Use certs.d from XDG_CONFIG_HOME when in rootless mode (fixes #40236) by dsseng · Pull Request #40243 · moby/moby

dsseng · 2019-11-25T08:04:17Z

- What I did
Made Docker look for cert.d in XDG_CONFIG_HOME in rootless mode
- How I did it
In rootless mode, path for certs.d is changed to $XDG_CONFIG_HOME/docker/certs.d
- How to verify it
Check it. I think that's too simple to have a dedicated test.
- Description for the changelog

Use certs.d from XDG_CONFIG_HOME when in rootless mode (#40236)

- A picture of a cute animal (not mandatory but encouraged)

AkihiroSuda

LGTM, but we should also let rootless mode use $XDG_CONFIG_HOME/certs.d rather than /etc/docker/certs.d

dsseng · 2019-11-25T08:46:02Z

@AkihiroSuda hello! Should that change go into another PR or go here too?

AkihiroSuda · 2019-11-25T08:56:39Z

Either is fine to me

AkihiroSuda · 2019-11-25T08:57:09Z

Please use real name for signing the commit

dsseng · 2019-11-25T09:01:45Z

@AkihiroSuda can't you change the signoff on merge manually? if not or it's hard for you, I can recommit and force-push with my real name.

dsseng · 2019-11-25T09:02:59Z

Either is fine to me

Let's do it in a new PR, I'll try to implement that soon. New PR for logic: this one fixes a bug, the second adds a feature. Am I correct, that's a new feature?

AkihiroSuda · 2019-11-25T09:05:26Z

can't you change the signoff on merge manually? if not or it's hard for you, I can recommit and force-push with my real name.

Please sign by yourself 🙏
Just git commit -a -s --amend && git push -f

New PR for logic: this one fixes a bug, the second adds a feature. Am I correct, that's a new feature?

I feel this one is a quick workaround, the second is the official bug fix.

dsseng · 2019-11-25T09:07:02Z

Ahh, okay, will signoff manually. If $XDG_CONFIG_HOME/certs.d is a proper fix I'll implement that.

Signed-off-by: Dmitry Sharshakov <[email protected]>

dsseng · 2019-11-25T09:43:58Z

Signoff now uses my real name.

from XDG_CONFIG_HOME when in rootless mode Signed-off-by: Dmitry Sharshakov <[email protected]>

dsseng · 2019-11-25T10:17:07Z

@AkihiroSuda I completed that fix, let's wait for CI to pass. Sorry, I couldn't find any test that would simulate rootless mode to check for something, so I didn't create a test.

thaJeztah

LGTM

thaJeztah · 2019-11-27T12:56:10Z

registry/registry.go

 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/sirupsen/logrus"
+
+	"github.com/docker/docker/pkg/homedir"


nit: these imports should be in the same group as the previous one (not a blocker)

okay, thanks

full diff: moby/moby@a09e6e3...a9507c6 Includes: - moby/moby#40077 Update "auto-generate" comments to improve detection by linters - moby/moby#40143 registry: add a critical section to protect authTransport.modReq - moby/moby#40212 Move DefaultCapabilities() to caps package - moby/moby#40021 Use newer x/sys/windows SecurityAttributes struct (carry 40017) - carries moby/moby#40017 Use newer x/sys/windows SecurityAttributes struct - moby/moby#40135 pkg/system: make OSVersion an alias for hcsshim OSVersion - follow-up to moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - moby/moby#40250 Bump hcsshim to b3f49c06ffaeef24d09c6c08ec8ec8425a0303e2 - moby/moby#40243 Use certs.d from XDG_CONFIG_HOME when in rootless mode - fixes moby/moby#40236 Docker rootless dies when unable to read /etc/docker/certs.d - moby/moby#40283 Fix possible runtime panic in Lgetxattr - moby/moby#40178 builder/remotecontext: small refactor - moby/moby#40179 builder/remotecontext: allow ssh:// for remote context URLs - fixes docker#2164 Docker build cannot resolve git context with html escapes - moby/moby#40302 client.ImagePush(): default to ":latest" instead of "all tags" - relates to docker#2214 [proposal] change "docker push" behavior to default to ":latest" instead of "all tags" - relates to docker#2220 implement docker push `-a`/ `--all-tags` - moby/moby#40263 Normalize comment formatting - moby/moby#40238 Allow client consumers like traefik to compile on illumos - moby/moby#40108 bump google.golang.org/grpc v1.23.1 - moby/moby#40312 update vendor golang.org/x/sys to 6d18c012aee9febd81bbf9806760c8c4480e870d - moby/moby#40247 pkg/system: deprecate constants in favor of golang.org/x/sys/windows - moby/moby#40246 pkg/system: minor cleanups and remove use of deprecated system.GetOSVersion() - moby/moby#40122 Update buildkit to containerd leases - vendor: update buildkit to leases support (4f4e03067523b2fc5ca2f17514a5e75ad63e02fb) - vendor: update containerd to acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b - vendor: update runc to d736ef14f0288d6993a1845745d6756cfc9ddd5a (v1.0.0-rc9) Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: moby/moby@a09e6e3...a9507c6 Includes: - moby/moby#40077 Update "auto-generate" comments to improve detection by linters - moby/moby#40143 registry: add a critical section to protect authTransport.modReq - moby/moby#40212 Move DefaultCapabilities() to caps package - moby/moby#40021 Use newer x/sys/windows SecurityAttributes struct (carry 40017) - carries moby/moby#40017 Use newer x/sys/windows SecurityAttributes struct - moby/moby#40135 pkg/system: make OSVersion an alias for hcsshim OSVersion - follow-up to moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - moby/moby#40250 Bump hcsshim to b3f49c06ffaeef24d09c6c08ec8ec8425a0303e2 - moby/moby#40243 Use certs.d from XDG_CONFIG_HOME when in rootless mode - fixes moby/moby#40236 Docker rootless dies when unable to read /etc/docker/certs.d - moby/moby#40283 Fix possible runtime panic in Lgetxattr - moby/moby#40178 builder/remotecontext: small refactor - moby/moby#40179 builder/remotecontext: allow ssh:// for remote context URLs - fixes docker/cli#2164 Docker build cannot resolve git context with html escapes - moby/moby#40302 client.ImagePush(): default to ":latest" instead of "all tags" - relates to docker/cli#2214 [proposal] change "docker push" behavior to default to ":latest" instead of "all tags" - relates to docker/cli#2220 implement docker push `-a`/ `--all-tags` - moby/moby#40263 Normalize comment formatting - moby/moby#40238 Allow client consumers like traefik to compile on illumos - moby/moby#40108 bump google.golang.org/grpc v1.23.1 - moby/moby#40312 update vendor golang.org/x/sys to 6d18c012aee9febd81bbf9806760c8c4480e870d - moby/moby#40247 pkg/system: deprecate constants in favor of golang.org/x/sys/windows - moby/moby#40246 pkg/system: minor cleanups and remove use of deprecated system.GetOSVersion() - moby/moby#40122 Update buildkit to containerd leases - vendor: update buildkit to leases support (4f4e03067523b2fc5ca2f17514a5e75ad63e02fb) - vendor: update containerd to acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b - vendor: update runc to d736ef14f0288d6993a1845745d6756cfc9ddd5a (v1.0.0-rc9) Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: 627a4cf7ccd0b7e92c6798c73de4dd4efc43175c Component: cli

full diff: moby/moby@a09e6e3...a9507c6 Includes: - moby/moby#40077 Update "auto-generate" comments to improve detection by linters - moby/moby#40143 registry: add a critical section to protect authTransport.modReq - moby/moby#40212 Move DefaultCapabilities() to caps package - moby/moby#40021 Use newer x/sys/windows SecurityAttributes struct (carry 40017) - carries moby/moby#40017 Use newer x/sys/windows SecurityAttributes struct - moby/moby#40135 pkg/system: make OSVersion an alias for hcsshim OSVersion - follow-up to moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - moby/moby#40250 Bump hcsshim to b3f49c06ffaeef24d09c6c08ec8ec8425a0303e2 - moby/moby#40243 Use certs.d from XDG_CONFIG_HOME when in rootless mode - fixes moby/moby#40236 Docker rootless dies when unable to read /etc/docker/certs.d - moby/moby#40283 Fix possible runtime panic in Lgetxattr - moby/moby#40178 builder/remotecontext: small refactor - moby/moby#40179 builder/remotecontext: allow ssh:// for remote context URLs - fixes docker#2164 Docker build cannot resolve git context with html escapes - moby/moby#40302 client.ImagePush(): default to ":latest" instead of "all tags" - relates to docker#2214 [proposal] change "docker push" behavior to default to ":latest" instead of "all tags" - relates to docker#2220 implement docker push `-a`/ `--all-tags` - moby/moby#40263 Normalize comment formatting - moby/moby#40238 Allow client consumers like traefik to compile on illumos - moby/moby#40108 bump google.golang.org/grpc v1.23.1 - moby/moby#40312 update vendor golang.org/x/sys to 6d18c012aee9febd81bbf9806760c8c4480e870d - moby/moby#40247 pkg/system: deprecate constants in favor of golang.org/x/sys/windows - moby/moby#40246 pkg/system: minor cleanups and remove use of deprecated system.GetOSVersion() - moby/moby#40122 Update buildkit to containerd leases - vendor: update buildkit to leases support (4f4e03067523b2fc5ca2f17514a5e75ad63e02fb) - vendor: update containerd to acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b - vendor: update runc to d736ef14f0288d6993a1845745d6756cfc9ddd5a (v1.0.0-rc9) Signed-off-by: Sebastiaan van Stijn <[email protected]>

AkihiroSuda approved these changes Nov 25, 2019

View reviewed changes

Don't die when daemon cannot read certs.d

2808762

Signed-off-by: Dmitry Sharshakov <[email protected]>

dsseng force-pushed the 40236-cert-permission branch from f068375 to 2808762 Compare November 25, 2019 09:42

Use certs.d

f4fa98f

from XDG_CONFIG_HOME when in rootless mode Signed-off-by: Dmitry Sharshakov <[email protected]>

AkihiroSuda approved these changes Nov 25, 2019

View reviewed changes

AkihiroSuda added process/cherry-pick area/rootless Rootless Mode kind/bugfix PR's that fix bugs labels Nov 25, 2019

dsseng changed the title ~~Don't die when daemon cannot read certs.d (fixes #40236)~~ Use certs.d from XDG_CONFIG_HOME when in rootless mode (fixes #40236) Nov 25, 2019

thaJeztah approved these changes Nov 27, 2019

View reviewed changes

thaJeztah merged commit 7c3d53e into moby:master Nov 27, 2019

dsseng deleted the 40236-cert-permission branch November 27, 2019 12:58

thaJeztah mentioned this pull request Jan 7, 2020

vendor: bump docker and dependencies a9507c6f76627fdc092edc542d5a7ef4a6df5eec docker/cli#2242

Merged

AkihiroSuda mentioned this pull request Feb 6, 2020

[19.03 backport] Use certs.d from XDG_CONFIG_HOME when in rootless mode (fixes #40236) #40461

Merged

thaJeztah added process/cherry-picked and removed process/cherry-pick labels Feb 6, 2020

thaJeztah mentioned this pull request Feb 25, 2020

Revert "Don't die when daemon cannot read certs.d" #40576

Merged

thaJeztah added this to the 20.03.0 milestone Apr 2, 2020

Conversation

dsseng commented Nov 25, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

AkihiroSuda commented Nov 25, 2019

Uh oh!

AkihiroSuda commented Nov 25, 2019

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

AkihiroSuda commented Nov 25, 2019

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

dsseng commented Nov 25, 2019

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah Nov 27, 2019

Choose a reason for hiding this comment

Uh oh!

dsseng Nov 27, 2019

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dsseng commented Nov 25, 2019 •

edited

Loading