Skip to content

Error on empty dockerfile#38487

Merged
thaJeztah merged 3 commits intomoby:masterfrom
LinuxMercedes:error-on-empty-dockerfile
Jan 15, 2019
Merged

Error on empty dockerfile#38487
thaJeztah merged 3 commits intomoby:masterfrom
LinuxMercedes:error-on-empty-dockerfile

Conversation

@LinuxMercedes
Copy link
Contributor

- What I did
Fixed a panic when running docker build on a dockerfile containing only a comment.

(Docker used to error on this a few years back, but sometime in between now and then something changed.)

- How I did it
Detect whether the root AST node is created from a dockerfile with no AST constructs.

- How to verify it

echo "#hello" > Dockerfile
docker build .
sudo systemctl status docker

- Description for the changelog

Fixed panic when building dockerfiles containing only comments.

- A picture of a cute animal (not mandatory but encouraged)
it's hank, she's my friend

@GordonTheTurtle GordonTheTurtle added the dco/no Automatically set by a bot when one of the commits lacks proper signature label Jan 3, 2019
@GordonTheTurtle
Copy link

Please sign your commits following these rules:
https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:

$ git clone -b "error-on-empty-dockerfile" [email protected]:LinuxMercedes/moby.git somewhere
$ cd somewhere
$ git rebase -i HEAD~842354124160
editor opens
change each 'pick' to 'edit'
save the file and quit
$ git commit --amend -s --no-edit
$ git rebase --continue # and repeat the amend for each commit
$ git push -f

Amending updates the existing PR. You DO NOT need to open a new one.

@thaJeztah
Copy link
Member

Thanks! Looks like you forgot to sign-off the commits; you can use the instructions that @GordonTheTurtle (our bot) provided above to fix that

@GordonTheTurtle GordonTheTurtle removed the dco/no Automatically set by a bot when one of the commits lacks proper signature label Jan 3, 2019
@codecov
Copy link

codecov bot commented Jan 3, 2019

Codecov Report

Merging #38487 into master will decrease coverage by 0.03%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master   #38487      +/-   ##
==========================================
- Coverage   36.64%    36.6%   -0.04%     
==========================================
  Files         608      608              
  Lines       45173    45270      +97     
==========================================
+ Hits        16552    16572      +20     
- Misses      26336    26412      +76     
- Partials     2285     2286       +1

@LinuxMercedes LinuxMercedes changed the title Error on empty dockerfile WIP Error on empty dockerfile Jan 3, 2019
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for finding this issue! I left some comments below; I think this fix may actually have to be made in the upstream buildkit repo, where parse.Parse() is vendored from; https://github.com/moby/buildkit/blob/3f8ab160d5079539f9ed971fb069e4205108dd9d/frontend/dockerfile/parser/parser.go#L214-L283

@LinuxMercedes LinuxMercedes changed the title WIP Error on empty dockerfile Error on empty dockerfile Jan 4, 2019
@thaJeztah thaJeztah requested a review from AkihiroSuda January 4, 2019 00:27
@LinuxMercedes
Copy link
Contributor Author

Alright, I've opened a PR against buildkit: moby/buildkit#771

Couple questions:

  1. One nice thing about handling this error in moby is that we can include the Dockerfile name if it exists. I feel like that'd be a useful attribute to keep -- do y'all have suggestions on how to reformat the error here to include the filename? Or should I not worry about it?
  2. Should I update the vendoring in this PR once that PR is merged?

Hanks for the help <3

@tonistiigi
Copy link
Member

One nice thing about handling this error in moby is that we can include the Dockerfile name if it exists. I feel like that'd be a useful attribute to keep -- do y'all have suggestions on how to reformat the error here to include the filename? Or should I not worry about it?

errors.Wrapf(err, "failed to parse %s", name)

Should I update the vendoring in this PR once that PR is merged?

yes

@GordonTheTurtle GordonTheTurtle added dco/no Automatically set by a bot when one of the commits lacks proper signature and removed dco/no Automatically set by a bot when one of the commits lacks proper signature labels Jan 5, 2019
@LinuxMercedes
Copy link
Contributor Author

Alright, I think this is all fixed and ready to go!

Copy link
Contributor

@fntlnz fntlnz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks @LinuxMercedes

@thaJeztah
Copy link
Member

Thanks! I built this PR and gave it a try;

1. With Docker CLI 17.06 and no buildkit

1.1 Comment-only Dockerfile:

docker build -t foo -<<'EOF'
# only a comment
EOF
Sending build context to Docker daemon  2.048kB
Error response from daemon: failed to parse Dockerfile: file with no instructions.

1.2 Empty lines only:

docker build -t foo -<<'EOF'



EOF
Sending build context to Docker daemon  2.048kB
Error response from daemon: failed to parse Dockerfile: file with no instructions.

1.3 Empty Dockerfile;

docker build -t foo -<<'EOF'
EOF
Sending build context to Docker daemon  1.536kB
Error response from daemon: the Dockerfile (Dockerfile) cannot be empty

However, I see we need to make some changes so that the API returns a proper (4xx) error, because it currently doesn't return a typed error, thus a 500 error is returned (see details below);

Details
ERRO[2019-01-07T15:41:02.274166785Z] Handler for POST /v1.30/build returned error: failed to parse Dockerfile: file with no instructions. 
DEBU[2019-01-07T15:41:02.274501230Z] FIXME: Got an API for which error does not match any expected type!!!: file with no instructions.
github.com/docker/docker/vendor/github.com/moby/buildkit/frontend/dockerfile/parser.Parse
	/go/src/github.com/docker/docker/vendor/github.com/moby/buildkit/frontend/dockerfile/parser/parser.go:280
github.com/docker/docker/builder/remotecontext.readAndParseDockerfile
	/go/src/github.com/docker/docker/builder/remotecontext/detect.go:155
github.com/docker/docker/builder/remotecontext.withDockerfileFromContext
	/go/src/github.com/docker/docker/builder/remotecontext/detect.go:77
github.com/docker/docker/builder/remotecontext.newArchiveRemote
	/go/src/github.com/docker/docker/builder/remotecontext/detect.go:58
github.com/docker/docker/builder/remotecontext.Detect
	/go/src/github.com/docker/docker/builder/remotecontext/detect.go:33
github.com/docker/docker/builder/dockerfile.(*BuildManager).Build
	/go/src/github.com/docker/docker/builder/dockerfile/builder.go:88
github.com/docker/docker/api/server/backend/build.(*Backend).Build
	/go/src/github.com/docker/docker/api/server/backend/build/backend.go:60
github.com/docker/docker/api/server/router/build.(*buildRouter).postBuild
	/go/src/github.com/docker/docker/api/server/router/build/build_routes.go:270
github.com/docker/docker/api/server/router/build.(*buildRouter).postBuild-fm
	/go/src/github.com/docker/docker/api/server/router/build/build.go:34
github.com/docker/docker/api/server/middleware.ExperimentalMiddleware.WrapHandler.func1
	/go/src/github.com/docker/docker/api/server/middleware/experimental.go:26
github.com/docker/docker/api/server/middleware.VersionMiddleware.WrapHandler.func1
	/go/src/github.com/docker/docker/api/server/middleware/version.go:62
github.com/docker/docker/pkg/authorization.(*Middleware).WrapHandler.func1
	/go/src/github.com/docker/docker/pkg/authorization/middleware.go:59
github.com/docker/docker/api/server/middleware.DebugRequestMiddleware.func1
	/go/src/github.com/docker/docker/api/server/middleware/debug.go:25
github.com/docker/docker/api/server.(*Server).makeHTTPHandler.func1
	/go/src/github.com/docker/docker/api/server/server.go:141
net/http.HandlerFunc.ServeHTTP
	/usr/local/go/src/net/http/server.go:1964
github.com/docker/docker/vendor/github.com/gorilla/mux.(*Router).ServeHTTP
	/go/src/github.com/docker/docker/vendor/github.com/gorilla/mux/mux.go:162
github.com/docker/docker/api/server.(*routerSwapper).ServeHTTP
	/go/src/github.com/docker/docker/api/server/router_swapper.go:29
net/http.serverHandler.ServeHTTP
	/usr/local/go/src/net/http/server.go:2741
net/http.(*conn).serve
	/usr/local/go/src/net/http/server.go:1847
runtime.goexit
	/usr/local/go/src/runtime/asm_amd64.s:1333  error_type="*errors.fundamental" module=api

2. With a Docker 18.09 cli, and DOCKER_BUILDKIT=1:

2.1 Comment-only Dockerfile:

docker build -t foo -<<'EOF'
# only a comment
EOF
[+] Building 0.1s (2/2) FINISHED                                                                 
 => [internal] load build definition from Dockerfile                                        0.0s
 => => transferring dockerfile: 40B                                                         0.0s
 => [internal] load .dockerignore                                                           0.0s
 => => transferring context: 2B                                                             0.0s
failed to create LLB definition: file with no instructions.

2.2 Empty lines only:

docker build -t foo -<<'EOF'



EOF
[+] Building 0.1s (2/2) FINISHED                                                                 
 => [internal] load build definition from Dockerfile                                        0.0s
 => => transferring dockerfile: 40B                                                         0.0s
 => [internal] load .dockerignore                                                           0.0s
 => => transferring context: 2B                                                             0.0s
failed to create LLB definition: file with no instructions.

2.3 Empty Dockerfile;

docker build -t foo -<<'EOF'
EOF
[+] Building 0.1s (2/2) FINISHED                                                                 
 => [internal] load .dockerignore                                                           0.0s
 => => transferring context: 2B                                                             0.0s
 => [internal] load build definition from Dockerfile                                        0.0s
 => => transferring dockerfile: 31B                                                         0.0s
failed to create LLB definition: the Dockerfile cannot be empty

2.4 Dockerfile with only # syntax=

docker build -t foo -<<'EOF'
# syntax = docker/dockerfile:1.0.1
EOF
[+] Building 5.6s (4/4) FINISHED                                                                 
 => [internal] load .dockerignore                                                           0.0s
 => => transferring context: 2B                                                             0.0s
 => [internal] load build definition from Dockerfile                                        0.0s
 => => transferring dockerfile: 72B                                                         0.0s
 => resolve image config for docker.io/docker/dockerfile:1.0.1                              1.9s
 => docker-image://docker.io/docker/dockerfile:1.0.1@sha256:653ad79c9cd2fe8105290b61bc0f26  2.9s
 => => resolve docker.io/docker/dockerfile:1.0.1@sha256:653ad79c9cd2fe8105290b61bc0f261c6f  0.0s
 => => sha256:653ad79c9cd2fe8105290b61bc0f261c6f73a9e9cb1780bdb529c396e04f 2.03kB / 2.03kB  0.0s
 => => sha256:9349a3e94e5a58e7ae582e1a3af64f69cdb1a116cf2a299c24fc4d1b22855f0c 527B / 527B  0.0s
 => => sha256:547e40b4ed88f333655094f16f69c7ba0620c9832035ac164d0e6f4a72905445 635B / 635B  0.0s
 => => sha256:ef68ca38e25b693b8cb72a677c2312c9c9fc312619db12ea4e772307a55d 7.52MB / 7.52MB  2.7s
 => => extracting sha256:ef68ca38e25b693b8cb72a677c2312c9c9fc312619db12ea4e772307a55d3e9b   0.2s
exit code: 2

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the above;

We should return a ErrInvalidParameter error, so that a 4xx error is returned by the API

moby/errdefs/defs.go

Lines 8 to 11 in d48392a

// ErrInvalidParameter signals that the user input is invalid
type ErrInvalidParameter interface {
InvalidParameter()
}

This patch would addres the cases I found while testing, but perhaps we need a follow-up to check for other errors;

diff --git a/builder/remotecontext/detect.go b/builder/remotecontext/detect.go
index 23db8a5aaa..073dee9a6b 100644
--- a/builder/remotecontext/detect.go
+++ b/builder/remotecontext/detect.go
@@ -12,6 +12,7 @@ import (
        "github.com/docker/docker/api/types/backend"
        "github.com/docker/docker/builder"
        "github.com/docker/docker/builder/dockerignore"
+       "github.com/docker/docker/errdefs"
        "github.com/docker/docker/pkg/fileutils"
        "github.com/docker/docker/pkg/urlutil"
        "github.com/moby/buildkit/frontend/dockerfile/parser"
@@ -147,14 +148,14 @@ func readAndParseDockerfile(name string, rc io.Reader) (*parser.Result, error) {
        br := bufio.NewReader(rc)
        if _, err := br.Peek(1); err != nil {
                if err == io.EOF {
-                       return nil, errors.Errorf("the Dockerfile (%s) cannot be empty", name)
+                       return nil, errdefs.InvalidParameter(errors.Errorf("the Dockerfile (%s) cannot be empty", name))
                }
                return nil, errors.Wrap(err, "unexpected error reading Dockerfile")
        }
 
        dockerfile, err := parser.Parse(br)
        if err != nil {
-               return nil, errors.Wrapf(err, "failed to parse %s", name)
+               return nil, errdefs.InvalidParameter(errors.Wrapf(err, "failed to parse %s", name))
        }
 
        return dockerfile, nil

In the BuildKit cases;

  • (2.1 / 2.2) failed to create LLB definition: file with no instructions. is a bit abstract; @tonistiigi - any suggestions for that one?
  • (2.3) failed to create LLB definition: the Dockerfile cannot be empty - that looks better (clear that it's something to do with the Dockerfile)
  • (2.4) exit code: 2 - this should be improved; probably something to be fixed upstream? @tonistiigi?

Testing:

  • Perhaps add a test for 1.2, 2.4

@GordonTheTurtle GordonTheTurtle added the dco/no Automatically set by a bot when one of the commits lacks proper signature label Jan 8, 2019
@LinuxMercedes
Copy link
Contributor Author

I have (I think) wrapped the error from parser.Parse everywhere it might be raised and added a test for case 1.2.

It seems that case 2.4 is indeed a buildkit problem and should be fixed there to raise the "file with no instructions" error as well. I can put together a patch for that in a bit if y'all agree. Also happy to workshop the wording of that error message since I agree that it's a little abstract for output from docker build and the like.

Once I do so I'll bump the vendor version here, add a test for case 2.4, and squash the commits up a bit!

@GordonTheTurtle GordonTheTurtle removed the dco/no Automatically set by a bot when one of the commits lacks proper signature label Jan 8, 2019
@LinuxMercedes
Copy link
Contributor Author

Probably the right fix is assert exc.value.response.status_code == 500 or exc.value.response.status_code == 400 since getting a 401, 404, 503, etc would likely indicate that something else besides the expected error has gone wrong.

@thaJeztah
Copy link
Member

thaJeztah commented Jan 8, 2019

Yes. I'm not really a Python coder, and wasn't sure if assert handled or there, so here's my quick attempt: docker/docker-py#2216

- Wrap parse errors in errdefs.InvalidParameters
- Include dockerfile in error names

Signed-off-by: Natasha Jarus <[email protected]>
@LinuxMercedes
Copy link
Contributor Author

LinuxMercedes commented Jan 15, 2019

z and janky failures are flaky: #37306

Not sure what's going on with the experimental build but it looks unrelated:

03:05:02 FAIL: docker_cli_daemon_plugins_test.go:161: DockerDaemonSuite.TestDaemonKillWithPlugins
Details
03:05:02 FAIL: docker_cli_daemon_plugins_test.go:161: DockerDaemonSuite.TestDaemonKillWithPlugins
03:05:02 
03:05:02 [db811e51e435f] waiting for daemon to start
03:05:02 [db811e51e435f] daemon started
03:05:02 
03:05:02 docker_cli_daemon_plugins_test.go:166:
03:05:02     c.Fatalf("Could not install plugin: %v %s", err, out)
03:05:02 ... Error: Could not install plugin: exit status 1 latest: Pulling from tiborvass/sample-volume-plugin
03:05:02 eb9c16fbdc53: Verifying Checksum
03:05:02 eb9c16fbdc53: Download complete
03:05:02 error pulling image configuration: unknown blob
03:05:02 
03:05:02 
03:05:02 [db811e51e435f] exiting daemon
03:05:04 time="2019-01-15T03:05:04Z" level=warning msg="Running modprobe nf_nat failed with message: ``, error: exec: \"modprobe\": executable file not found in $PATH"
03:05:04 time="2019-01-15T03:05:04Z" level=warning msg="Running modprobe xt_conntrack failed with message: ``, error: exec: \"modprobe\": executable file not found in $PATH"

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks so much!

@thaJeztah thaJeztah merged commit bba8339 into moby:master Jan 15, 2019
thaJeztah pushed a commit to thaJeztah/buildkit that referenced this pull request Apr 19, 2019
See moby/moby#38487 for more discussion.

Signed-off-by: Natasha Jarus <[email protected]>
(cherry picked from commit 2ec7d53)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jun 30, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jun 30, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
paralin pushed a commit to skiffos/buildroot that referenced this pull request Jul 2, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
paralin pushed a commit to skiffos/buildroot that referenced this pull request Jul 2, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jul 7, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
(cherry picked from commit 13cf6f0)
Signed-off-by: Peter Korsgaard <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jul 7, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
(cherry picked from commit cdbb3ce)
Signed-off-by: Peter Korsgaard <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jul 7, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
(cherry picked from commit 13cf6f0)
Signed-off-by: Peter Korsgaard <[email protected]>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this pull request Jul 7, 2019
Fixes CVE-2018-15664: API endpoints behind the 'docker cp' command are
vulnerable to a symlink-exchange attack with Directory Traversal, giving
attackers arbitrary read-write access to the host filesystem with root
privileges, because daemon/archive.go does not do archive operations on a
frozen filesystem (or from within a chroot).

And includes additional post-18.09.6 fixes:

Builder
- Fixed a panic error when building dockerfiles that contain only comments.
  moby/moby#38487
- Added a workaround for GCR authentication issue. moby/moby#38246
- Builder-next: Fixed a bug in the GCR token cache implementation
  workaround.  moby/moby#39183

Runtime
- Added performance optimizations in aufs and layer store that helps in
  massively parallel container creation and removal.  moby/moby#39107,
  moby/moby#39135
- daemon: fixed a mirrors validation issue. moby/moby#38991
- Docker no longer supports sorting UID and GID ranges in ID maps.
  moby/moby#39288

Logging
- Added a fix that now allows large log lines for logger plugins.
  moby/moby#39038

Signed-off-by: Peter Korsgaard <[email protected]>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <[email protected]>
(cherry picked from commit cdbb3ce)
Signed-off-by: Peter Korsgaard <[email protected]>
crazy-max pushed a commit to crazy-max/dockerfile that referenced this pull request Jan 8, 2022
See moby/moby#38487 for more discussion.

Signed-off-by: Natasha Jarus <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants