docker-25.0.6_ce-150000.207.1 < > , T| fp9| 4@צMN,F$5+/2EWICz)ZNةog`:* {;Ǔ2vRXÑ ̸PO*+'%rQzF&TASqm:xS*'PXdȏQqOR+W2"-5.ӞbgԪƤ}`$*ipx bxծau?`/ y 6inK7`I=~
$ > L Et ? Ed d I / A V \ b j . x
d R
S W [2 _L _t b c , c , f , ( g` 8 gh 9 k : E = > ? @ B F + G @ H I X Y Z [ \ $ ] !l ^ 3v b 4 c 5 d 6 e 6 f 6 l 6 u 6 v 9h w =| x @ y D $ z D D D D E E E E` C docker 25.0.6_ce 150000.207.1 The Moby-project Linux container runtime Docker complements LXC with a high-level API which operates at the process
level. It runs unix processes with strong guarantees of isolation and
repeatability across servers.
Docker is a great building block for automating distributed systems: large-scale
web deployments, database clusters, continuous deployment systems, private PaaS,
service-oriented architectures, etc. fs390zp35
SUSE Linux Enterprise 15 SUSE LLC Apache-2.0 https://www.suse.com/ System/Management http://www.docker.io linux s390x # /etc/sub[ug]id should exist already (it's part of shadow-utils), but older
# distros don't have it. Docker just parses it and doesn't need any special
# shadow-utils helpers.
touch /etc/subuid /etc/subgid ||:
# "useradd -r" doesn't add sub[ug]ids so we manually add some. Hopefully there
# aren't any conflicts here, because usermod doesn't provide the same "get
# unusued range" feature that dockremap does.
grep -q '^dockremap:' /etc/subuid || \
usermod -v 100000000-200000000 dockremap &>/dev/null || \
echo "dockremap:100000000:100000001" >>/etc/subuid ||:
grep -q '^dockremap:' /etc/subgid || \
usermod -w 100000000-200000000 dockremap &>/dev/null || \
echo "dockremap:100000000:100000001" >>/etc/subgid ||:
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
for service in docker.service docker.socket ; do
sysv_service=${service%.*}
if [ ! -e /usr/lib/systemd/system/$service ] &&
[ ! -e /etc/init.d/$sysv_service ]; then
mkdir -p /run/systemd/rpm/needs-preset
touch /run/systemd/rpm/needs-preset/$service
elif [ -e /etc/init.d/$sysv_service ] &&
[ ! -e /var/lib/systemd/migrated/$sysv_service ]; then
/usr/sbin/systemd-sysv-convert --save $sysv_service || :
mkdir -p /run/systemd/rpm/needs-sysv-convert
touch /run/systemd/rpm/needs-sysv-convert/$service
fi
done
fi
#!/bin/bash
tail -n 2 $0 | /usr/sbin/sysusers2shadow
RET=$?
test -f /.buildenv && exit 0
exit $RET
######## data below ########
g docker - - - -
u dockremap - 'docker --userns-remap=default' - -
if [ -x /usr/bin/systemctl ]; then
test -n "$FIRST_ARG" || FIRST_ARG="$1"
[ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || :
if [ "$YAST_IS_RUNNING" != "instsys" ]; then
/usr/bin/systemctl daemon-reload || :
fi
for service in docker.service docker.socket ; do
sysv_service=${service%.*}
if [ -e /run/systemd/rpm/needs-preset/$service ]; then
/usr/bin/systemctl preset $service || :
rm "/run/systemd/rpm/needs-preset/$service" || :
elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then
/usr/sbin/systemd-sysv-convert --apply $sysv_service || :
rm "/run/systemd/rpm/needs-sysv-convert/$service" || :
touch /var/lib/systemd/migrated/$sysv_service || :
fi
done
fi
PNAME=docker
SUBPNAME=
SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME
# If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR
if [ ! -f $SYSC_TEMPLATE ] ; then
TEMPLATE_DIR=/var/adm/fillup-templates
SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME
fi
SD_NAME=""
if [ -x /bin/fillup ] ; then
if [ -f $SYSC_TEMPLATE ] ; then
echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..."
mkdir -p /etc/sysconfig/$SD_NAME
touch /etc/sysconfig/$SD_NAME$PNAME
/bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE
fi
else
echo "ERROR: fillup not found. This should not happen. Please compare"
echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and"
echo "update by hand."
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then
# Package removal, not upgrade
/usr/bin/systemctl --no-reload disable docker.service docker.socket || :
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services
test "$DISABLE_STOP_ON_REMOVAL" = yes -o \
"$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0
/usr/bin/systemctl stop docker.service docker.socket
) || :
fi
test -n "$FIRST_ARG" || FIRST_ARG="$1"
if [ $1 -eq 0 ]; then
# Package removal
for service in docker.service docker.socket ; do
sysv_service="${service%.*}"
rm -f "/var/lib/systemd/migrated/$sysv_service" || :
done
fi
if [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl daemon-reload || :
fi
if [ "$FIRST_ARG" -ge 1 ]; then
# Package upgrade, not uninstall
if [ -x /usr/bin/systemctl ]; then
(
test "$YAST_IS_RUNNING" = instsys && exit 0
test -f /etc/sysconfig/services -a \
-z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services
test "$DISABLE_RESTART_ON_UPDATE" = yes -o \
"$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0
/usr/bin/systemctl try-restart docker.service docker.socket
) || :
fi
fi w` !BZh Y
D *
z % h = p ! H % N 2 S * < I
f [ d z A
/ 6 ~ B 3 % & < ' z 5 x W E R 2 > 8 1 ) E W E j % s U V = b . @ < 1 L 4 N ' ? )
[
0 '
= } J G % Z ` 9 A큤AA큤A큤A큤A ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa96c13aa62dba0ba72e422703eba9ae57bb381c0793e49cd51fc1f056b150155 599528952f4d49459aab811fbc75b2f76c52ee74e975681df49af8aad416d0e7 ba606c3782771b21f44cb3ef41da4b88a09fbe837208c20eb74d86b88fe73387 a4f57865833837ca37a3c01997512b4b30962955a745647bb4912de657046966 33c022964a4aaf4b485d03c271c756b97424c95f7aa3e05cd41a7ba87fe5a817 33ed636b0a4625ba1d2c9ccbc9c0f6310f9273810b041e5e50dad92f2d55b850 b14e0057afa4ac1e691116f48cbe8f89ff62bc319f02a7850624273013aebb3d 2778d52ceb07f545bee4a36f2de7d278b8d1b3f522d35a8d46b685eac0e19366 c288873fc1cbcddeb816ff1f7914339f69555ac4c5e147dbc61692d82b0c48cd e5af37e16b3ed9f4d3afca28e628c4f15c9053a902f80bec2c1a6109a7a1ae6c e79e09781c56252b74e90b4113e19ff8b6e14044adc1af2f4a6aa40372742c79 b35cd2f6ea1d7f69576c38b07420e091600a69744c5cea2a32a710fb91abf231 7c87873291f289713ac5df48b1f2010eb6963752bbd6b530416ab99fc37914a8 43e7eba231ccf1b15e748ec184d36e73c4cbbfc272f80c655bf8dd956c2d0fbe 02f8f955657b832a716becd4776487a6510bf996ce534e9b7c297d9298c4e72b a7e79b6ff4ddb38e0491b16e6327d38a3b789932fd380413d3f9069ec98a5d9f ffd4b10027b18aa33060bab475275890d451a58977d300458ebe7c43052bfdb9 edab23ff88c820591df34b1575025578cec30769d68f3dd02bccd1567ec9b372 dd47308db65339be53147c52a1ef4263bc905f40942a815a311a5b6d32a5d603 682abd657b7cb9a2e1bfa2c84fa6a26e29ff4fa87cac2afc09683c4b5fb8bf45 c9664f93180b6989c745b05ec488c4ff2265ab11800c8c113344aabc0b5b268a 993618a74050d1f75f8097e058dcb9d572c3f6dd2d701ba4f8608ed7474f1be1 71c72b07e0ba4a05b45db6d144dbfd3c93ad41586af27947ff7185516d5bcab4 e31b4788e59ffe8bbecaa7c904c9228f398da121231ce0d29eeabae4873c5359 70ef4859d99e919f1a406a94f2a637cb9383a118efb38eb60468c86167c45fb7 7e45a7100be2587eb2b43b18e74bb19c7eb63b7120bec5e3d36609f00642e3b9 8daacce6b6b69569851f95265c31d104802c353a37bd5d3d5c95d7207ff1d632 226ab33e8acf9a8aee89edcd65ff98dc6b7f1476337f9dbf55b5105f07d455aa 698668385def8faaf593579429775d39f0b85c8ba2a38d9a955ebc404110367b 0b303866e58033d7d1a58eb52a43d55832b7e54c510e16c2f4be66160a5f8e5b 73f4e0f2fd7f674966dd2f06d6b26a081565e2f28369001baafc9e6826c28010 81ecd32c13565aa01eb90ebe0873c1dab1d999574a09ff4a176ac4892bf23450 e8ffab92d0c632f855e272ba6c16b3ecf6d128d24591ed4a18e7c34b75814745 995872296c8a6bad8ff4b0e5a7b4a5038a5c1338414c8a79a1356d5b5caf0193 8f5a374592aea6647c270de23f46cf7114aba37e24bc23d228653e392a429d0c d846b15ded2ac6674393378357f9e995efe08c709dd60661c2b07abce28ec7f1 4e0448000d149fb4cec39df658b344e4f6818ea4a28fc14b5dcf2c299684b167 79f8cdc2b99c2d67b0823d2bf869cfedb96b7ab024159fdb596c0c4aeae3a30d 1141658206a941e7c7f5981be94f914b58c3c30424822d8aada94dd939bedb02 c6e6d49e2337e733e383225bcb3f626692108f14017cbbb8b6596e560b0e37f7 6f959f381dffe17175e9826c903a4819b1973ff7aae7318ed148437ab4f280c9 bb9d64d3d122626c3c81cf13ae0e257384aecad5a9de354639af1c16bff2ae37 c69a5f94b1da46aaf25456269c9ce62b83bb619700031468f5c622ec58fc83b1 bedaaa0f603a77ffcd75d4e7e3d689b8538152638757055a19e2f918a21a2676 cdb3898f858fe49bc5edeeea1ec0502232dbeb1b6162d4eba152431557ae0997 a5e197e9515befa90921025499a8a090fdadaf78ef8477028ef35ce2ae7ff920 6d528c53529b0e1d79b305f5c61d5f1507a87d36421bfb9673788901cd962f23 f648cdd4c6ce10420552b96194de4a737729b755b05f579b8d16151cfc7e15e8 b4fed662a4593085a06a74644a9bf6a4e9fa740328cfe0d5ec7d72a6e40e8733 b57933a56de60f0614f6297581b9181d9d78b4492b04b2b9695cc8291c2aeafe 8c04cb9807f5f553a714adc466a779c9545b7d4e776dcc3c36a29e583fc0bd34 bf6848211c6444cba9789e52c077416c4ae32a6ada4b6c9f5efb4593572bfe4e 19b46358cd148a4ee1137d499fe51cb72999174153d4045f75cb6a782870331c 863bfd9b2176b9929d972d26c16d101d102962ec003ba9b32a6e90167c960709 d69eec5f1d3d1058f9ff2532742f5445a53443e0a0ba963619241de72ffd0a7f 3edf473ea39ab87ac9370ff473f04eb986373687e9c1998fcc0dbd4c4bb5c5eb 1768d5ad9c976fa35a7c94d52e49a987c84e2ebcd01ed27053191126adfcd033 bee700555c24ce78eee7a3f70c692c55b17c5e61213a31c74b62a9b8fdf124cd 508af1af6fa21d83f8217fd9aa13a2728b3abc403fb29ef9007dfadc20fec226 25707c43712bdb1fa8784a5202a89cb56c06010415505f5681021f514a96033a 2b8adc70cbc180b26fe33ed319191fdbc1bf74a69c14e3952f3042789472a7f7 ac9fae3ff3fda2f78cf72978f71358cc9a3bd0c4c33d77cb2ecd9b9f96438a84 062fa0e9303c733951e6bedc8e6ed7cbd42ca30646f41e9c77b51e0f41988fcc d0a8c83872a5dc8640feebb9be4e582facc2714377b8bc9083e2a0a3cd569ffe befe0d058270e613347366f7edbcb3e263294a24939f4ad2752d1f23fabe00a3 0edf81911cefd9a13481afa0bdbb0ccd52758426b6a3b816d3ccafb4af8d622a 0aed5ab99075eeef2d8b66eca3aa4f5b03a9d925b81f45879588dde7ce43a7d7 3a086765af48c07ee1f7d91533d2078c6d4ca3d20f7417a59a2854f5c1bc4c67 1ed859e78b8859bf9e17bce7a4153fd248aef4fa6ff7f3324be007ebd529aa57 8bda88650e179796ae6ce871405677d22a616dfccc8b9b7e8d6cda7691d70a49 0b7733447bcf00533b43551384a0113f8888de61ebb17f280ad195d3fc322ace 4f71a34ec6956594747b8e2af1dcb4706f1299e52b137dd6a824ed6155ee582b 46f1268b9a2b32e6475d729fa296bb1c938abc9f839cb6c5e3a0a9beebb7ade9 fd8ba8db84144b4850735f953cb4eabea88ea6c846eb8d566c2b1a4832d1e746 f34da06a686b26928bfc7291fa411b0a42c7497bec647c0c3d099b3d08783649 1c495543dce6ada3536b71df4eabf26ae0a35ef1998c9434c4339abd475e375e fae2fd3d4447c4ae33af5df17abea43d82c0f54662a7f508a640c9738d9d14bd 9e5b9c539b7dce320c1953beea15f8e39d235bec3da2116c020d1ac64caf6b16 5905fba2369951c661e1a9d219b5714a05d91d5a51e0583acf5976e9843a0ac9 e2c3d831083b18e40311934ca351446d6098f596ed8719da8e6ff1a95a0f41ae b2667ebc9d0fd45dc18b13c98603d48e82b58df12043f78cf9a38d3952aeef6a 7425a937b3267e28c6ac6f36e0ac00c4a70f5486f077a04f21a90d6bae2553f5 90c752911da66eb77c22c1663b630d4920c6e63d97af6afbb2cc78d942efea2f ed5167cbcd05761bc7745bdc9eee68cfe9233fbc885d9b715e22da986127de45 fbfe10b25b0da4535d9adf8b2f736ce742c945e2823d0dfe552791f07433e9a2 2512d04cf44deafd79f2f8127458a8ff91444ffa359055235ff2f8268c0ab27b f2a6a0fc9fe8b21432fe603b6e9ac16be3138447c353211f1c6b598c6c0e1858 837a9d5194cab0bf73fe0415f0ee3ba3b828cf7e3d3cd10707148582c89ededd 0e583e626c6a2bee7c5a1d9dd45b7053a85564e3a1c27e9cec154c1faad60ef3 6136a445d2803d1d272b311a428b119f3351f6bdb6510c61e227a78cfa0abc17 c90937afa78b1fb7cb5d94026549995ae58368c0fcd1972ac3938253c84a4224 1d02ec2855674b80e043d26a75463108b7ed397fb468a33439e0966617fdb830 19a765b0362af06574c1aa4ff082b71ba2b6a86fc1aab7722486e096c968b653 65d29e14d85f2f4541ea929c1708adfaa78706a703742a5b140c81b424db2fde 222495f3c02ccf38476aa87aab2f992f428ba3f210d8d5af64ae1dd911496084 f3e9d72cc240dcbc8c9df00628c2a220281b5912faeaf930d280b9079670ef0d 185da85fbaae07131bf0eff103f53077b283c9ba4dc9884fe7ab25c8e8f0e771 535bf250dc27539178308675bbf782e927d18c4aae5a5ebbfed40886293bdd22 e307d0e1fd9a9fa69caeebb6f865c431ba79b1ea38669e954c416bb66ac352f8 16da4c4a08e79cea56202640654bd72344691d88005f9a57f5c54bb19f4c3059 59ca2cc7e19ef26e94cfc8866a12b04f5d35d4b8fea0cf1071d9cc3388d83692 6da9374dea9e226b0d53ade9222491b9dee512dcb0e090bb7eb2f1ebe4c3b09a fd9f881fdebb37c76410f79a26a89ed8b670ada29f6149ab151ed1f511a32163 625999f3b1492044739a697a6b449e8d445fefdf9e71efc419077e514a57e138 088abde9b90547a2f420b9b3a91c19d7c0cbbe04d9b3e00ed093133f842597b7 9bdb5062ab3ccfef9f08beefa6119b106ce852bff70c9f2c7a9820f96a1d3a96 3820942cc74a63cb90c041ce4a60983ea879a7ecf60fc384d318c266a3b69b1e 80b87caea607956a044647261ecae72d4e9979be20cfc30cd68b158f7e06b0f6 67dce744858296c12c2edc5751a2ab51e23fa956241f1fc025fd04a217b7bc3d f71679b3a96968d6e2579125aedaaa01ba89963b6101ccc5f3683d51c700b362 8a07461faa84ece4b976774b6847dc27cb6744cbb69c4d0bdb008f4c5c2d8816 be2731ff5d1e4f3e0610025c7e04f225fefdc7f5f222ed6057b1820e12deae3d 6d3b6aaf66788612f30cfee92340d4f8a5c961bc7e01ea762562f434c0472abc 97b6edb009d72ad7ecdb2e9ab5b04424c6730f030c474d6e44b1df40e04b89aa 31ad2145000efeb162e611b0f32bad0368dfe38d0f0390d49e862e01ecad6c71 50d366216f72b25868e9b111e76a31a4f40e892db5a1c38d19f926d6441e9a78 f9cd9aaeab773533d83328d582bdcf86ed48d3922a76ad4e31a634c396a5fcf0 ecef46e1e8b2455ad70c8b534e852cb5e1aa4e28d3d79c1ca151a18761ed9318 1b97e9020d3deac8c64c352dcc1029c204cf14c4c360d22c8ef6f594f834f235 7de6bad8bd5299a477d3cb636ba32793f409b0719009319e82aae451929c2ffe df231531292ec1f79b8ee79d53a99253ed64ddb5aaace5b6bc9d18eaf00891eb 376159390d50ba7320b1a27ab1f55931cf2335839d7ea54d65976909b9907c8a 9520ff6b1777b086a11d5f759d24d91d2c2151c923b24625eba8a1c42b1c6903 e6db399d2f7382003740ebfe846e962a11e981d5324ebb5d34a2592936ee32fc 8be2b82f6f42142ec766949da096a85fc725fe1507fa0840898e248766e3b306 910fbc4239f0cce390320d17fccf479a23c2c1441d76428980ae2dc987a7da19 c2456718d8cd22a04b4e32421d767efff1b8eaf1509e501ccf50413b227cfcf6 062c64fdd8110140592fff45f5231803b52ac44b29607ddabeb74f3660ecdbfe 7d3e65be4b222977ed091f2a7c9fbf7a4855ddc3917310adfa50bb68203c9339 4114f6c5c847fec0b76074a02a82efaadad335bb9aba5542a3b52c03935f0397 287d70ffc0edbf0b44cd6668a6033c0336b40442b0b180a2f01f682e7e1f5f7d 68008d6f0dc32a7d23a3a36048e64d06d49f475cd5da9331588bc9bfc1683aa8 08de03d397411fc308538a6cfc9ab53a4dd48b3fdc5e5dc8a6dfa1ae13d33dd5 9469e91d58627f1007e7250a1b89b8b3e581e81afbb2d22b78bae2289163069e a8c72507e2ed67a789f6f8b558846df2d7743e95f0385967656d6292d2589de7 69ff1fb9647611d965dfb7e743c547497bdc05400b94ae09da4363e66ab18239 25f9290b91a4e2c4e2d237e216c89f5cb9c6660aa7b4cef4f170a857a604e17f d1ab8877c4f7c4da2cd3a29fef8d3768c292f5170d99f269fe5d9b4e97c93dd6 6b99f65ca0beabb71656511ecd7281e6d62a93575d19bb23cb505266c239556d 5f62c801be0aa0f2a6b96909f4c5911197e53b2a4837ff176271bee85516655e 3c9a7ad81d8dfb66894c525a4469bf03da75fa600555be3895c7e918f3eaec2b a938ca06fa81f5b049fb6bd8445949acd06a135196249cc76e363f10df76371f 4e4142dfbcdea25670a419e7a90715759324679f37019a4114fdf53490fed883 a8563ab4afc66c37b450b8ab13133140841be395543e8d6881055a7a517adc2b 5e5e4a83e3d71f24ba056b90dd0bef1e507a87bfda1b58a434df09a9aa29c19e 41fa272ab80331bd6065e9552c4abb7a3dd3b80b1d36f7182a9b041122715aa3 b76ddcee38281c74e7e2712faeddefaa9554506d1317a2f5a59428433f4c7a6d bdb15dbf1af7bc2010124a80f9384951b9b1042f2d2d9b84f040bab78694e320 7f68f9231c0370d286f0f4dd148ed6db41642f0b772e6e906011811cfb4c1687 f49feb803d33c3729bbba8c9962a49cbf7ea6996ef539783899aa4819f4f8d73 69087f59501c4be4bd6d0c66063438d1d0a30db7c6cdd1e9c3d31042a66bd759 864be6147a9e24c8fb3bed57dcaeeb222591a906ec1beafd694b169639a72200 0f77533b80b2dfca93bd56dd64c679bf338e1ddf5c1105cf09d9dd981728e76c 2eb74c4c2d993e29443a8132f20a97b64a61c195e1cd9b020bc1dc03078ef524 68c7ece295f31f44b9d5a28bd2b17a238ee27ab4fabda583fb94958ede5a6f7d bc4b40b5fbe7696bc67dec948d295c40485962a65bda2af773f20af35b2ea98a 324a6f2623f51dfff1c7fb3d89c6efdc007bba356c30d41d6c1175779bbc3802 c20f23b831b3dfe35d6f74eb08194352cad1c42e790f54f77fcd5908924860a8 56d6677f891a55be2bfd213e0007fbf3d74afb4ccef230a47cee6c886994e557 38676fd8f3254e723ddcd245af23f3058e70ba2933c1c8f2503399aa4883dbd0 153265b619d247a713d102e1894dad678e068279b2622ddc5a321c3ff4bfa9e4 f2cdedeeb6573710708035f559a075c6a7bf6f4049db46a9107ed3990ce87e26 07a066f340c8fb3cb83cd05edf1a5b27f5c74f6f7b8e62c3f381385b70f01326 b2c9be04a3d4e168ff61eec8cd2452c09eb9bcc6952a2f8663d8e726f66ad1c7 451cf5b8610736f04256b85b4d1f4f29fda4e246d3e5ae926bc224327b559c9f 518fb1fc7e09f9c11f81382650ef3d313e351dca4b702ef3f83946376d1762ba 7c14d058e4876f1eef5d83abd51f831366d1a61f264a8cdf4df154f811809f2f 624d70a64f56f5dbeae144b1aa282428c0be27d3c70bcdc96c5b2fddefec35cc 9177b2786c2963b0695900043821d3152e966e7ef16f49d9087c58717d12aaee 5556e9e717d5fb569d3ba48e1a529b54a587e3bef4be0e0ac36516b4ef91dac3 ef6e795982de057d199c341b74591c5ea4ad630122fd0237c4b6d8a1d5901dc5 45a2a3b175e3cf5792083df0dd4c879256704518a25537b6264c139b2a99ab79 46898f1f3332cccafb9f28a4e08cd918a18801d0a9053366b3b8a3ed45894c81 d1a14b399c0502d1c678d5d3f225bf52e65718693e02789c7243eb1e96a139d6 1c393b16387f36d481497d216ddd69e93c2a13988bc94a4c01f4d03318f0d14f cffbd1aac089b988581c93eff2bd3eb6ba0e91aea9ee04d33e416935cf1ec865 a1d6f8d115f59893c6926f9b289444b1f4ed131dda20f1bf131dcc394c17ca90 3f325288bf30c7b0da140a1ae224001592f3f604099fa3b1614c28fdca370949 2d86ef8e5ff2ab2202c186ab98e42c959117adb185cda77009a8387ba468797a 50a7bc9bd7c0f0d5953a207b925349aa51b921b683dd33e648383d0c97af11e8 c5842850e7eea520caab9d7a300ebd1ddc87eff6cf16a0e1f21563902bc22238 1602c548854ed4cd8566dd0ff4d873a9127a6ff4f03685e0dec737041a9ead7b b55513424fd4697b49e31558cb78ec9154c1eadc788d6967e913c09a76353a11 7b000cd27bf2b20a0f2be3cfdd0e6749ee60df8d140971e5a711b6fae494313b 648ee0edacc15753159dfc33f5d8b14719cc8ecb7232e2dca967119441894b17 9ed0d14cadba9dfc52f198570bc21f77a3194311f29b3c466682a8ce01c39198 21ce36627d1b03917aaa5586ce77985cf9af773968d6fdb9d80ed53cb08bedbf 3cd896fa943f51ccb23640756a31057115d02491afd411e4c6cf23062f3ac857 c143600213733838986cdd0426e7301189f26c165c91e04e3a5b46932ca88629 a3c5f5a76dd4dae4031e089120a6f4be20919c099437b000abaae1702433cbaa fbb7758b9d1ab35876e9a6b797de5dddcc4e473b15ca9aa7a9fce093575fdc83 cd4bc7afcf4c33f192b690d821b81395638ef57a6247ee008b1e359af706f741 0e697c32bf7da903b6d7ab83729ba82d23cdd8d7158cd0b6a978ed750510555b e70b73909b2e88fc56701f4476058fc6d85e92481430787374835ddd1852939b e0eec896c8bab6c5f16193eb499bf23ada1da82db083ce40ba4d417c17e123bd 108ac04129d6e7a6f520c389851247c05138326a669d08622b20f65931a38f59 f93a56f7bb2add4ee3d96ec59e3bd7450fa0b20368c66d1abaf69b188a8f44a0 76a5010bb309bb80a66ad07300001ab529e320ab7fd1c9d040ea79b326f9dc6c f2587d49f4c8c3b654b86fc866477e5672fd11ea0917500a30f045dd206d894f 60a41c2eb3ef36b22236bbadabdd8d8c8dcd29013dd5862cf112757d050fa0b1 0326b4274752ee1636b3dfb07bc2352e0db87ff33b7e6e9e92c2002800e1324d 1859e15fd6929a3d1a3bc9d761befd733344347c6c6ef87e26e6995466200b8e 31664020cdfa92f48415317b467c7a01fef2312cbdbb8913df635a4ffb36dbbc service root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root docker-25.0.6_ce-150000.207.1.src.rpm config(docker) docker docker(s390-64) docker-libnetwork group(docker) user(dockremap) @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
(apparmor-parser or container-selinux) /bin/sh /bin/sh /bin/sh /bin/sh ca-certificates-mozilla catatonit config(docker) containerd coreutils diffutils e2fsprogs fillup grep iproute2 iptables libc.so.6()(64bit) libc.so.6(GLIBC_2.14)(64bit) libc.so.6(GLIBC_2.2)(64bit) libc.so.6(GLIBC_2.2.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libdl.so.2()(64bit) libdl.so.2(GLIBC_2.2)(64bit) libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2)(64bit) libpthread.so.0(GLIBC_2.2.3)(64bit) libpthread.so.0(GLIBC_2.3.2)(64bit) libresolv.so.2()(64bit) libresolv.so.2(GLIBC_2.2)(64bit) libsystemd.so.0()(64bit) libsystemd.so.0(LIBSYSTEMD_209)(64bit) procps rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) rpmlib(RichDependencies) runc shadow shadow sysuser-shadow tar udev xz 25.0.6_ce-150000.207.1 1.7.3 3.5 1.4 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.12.0-1 1.1.9 1.26 4.9 4.14.1 f'@fy_fg@ee7@eПe̫@e;@e&@ed@d@d@dr@dddjdJcdI@cT@c.cV~@c5c5bz@bb>b=bk@bX aZ@a@@a]aHw``x*`?z@`)`#` `>`>``_1@_@_S_#_d@_'@^)@^^?@]f@]+]@]҇]]z@]?]b@]@1@]:@]5@]/
]@]\Q\!\-@\@\@\u*@\^\Z@\Yz\8@\2\@\[[F[s[s[@[}P@[{[{[ug@[a[`O@[^[6 @[{@[{@[{@[
@Z @ZJ@Z̧@Za@Zľ@Z2@Z%Z@ZZ|;Zp^@Zo Zk@ZaZaZ7Z7Z&@Z%8Z Z@Z
Z@Z@Y+@Y@YdY*@Y˒YY@YYYoIYoIYdY_wY^&@YGY-^Y,
@Y ;@YR@Y Y Y#@XXh@XXXX@X@X@XX@XO@XO@XO@XXX6@XXx@Xv @XY @XY @XWXEVX=mX6@X@Ww@W@W@W;WҤ@W@WίWiWiWu@W#W/@W/@W/@W/@WW@W:W:W:W @W@W@W-@W{@W{@Wm WXW>@W=W
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
* 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
symlinks. Backport of and
. bsc#1221916
+ 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
future Docker starts failing due to empty files. Backport of
. bsc#1214855
+ 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
bsc#1223409
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
- 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path. [NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
* 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) - Update to Docker 25.0.3-ce. See upstream changelog online at
- Fixes:
* bsc#1219267 - CVE-2024-23651
* bsc#1219268 - CVE-2024-23652
* bsc#1219438 - CVE-2024-23653
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
- 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Vendor latest buildkit v0.11:
Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
vendors in the latest v0.11 buildkit branch including bugfixes for the following:
* bsc#1219438: CVE-2024-23653
* bsc#1219268: CVE-2024-23652
* bsc#1219267: CVE-2024-23651
- rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash & zsh
completion warnings - Update to Docker 24.0.7-ce. See upstream changelog online at
. bsc#1217513
* Deny containers access to /sys/devices/virtual/powercap by default.
- CVE-2020-8694 bsc#1170415
- CVE-2020-8695 bsc#1170446
- CVE-2020-12912 bsc#1178760
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
version-specific templating for the default apparmor profile. bsc#1213500
+ 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.6-ce. See upstream changelog online at
. bsc#1215323
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
disabled to ensure that Docker will always run even if you start the socket
individually. Users should probably just ignore this unit file. bsc#1210141 - Update to Docker 24.0.5-ce. See upstream changelog online at
. bsc#1213229 - Update to Docker 24.0.4-ce. See upstream changelog online at
. bsc#1213500 - Update to Docker 24.0.3-ce. See upstream changelog online at
. bsc#1213120
- Rebase patches:
* cli-0001-docs-include-required-tools-in-source-tree.patch - Recommend docker-rootless-extras instead of Require(ing) it, given
it's an additional functionality and not inherently required for
docker to function. - Add docker-rootless-extras subpackage
(https://docs.docker.com/engine/security/rootless) - Update to Docker 24.0.2-ce. See upstream changelog online at
. bsc#1212368
* Includes the upstreamed fix for the mount table pollution issue.
bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
being provided by this package.
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at
. bsc#1211578
- Rebase patches:
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
(the uapi headers in SLE-12 are too old).
+ 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
- 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
+ 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 23.0.5-ce. See upstream changelog online at
.
- Rebase patches:
* cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.4-ce. See upstream changelog online at
. bsc#1208074
- Fixes:
* bsc#1214107 - CVE-2023-28840
* bsc#1214108 - CVE-2023-28841
* bsc#1214109 - CVE-2023-28842
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
- 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
- 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport to allow man pages to be
built without internet access in OBS.
+ cli-0001-docs-include-required-tools-in-source-tree.patch - update to 20.10.23-ce.
* see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 20.10.21-ce. See upstream changelog online at
. bsc#1206065
bsc#1205375 CVE-2022-36109
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
* 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
* 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- The PRIVATE-REGISTRY patch will now output a warning if it is being used (in
preparation for removing the feature). This feature was never meant to be
used by users directly (and is only available in the -kubic/CaaSP version of
the package anyway) and thus should not affect any users. - Fix wrong After: in docker.service, fixes bsc#1188447 - Add apparmor-parser as a Recommends to make sure that most users will end up
with it installed even if they are primarily running SELinux. - Fix syntax of boolean dependency - Allow to install container-selinux instead of apparmor-parser. - Change to using systemd-sysusers - Backport to fix a crash-on-start
issue with dockerd. bsc#1200022
+ 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Update to Docker 20.10.17-ce. See upstream changelog online at
. bsc#1200145
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
* 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
bsc#1193930 bsc#1197284
* 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - Update to Docker 20.10.14-ce. See upstream changelog online at
. bsc#1197517
CVE-2022-24769 - Update to Docker 20.10.12-ce. See upstream changelog online at
.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
changelogs are currently only available online. - Update to Docker 20.10.11-ce. See upstream changelog online at
. bsc#1192814
bsc#1193273 CVE-2021-41190
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
- 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch - Update to Docker 20.10.9-ce. See upstream changelog online at
. bsc#1191355
CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
* 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream. - Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
bsc#1190670
+ 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch - Add shell requires for the *-completion subpackages. - Update to Docker 20.10.6-ce. See upstream changelog online at
. bsc#1184768
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix for btrfs
quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
+ 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - Update to Docker 20.10.5-ce. See upstream changelog online at
. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
- cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
tools. boo#1182476 [NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
the patch entirely. bsc#1180401 bsc#1182168
- boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch - Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch [NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
* bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
It appears that SLES doesn't like the patch. bsc#1180401 - Update to Docker 20.10.3-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
(CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
- 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
+ 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
- 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
+ 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
+ 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
- 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
+ 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
the upstream runc package (it's stable enough and Docker no longer pins git
versions). docker-libnetwork is so unstable that it doesn't have any
versioning scheme and so it really doesn't make sense to maintain the project
as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
docker-runc and docker-libnetwork.
- 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch - Update to Docker 20.10.2-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
- bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
- boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
+ cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
our patches. While doing this, I've collapsed all patches into one branch
per-release and thus all the patches are now just one series:
- packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
+ 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
- secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
+ 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
- secrets-0002-SUSE-implement-SUSE-container-secrets.patch
+ 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- private-registry-0001-Add-private-registry-mirror-support.patch
+ 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
- bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
+ 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
was fixed.
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Add Conflicts and Provides for kubic flavour of docker-fish-completion. - Update to Docker 19.03.14-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
https://github.com/docker/docker-ce/releases/tag/v19.03.14 - Enable fish-completion - Add a patch which makes Docker compatible with firewalld with
nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
(boo#1178801, SLE-16460)
* boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch - Update to Docker 19.03.13-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Emergency fix: %requires_eq does not work with provide symbols,
only effective package names. Convert back to regular Requires. - Update to Docker 19.03.12-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
spurrious errors due to Go returning -EINTR from I/O syscalls much more often
(due to Go 1.14's pre-emptive goroutine support).
- bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
dependencies much more quickly. - Update to Docker 19.03.11-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
can build Docker with Go 1.14 (upstream uses Go 1.13).
+ bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch - BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
Allow OBS to shortcut through the -mini flavors. - Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
+ bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch - Support older SLE systems which don't have "usermod -w -v". - Update to Docker 19.03.5-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1158590 bsc#1157330 - Update to Docker 19.03.4-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. - Drop containerd.service workaround (we've released enough versions without
containerd.service -- there's no need to support package upgrades that old).
- Update to Docker 19.03.3-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1153367 - Update to Docker 19.03.2-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1150397 - Fix zsh-completion (docker -> _docker) - Fix default installation such that --userns-remap=default works properly
(this appears to be an upstream regression, where --userns-remap=default
doesn't auto-create the group and results in an error on-start). boo#1143349 - Update to Docker 19.03.1-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. CVE-2019-14271 - Update to Docker 19.03.0-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1142413
- Remove upstreamed patches:
- bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch
- bsc1001161-0002-cli-add-a-separate-domainname-flag.patch
- bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch
- bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch
- Rebase pacthes:
* bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
* packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
* private-registry-0001-Add-private-registry-mirror-support.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Move bash-completion to correct location.
- Update to Docker 18.09.8-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
* Includes fixes for CVE-2019-13509 bsc#1142160. - Update to Docker 18.09.7-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1139649
- Remove upstreamed patches:
- CVE-2018-15664.patch - Use %config(noreplace) for /etc/docker/daemon.json. bsc#1138920 - Add patch for CVE-2018-15664. bsc#1096726
+ CVE-2018-15664.patch - Update to Docker 18.09.6-ce see upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
- Rebase patches:
* bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch - Update to Docker 18.09.5-ce see upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1128376 boo#1134068
- Rebase patches:
* bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch
* bsc1001161-0002-cli-add-a-separate-domainname-flag.patch
* bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch
* bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch
* packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
* private-registry-0001-Add-private-registry-mirror-support.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch
- Updated patch name:
+ bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch - Update to Docker 18.09.3-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. - docker-test: improvements to test packaging (we don't need to ship around the
entire source tree, and we also need to build the born-again integration/
tests which contain a suite-per-directory). We also need a new patch which
fixes the handling of *-test images. bsc#1128746
+ bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch - Move daemon.json file to /etc/docker directory, bsc#1114832 - Update shell completion to use Group: System/Shells. - Add daemon.json file with rotation logs cofiguration, bsc#1114832 - Update to Docker 18.09.1-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1124308
* Includes fix for CVE-2018-10892 bsc#1100331.
* Includes fix for CVE-2018-20699 bsc#1121768.
- Remove upstreamed patches.
- bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch - Disable leap based builds for kubic flavor. bsc#1121412 - Update go requirements to >= go1.10.6 to fix
* bsc#1118897 CVE-2018-16873
go#29230 cmd/go: remote command execution during "go get -u"
* bsc#1118898 CVE-2018-16874
go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
* bsc#1118899 CVE-2018-16875
go#29233 crypto/x509: CPU denial of service - Handle build breakage due to missing 'export GOPATH' (caused by resolution of
boo#1119634). I believe Docker is one of the only packages with this problem. - Add backports of https://github.com/docker/docker/pull/37302 and
https://github.com/docker/cli/pull/1130, which allow for users to explicitly
specify the NIS domainname of a container. bsc#1001161
+ bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch
+ bsc1001161-0002-cli-add-a-separate-domainname-flag.patch - Update docker.service to match upstream and avoid rlimit problems.
bsc#1112980
- Upgrade to Docker 18.09.0-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. boo#1115464 bsc#1118990
- Add revert of an upstream patch to fix docker-* handling.
+ packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
- Rebase patches:
* bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch
* bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch
* bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch
* private-registry-0001-Add-private-registry-mirror-support.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch
- Remove upstreamed patches:
- bsc1100727-0001-build-add-buildmode-pie.patch - Reduce the disk footprint by recommending git-core instead of
hard requiring it.
bsc#1108038 - ExcludeArch i586 for entire docker-kubic flavour - ExcludeArch i586 for docker-kubic-kubeadm-criconfig subpackage - Add patch to make package reproducible, which is a backport of
https://github.com/docker/cli/pull/1306. boo#1047218
+ bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch - Upgrade to docker-ce v18.06.1-ce. bsc#1102522 bsc#1113313
Upstream changelog:
https://github.com/docker/docker-ce/releases/tag/v18.06.1-ce
- Remove patches that were merged upstream:
- bsc1102522-0001-18.06-disable-containerd-CRI-plugin.patch - Add a backport of https://github.com/docker/engine/pull/29 for the 18.06.0-ce
upgrade. This is a potential security issue (the CRI plugin was enabled by
default, which listens on a TCP port bound to 0.0.0.0) that will be fixed
upstream in the 18.06.1-ce upgrade. bsc#1102522
+ bsc1102522-0001-18.06-disable-containerd-CRI-plugin.patch - Kubic: Make crio default, docker as alternative runtime
(boo#1104821)
- Provide kubernetes CRI config with docker-kubic-kubeadm-criconfig
subpackage - Merge -kubic packages back into the main Virtualization:containers packages.
This is done using _multibuild to add a "kubic" flavour, which is then used
to conditionally compile patches and other kubic-specific features.
bsc#1105000
- Rework docker-rpmlintrc with the new _multibuild setup. - Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
to work with Docker and containerd. fate#325877 - Upgrade to docker-ce v18.06.0-ce. bsc#1102522
- Remove systemd-service dependency on containerd, which is now being started
by dockerd to align with upstream defaults.
- Removed the following patches as they are merged upstream:
- bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch
- bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch
- Rebased the following patches:
* bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch
* bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch
* bsc1100727-0001-build-add-buildmode-pie.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Build the client binary with -buildmode=pie to fix issues on POWER.
bsc#1100727
+ bsc1100727-0001-build-add-buildmode-pie.patch - Update the AppArmor patchset again to fix a separate issue where changed
AppArmor profiles don't actually get applied on Docker daemon reboot.
bsc#1099277
* bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch
+ bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch - Update to AppArmor patch so that signal mediation also works for signals
between in-container processes. bsc#1073877
* bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems
and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke
testing has been far more useful. boo#1095817 - Update secrets patch to not log incorrect warnings when attempting to inject
non-existent host files. bsc#1065609
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Review Obsoletes to fix bsc#1080978 - Put docker under the podruntime slice. This the recommended
deployment to allow fine resource control on Kubernetes.
bsc#1086185 - Add patch to handle AppArmor changes that make 'docker kill' stop working.
bsc#1073877 boo#1089732
+ bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch - Fix manpage generation breaking ppc64le builds due to a missing
- buildemode=pie. - Compile and install all manpages.
bsc#1085117 - Add requirement for catatonit, which provides a docker-init implementation.
fate#324652 bsc#1085380 - Fix private-registry-0001-Add-private-registry-mirror-support.patch to
deal corretly with TLS configs of 3rd party registries.
fix bsc#1084533 - Update patches to be sourced from https://github.com/suse/docker-ce (which
are based on the upstream docker/docker-ce repo). The reason for this change
(though it is functionally identical to the old patches) is so that public
patch maintenance is much simpler.
* bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch
* bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch
* private-registry-0001-Add-private-registry-mirror-support.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Add ${version} to equivalent non-kubic package provides - Add Provides for equivalent non-kubic packages - Disable all tests for docker/client and docker/pkg/discovery. The unit tests
of those packages broke reproducibly the builds in IBS. - Disable flaky tests github.com/docker/docker/pkg/discovery/kv. - Add patch to support mirroring of private/non-upstream registries. As soon as
the upstream PR (https://github.com/moby/moby/pull/34319) is merged, this
patch will be replaced by the backported one from upstream.
+ private-registry-0001-Add-private-registry-mirror-support.patch
fix bsc#1074971 - Add Obsoletes: docker-image-migrator, as the tool is no longer needed and
we've pretty much removed it from everywhere except the containers module.
bsc#1069758 - Remove requirement on bridge-utils, which has been replaced by libnetwork in
Docker. bsc#1072798 - Update to Docker v17.09.1_ce (bsc#1069758). Upstream changelog:
https://github.com/docker/docker-ce/releases/tag/v17.09.1-ce
- Removed patches (merged upstream):
- bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch
- bsc1066210-0001-vendor-update-to-github.com-vbatts-tar-split-v0.10.2.patch
- bsc1066801-0001-oci-add-proc-scsi-to-masked-paths.patch - Update to Docker v17.09.0_ce. Upstream changelog:
https://github.com/docker/docker-ce/releases/tag/v17.09.0-ce
- Rebased patches:
* bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch
* bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch
* bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch
- Removed patches (merged upstream):
- bsc1064781-0001-Allow-to-override-build-date.patch - Add a patch to dynamically probe whether libdevmapper supports
dm_task_deferred_remove. This is necessary because we build the containers
module on a SLE12 base, but later SLE versions have libdevmapper support.
This should not affect openSUSE, as all openSUSE versions have a new enough
libdevmapper. Backport of https://github.com/moby/moby/pull/35518.
bsc#1021227 bsc#1029320 bsc#1058173
+ bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch - Fix up the ordering of tests in docker.spec. This is to keep things easier to
backport into the SLE package. - Include secrets fix to handle "old" containers that have orphaned secret
data. It's not clear why Docker caches these secrets, but fix the problem by
trashing the references manually. bsc#1057743
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Replace references to /var/adm/fillup-templates with new
%_fillupdir macro (boo#1069468) - Remove migration code for the v1.9.x -> v1.10.x migration. This has been
around for a while, and we no longer support migrating from such an old
version "nicely". Docker still has migration code that will run on
first-boot, we are merely removing all of the "nice" warnings which tell
users how to avoid issues during an upgrade that ocurred more than a year
ago.
- Drop un-needed files:
- docker-plugin-message.txt
- docker-update-message.txt - Add a backport of https://github.com/moby/moby/pull/35424, which fixes a
security issue where a maliciously crafted image could be used to crash a
Docker daemon. bsc#1066210 CVE-2017-14992
+ bsc1066210-0001-vendor-update-to-github.com-vbatts-tar-split-v0.10.2.patch - Add a backport of https://github.com/moby/moby/pull/35399, which fixes a
security issue where a Docker container (with a disabled AppArmor profile)
could write to /proc/scsi/... and subsequently DoS the host. bsc#1066801
CVE-2017-16539
+ bsc1066801-0001-oci-add-proc-scsi-to-masked-paths.patch - Correctly set `docker version` information, including the version, git
commit, and SOURCE_DATE_EPOCH (requires a backport). This should
* effectively* make Docker builds reproducible, with minimal cost. boo#1064781
+ bsc1064781-0001-Allow-to-override-build-date.patch - Add backport of https://github.com/moby/moby/pull/35205. This used to be
fixed in docker-runc, but we're moving it here after upstream discussion.
bsc#1055676
+ bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch - Update to Docker v17.07.0_ce. Upstream changelog:
https://github.com/docker/docker-ce/releases/tag/v17.06.0-ce
https://github.com/docker/docker-ce/releases/tag/v17.07.0-ce
- Removed no-longer needed patches.
- bsc1037436-0001-client-check-tty-before-creating-exec-job.patch
- bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch
- integration-cli-fix-TestInfoEnsureSucceeds.patch
- Added backport of https://github.com/moby/moby/pull/34573. bsc#1045628
+ bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch
- Rewrite secrets patches to correctly handle directories in a way that doesn't
cause errors when starting new containers.
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Fix bsc#1059011
The systemd service helper script used a timeout of 60 seconds to
start the daemon, which is insufficient in cases where the daemon
takes longer to start. Instead, set the service type from 'simple' to
'notify' and remove the now superfluous helper script. - fix bsc#1057743: Add a Requires: fix_bsc_1057743 which is provided by the
newer version of docker-libnetwork. This is necessary because of a versioning
bug we found in bsc#1057743. - fix /var/adm/update-message/docker file name to be
/var/adm/update-message/docker-%{version}-%{release} - devicemapper: add patch to make the dm storage driver remove a container's
rootfs mountpoint before attempting to do libdm operations on it. This helps
avoid complications when live mounts will leak into containers. Backport of
https://github.com/moby/moby/pull/34573. bsc#1045628
+ bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch - Fix a regression in our SUSE secrets patches, which caused the copied files
to not carry the correct {uid,gid} mapping when using user namespaces. This
would not cause any bugs (SUSEConnect does the right thing anyway) but it's
possible some programs would not treat the files correctly. This is
tangentially related to bsc#1055676.
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Use -buildmode=pie for tests and binary build. bsc#1048046 bsc#1051429 - enable deferred removal for sle12sp2 and newer (and openSUSE
equivalent. fix bsc#1021227 - enable libseccomp on sle12sp2 and newer, 42.2 and newer
fix bsc#1028638 - docker: conditional filtering not supported on
libseccomp for sle12 - add SuSEfirewall2.service to the After clause in docker.service
in order to fix bsc#1046024 - fix path to docker-runc in systemd service file - change dependency to docker-runc - Fix bsc#1029630: docker does not wait for lvm on system startup
I added "lvm2-monitor.service" as an "After dependency" of the docker systemd
unit. - Fix bsc#1032287: missing docker systemd configuration - Update SUSE secrets patch to correctly handle restarting of containers.
+ secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
+ secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Fix bsc#1037607 which was causing read-only issues on Kubic, this is a
backport of https://github.com/moby/moby/pull/33250.
+ bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch - Fix bsc#1038476 warning about non-executable docker
* Simply verify we have binary prior using it, might happen if
someone had docker installed and then did remove it and install
from scratch again - Add a partial fix for boo#1038493.
- Fixed bsc#1037436 where execids were being leaked due to bad error handling.
This is a backport of https://github.com/docker/cli/pull/52.
+ bsc1037436-0001-client-check-tty-before-creating-exec-job.patch - Fix golang requirements in the subpackages - Update golang build requirements to use golang(API) symbol: this is
needed to solve a conflict between multiple versions of Go being available - Fix secrets-0002-SUSE-implement-SUSE-container-secrets.patch:
substitute docker/distribution/digest by opencontainers/digest - Update to version 17.04.0-ce (fix bsc#1034053 )
- Patches removed because have been merged into this version:
* pr31549-cmd-docker-fix-TestDaemonCommand.patch
* pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch
- Patches rebased:
* integration-cli-fix-TestInfoEnsureSucceeds.patch
- Build man pages for all archs (bsc#953182)
- Containers cannot resolve DNS if docker host uses 127.0.0.1 as resolver (bsc#1034063)
see /usr/share/doc/packages/docker/CHANGELOG.md - Make sure this is being built with go 1.7 - remove the go_arches macro because we are using go1.7 which
is available in all archs
- remove gcc specific patches
* gcc-go-patches.patch
* netlink_netns_powerpc.patch
* boltdb_bolt_add_brokenUnaligned.patch - Enable Delegate=yes, since systemd will safely ignore lvalues it doesn't
understand. - Update SUSE secrets patch to handle boo#1030702.
* secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
* secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Fix (bsc#1032644)
Change lvm2 from Requires to Recommends
Docker usually uses a default storage driver, when it's not configured
explicitly. This default driver then depends on the underlying
system and gets chosen during installation. - Disable libseccomp for leap 42.1, sle12sp1 and sle12, because
docker needs a higher version. Otherwise, we get the error
"conditional filtering requires libseccomp version >= 2.2.1
(bsc#1028639 and bsc#1028638) - Add a backport of fix to AppArmor lazy loading docker-exec case.
https://github.com/docker/docker/pull/31773
+ pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch - Clean up docker-mount-secrets.patch to use the new swarm secrets internals of
Docker 1.13.0, which removes the need to implement any secret handling
ourselves. This resulted in a split up of the patch.
- docker-mount-secrets.patch
+ secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
+ secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Remove old plugins.json to prevent docker-1.13 to fail to start - Fix bsc#1026827: systemd TasksMax default throttles docker - Fix post section by adding shadow as a package requirement
Otherwise the groupadd instruction fails - Add patch to fix TestDaemonCommand failure in %check. This is an upstream
bug, and has an upstream PR to fix it https://github.com/docker/docker/pull/31549.
+ pr31549-cmd-docker-fix-TestDaemonCommand.patch - update docker to 1.13.0
see details in https://github.com/docker/docker/releases/tag/v1.13.0
- use the same buildflags for building docker and for building the
tests.
- enable pkcs11:
https://github.com/docker/docker/commit/37fa75b3447007bb8ea311f02610bb383b0db77f - enable architecture s390x for openSUSE - provide the oci runtime so that containers which were using an old
runtime option, when started on the new docker version, the runtime
is changed to the new one. fix bsc#1020806 bsc#1016992 - fix CVE-2016-9962 bsc#1012568 . Fix it by updating to 1.12.6
plus an extra commit to fix liverestore:
https://github.com/docker/docker/commit/97cd32a6a9076306baa637a29bba84c3f1f3d218 - add "a wait" when starting docker service to fix
bsc#1019251 - remove netlink_gcc_go.patch after integration of PR
https://github.com/golang/go/issues/11707
- new boltdb_bolt_add_brokenUnaligned.patch for ppc64
waiting for https://github.com/boltdb/bolt/pull/635 - Remove old flags from dockerd's command-line, to be more inline with
upstream (now that docker-runc is provided by the runc package). -H is
dropped because upstream dropped it due to concerns with socket
activation.
- Remove socket activation entirely. - update docker to 1.12.5 (bsc#1016307).
This fixes bsc#1015661 - fix bash-completion - Add packageand(docker:bash) to bash-completion to match zsh-completion. - fix runc and containerd revisions
fix bsc#1009961 - update docker to 1.12.3
- fix bsc#1007249 - CVE-2016-8867: Fix ambient capability usage in containers
- other fixes:
https://github.com/docker/docker/releases/tag/v1.12.3 - update docker to 1.12.2 (bsc#1004490). See changelog
https://github.com/docker/docker/blob/v1.12.2/CHANGELOG.md
- update docker-mount-secrets.patch to 1.12.2 code - docker-mount-secrets.patch: change the internal mountpoint name to not use
":" as that character can be considered a special character by other tools.
bsc#999582 - fix go_arches definition: use global instead of define, otherwise
it fails to build - Add dockerd(8) man page. - add missing patch to changelog - fix integration test case
- add integration-cli-fix-TestInfoEnsureSucceeds.patch - update rpmlintrc - make test timeout configurable - Remove noarch from docker-test, which was causing lots of fun issues when
trying to run them. - Fix build for ppc64le: use static libgo for dockerd and docker-proxy
as in docker build. - Update docker to 1.12.1 (bsc#996015)
see changelog in https://github.com/docker/docker/releases/tag/v1.12.1 - Add asaurin@suse.com's test.sh test script.
- Add integration test binary in docker.spec file. This is work done by
asaurin@suse.com. - Package docker-proxy (which was split out of the docker binary in 1.12).
boo#995620 - fix bsc#995102 - Docker "migrator" prevents installing "docker",
if docker 1.9 was installed before but there were no images - Update docker.service file with several changes.
* Reapply fix for bsc#983015 (Limit*=infinity).
* Specify an "OCI" runtime for our runc package explicitly. bsc#978260 - remove disable-pprof-trace.patch: We can remove this patch because
we use go 1.6, either gcc6-go or gc-go. This patch was for gcc5-go - add go_arches in project configuration: this way, we can use the
same spec file but decide in the project configuration if to
use gc-go or gcc-go for some archs. - use gcc6-go instead of gcc5-go (bsc#988408)
- build ppc64le with gc-go because this version builds with gc-go 1.6
- remove bnc964673-boltdb-metadata-recovery.patch because it has already
been merged - update to v1.12.0 (bsc#995058)
see detailed changelog at
https://github.com/docker/docker/releases/tag/v1.12.0
- disable test that fail in obs build context
- only run unit tests on architectures that provide the go list and go test
tools
- disable dockerd, parser, integration test, and devicemapper related tests
on versions below SLE12 and openSUSE_13.2
- bump test timeout to 10m (for aarch64)
- run unit tests during the build
- Adapt docker.service file.
- adapt install sections for gccgo builds: gccgo build are not built in separate
folders for client and daemon. They both reside in dyngccgo.
- gcc-go-patch: link against systemd when compiling the daemon.
- Add disable-pprof-trace.patch
pprof.Trace() is not available in go version <= 1.4 which we use to build SLES
packages. This patch comments out the pprof.Trace() section.
- update gcc-go-patch and docker-mount-secrets.patch - Fixed binary split, install both required binaries correctly * Explicitly state the version dependencies for runC and containerd, to
avoid potential issues with incompatible component versions. These
must be updated *each time we do a release*. bsc#993847 - Don't exit mid install, add the ability to not restart the docker
service during certain updates with long migration phases
bsc#980555 - remove kernel dependency (bsc#987198) - remove sysconfig.docker.ppc64le patch
setting iptables option on ppc64le works now (bsc#988707) - fix bsc#984942: audit.rules in docker-1.9.1-58.1.x86_64.rpm has a
syntax error * Update docker.service to include changes from upstream, including the
soon-to-be-merged patch https://github.com/docker/docker/pull/24307,
which fixes bnc#983015. - readd dropped declaration for patch200 * Removed patches:
- cve-2016-3697-numeric-uid.patch (merged upstream in gh@docker/docker#22998).
* Update Docker to 1.11.2. (bsc#989566) Changelog from upstream:
* Networking
* Fix a stale endpoint issue on overlay networks during ungraceful restart
(#23015)
* Fix an issue where the wrong port could be reported by docker
inspect/ps/port (#22997)
* Runtime
* Fix a potential panic when running docker build (#23032)
* Fix interpretation of --user parameter (#22998)
* Fix a bug preventing container statistics to be correctly reported (#22955)
* Fix an issue preventing container to be restarted after daemon restart
(#22947)
* Fix issues when running 32 bit binaries on Ubuntu 16.04 (#22922)
* Fix a possible deadlock on image deletion and container attach (#22918)
* Fix an issue where containers fail to start after a daemon restart if they
depend on a containerized cluster store (#22561)
* Fix an issue causing docker ps to hang on CentOS when using devicemapper
(#22168, #23067)
* Fix a bug preventing to docker exec into a container when using
devicemapper (#22168, #23067) - Fix udev files ownership - Pass over with spec-cleaner, no factual changes * Make sure we *always* build unstripped Go binaries. * Add a patch to fix database soft corruption issues if the Docker dameon dies
in a bad state. There is a PR upstream to vendor Docker to have this fix as
well, but it probably won't get in until 1.11.2. bnc#964673
(https://github.com/docker/docker/pull/22765)
+ bnc964673-boltdb-metadata-recovery.patch * Remove conditional Patch directive for SUSE secrets, since conditionally
including patches results in incompatible .src.rpms. The patch is still
applied conditionally. * Update to Docker 1.11.1. Changelog from upstream:
* Distribution
- Fix schema2 manifest media type to be of type `application/vnd.docker.container.image.v1+json` ([#21949](https://github.com/docker/docker/pull/21949))
* Documentation
+ Add missing API documentation for changes introduced with 1.11.0 ([#22048](https://github.com/docker/docker/pull/22048))
* Builder
* Append label passed to `docker build` as arguments as an implicit `LABEL` command at the end of the processed `Dockerfile` ([#22184](https://github.com/docker/docker/pull/22184))
* Networking
- Fix a panic that would occur when forwarding DNS query ([#22261](https://github.com/docker/docker/pull/22261))
- Fix an issue where OS threads could end up within an incorrect network namespace when using user defined networks ([#22261](https://github.com/docker/docker/pull/22261))
* Runtime
- Fix a bug preventing labels configuration to be reloaded via the config file ([#22299](https://github.com/docker/docker/pull/22299))
- Fix a regression where container mounting `/var/run` would prevent other containers from being removed ([#22256](https://github.com/docker/docker/pull/22256))
- Fix an issue where it would be impossible to update both `memory-swap` and `memory` value together ([#22255](https://github.com/docker/docker/pull/22255))
- Fix a regression from 1.11.0 where the `/auth` endpoint would not initialize `serveraddress` if it is not provided ([#22254](https://github.com/docker/docker/pull/22254))
- Add missing cleanup of container temporary files when cancelling a schedule restart ([#22237](https://github.com/docker/docker/pull/22237))
- Removed scary error message when no restart policy is specified ([#21993](https://github.com/docker/docker/pull/21993))
- Fix a panic that would occur when the plugins were activated via the json spec ([#22191](https://github.com/docker/docker/pull/22191))
- Fix restart backoff logic to correctly reset delay if container ran for at least 10secs ([#22125](https://github.com/docker/docker/pull/22125))
- Remove error message when a container restart get cancelled ([#22123](https://github.com/docker/docker/pull/22123))
- Fix an issue where `docker` would not correcly clean up after `docker exec` ([#22121](https://github.com/docker/docker/pull/22121))
- Fix a panic that could occur when servicing concurrent `docker stats` commands ([#22120](https://github.com/docker/docker/pull/22120))`
- Revert deprecation of non-existing host directories auto-creation ([#22065](https://github.com/docker/docker/pull/22065))
- Hide misleading rpc error on daemon shutdown ([#22058](https://github.com/docker/docker/pull/22058)) - Fix go version to 1.5 (bsc#977394) - Add patch to fix vulnerability in Docker <= 1.11.0. This patch is upstream,
but was merged after the 1.11.0 merge window. CVE-2016-3697. bsc#976777.
+ cve-2016-3697-numeric-uid.patch
The upstream PR is here[1] and was vendored into Docker here[2].
[1]: https://github.com/opencontainers/runc/pull/708
[2]: https://github.com/docker/docker/pull/21665 - Supplemnent zsh from zsh-completion
* zsh-completion will be automatically installed if zsh and
docker are installed - Remove gcc5_socker_workaround.patch: This patch is not needed anymore
since gcc5 has been updated in all platforms * Removed patches that have been fixed upstream and in gcc-go:
- boltdb_bolt_powerpc.patch
- fix-apparmor.patch
- fix-btrfs-ioctl-structure.patch
- fix-docker-init.patch
- libnetwork_drivers_bridge_powerpc.patch
- ignore-dockerinit-checksum.patch
* Require containerd, as it is the only currently supported Docker execdriver.
* Update docker.socket to require containerd.socket and use --containerd in
docker.service so that the services are self-contained.
* Update to Docker 1.11.0. Changelog from upstream:
* Builder
- Fix a bug where Docker would not used the correct uid/gid when processing the `WORKDIR` command ([#21033](https://github.com/docker/docker/pull/21033))
- Fix a bug where copy operations with userns would not use the proper uid/gid ([#20782](https://github.com/docker/docker/pull/20782), [#21162](https://github.com/docker/docker/pull/21162))
* Client
* Usage of the `:` separator for security option has been deprecated. `=` should be used instead ([#21232](https://github.com/docker/docker/pull/21232))
+ The client user agent is now passed to the registry on `pull`, `build`, `push`, `login` and `search` operations ([#21306](https://github.com/docker/docker/pull/21306), [#21373](https://github.com/docker/docker/pull/21373))
* Allow setting the Domainname and Hostname separately through the API ([#20200](https://github.com/docker/docker/pull/20200))
* Docker info will now warn users if it can not detect the kernel version or the operating system ([#21128](https://github.com/docker/docker/pull/21128))
- Fix an issue where `docker stats --no-stream` output could be all 0s ([#20803](https://github.com/docker/docker/pull/20803))
- Fix a bug where some newly started container would not appear in a running `docker stats` command ([#20792](https://github.com/docker/docker/pull/20792))
* Post processing is no longer enabled for linux-cgo terminals ([#20587](https://github.com/docker/docker/pull/20587))
- Values to `--hostname` are now refused if they do not comply with [RFC1123](https://tools.ietf.org/html/rfc1123) ([#20566](https://github.com/docker/docker/pull/20566))
+ Docker learned how to use a SOCKS proxy ([#20366](https://github.com/docker/docker/pull/20366), [#18373](https://github.com/docker/docker/pull/18373))
+ Docker now supports external credential stores ([#20107](https://github.com/docker/docker/pull/20107))
* `docker ps` now supports displaying the list of volumes mounted inside a container ([#20017](https://github.com/docker/docker/pull/20017))
* `docker info` now also report Docker's root directory location ([#19986](https://github.com/docker/docker/pull/19986))
- Docker now prohibits login in with an empty username (spaces are trimmed) ([#19806](https://github.com/docker/docker/pull/19806))
* Docker events attributes are now sorted by key ([#19761](https://github.com/docker/docker/pull/19761))
* `docker ps` no longer show exported port for stopped containers ([#19483](https://github.com/docker/docker/pull/19483))
- Docker now cleans after itself if a save/export command fails ([#17849](https://github.com/docker/docker/pull/17849))
* Docker load learned how to display a progress bar ([#17329](https://github.com/docker/docker/pull/17329), [#120078](https://github.com/docker/docker/pull/20078))
* Distribution
- Fix a panic that occurred when pulling an images with 0 layers ([#21222](https://github.com/docker/docker/pull/21222))
- Fix a panic that could occur on error while pushing to a registry with a misconfigured token service ([#21212](https://github.com/docker/docker/pull/21212))
+ All first-level delegation roles are now signed when doing a trusted push ([#21046](https://github.com/docker/docker/pull/21046))
+ OAuth support for registries was added ([#20970](https://github.com/docker/docker/pull/20970))
* `docker login` now handles token using the implementation found in [docker/distribution](https://github.com/docker/distribution) ([#20832](https://github.com/docker/docker/pull/20832))
* `docker login` will no longer prompt for an email ([#20565](https://github.com/docker/docker/pull/20565))
* Docker will now fallback to registry V1 if no basic auth credentials are available ([#20241](https://github.com/docker/docker/pull/20241))
* Docker will now try to resume layer download where it left off after a network error/timeout ([#19840](https://github.com/docker/docker/pull/19840))
- Fix generated manifest mediaType when pushing cross-repository ([#19509](https://github.com/docker/docker/pull/19509))
- Fix docker requesting additional push credentials when pulling an image if Content Trust is enabled ([#20382](https://github.com/docker/docker/pull/20382))
* Logging
- Fix a race in the journald log driver ([#21311](https://github.com/docker/docker/pull/21311))
* Docker syslog driver now uses the RFC-5424 format when emitting logs ([#20121](https://github.com/docker/docker/pull/20121))
* Docker GELF log driver now allows to specify the compression algorithm and level via the `gelf-compression-type` and `gelf-compression-level` options ([#19831](https://github.com/docker/docker/pull/19831))
* Docker daemon learned to output uncolorized logs via the `--raw-logs` options ([#19794](https://github.com/docker/docker/pull/19794))
+ Docker, on Windows platform, now includes an ETW (Event Tracing in Windows) logging driver named `etwlogs` ([#19689](https://github.com/docker/docker/pull/19689))
* Journald log driver learned how to handle tags ([#19564](https://github.com/docker/docker/pull/19564))
+ The fluentd log driver learned the following options: `fluentd-address`, `fluentd-buffer-limit`, `fluentd-retry-wait`, `fluentd-max-retries` and `fluentd-async-connect` ([#19439](https://github.com/docker/docker/pull/19439))
+ Docker learned to send log to Google Cloud via the new `gcplogs` logging driver. ([#18766](https://github.com/docker/docker/pull/18766))
* Misc
+ When saving linked images together with `docker save` a subsequent `docker load` will correctly restore their parent/child relationship ([#21385](https://github.com/docker/docker/pull/c))
+ Support for building the Docker cli for OpenBSD was added ([#21325](https://github.com/docker/docker/pull/21325))
+ Labels can now be applied at network, volume and image creation ([#21270](https://github.com/docker/docker/pull/21270))
* The `dockremap` is now created as a system user ([#21266](https://github.com/docker/docker/pull/21266))
- Fix a few response body leaks ([#21258](https://github.com/docker/docker/pull/21258))
- Docker, when run as a service with systemd, will now properly manage its processes cgroups ([#20633](https://github.com/docker/docker/pull/20633))
* Docker info now reports the value of cgroup KernelMemory or emits a warning if it is not supported ([#20863](https://github.com/docker/docker/pull/20863))
* Docker info now also reports the cgroup driver in use ([#20388](https://github.com/docker/docker/pull/20388))
* Docker completion is now available on PowerShell ([#19894](https://github.com/docker/docker/pull/19894))
* `dockerinit` is no more ([#19490](https://github.com/docker/docker/pull/19490),[#19851](https://github.com/docker/docker/pull/19851))
+ Support for building Docker on arm64 was added ([#19013](https://github.com/docker/docker/pull/19013))
+ Experimental support for building docker.exe in a native Windows Docker installation ([#18348](https://github.com/docker/docker/pull/18348))
* Networking
- Fix panic if a node is forcibly removed from the cluster ([#21671](https://github.com/docker/docker/pull/21671))
- Fix "error creating vxlan interface" when starting a container in a Swarm cluster ([#21671](https://github.com/docker/docker/pull/21671))
* `docker network inspect` will now report all endpoints whether they have an active container or not ([#21160](https://github.com/docker/docker/pull/21160))
+ Experimental support for the MacVlan and IPVlan network drivers have been added ([#21122](https://github.com/docker/docker/pull/21122))
* Output of `docker network ls` is now sorted by network name ([#20383](https://github.com/docker/docker/pull/20383))
- Fix a bug where Docker would allow a network to be created with the reserved `default` name ([#19431](https://github.com/docker/docker/pull/19431))
* `docker network inspect` returns whether a network is internal or not ([#19357](https://github.com/docker/docker/pull/19357))
+ Control IPv6 via explicit option when creating a network (`docker network create --ipv6`). This shows up as a new `EnableIPv6` field in `docker network inspect` ([#17513](https://github.com/docker/docker/pull/17513))
* Support for AAAA Records (aka IPv6 Service Discovery) in embedded DNS Server ([#21396](https://github.com/docker/docker/pull/21396))
- Fix to not forward docker domain IPv6 queries to external servers ([#21396](https://github.com/docker/docker/pull/21396))
* Multiple A/AAAA records from embedded DNS Server for DNS Round robin ([#21019](https://github.com/docker/docker/pull/21019))
- Fix endpoint count inconsistency after an ungraceful dameon restart ([#21261](https://github.com/docker/docker/pull/21261))
- Move the ownership of exposed ports and port-mapping options from Endpoint to Sandbox ([#21019](https://github.com/docker/docker/pull/21019))
- Fixed a bug which prevents docker reload when host is configured with ipv6.disable=1 ([#21019](https://github.com/docker/docker/pull/21019))
- Added inbuilt nil IPAM driver ([#21019](https://github.com/docker/docker/pull/21019))
- Fixed bug in iptables.Exists() logic [#21019](https://github.com/docker/docker/pull/21019)
- Fixed a Veth interface leak when using overlay network ([#21019](https://github.com/docker/docker/pull/21019))
- Fixed a bug which prevents docker reload after a network delete during shutdown ([#20214](https://github.com/docker/docker/pull/20214))
- Make sure iptables chains are recreated on firewalld reload ([#20419](https://github.com/docker/docker/pull/20419))
- Allow to pass global datastore during config reload ([#20419](https://github.com/docker/docker/pull/20419))
- For anonymous containers use the alias name for IP to name mapping, ie:DNS PTR record ([#21019](https://github.com/docker/docker/pull/21019))
- Fix a panic when deleting an entry from /etc/hosts file ([#21019](https://github.com/docker/docker/pull/21019))
- Source the forwarded DNS queries from the container net namespace ([#21019](https://github.com/docker/docker/pull/21019))
- Fix to retain the network internal mode config for bridge networks on daemon reload ([#21780] (https://github.com/docker/docker/pull/21780))
- Fix to retain IPAM driver option configs on daemon reload ([#21914] (https://github.com/docker/docker/pull/21914))
* Plugins
- Fix a file descriptor leak that would occur every time plugins were enumerated ([#20686](https://github.com/docker/docker/pull/20686))
- Fix an issue where Authz plugin would corrupt the payload body when faced with a large amount of data ([#20602](https://github.com/docker/docker/pull/20602))
* Runtime
- Fix a panic that could occur when cleanup after a container started with invalid parameters ([#21716](https://github.com/docker/docker/pull/21716))
- Fix a race with event timers stopping early ([#21692](https://github.com/docker/docker/pull/21692))
- Fix race conditions in the layer store, potentially corrupting the map and crashing the process ([#21677](https://github.com/docker/docker/pull/21677))
- Un-deprecate auto-creation of host directories for mounts. This feature was marked deprecated in ([#21666](https://github.com/docker/docker/pull/21666))
Docker 1.9, but was decided to be too much of an backward-incompatible change, so it was decided to keep the feature.
+ It is now possible for containers to share the NET and IPC namespaces when `userns` is enabled ([#21383](https://github.com/docker/docker/pull/21383))
+ `docker inspect ` will now expose the rootfs layers ([#21370](https://github.com/docker/docker/pull/21370))
+ Docker Windows gained a minimal `top` implementation ([#21354](https://github.com/docker/docker/pull/21354))
* Docker learned to report the faulty exe when a container cannot be started due to its condition ([#21345](https://github.com/docker/docker/pull/21345))
* Docker with device mapper will now refuse to run if `udev sync` is not available ([#21097](https://github.com/docker/docker/pull/21097))
- Fix a bug where Docker would not validate the config file upon configuration reload ([#21089](https://github.com/docker/docker/pull/21089))
- Fix a hang that would happen on attach if initial start was to fail ([#21048](https://github.com/docker/docker/pull/21048))
- Fix an issue where registry service options in the daemon configuration file were not properly taken into account ([#21045](https://github.com/docker/docker/pull/21045))
- Fix a race between the exec and resize operations ([#21022](https://github.com/docker/docker/pull/21022))
- Fix an issue where nanoseconds were not correctly taken in account when filtering Docker events ([#21013](https://github.com/docker/docker/pull/21013))
- Fix the handling of Docker command when passed a 64 bytes id ([#21002](https://github.com/docker/docker/pull/21002))
* Docker will now return a `204` (i.e http.StatusNoContent) code when it successfully deleted a network ([#20977](https://github.com/docker/docker/pull/20977))
- Fix a bug where the daemon would wait indefinitely in case the process it was about to killed had already exited on its own ([#20967](https://github.com/docker/docker/pull/20967)
* The devmapper driver learned the `dm.min_free_space` option. If the mapped device free space reaches the passed value, new device creation will be prohibited. ([#20786](https://github.com/docker/docker/pull/20786))
+ Docker can now prevent processes in container to gain new privileges via the `--security-opt=no-new-privileges` flag ([#20727](https://github.com/docker/docker/pull/20727))
- Starting a container with the `--device` option will now correctly resolves symlinks ([#20684](https://github.com/docker/docker/pull/20684))
+ Docker now relies on [`containerd`](https://github.com/docker/containerd) and [`runc`](https://github.com/opencontainers/runc) to spawn containers. ([#20662](https://github.com/docker/docker/pull/20662))
- Fix docker configuration reloading to only alter value present in the given config file ([#20604](https://github.com/docker/docker/pull/20604))
+ Docker now allows setting a container hostname via the `--hostname` flag when `--net=host` ([#20177](https://github.com/docker/docker/pull/20177))
+ Docker now allows executing privileged container while running with `--userns-remap` if both `--privileged` and the new `--userns=host` flag are specified ([#20111](https://github.com/docker/docker/pull/20111))
- Fix Docker not cleaning up correctly old containers upon restarting after a crash ([#19679](https://github.com/docker/docker/pull/19679))
* Docker will now error out if it doesn't recognize a configuration key within the config file ([#19517](https://github.com/docker/docker/pull/19517))
- Fix container loading, on daemon startup, when they depends on a plugin running within a container ([#19500](https://github.com/docker/docker/pull/19500))
* `docker update` learned how to change a container restart policy ([#19116](https://github.com/docker/docker/pull/19116))
* `docker inspect` now also returns a new `State` field containing the container state in a human readable way (i.e. one of `created`, `restarting`, `running`, `paused`, `exited` or `dead`)([#18966](https://github.com/docker/docker/pull/18966))
+ Docker learned to limit the number of active pids (i.e. processes) within the container via the `pids-limit` flags. NOTE: This requires `CGROUP_PIDS=y` to be in the kernel configuration. ([#18697](https://github.com/docker/docker/pull/18697))
- `docker load` now has a `--quiet` option to suppress the load output ([#20078](https://github.com/docker/docker/pull/20078))
- Fix a bug in neighbor discovery for IPv6 peers ([#20842](https://github.com/docker/docker/pull/20842))
- Fix a panic during cleanup if a container was started with invalid options ([#21802](https://github.com/docker/docker/pull/21802))
- Fix a situation where a container cannot be stopped if the terminal is closed ([#21840](https://github.com/docker/docker/pull/21840))
* Security
* Object with the `pcp_pmcd_t` selinux type were given management access to `/var/lib/docker(/.*)?` ([#21370](https://github.com/docker/docker/pull/21370))
* `restart_syscall`, `copy_file_range`, `mlock2` joined the list of allowed calls in the default seccomp profile ([#21117](https://github.com/docker/docker/pull/21117), [#21262](https://github.com/docker/docker/pull/21262))
* `send`, `recv` and `x32` were added to the list of allowed syscalls and arch in the default seccomp profile ([#19432](https://github.com/docker/docker/pull/19432))
* Docker Content Trust now requests the server to perform snapshot signing ([#21046](https://github.com/docker/docker/pull/21046))
* Support for using YubiKeys for Content Trust signing has been moved out of experimental ([#21591](https://github.com/docker/docker/pull/21591))
* Volumes
* Output of `docker volume ls` is now sorted by volume name ([#20389](https://github.com/docker/docker/pull/20389))
* Local volumes can now accepts options similar to the unix `mount` tool ([#20262](https://github.com/docker/docker/pull/20262))
- Fix an issue where one letter directory name could not be used as source for volumes ([#21106](https://github.com/docker/docker/pull/21106))
+ `docker run -v` now accepts a new flag `nocopy`. This tell the runtime not to copy the container path content into the volume (which is the default behavior) ([#21223](https://github.com/docker/docker/pull/21223)) - docker.spec: apply gcc5 socket patch also for sle12 and leap
because gcc5 has been updated there as well.
- docker.spec: add a "is_opensuse" check for the mount-secrets patch.
This way we can use this same package for opensuse. - use go-lang for aarch64:
- drop fix_platform_type_arm.patch (works around a gcc-go bug, so
unnecessary) - Add patch from upstream (https://github.com/docker/docker/pull/21723) to fix
compilation on Factory and Tumbleweed (which have btrfsprogs >= 4.5).
+ fix-btrfs-ioctl-structure.patch bnc#974208 - Changed systemd unit file and default sysconfig file to include network options,
this is needed to get SDN like flannel to work - docker.spec: update warning to mention that /etc/sysconfig/docker is sourced
by the migration script. - docker.spec: only Reccomends: the docker-image-migrator package as it is no
longer required for our ugly systemctl hacks.
- docker.spec: fix up documentation to refer to the script you need to run in
the migrator package.
- docker.spec: print a warning if you force the DOCKER_FORCE_INSTALL option. - spec: switch to new done file name from docker-image-migrator - update to docker 1.10.3 (bnc#970637)
Runtime
Fix Docker client exiting with an "Unrecognized input header" error #20706
Fix Docker exiting if Exec is started with both AttachStdin and Detach #20647
Distribution
Fix a crash when pushing multiple images sharing the same layers to the same repository in parallel #20831
Fix a panic when pushing images to a registry which uses a misconfigured token service #21030
Plugin system
Fix issue preventing volume plugins to start when SELinux is enabled #20834
Prevent Docker from exiting if a volume plugin returns a null response for Get requests #20682
Fix plugin system leaking file descriptors if a plugin has an error #20680
Security
Fix linux32 emulation to fail during docker build #20672 It was due to the personality syscall being blocked by the default seccomp profile.
Fix Oracle XE 10g failing to start in a container #20981 It was due to the ipc syscall being blocked by the default seccomp profile.
Fix user namespaces not working on Linux From Scratch #20685
Fix issue preventing daemon to start if userns is enabled and the subuid or subgid files contain comments #20725
More at https://github.com/docker/docker/releases/tag/v1.10.3 - spec: improve file-based migration checks to make sure that it doesn't cause
errors if running on a /var/lib/docker without /var/lib/docker/graph. - spec: implement file-based migration checks. The migrator will be updated to
match the warning message's instructions. This looks like it works with my
testing. - more patches to build on ppc64 architecture
update netlink_gcc_go.patch
new netlink_netns_powerpc.patch
new boltdb_bolt_powerpc.patch
new libnetwork_drivers_bridge_powerpc.patch to replace
deleted fix-ppc64le.patch - fix bsc#968972 - let docker manage the cgroups of the processes
that it launches without systemd - Require docker-image-migrator (bnc#968933) Update to version 1.10.2 (bnc#968933)
- Runtime
Prevent systemd from deleting containers' cgroups when its configuration is reloaded #20518
Fix SELinux issues by disregarding --read-only when mounting /dev/mqueue #20333
Fix chown permissions used during docker cp when userns is used #20446
Fix configuration loading issue with all booleans defaulting to true #20471
Fix occasional panic with docker logs -f #20522
- Distribution
Keep layer reference if deletion failed to avoid a badly inconsistent state #20513
Handle gracefully a corner case when canceling migration #20372
Fix docker import on compressed data #20367
Fix tar-split files corruption during migration that later cause docker push and docker save to fail #20458
- Networking
Fix daemon crash if embedded DNS is sent garbage #20510
- Volumes
Fix issue with multiple volume references with same name #20381
- Security
Fix potential cache corruption and delegation conflict issues #20523
link to changelog:
https://github.com/docker/docker/blob/v1.10.2/CHANGELOG.md - fix-apparmor.patch: switch to a backported version of docker/docker#20305,
which also fixes several potential issues if the major version of apparmor
changes. - Remove 1.10.0 tarball. - Update to docker 1.10.1
It includes some fixes to 1.10.0, see detailed changelog in
https://github.com/docker/docker/blob/v1.10.1/CHANGELOG.md - Update docker to 1.10.0 (bnc#965918)
Add usernamespace support
Add support for custom seccomp profiles
Improvements in network and volume management
detailed changelog in
https://github.com/docker/docker/blob/590d5108bbdaabb05af590f76c9757daceb6d02e/CHANGELOG.md
- removed patches, because code has been merged in 1.10.0 release:
libcontainer-apparmor-fixes.patch: see: https://github.com/docker/docker/blob/release/v1.10/contrib/apparmor/template.go
fix_bnc_958255.patch: see https://github.com/docker/docker/commit/2b4f64e59018c21aacbf311d5c774dd5521b5352
use_fs_cgroups_by_default.patch
fix_cgroup.parent_path_sanitisation.patch
add_bolt_ppc64.patch
add_bolt_arm64.patch
add_bolt_s390x.patch
- remove gcc-go-build-static-libgo.patch: This has been replace by gcc-go-patches.patch
- removed patches, because arm and ppc are not build using the dynbinary target, but the dyngccgo one:
docker_remove_journald_to_fix_dynbinary_build_on_arm.patch
docker_remove_journald_to_fix_dynbinary_build_on_powerpc.patch
docker_remove_journald_to_fix_dynbinary_build_on_arm64.patch
- added patches:
fix_platform_type_arm.patch: fix build for arm64 and aarch64: set utsname as uint8 for arm64 and aarch64
gcc5_socket_workaround.patch: gcc5-go in Tumbleweed includes this commit
https://github.com/golang/gofrontend/commit/a850225433a66a58613c22185c3b09626f5545eb
Which "fixes" the data type for RawSockaddr.Data
However, docker now expects the "wrong" data type, since docker had a workaround
for that issue.
Thus, we need to workaround the workaround in tumbleweed
netlink_gcc_go.patch: add constants for syscalls TUNSETIFF and TUNSETPERSIST to fix a gcc issue.
This is a workaround for bnc#964468: gcc-go can no longer compile Docker.
fix-apparmor.patch: fix https://github.com/docker/docker/issues/20269 . It affects SLE12 which has apparmor
version 2.8 and not openSUSE which has version 2.9.
fix-ppc64le.patch: Build netlink driver using int8 and not uint8 for the data structure
- reviewed patches:
ignore-dockerinit-checksum.patch: review context in patch
fix-docker-init.patch: review patch because build method has been changed in spec file for gcc-go
gcc-go-patches.patch: review context in patch
- Build requires go >= 1.5: For version 1.9, we could use Go 1.4.3
see GO_VERSION https://github.com/docker/docker/blob/release/v1.9/Dockerfile
However, for version 1.10, we need go 1.5.3
see GO_VERSION https://github.com/docker/docker/blob/release/v1.10/Dockerfile
- fix bnc#965600 - SLES12 SP1 - Static shared memory limit in container - docker-mount-secrets.patch: fix up this patch to work on Docker 1.10 - docker-mount-secrets.patch: properly register /run/secrets as a
mountpoint, so that it is unmounted properly when the container
is removed and thus container removal works. (bnc#963142)
- docker-mount-secrets.patch: in addition, add some extra debugging
information to the secrets patch. - fix_json_econnreset_bug.patch: fix JSON bug that causes containers to not start
in weird circumstances. https://github.com/docker/docker/issues/14203 - fix_bnc_958255.patch: fix Docker creates strange apparmor profile
(bnc#958255)
- use_fs_cgroups_by_default.patch: Use fs cgroups by default:
https://github.com/docker/docker/commit/419fd7449fe1a984f582731fcd4d9455000846b0
- fix_cgroup.parent_path_sanitisation.patch: fix cgroup.Parent path
sanitisation:
https://github.com/opencontainers/runc/commit/bf899fef451956be4abd63de6d6141d9f9096a02
- Add rules for auditd. This is required to fix bnc#959405
- Remove 7 patches, add 6 and modify 1, after 1.9.1 upgrade
* Removed:
- docker_missing_ppc64le_netlink_linux_files.patch: the code that this
bug refers to has benn removed upstream
- docker_rename_jump_amd64_as_jump_linux.patch: the code that this bug
refers to has been removed upstream
- Remove fix_15279.patch: code has been merged upstream
- Remove add_missing_syscall_for_s390x.patch: code has been merged upstream
- Remove fix_incompatible_assignment_error_bnc_950931.patch: code has been
merged upstream
- Remove fix_libsecomp_error_bnc_950931.patch: the code that this bug refers to
has been removed upstream
- Remove gcc5_socket_workaround.patch: Code has been fixed. Building with
this patch is giving the error we were trying to fix, implying that the
code has been fixed somewhere else.
* Added:
- add_bolt_ppc64.patch
- add_bolt_arm64.patch
- docker_remove_journald_to_fix_dynbinary_build_on_arm.patch
- docker_remove_journald_to_fix_dynbinary_build_on_powerpc.patch
- docker_remove_journald_to_fix_dynbinary_build_on_arm64.patch
- gcc-go-build-static-libgo.patch: enable static linking of libgo in ggc-go
In order to do this, we had to work-around an issue from gcc-go:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69357
* Modify:
- Upgrade to 1.9.1(bnc#956434)
* Runtime:
- Do not prevent daemon from booting if images could not be restored
(#17695)
- Force IPC mount to unmount on daemon shutdown/init (#17539)
- Turn IPC unmount errors into warnings (#17554)
- Fix `docker stats` performance regression (#17638)
- Clarify cryptic error message upon `docker logs` if `--log-driver=none`
(#17767)
- Fix seldom panics (#17639, #17634, #17703)
- Fix opq whiteouts problems for files with dot prefix (#17819)
- devicemapper: try defaulting to xfs instead of ext4 for performance
reasons (#17903, #17918)
- devicemapper: fix displayed fs in docker info (#17974)
- selinux: only relabel if user requested so with the `z` option
(#17450, #17834)
- Do not make network calls when normalizing names (#18014)
* Client:
- Fix `docker login` on windows (#17738)
- Fix bug with `docker inspect` output when not connected to daemon
(#17715)
- Fix `docker inspect -f {{.HostConfig.Dns}} somecontainer` (#17680)
* Builder:
- Fix regression with symlink behavior in ADD/COPY (#17710)
* Networking:
- Allow passing a network ID as an argument for `--net` (#17558)
- Fix connect to host and prevent disconnect from host for `host` network
(#17476)
- Fix `--fixed-cidr` issue when gateway ip falls in ip-range and ip-range
is not the first block in the network (#17853)
- Restore deterministic `IPv6` generation from `MAC` address on default
`bridge` network (#17890)
- Allow port-mapping only for endpoints created on docker run (#17858)
- Fixed an endpoint delete issue with a possible stale sbox (#18102)
* Distribution:
- Correct parent chain in v2 push when v1Compatibility files on the disk
are inconsistent (#18047)
- Update to version 1.9.0 (bnc#954812):
* Runtime:
- `docker stats` now returns block IO metrics (#15005)
- `docker stats` now details network stats per interface (#15786)
- Add `ancestor=` filter to `docker ps --filter` flag to filter
containers based on their ancestor images (#14570)
- Add `label=` filter to `docker ps --filter` to filter
containers based on label (#16530)
- Add `--kernel-memory` flag to `docker run` (#14006)
- Add `--message` flag to `docker import` allowing to specify an optional
message (#15711)
- Add `--privileged` flag to `docker exec` (#14113)
- Add `--stop-signal` flag to `docker run` allowing to replace the
container process stopping signal (#15307)
- Add a new `unless-stopped` restart policy (#15348)
- Inspecting an image now returns tags (#13185)
- Add container size information to `docker inspect` (#15796)
- Add `RepoTags` and `RepoDigests` field to `/images/{name:.*}/json`
(#17275)
- Remove the deprecated `/container/ps` endpoint from the API (#15972)
- Send and document correct HTTP codes for `/exec//start` (#16250)
- Share shm and mqueue between containers sharing IPC namespace (#15862)
- Event stream now shows OOM status when `--oom-kill-disable` is
set (#16235)
- Ensure special network files (/etc/hosts etc.) are read-only if
bind-mounted
with `ro` option (#14965)
- Improve `rmi` performance (#16890)
- Do not update /etc/hosts for the default bridge network, except for links
(#17325)
- Fix conflict with duplicate container names (#17389)
- Fix an issue with incorrect template execution in `docker inspect`
(#17284)
- DEPRECATE `-c` short flag variant for `--cpu-shares` in docker run
(#16271)
* Client:
- Allow `docker import` to import from local files (#11907)
* Builder:
- Add a `STOPSIGNAL` Dockerfile instruction allowing to set a different
stop-signal for the container process (#15307)
- Add an `ARG` Dockerfile instruction and a `--build-arg` flag to
`docker build`
that allows to add build-time environment variables (#15182)
- Improve cache miss performance (#16890)
* Storage:
- devicemapper: Implement deferred deletion capability (#16381)
* Networking:
- `docker network` exits experimental and is part of standard release
(#16645)
- New network top-level concept, with associated subcommands and API
(#16645)
WARNING: the API is different from the experimental API
- Support for multiple isolated/micro-segmented networks (#16645)
- Built-in multihost networking using VXLAN based overlay driver (#14071)
- Support for third-party network plugins (#13424)
- Ability to dynamically connect containers to multiple networks (#16645)
- Support for user-defined IP address management via pluggable IPAM drivers
(#16910)
- Add daemon flags `--cluster-store` and `--cluster-advertise` for built-in
nodes discovery (#16229)
- Add `--cluster-store-opt` for setting up TLS settings (#16644)
- Add `--dns-opt` to the daemon (#16031)
- DEPRECATE following container `NetworkSettings` fields in API v1.21:
`EndpointID`, `Gateway`, `GlobalIPv6Address`, `GlobalIPv6PrefixLen`,
`IPAddress`, `IPPrefixLen`, `IPv6Gateway` and `MacAddress`.
Those are now specific to the `bridge` network. Use
`NetworkSettings.Networks` to inspect
the networking settings of a container per network.
* Volumes:
- New top-level `volume` subcommand and API (#14242)
- Move API volume driver settings to host-specific config (#15798)
- Print an error message if volume name is not unique (#16009)
- Ensure volumes created from Dockerfiles always use the local volume driver
(#15507)
- DEPRECATE auto-creating missing host paths for bind mounts (#16349)
* Logging:
- Add `awslogs` logging driver for Amazon CloudWatch (#15495)
- Add generic `tag` log option to allow customizing container/image
information passed to driver (e.g. show container names) (#15384)
- Implement the `docker logs` endpoint for the journald driver (#13707)
- DEPRECATE driver-specific log tags (e.g. `syslog-tag`, etc.) (#15384)
* Distribution:
- `docker search` now works with partial names (#16509)
- Push optimization: avoid buffering to file (#15493)
- The daemon will display progress for images that were already being
pulled by another client (#15489)
- Only permissions required for the current action being performed are
requested (#)
- Renaming trust keys (and respective environment variables) from `offline`
to `root` and `tagging` to `repository` (#16894)
- DEPRECATE trust key environment variables
`DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE` and
`DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE` (#16894)
* Security:
- Add SELinux profiles to the rpm package (#15832)
- Fix various issues with AppArmor profiles provided in the deb package
(#14609)
- Add AppArmor policy that prevents writing to /proc (#15571)
- Change systemd unit file to no longer use the deprecated "-d" option
(bnc#954737) - Changed docker-mount-secrets.patch: allow removal of containers
even when the entry point failed. bnc#954797 - Fixed the format of the fix_libsecomp_error_bnc_950931 patch. - Merged the fix_libsecomp_error_bnc_950931.patch and the
fix_x86_build_removing_empty_file_jump_amd_64.patch patches. - Fix build for x86_64. Patch fix_libsecomp_error_bnc_950931.patch
had created and empty file jump_amd64.go instead of removing it.
This broke the build for x86_64.
This commit fixes it by removing that empty file.
fix_x86_build_removing_empty_file_jump_amd_64.patch: patch that
removes empty file jump_amd64.go - Added patch that fixes a known gcc-go for ppc64xe in the syscall.RawSockAddr
type.
gcc5_socket_workaround.patch - Add patches for fixing ppc64le build (bnc#950931)
fix_libsecomp_error_bnc_950931.patch
fix_incompatible_assignment_error_bnc_950931.patch
docker_missing_ppc64le_netlink_linux_files.patch
- Remove docker_rename_jump_amd64_as_jump_linux.patch because it clashes
with the previous patches. - Exclude libgo as a requirement. The auto requires script was adding
libgo as a requirement when building with gcc-go which was wrong. - Add patch for missing systemcall for s390x. See
https://github.com/docker/docker/commit/eecf6cd48cf7c48f00aa8261cf431c87084161ae
add_missing_syscall_for_s390x.patch: contains the patch
- Exclude s390x for sle12 because it hangs when running go. It works for sle12sp1
thus we don't want to exclude sle12sp1 but only sle12. - Update docker to 1.8.3 version:
* Fix layer IDs lead to local graph poisoning (CVE-2014-8178) (bnc#949660)
* Fix manifest validation and parsing logic errors allow pull-by-digest validation bypass (CVE-2014-8179)
* Add `--disable-legacy-registry` to prevent a daemon from using a v1 registry - Update docker to 1.8.2 version
see detailed changelog in
https://github.com/docker/docker/releases/tag/v1.8.2
fix bsc#946653 update do docker 1.8.2
- devicemapper: fix zero-sized field access
Fix issue #15279: does not build with Go 1.5 tip
Due to golang/go@7904946
the devices field is dropped.
This solution works on go1.4 and go1.5
See more in https://github.com/docker/docker/pull/15404
This fix was not included in v1.8.2. See previous link
on why.
fix_15279.patch: contains the patch for issue#15279 - new patch as per upstream issue
https://github.com/docker/docker/issues/14056#issuecomment-113680944
docker_rename_jump_amd64_as_jump_linux.patch - ignore-dockerinit-checksum.patch need -p1 in spec - Update to docker 1.8.1(bsc#942369 and bsc#942370):
- Fix a bug where pushing multiple tags would result in invalid images
- Update to docker 1.8.0:
see detailed changelog in
https://github.com/docker/docker/releases/tag/v1.8.0
- remove docker-netns-aarch64.patch: This patch was adding
vendor/src/github.com/vishvananda/netns/netns_linux_arm64.go
which is now included upstream, so we don't need this patch anymore - Remove 0002-Stripped-dockerinit-binary.patch because we do not
use it anymore (we got rid of that when updating to 1.7.1) - Exclude archs where docker does not build. Otherwise it gets into
and infinite loop when building.
We'll fix that later if we want to release for those archs. - Update to 1.7.1 (2015-07-14) (bnc#938156)
* Runtime
- Fix default user spawning exec process with docker exec
- Make --bridge=none not to configure the network bridge
- Publish networking stats properly
- Fix implicit devicemapper selection with static binaries
- Fix socket connections that hung intermittently
- Fix bridge interface creation on CentOS/RHEL 6.6
- Fix local dns lookups added to resolv.conf
- Fix copy command mounting volumes
- Fix read/write privileges in volumes mounted with --volumes-from
* Remote API
- Fix unmarshalling of Command and Entrypoint
- Set limit for minimum client version supported
- Validate port specification
- Return proper errors when attach/reattach fail
* Distribution
- Fix pulling private images
- Fix fallback between registry V2 and V1 - Exclude init scripts other than systemd from the test-package - Exclude intel 32 bits arch. Docker does not built on that. Let's
make it explicit. - rediff ignore-dockerinit-checksum.patch, gcc-go-build-static-libgo.patch
to make them apply again.
- introduce go_arches for architectures that use the go compiler
instead of gcc-go
- add docker-netns-aarch64.patch: Add support for AArch64
- enable build for aarch64 - Build man pages only on platforms where gc compiler is available. - Updated to 1.7.0 (2015-06-16) - bnc#935570
* Runtime
- Experimental feature: support for out-of-process volume plugins
- The userland proxy can be disabled in favor of hairpin NAT using the daemon’s `--userland-proxy=false` flag
- The `exec` command supports the `-u|--user` flag to specify the new process owner
- Default gateway for containers can be specified daemon-wide using the `--default-gateway` and `--default-gateway-v6` flags
- The CPU CFS (Completely Fair Scheduler) quota can be set in `docker run` using `--cpu-quota`
- Container block IO can be controlled in `docker run` using`--blkio-weight`
- ZFS support
- The `docker logs` command supports a `--since` argument
- UTS namespace can be shared with the host with `docker run --uts=host`
* Quality
- Networking stack was entirely rewritten as part of the libnetwork effort
- Engine internals refactoring
- Volumes code was entirely rewritten to support the plugins effort
- Sending SIGUSR1 to a daemon will dump all goroutines stacks without exiting
* Build
- Support ${variable:-value} and ${variable:+value} syntax for environment variables
- Support resource management flags `--cgroup-parent`, `--cpu-period`, `--cpu-quota`, `--cpuset-cpus`, `--cpuset-mems`
- git context changes with branches and directories
- The .dockerignore file support exclusion rules
* Distribution
- Client support for v2 mirroring support for the official registry
* Bugfixes
- Firewalld is now supported and will automatically be used when available
- mounting --device recursively
- Patch 0002-Stripped-dockerinit-binary.patch renamed to fix-docker-init.patch
and fixed to build with latest version of docker - Add test subpackage and fix line numbers in patches - Fixed ppc64le name inside of spec file - Build docker on PPC and S390x using gcc-go provided by gcc5
* added sysconfig.docker.ppc64le: make docker daemon start on ppc64le
despite some iptables issues. To be removed soon
* ignore-dockerinit-checksum.patch: applied only when building with
gcc-go. Required to workaround a limitation of gcc-go
* gcc-go-build-static-libgo.patch: used only when building with gcc-go,
link libgo statically into docker itself. - Remove set-SCC_URL-env-variable.patch, the SCC_URL is now read
from SUSEConnect by the container service - Automatically set SCC_URL environment variable inside of the
containers by parsing the /etc/SUSEConnect.example file
* Add set-SCC_URL-env-variable.patch - Place SCC machine credentials inside of /run/secrets/credentials.d
* Edit docker-mount-scc-credentials.patch¬ - pass the SCC machine credentials to the container
* Add docker-mount-scc-credentials.patch - build and install man pages - Update to version 1.6.2 (2015-05-13) [bnc#931301]
* Revert change prohibiting mounting into /sys Updated to version 1.6.1 (2015-05-07) [bnc#930235]
* Security
- Fix read/write /proc paths (CVE-2015-3630)
- Prohibit VOLUME /proc and VOLUME / (CVE-2015-3631)
- Fix opening of file-descriptor 1 (CVE-2015-3627)
- Fix symlink traversal on container respawn allowing local privilege escalation (CVE-2015-3629)
- Prohibit mount of /sys
* Runtime
- Update Apparmor policy to not allow mounts
- Updated libcontainer-apparmor-fixes.patch: adapt patch to reflect
changes introduced by docker 1.6.1 - Get rid of SocketUser and SocketGroup workarounds for docker.socket - Updated to version 1.6.0 (2015-04-07) [bnc#908033]
* Builder:
+ Building images from an image ID
+ build containers with resource constraints, ie `docker build --cpu-shares=100 --memory=1024m...`
+ `commit --change` to apply specified Dockerfile instructions while committing the image
+ `import --change` to apply specified Dockerfile instructions while importing the image
+ basic build cancellation
* Client:
+ Windows Support
* Runtime:
+ Container and image Labels
+ `--cgroup-parent` for specifying a parent cgroup to place container cgroup within
+ Logging drivers, `json-file`, `syslog`, or `none`
+ Pulling images by ID
+ `--ulimit` to set the ulimit on a container
+ `--default-ulimit` option on the daemon which applies to all created containers (and overwritten by `--ulimit` on run)
- Updated '0002-Stripped-dockerinit-binary.patch' to reflect changes inside of
the latest version of Docker.
- bnc#908033: support of Docker Registry API v2. - enable build for armv7l - Updated docker.spec to fixed building with the latest version of our
Go pacakge.
- Updated 0002-Stripped-dockerinit-binary.patch to fix check made by
the docker daemon against the dockerinit binary. - Updated systemd service and socket units to fix socket activation
and to align with best practices recommended by upstram. Moreover
socket activation fixes bnc#920645. - Updated to 1.5.0 (2015-02-10):
* Builder:
- Dockerfile to use for a given `docker build` can be specified with
the `-f` flag
- Dockerfile and .dockerignore files can be themselves excluded as part
of the .dockerignore file, thus preventing modifications to these files
invalidating ADD or COPY instructions cache
- ADD and COPY instructions accept relative paths
- Dockerfile `FROM scratch` instruction is now interpreted as a no-base
specifier
- Improve performance when exposing a large number of ports
* Hack:
- Allow client-side only integration tests for Windows
- Include docker-py integration tests against Docker daemon as part of our
test suites
* Packaging:
- Support for the new version of the registry HTTP API
- Speed up `docker push` for images with a majority of already existing
layers
- Fixed contacting a private registry through a proxy
* Remote API:
- A new endpoint will stream live container resource metrics and can be
accessed with the `docker stats` command
- Containers can be renamed using the new `rename` endpoint and the
associated `docker rename` command
- Container `inspect` endpoint show the ID of `exec` commands running in
this container
- Container `inspect` endpoint show the number of times Docker
auto-restarted the container
- New types of event can be streamed by the `events` endpoint: ‘OOM’
(container died with out of memory), ‘exec_create’, and ‘exec_start'
- Fixed returned string fields which hold numeric characters incorrectly
omitting surrounding double quotes
* Runtime:
- Docker daemon has full IPv6 support
- The `docker run` command can take the `--pid=host` flag to use the host
PID namespace, which makes it possible for example to debug host processes
using containerized debugging tools
- The `docker run` command can take the `--read-only` flag to make the
container’s root filesystem mounted as readonly, which can be used in
combination with volumes to force a container’s processes to only write to
locations that will be persisted
- Container total memory usage can be limited for `docker run` using the
`—memory-swap` flag
- Major stability improvements for devicemapper storage driver
- Better integration with host system: containers will reflect changes
to the host's `/etc/resolv.conf` file when restarted
- Better integration with host system: per-container iptable rules are moved
to the DOCKER chain
- Fixed container exiting on out of memory to return an invalid exit code
* Other:
- The HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables are
properly taken into account by the client when connecting to the
Docker daemon - Updated to 1.4.1 (2014-12-15):
* Runtime:
- Fix issue with volumes-from and bind mounts not being honored after
create (fixes bnc#913213) - Added e2fsprogs as runtime dependency, this is required when the
devicemapper driver is used. (bnc#913211).
- Fixed owner & group for docker.socket (thanks to Andrei Dziahel and
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752555#5) - Updated to 1.4.0 (2014-12-11):
* Notable Features since 1.3.0:
- Set key=value labels to the daemon (displayed in `docker info`), applied with
new `-label` daemon flag
- Add support for `ENV` in Dockerfile of the form:
`ENV name=value name2=value2...`
- New Overlayfs Storage Driver
- `docker info` now returns an `ID` and `Name` field
- Filter events by event name, container, or image
- `docker cp` now supports copying from container volumes
- Fixed `docker tag`, so it honors `--force` when overriding a tag for existing
image.
- Changes introduced by 1.3.3 (2014-12-11):
* Security:
- Fix path traversal vulnerability in processing of absolute symbolic links (CVE-2014-9356) - (bnc#909709)
- Fix decompression of xz image archives, preventing privilege escalation (CVE-2014-9357) - (bnc#909710)
- Validate image IDs (CVE-2014-9358) - (bnc#909712)
* Runtime:
- Fix an issue when image archives are being read slowly
* Client:
- Fix a regression related to stdin redirection
- Fix a regression with `docker cp` when destination is the current directory - Updated to 1.3.2 (2014-11-20) - fixes bnc#907012 (CVE-2014-6407) and
bnc#907014 (CVE-2014-6408)
* Security:
- Fix tar breakout vulnerability
- Extractions are now sandboxed chroot
- Security options are no longer committed to images
* Runtime:
- Fix deadlock in `docker ps -f exited=1`
- Fix a bug when `--volumes-from` references a container that failed to start
* Registry:
- `--insecure-registry` now accepts CIDR notation such as 10.1.0.0/16
- Private registries whose IPs fall in the 127.0.0.0/8 range do no need
the `--insecure-registry` flag
- Skip the experimental registry v2 API when mirroring is enabled
- Fixed minor packaging issues. - Updated to version 1.3.1 2014-10-28)
* Security:
- Prevent fallback to SSL protocols < TLS 1.0 for client, daemon and
registry [CVE-2014-5277]
- Secure HTTPS connection to registries with certificate verification and
without HTTP fallback unless `--insecure-registry` is specified
* Runtime:
- Fix issue where volumes would not be shared
* Client:
- Fix issue with `--iptables=false` not automatically
setting `--ip-masq=false`
- Fix docker run output to non-TTY stdout
* Builder:
- Fix escaping `$` for environment variables
- Fix issue with lowercase `onbuild` Dockerfile instruction
- Restrict envrionment variable expansion to `ENV`, `ADD`, `COPY`,
`WORKDIR`, `EXPOSE`, `VOLUME` and `USER` - Upgraded to version 1.3.0 (2014-10-14)
* docker `exec` allows you to run additional processes inside existing containers
* docker `create` gives you the ability to create a container via the cli without executing a process
* `--security-opts` options to allow user to customize container labels and apparmor profiles
* docker `ps` filters
* wildcard support to copy/add
* move production urls to get.docker.com from get.docker.io
* allocate ip address on the bridge inside a valid cidr
* use drone.io for pr and ci testing
* ability to setup an official registry mirror
* Ability to save multiple images with docker `save` /bin/sh /bin/sh /bin/sh /bin/sh docker-libnetwork s390zp35 1723047642
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ 25.0.6_ce-150000.207.1 25.0.6_ce-150000.207.1 25.0.6_ce-150000.207.1 0.7.0.2.25.0.6_ce 0.7.0.2
docker.rules docker daemon.json docker docker-proxy dockerd docker cli-plugins docker.service docker.socket docker.conf 80-docker.rules rcdocker docker README.md README_SUSE.md sysconfig.docker docker LICENSE docker-attach.1.gz docker-build.1.gz docker-builder-build.1.gz docker-builder-prune.1.gz docker-builder.1.gz docker-checkpoint-create.1.gz docker-checkpoint-ls.1.gz docker-checkpoint-rm.1.gz docker-checkpoint.1.gz docker-commit.1.gz docker-config-create.1.gz docker-config-inspect.1.gz docker-config-ls.1.gz docker-config-rm.1.gz docker-config.1.gz docker-container-attach.1.gz docker-container-commit.1.gz docker-container-cp.1.gz docker-container-create.1.gz docker-container-diff.1.gz docker-container-exec.1.gz docker-container-export.1.gz docker-container-inspect.1.gz docker-container-kill.1.gz docker-container-logs.1.gz docker-container-ls.1.gz docker-container-pause.1.gz docker-container-port.1.gz docker-container-prune.1.gz docker-container-rename.1.gz docker-container-restart.1.gz docker-container-rm.1.gz docker-container-run.1.gz docker-container-start.1.gz docker-container-stats.1.gz docker-container-stop.1.gz docker-container-top.1.gz docker-container-unpause.1.gz docker-container-update.1.gz docker-container-wait.1.gz docker-container.1.gz docker-context-create.1.gz docker-context-export.1.gz docker-context-import.1.gz docker-context-inspect.1.gz docker-context-ls.1.gz docker-context-rm.1.gz docker-context-show.1.gz docker-context-update.1.gz docker-context-use.1.gz docker-context.1.gz docker-cp.1.gz docker-create.1.gz docker-diff.1.gz docker-events.1.gz docker-exec.1.gz docker-export.1.gz docker-history.1.gz docker-image-build.1.gz docker-image-history.1.gz docker-image-import.1.gz docker-image-inspect.1.gz docker-image-load.1.gz docker-image-ls.1.gz docker-image-prune.1.gz docker-image-pull.1.gz docker-image-push.1.gz docker-image-rm.1.gz docker-image-save.1.gz docker-image-tag.1.gz docker-image.1.gz docker-images.1.gz docker-import.1.gz docker-info.1.gz docker-inspect.1.gz docker-kill.1.gz docker-load.1.gz docker-login.1.gz docker-logout.1.gz docker-logs.1.gz docker-manifest-annotate.1.gz docker-manifest-create.1.gz docker-manifest-inspect.1.gz docker-manifest-push.1.gz docker-manifest-rm.1.gz docker-manifest.1.gz docker-network-connect.1.gz docker-network-create.1.gz docker-network-disconnect.1.gz docker-network-inspect.1.gz docker-network-ls.1.gz docker-network-prune.1.gz docker-network-rm.1.gz docker-network.1.gz docker-node-demote.1.gz docker-node-inspect.1.gz docker-node-ls.1.gz docker-node-promote.1.gz docker-node-ps.1.gz docker-node-rm.1.gz docker-node-update.1.gz docker-node.1.gz docker-pause.1.gz docker-plugin-create.1.gz docker-plugin-disable.1.gz docker-plugin-enable.1.gz docker-plugin-inspect.1.gz docker-plugin-install.1.gz docker-plugin-ls.1.gz docker-plugin-push.1.gz docker-plugin-rm.1.gz docker-plugin-set.1.gz docker-plugin-upgrade.1.gz docker-plugin.1.gz docker-port.1.gz docker-ps.1.gz docker-pull.1.gz docker-push.1.gz docker-rename.1.gz docker-restart.1.gz docker-rm.1.gz docker-rmi.1.gz docker-run.1.gz docker-save.1.gz docker-search.1.gz docker-secret-create.1.gz docker-secret-inspect.1.gz docker-secret-ls.1.gz docker-secret-rm.1.gz docker-secret.1.gz docker-service-create.1.gz docker-service-inspect.1.gz docker-service-logs.1.gz docker-service-ls.1.gz docker-service-ps.1.gz docker-service-rm.1.gz docker-service-rollback.1.gz docker-service-scale.1.gz docker-service-update.1.gz docker-service.1.gz docker-stack-config.1.gz docker-stack-deploy.1.gz docker-stack-ls.1.gz docker-stack-ps.1.gz docker-stack-rm.1.gz docker-stack-services.1.gz docker-stack.1.gz docker-start.1.gz docker-stats.1.gz docker-stop.1.gz docker-swarm-ca.1.gz docker-swarm-init.1.gz docker-swarm-join-token.1.gz docker-swarm-join.1.gz docker-swarm-leave.1.gz docker-swarm-unlock-key.1.gz docker-swarm-unlock.1.gz docker-swarm-update.1.gz docker-swarm.1.gz docker-system-df.1.gz docker-system-events.1.gz docker-system-info.1.gz docker-system-prune.1.gz docker-system.1.gz docker-tag.1.gz docker-top.1.gz docker-trust-inspect.1.gz docker-trust-key-generate.1.gz docker-trust-key-load.1.gz docker-trust-key.1.gz docker-trust-revoke.1.gz docker-trust-sign.1.gz docker-trust-signer-add.1.gz docker-trust-signer-remove.1.gz docker-trust-signer.1.gz docker-trust.1.gz docker-unpause.1.gz docker-update.1.gz docker-version.1.gz docker-volume-create.1.gz docker-volume-inspect.1.gz docker-volume-ls.1.gz docker-volume-prune.1.gz docker-volume-rm.1.gz docker-volume-update.1.gz docker-volume.1.gz docker-wait.1.gz docker.1.gz Dockerfile.5.gz dockerd.8.gz docker /etc/audit/rules.d/ /etc/ /etc/docker/ /usr/bin/ /usr/lib/ /usr/lib/docker/ /usr/lib/systemd/system/ /usr/lib/sysusers.d/ /usr/lib/udev/rules.d/ /usr/sbin/ /usr/share/doc/packages/ /usr/share/doc/packages/docker/ /usr/share/fillup-templates/ /usr/share/licenses/ /usr/share/licenses/docker/ /usr/share/man/man1/ /usr/share/man/man5/ /usr/share/man/man8/ /var/lib/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:35144/SUSE_SLE-15_Update/42fdbbf4c156f3009e51667182a23c21-docker.SUSE_SLE-15_Update drpm xz 5 s390x-suse-linux
ASCII text directory ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=103873c36765613f243a43a2e5a4668753301ff5, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=8a02aa95e468025a1fe0d5be7fd27e74a4b40b2a, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=ac24788590f2389a7ee3cf9a76c6ae14d50e9172, for GNU/Linux 3.2.0, stripped UTF-8 Unicode text troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix) troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) "
R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R P P ۅ6 |U8i apparmor-parser docker-buildx docker-rootless-extras git-core lvm2 1.7 2.2.89 utf-8 8bc14018325cc9260dd776622fcad28e9d84e164748d0ed705b74b1e4d90b6c9 ? @ 7zXZ
! t/ p ] "k%V&ۨ5rl?K44e\ϰ甡'(D A*Z6}=`d.8ÙNr/hw0OiQ>w'wQ#CQmewU% ArF11S7%:
$0GHAᶐp+-Ȑ t@i>C DT SD/LT L! и}IR?[Х؛ćqܯQ[;b.i
6>r\ԫ
Xͺ'V8c z0j7=V/żzǝ 7єgB{i[DB[7ݴ \k /ܧnTztYb2y6toY8 E;MH3D"Ho8ZH <4\ dC!YrV]9:07}W[@|Ve/Y} ! \½Y)h(gjwKaܱ= `1U3TS <,bm yzW `+)̾e ʺ칷08NOqĿn\83 zRn©"CpxsoBq[<} ܵ &E '$82#`& L 2q
ǀ|zf<`*yH)(){q_Z8fK)L|ҭ DBW1/S U*YzͿ _qfPI
$q7줴f2M
Dy
>(TJR_zC0/[#OZ@S AiŴQ+17NY,^є6;(MmuO)}f~Rꈇ~^-) UHL,@b.Xƀcrq# c,|DO\O&s tlɉ&γUOXSo)},~-I^Cd-oM^!:6 W{E6Jl)+M5u攎Aqy /sxRUS-/$ W 6RvZ;n A 3X&K8ܧZMsLuDE$#KZOc!R1Ojv
w77ňԙ'S ǽjჶ10 F+
ؒ pBңR- 3H(Q Euh(1I60RlA'1)57O? ʚ&23usP
B
̗tzIF*^~iJGI)7Zl, nx$&FX)Nxf`&|M$wdatp}$u _جwf۵2 R+젫LŌ}˷fύ{MZ`Se I
zC ^\ \* -v C"Dp $cf9˽ 6,*hy{BfRV*}C*\`&^
4ݚ۪}С/XU^3LQqfď^磎x FW&Dʽ!4eTsvE+HCG/Yai.3xgZ:
?CQ>>@d.g *?F1S;iJ_סb oCCg;~蘶5{;-ABY3Q*+زs>m̧zتHy/ D
6>N][ʂ=gu27eGw#xJR![LAƆ3MCժT|e\ N0MF 3CldQc
NK((\.P^wUݬזf>!ȉ@p"}0
g+ fɄQ;
͟3{XM:m?E
nXO
\Qo5#
T
~К} da 9'Usy]eWB #iz&ߵإspcKS:Ը
ª`jb,987fu eo 7i 8 t`Ķ
YZ