
|
||||
local DOCS=( README.md PRINCIPLES.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
|
||||
src_test() {
|
||||
emake "${myemakeargs[@]}" localunittest
|
||||
}
|
||||
78
sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.9.ebuild
vendored
Normal file
78
sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.9.ebuild
vendored
Normal file
@ -0,0 +1,78 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module linux-info
|
||||
|
||||
# update on bump, look for https://github.com/docker\
|
||||
# docker-ce/blob/<docker ver OR branch>/components/engine/hack/dockerfile/install/runc.installer
|
||||
RUNC_COMMIT=ccaecfcbc907d70a7aa870a6650887b901b25b82
|
||||
CONFIG_CHECK="~USER_NS"
|
||||
|
||||
DESCRIPTION="runc container cli tools"
|
||||
HOMEPAGE="http://github.com/opencontainers/runc/"
|
||||
MY_PV="${PV/_/-}"
|
||||
SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0 BSD-2 BSD MIT"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
|
||||
IUSE="apparmor hardened +kmem +seccomp selinux test"
|
||||
|
||||
DEPEND="seccomp? ( sys-libs/libseccomp )"
|
||||
|
||||
RDEPEND="
|
||||
${DEPEND}
|
||||
!app-emulation/docker-runc
|
||||
apparmor? ( sys-libs/libapparmor )
|
||||
selinux? ( sec-policy/selinux-container )
|
||||
"
|
||||
|
||||
BDEPEND="
|
||||
dev-go/go-md2man
|
||||
test? ( "${RDEPEND}" )
|
||||
"
|
||||
|
||||
# tests need busybox binary, and portage namespace
|
||||
# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
|
||||
# majority of tests pass
|
||||
RESTRICT+=" test"
|
||||
|
||||
S="${WORKDIR}/${PN}-${MY_PV}"
|
||||
|
||||
src_compile() {
|
||||
# Taken from app-containers/docker-1.7.0-r1
|
||||
export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
|
||||
export CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')
|
||||
-L${ESYSROOT}/usr/$(get_libdir)"
|
||||
|
||||
# build up optional flags
|
||||
local options=(
|
||||
$(usev apparmor)
|
||||
$(usev seccomp)
|
||||
$(usex kmem '' 'nokmem')
|
||||
)
|
||||
|
||||
myemakeargs=(
|
||||
BUILDTAGS="${options[*]}"
|
||||
COMMIT="${RUNC_COMMIT}"
|
||||
)
|
||||
|
||||
emake "${myemakeargs[@]}" runc man
|
||||
}
|
||||
|
||||
src_install() {
|
||||
myemakeargs+=(
|
||||
PREFIX="${ED}/usr"
|
||||
BINDIR="${ED}/usr/bin"
|
||||
MANDIR="${ED}/usr/share/man"
|
||||
)
|
||||
emake "${myemakeargs[@]}" install install-man install-bash
|
||||
|
||||
local DOCS=( README.md PRINCIPLES.md docs/. )
|
||||
einstalldocs
|
||||
}
|
||||
|
||||
src_test() {
|
||||
emake "${myemakeargs[@]}" localunittest
|
||||
}
|
||||
1
sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
vendored
Normal file
1
sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
vendored
Normal file
@ -0,0 +1 @@
|
||||
DIST go-md2man-2.0.2.tar.gz 64353 BLAKE2B cc9ce9d14b61e600cf5179b72e08bc7e6ae5fcf31d3e00d6e5f7e5e77a26dd2b2b8a938e168e0053b2a9f9aab734d9beb02f7d95549fbf073125ad42b03cf478 SHA512 c81edfdc0b6647ef699cc908a1a7038d98da34df6d48b223b83a0699de91a7e322e70d67645acf1fc848918f4c1ea310160c7ccb75e6f97b53af7103c7aa18b3
|
||||
32
sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.2.ebuild
vendored
Normal file
32
sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.2.ebuild
vendored
Normal file
@ -0,0 +1,32 @@
|
||||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
inherit go-module
|
||||
|
||||
DESCRIPTION="A utility to convert markdown to man pages"
|
||||
SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
HOMEPAGE="https://github.com/cpuguy83/go-md2man"
|
||||
|
||||
LICENSE="BSD-2 MIT"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
|
||||
|
||||
# restrict tests because they need network-sandbox disabled
|
||||
# bug https://bugs.gentoo.org/715028
|
||||
RESTRICT+=" test"
|
||||
|
||||
src_compile() {
|
||||
emake BUILD_FLAGS="-mod=vendor" build
|
||||
}
|
||||
|
||||
src_install() {
|
||||
"${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1 ||
|
||||
die "Unable to create man page"
|
||||
dobin bin/go-md2man
|
||||
doman go-md2man.1
|
||||
}
|
||||
|
||||
src_test() {
|
||||
emake test
|
||||
}
|
||||
@ -1,8 +1,11 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="person">
|
||||
<email>williamh@gentoo.org</email>
|
||||
<name>William Hubbs</name>
|
||||
</maintainer>
|
||||
<upstream>
|
||||
<remote-id type="github">cpuguy83/go-md2man</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
Loading…
Reference in New Issue
Block a user