Rebase #36720 "Add exec option to tmpfs" #46809

dperny · 2023-11-13T16:26:02Z

addresses:

I'm eliding the typical format for PRs because this PR is simply a rebase of an existing PR, #36720 onto the current master.

Closes #36720.

thaJeztah · 2023-11-13T16:49:56Z

api/swagger.yaml

@@ -434,6 +434,9 @@ definitions:
          Mode:
            description: "The permission mode for the tmpfs mount in an integer."
            type: "integer"
+          Options:
+            description: "The list of options to be passed to the tmpfs mount in a string."
+            type: "string"


ISTR there was some discussion whether this should be a string, a []string (or a map[string]string, but I think we didn't want a map), did we ever reach full consensus on that?

cpuguy83

I'm going to be a little pedantic on having a TmpfsOptions struct with a generic Options field inside of it.
I don't want to block this on pedantry, especially since noexec is a good thing to add so happy to bow out if others think this is fine.

cpuguy83 · 2024-01-04T01:12:52Z

api/types/mount/mount.go

@@ -118,7 +118,8 @@ type TmpfsOptions struct {
 	SizeBytes int64 `json:",omitempty"`
 	// Mode of the tmpfs upon creation
 	Mode os.FileMode `json:",omitempty"`
-
+	// Options passed directly to the tmpfs mount


It seems like we only plan to have a very small subset of options here.
Does it make sense to promote those optioons to fields on this struct?
The ones we have are difficult to represent accurately, I admit (default exec vs explicit exec vs noexec).

UID/GID are probably worth adding at some point... if someone asks for it (this may have already happened).
I'm not sure I agree with the comment about implications in the cluster.

I'm not sure the other options would be worthwhile.

corhere · 2024-04-18T21:51:34Z

We discussed this during today's maintainer call. The main sticking point is that the daemon is tokenizing and parsing the options string. Parsing would not be needed if the options were encoded as structured data in the API request. Nor would parsing be needed if the daemon didn't validate the options against an allowlist: it would simply concatenate the user options to the end of the daemon-generated options string and pass that along to the kernel. No matter which decision we make on validating the options against an allowlist, there is no need for the daemon to parse a mount options string.

Consensus was in favour of keeping validation in, based on the "yes is forever, no is temporary" principle of API design. We can always expand the allowlist or remove the validation in the future, but we can't walk it back. (We would also like to add a few more obviously safe options to the allowlist, such as nosuid, nosymfollow, dev/nodev, suid/nosuid.) That means the options need to be encoded as structured data in the API so the daemon can validate them without parsing. For future-proofing, I would ideally like the structure to map cleanly onto the new fsconfig syscall API.

Key and value are separate in the structured data
Ordered list, in case the order that parameters are supplied may be significant

The outer data structure has to be a JSON Array. The only remaining question is how to encode individual parameters. At the very least we have to distinguish between flags and string parameters in the API as some flags will not be accepted through the fsconfig_set_string command.

If we limit ourselves to making only fsconfig_set_flag and fsconfig_set_string parameters representable in the API, it could be as simple as encoding flags as bare strings and string parameters as a 2-tuple of (string, string), encoded in JSON as a two-element array.

[ "noexec", ["uid", "12345"] ]

Or use 2-tuples consistently, but use null in the value position to signify a flag?

[ ["noexec", null], ["uid", "12345"] ]

If they're all 2-tuples, they could simply be flattened into an array where even indices are keys and odd indices are values.

["noexec", null, "uid", "12345"]

If we really want to future-proof for the other kinds of parameter, we could (also?) accept a more verbose struct (JSON Object) representation, e.g.:

[
  {"kind": "flag", "key": "noexec"},
  {"kind": "string", "key": "uid", "value": "12345"},
  {"kind": "binary-base64", "key": "some-binary-blob", "value": "eQo="},
  {"kind": "host-path", "key": "lowerdir", "value": "/path/to/thing"}
]

Or only be verbose in the value position.

[
  "noexec", null,
  "uid", "12345",
  "gid": {"kind": "string", "value": "23456"},
  "rw", {"kind": "flag"},
  "some-binary-blob": {"kind": "binary", "content-encoding": "base64", "value": "eQo="}
]

The tmpfs filesystem currently only accepts flag and string parameters (and no in-tree filesystem accepts binary parameters as of Linux v6.8) so we don't need to implement support for the other kinds yet. We only need to ensure that whatever shape we choose can afford being extended to support expressing the other kinds of parameter when the time comes.

We also considered adding the mount options to the outer Mount struct, but have decided not to pursue that for now. We could add one in the future without conflicting with the TmpfsOptions mount options, so long as we concatenate the options (or apply the fsconfig) from the different sources in a consistent order.

cpuguy83 · 2024-05-02T18:08:26Z

volume/mounts/linux_parser_test.go:257:54: cannot use "exec" (untyped string constant) as [][]string value in struct literal
volume/mounts/linux_parser_test.go:263:37: cannot use "INVALID" (untyped string constant) as [][]string value in struct literal

thaJeztah

LGTM

missed the failure

daemon/cluster/convert/container.go

daemon/cluster/executor/container/container.go

thaJeztah · 2024-06-12T11:49:40Z

Looks like something is failing in swagger validation;

Error: gger.yaml:452:15: [error] syntax error: expected <block end>, but found '<block mapping start>' (syntax)
Warning: er.yaml:2306:7: [warning] comment not indented like content (comments-indentation)
make: *** [Makefile:249: validate-swagger] Error 1
Error: Process completed with exit code 2.

Includes two commits from Arash Deshmeh: add exec option to API TmpfsOptions and the related volume functions Signed-off-by: Arash Deshmeh <adeshmeh@ca.ibm.com> feature: daemon handles tmpfs mounts exec option Signed-off-by: Arash Deshmeh <adeshmeh@ca.ibm.com> Updated by Drew Erny Signed-off-by: Drew Erny <derny@mirantis.com>

thaJeztah · 2024-06-15T18:54:09Z

docs/api/version-history.md

@@ -30,6 +30,8 @@ keywords: "API, Docker, rcli, REST, documentation"
 * `POST /images/{name}/push` now supports a `platform` parameter (JSON encoded
  OCI Platform type) that allows selecting a specific platform manifest from
  the multi-platform image.
+* `POST /containers/create` now takes `Options` as part of `HostConfig.Mounts.TmpfsOptions` to set options for tmpfs mounts.
+* `POST /services/create` now takes `Options` as part of `ContainerSpec.Mounts.TmpfsOptions`, to set options for tmpfs mounts.


Does /services/{id}/update also accept it? (we can amend in a follow-up if needed)

thaJeztah

LGTM

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker/docker](https://togithub.com/docker/docker) | major | `26.1.4` -> `27.0.3` | --- ### Release Notes <details> <summary>docker/docker (docker/docker)</summary> ### [`v27.0.3`](https://togithub.com/moby/moby/releases/tag/v27.0.3) [Compare Source](https://togithub.com/docker/docker/compare/v27.0.2...v27.0.3) #### 27.0.3 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: - [docker/cli, 27.0.3 milestone](https://togithub.com/docker/cli/issues?q=is%3Aclosed+milestone%3A27.0.3) - [moby/moby, 27.0.3 milestone](https://togithub.com/moby/moby/issues?q=is%3Aclosed+milestone%3A27.0.3) - Deprecated and removed features, see [Deprecated Features](https://togithub.com/docker/cli/blob/v27.0.3/docs/deprecated.md). - Changes to the Engine API, see [API version history](https://togithub.com/moby/moby/blob/v27.0.3/docs/api/version-history.md). ##### Bug fixes and enhancements - Fix a regression that incorrectly reported a port mapping from a host IPv6 address to an IPv4-only container as an error. [moby/moby#48090](https://togithub.com/moby/moby/pull/48090) - Fix a regression that caused duplicate subnet allocations when creating networks. [moby/moby#48089](https://togithub.com/moby/moby/pull/48089) - Fix a regression resulting in "fail to register layer: failed to Lchown" errors when trying to pull an image with rootless enabled on a system that supports native overlay with user-namespaces. [moby/moby#48086](https://togithub.com/moby/moby/pull/48086) ### [`v27.0.2`](https://togithub.com/moby/moby/releases/tag/v27.0.2) [Compare Source](https://togithub.com/docker/docker/compare/v27.0.1-rc.1...v27.0.2) #### 27.0.2 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: - [docker/cli, 27.0.2 milestone](https://togithub.com/docker/cli/issues?q=is%3Aclosed+milestone%3A27.0.2) - [moby/moby, 27.0.2 milestone](https://togithub.com/moby/moby/issues?q=is%3Aclosed+milestone%3A27.0.2) - Deprecated and removed features, see [Deprecated Features](https://togithub.com/docker/cli/blob/v27.0.2/docs/deprecated.md). - Changes to the Engine API, see [API version history](https://togithub.com/moby/moby/blob/v27.0.2/docs/api/version-history.md). ##### Bug fixes and enhancements - Fix a regression that caused port numbers to be ignored when parsing a Docker registry URL. [docker/cli#5197](https://togithub.com/docker/cli/pull/5197), [docker/cli#5198](https://togithub.com/docker/cli/pull/5198) ##### Removed - api/types: deprecate `ContainerJSONBase.Node` field and `ContainerNode` type. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. [moby/moby#48055](https://togithub.com/moby/moby/pull/48055) ### [`v27.0.1`](https://togithub.com/moby/moby/releases/tag/v27.0.1) [Compare Source](https://togithub.com/docker/docker/compare/v26.1.4...v27.0.1-rc.1) #### 27.0.1 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: - [docker/cli, 27.0.0 milestone](https://togithub.com/docker/cli/issues?q=is%3Aclosed+milestone%3A27.0.0) - [moby/moby, 27.0.0 milestone](https://togithub.com/moby/moby/issues?q=is%3Aclosed+milestone%3A27.0.0) - Deprecated and removed features, see [Deprecated Features](https://togithub.com/docker/cli/blob/v27.0.1/docs/deprecated.md). - Changes to the Engine API, see [API version history](https://togithub.com/moby/moby/blob/v27.0.1/docs/api/version-history.md). ##### New - containerd image store: Add `--platform` flag to `docker image push` and improve the default behavior when not all platforms of the multi-platform image are available locally. [docker/cli#4984](https://togithub.com/docker/cli/pull/4984), [moby/moby#47679](https://togithub.com/moby/moby/pull/47679) - Add support to `docker stack deploy` for `driver_opts` in a service's networks. [docker/cli#5125](https://togithub.com/docker/cli/pull/5125) - Consider additional `/usr/local/libexec` and `/usr/libexec` paths when looking up the userland proxy binaries by a name with a `docker-` prefix. [moby/moby#47804](https://togithub.com/moby/moby/pull/47804) ##### Bug fixes and enhancements - `*client.Client` instances are now always safe for concurrent use by multiple goroutines. Previously, this could lead to data races when the `WithAPIVersionNegotiation()` option is used. [moby/moby#47961](https://togithub.com/moby/moby/pull/47961) - Fix a bug causing the Docker CLI to leak Unix sockets in `$TMPDIR` in some cases. [docker/cli#5146](https://togithub.com/docker/cli/pull/5146) - Don't ignore a custom seccomp profile when used in conjunction with `--privileged`. [moby/moby#47500](https://togithub.com/moby/moby/pull/47500) - rootless: overlay2: support native overlay diff when using rootless-mode with Linux kernel version 5.11 and later. [moby/moby#47605](https://togithub.com/moby/moby/pull/47605) - Fix the `StartInterval` default value of healthcheck to reflect the documented value of 5s. [moby/moby#47799](https://togithub.com/moby/moby/pull/47799) - Fix `docker save` and `docker load` not ending on the daemon side when the operation was cancelled by the user, for example with <kbd>Ctrl+C</kbd>. [moby/moby#47629](https://togithub.com/moby/moby/pull/47629) - The `StartedAt` property of containers is now recorded before container startup, guaranteeing that the `StartedAt` is always before `FinishedAt`. [moby/moby#47003](https://togithub.com/moby/moby/pull/47003) - The internal DNS resolver used by Windows containers on Windows now forwards requests to external DNS servers by default. This enables `nslookup` to resolve external hostnames. This behaviour can be disabled via `daemon.json`, using `"features": { "windows-dns-proxy": false }`. The configuration option will be removed in a future release. [moby/moby#47826](https://togithub.com/moby/moby/pull/47826) - Print a warning when the CLI does not have permissions to read the configuration file. [docker/cli#5077](https://togithub.com/docker/cli/pull/5077) - Fix a goroutine and file-descriptor leak on container attach. [moby/moby#45052](https://togithub.com/moby/moby/pull/45052) - Clear the networking state of all stopped or dead containers during daemon start-up. [moby/moby#47984](https://togithub.com/moby/moby/pull/47984) - Write volume options JSON atomically to avoid "invalid JSON" errors after system crash. [moby/moby#48034](https://togithub.com/moby/moby/pull/48034) - Allow multiple macvlan networks with the same parent. [moby/moby#47318](https://togithub.com/moby/moby/pull/47318) - Allow BuildKit to be used on Windows daemons that advertise it. [docker/cli#5178](https://togithub.com/docker/cli/pull/5178) ##### Networking - Allow sysctls to be set per-interface during container creation and network connection. [moby/moby#47686](https://togithub.com/moby/moby/pull/47686) - In a future release, this will be the only way to set per-interface sysctl options. For example, on the command line in a `docker run` command,`--network mynet --sysctl net.ipv4.conf.eth0.log_martians=1` will be rejected. Instead, you must use `--network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1`. ##### IPv6 - `ip6tables` is no longer experimental. You may remove the `experimental` configuration option and continue to use IPv6, if it is not required by any other features. - `ip6tables` is now enabled for Linux bridge networks by default. [moby/moby#47747](https://togithub.com/moby/moby/pull/47747) - This makes IPv4 and IPv6 behaviors consistent with each other, and reduces the risk that IPv6-enabled containers are inadvertently exposed to the network. - There is no impact if you are running Docker Engine with `ip6tables` enabled (new default). - If you are using an IPv6-enabled bridge network without `ip6tables`, this is likely a breaking change. Only published container ports (`-p` or `--publish`) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host. - To restore the behavior of earlier releases, no `ip6tables` at all, set `"ip6tables": false` in `daemon.json`, or use the CLI option `--ip6tables=false`. Alternatively, leave `ip6tables` enabled, publish ports, and enable direct routing. - With `ip6tables` enabled, if `ip6tables` is not functional on your host, Docker Engine will start but it will not be possible to create an IPv6-enabled network. ##### IPv6 network configuration improvements - A Unique Local Address (ULA) base prefix is automatically added to `default-address-pools` if this parameter wasn't manually configured, or if it contains no IPv6 prefixes. [moby/moby#47853](https://togithub.com/moby/moby/pull/47853) - Prior to this release, to create an IPv6-enabled network it was necessary to use the `--subnet` option to specify an IPv6 subnet, or add IPv6 ranges to `default-address-pools` in `daemon.json`. - Starting in this release, when a bridge network is created with `--ipv6` and no IPv6 subnet is defined by those options, an IPv6 Unique Local Address (ULA) base prefix is used. - The ULA prefix is derived from the Engine host ID such that it's unique across hosts and over time. - IPv6 address pools of any size can now be added to `default-address-pools`. [moby/moby#47768](https://togithub.com/moby/moby/pull/47768) - IPv6 can now be enabled by default on all custom bridge networks using `"default-network-opts": { "bridge": {"com.docker.network.enable_ipv6": "true"}}` in `daemon.json`, or `dockerd --default-network-opt=bridge=com.docker.network.enable_ipv6=true`on the comand line. [moby/moby#47867](https://togithub.com/moby/moby/pull/47867) - Direct routing for IPv6 networks, with `ip6tables` enabled. [moby/moby#47871](https://togithub.com/moby/moby/pull/47871) - Added bridge driver option `com.docker.network.bridge.gateway_mode_ipv6=<nat|routed>`. - The default behavior, `nat`, is unchanged from previous releases running with `ip6tables` enabled. NAT and masquerading rules are set up for each published container port. - When set to `routed`, no NAT or masquerading rules are configured for published ports. This enables direct IPv6 access to the container, if the host's network can route packets for the container's address to the host. Published ports will be opened in the container's firewall. - When a port mapping only applies to `routed` mode, only addresses `0.0.0.0` or `::` are allowed and a host port must not be given. - Note that published container ports, in `nat` or `routed` mode, are accessible from any remote address if routing is set up in the network, unless the Docker host's firewall has additional restrictions. For example: `docker network create --ipv6 -o com.docker.network.bridge.gateway_mode_ipv6=routed mynet`. - The option `com.docker.network.bridge.gateway_mode_ipv4=<nat|routed>` is also available, with the same behavior but for IPv4. - If firewalld is running on the host, Docker creates policy `docker-forwarding` to allow forwarding from any zone to the `docker` zone. This makes it possible to configure a bridge network with a routable IPv6 address, and no NAT or masquerading. [moby/moby#47745](https://togithub.com/moby/moby/pull/47745) - When a port is published with no host port specified, or a host port range is given, the same port will be allocated for IPv4 and IPv6. [moby/moby#47871](https://togithub.com/moby/moby/pull/47871) - For example `-p 80` will result in the same ephemeral port being allocated for `0.0.0.0` and `::`, and `-p 8080-8083:80` will pick the same port from the range for both address families. - Similarly, ports published to specific addresses will be allocated the same port. For example, `-p 127.0.0.1::80 -p '[::1]::80'`. - If no port is available on all required addresses, container creation will fail. - Environment variable `DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE`, introduced in release 26.1.1, no longer has any effect. [moby/moby#47963](https://togithub.com/moby/moby/pull/47963) - If IPv6 could not be disabled on an interface because of a read-only `/proc/sys/net`, the environment variable allowed the container to start anyway. - In this release, if IPv4 cannot be disabled for an interface, IPv6 can be explicitly enabled for the network simply by using `--ipv6` when creating it. Other workarounds are to configure the OS to disable IPv6 by default on new interfaces, mount `/proc/sys/net` read-write, or use a kernel with no IPv6 support. - For IPv6-enabled bridge networks, do not attempt to replace the bridge's kernel-assigned link local address with `fe80::1`. [moby/moby#47787](https://togithub.com/moby/moby/pull/47787) ##### Removed - Deprecate experimental GraphDriver plugins. [moby/moby#48050](https://togithub.com/moby/moby/pull/48050), [docker/cli#5172](https://togithub.com/docker/cli/pull/5172) - pkg/archive: deprecate `NewTempArchive` and `TempArchive`. These types were only used in tests and will be removed in the next release. [moby/moby#48002](https://togithub.com/moby/moby/pull/48002) - pkg/archive: deprecate `CanonicalTarNameForPath` [moby/moby#48001](https://togithub.com/moby/moby/pull/48001) - Deprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. [moby/moby#47999](https://togithub.com/moby/moby/pull/47999) - Deprecate `pkg/stringid.ValidateID` and `pkg/stringid.IsShortID` [moby/moby#47995](https://togithub.com/moby/moby/pull/47995) - runconfig: deprecate `SetDefaultNetModeIfBlank` and move `ContainerConfigWrapper` to `api/types/container` [moby/moby#48007](https://togithub.com/moby/moby/pull/48007) - runconfig: deprecate `DefaultDaemonNetworkMode` and move to `daemon/network` [moby/moby#48008](https://togithub.com/moby/moby/pull/48008) - runconfig: deprecate `opts.ConvertKVStringsToMap`. This utility is no longer used, and will be removed in the next release. [moby/moby#48016](https://togithub.com/moby/moby/pull/48016) - runconfig: deprecate `IsPreDefinedNetwork`. [moby/moby#48011](https://togithub.com/moby/moby/pull/48011) ##### API - containerd image store: `POST /images/{name}/push` now supports a `platform` parameter (JSON encoded OCI Platform type) that allows selecting a specific platform-manifest from the multi-platform image. This is experimental and may change in future API versions. [moby/moby#47679](https://togithub.com/moby/moby/pull/47679) - `POST /services/create` and `POST /services/{id}/update` now support `OomScoreAdj`. [moby/moby#47950](https://togithub.com/moby/moby/pull/47950) - `ContainerList` api returns container annotations. [moby/moby#47866](https://togithub.com/moby/moby/pull/47866) - `POST /containers/create` and `POST /services/create` now take `Options` as part of `HostConfig.Mounts.TmpfsOptions` allowing to set options for tmpfs mounts. [moby/moby#46809](https://togithub.com/moby/moby/pull/46809) - The `Healthcheck.StartInterval` property is now correctly ignored when updating a Swarm service using API versions less than v1.44. [moby/moby#47991](https://togithub.com/moby/moby/pull/47991) - `GET /events` now supports image `create` event that is emitted when a new image is built regardless if it was tagged or not. [moby/moby#47929](https://togithub.com/moby/moby/pull/47929) - `GET /info` now includes a `Containerd` field containing information about the location of the containerd API socket and containerd namespaces used by the daemon to run containers and plugins. [moby/moby#47239](https://togithub.com/moby/moby/pull/47239) - Deprecate non-standard (config) fields in image inspect output. The `Config` field returned by this endpoint (used for `docker image inspect`) returned additional fields that are not part of the image's configuration and not part of the [Docker Image Spec] and the [OCI Image Spec]. These fields are never set (and always return the default value for the type), but are not omitted in the response when left empty. As these fields were not intended to be part of the image configuration response, they are deprecated, and will be removed in the future API versions. - Deprecate the daemon flag `--api-cors-header` and the corresponding `daemon.json` configuration option. These will be removed in the next major release. [moby/moby#45313](https://togithub.com/moby/moby/pull/45313) The following deprecated fields are currently included in the API response, but are not part of the underlying image's `Config`: [moby/moby#47941](https://togithub.com/moby/moby/pull/47941) - `Hostname` - `Domainname` - `AttachStdin` - `AttachStdout` - `AttachStderr` - `Tty` - `OpenStdin` - `StdinOnce` - `Image` - `NetworkDisabled` (already omitted unless set) - `MacAddress` (already omitted unless set) - `StopTimeout` (already omitted unless set) ##### Go SDK changes - Client API callback for the following functions now require a context parameter. [moby/moby#47536](https://togithub.com/moby/moby/pull/47536) - `client.RequestPrivilegeFunc` - `client.ImageSearchOptions.AcceptPermissionsFunc` - `image.ImportOptions.PrivilegeFunc` - Remove deprecated aliases for Image types. [moby/moby#47900](https://togithub.com/moby/moby/pull/47900) - `ImageImportOptions` - `ImageCreateOptions` - `ImagePullOptions` - `ImagePushOptions` - `ImageListOptions` - `ImageRemoveOptions` - Introduce `Ulimit` type alias for `github.com/docker/go-units.Ulimit`. The `Ulimit` type as used in the API is defined in a Go module that will transition to a new location in future. A type alias is added to reduce the friction that comes with moving the type to a new location. The alias makes sure that existing code continues to work, but its definition may change in future. Users are recommended to use this alias instead of the `units.Ulimit` directly. [moby/moby#48023](https://togithub.com/moby/moby/pull/48023) - Move and rename types, changing their import paths and exported names. [moby/moby#47936](https://togithub.com/moby/moby/pull/47936), [moby/moby#47873](https://togithub.com/moby/moby/pull/47873), [moby/moby#47887](https://togithub.com/moby/moby/pull/47887), [moby/moby#47882](https://togithub.com/moby/moby/pull/47882), [moby/moby#47921](https://togithub.com/moby/moby/pull/47921), [moby/moby#48040](https://togithub.com/moby/moby/pull/48040): - Move the following types to `api/types/container`: - `BlkioStatEntry` - `BlkioStats` - `CPUStats` - `CPUUsage` - `ContainerExecInspect` - `ContainerPathStat` - `ContainerStats` - `ContainersPruneReport` - `CopyToContainerOptions` - `ExecConfig` - `ExecStartCheck` - `MemoryStats` - `NetworkStats` - `PidsStats` - `StatsJSON` - `Stats` - `StorageStats` - `ThrottlingData` - Move the following types to `api/types/image`: - `ImagesPruneReport` - `ImageImportSource` - `ImageLoadResponse` - Move the `ExecStartOptions` type to `api/types/backend`. - Move the `VolumesPruneReport` type to `api/types/volume`. - Move the `EventsOptions` type to `api/types/events`. - Move the `ImageSearchOptions` type to `api/types/registry`. - Drop `Network` prefix and move the following types to `api/types/network`: - `NetworkCreateResponse` - `NetworkConnect` - `NetworkDisconnect` - `NetworkInspectOptions` - `EndpointResource` - `NetworkListOptions` - `NetworkCreateOptions` - `NetworkCreateRequest` - `NetworksPruneReport` - Move `NetworkResource` to `api/types/network`. ##### Packaging updates - Update Buildx to [v0.15.1](https://togithub.com/docker/buildx/releases/tag/v0.15.1). [docker/docker-ce-packaging#1029](https://togithub.com/docker/docker-ce-packaging/pull/1029) - Update BuildKit to [v0.14.1](https://togithub.com/moby/buildkit/releases/tag/v0.14.1). [moby/moby#48028](https://togithub.com/moby/moby/pull/48028) - Update runc to [v1.1.13](https://togithub.com/opencontainers/runc/releases/tag/v1.1.13) [moby/moby#47976](https://togithub.com/moby/moby/pull/47976) - Update Compose to [v2.28.1](https://togithub.com/docker/compose/releases/tag/v2.28.1). [moby/docker-ce-packaging#1032](https://togithub.com/docker/docker-ce-packaging/pull/1032) [Docker image spec]: https://togithub.com/moby/docker-image-spec/blob/v1.3.1/specs-go/v1/image.go#L19-L32 [OCI Image Spec]: https://togithub.com/opencontainers/image-spec/blob/v1.1.0/specs-go/v1/config.go#L24-L62 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6am on monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/earthly/dind).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

thaJeztah reviewed Nov 13, 2023

View reviewed changes

cpuguy83 reviewed Jan 4, 2024

View reviewed changes

dperny force-pushed the add-exec-option-to-tmpfs branch from 1915580 to ad67215 Compare February 23, 2024 16:30

dperny force-pushed the add-exec-option-to-tmpfs branch 5 times, most recently from c58464a to 2922732 Compare April 4, 2024 17:09

dperny force-pushed the add-exec-option-to-tmpfs branch from 2922732 to 56a5367 Compare May 2, 2024 14:47

thaJeztah previously approved these changes May 2, 2024

View reviewed changes

dperny mentioned this pull request May 3, 2024

API: bump version to 1.46 #47651

Merged

dperny force-pushed the add-exec-option-to-tmpfs branch 2 times, most recently from df66111 to 6764750 Compare May 14, 2024 17:03

dperny force-pushed the add-exec-option-to-tmpfs branch from 6764750 to f4f4bee Compare June 7, 2024 17:22

corhere approved these changes Jun 7, 2024

View reviewed changes

daemon/cluster/convert/container.go Outdated Show resolved Hide resolved

daemon/cluster/executor/container/container.go Outdated Show resolved Hide resolved

thaJeztah added area/api API impact/api area/swarm status/2-code-review labels Jun 12, 2024

dperny force-pushed the add-exec-option-to-tmpfs branch 2 times, most recently from 32487da to 52328db Compare June 14, 2024 16:32

dperny force-pushed the add-exec-option-to-tmpfs branch from 52328db to dd1ca95 Compare June 14, 2024 17:11

thaJeztah reviewed Jun 15, 2024

View reviewed changes

thaJeztah approved these changes Jun 15, 2024

View reviewed changes

thaJeztah merged commit d1273b2 into moby:master Jun 15, 2024

thaJeztah added this to the 27.0.0 milestone Jun 15, 2024

thaJeztah added the impact/changelog label Jun 15, 2024

thaJeztah mentioned this pull request Jun 18, 2024

vendor: github.com/docker/docker ec4bac431c88 (v27.0.0-dev) docker/cli#5158

Merged

mook-as mentioned this pull request Jun 20, 2024

OpenAPI Spec: v1.46: TmpFsOptions has incorrect Options #48048

Closed

j-aub mentioned this pull request Jul 27, 2024

add the Options field to TempfsOptions fsouza/go-dockerclient#1077

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Rebase #36720 "Add exec option to tmpfs" #46809

Rebase #36720 "Add exec option to tmpfs" #46809

Uh oh!

dperny commented Nov 13, 2023 •

edited by thaJeztah

Loading

Uh oh!

thaJeztah Nov 13, 2023

Uh oh!

cpuguy83 left a comment

Uh oh!

cpuguy83 Jan 4, 2024

Uh oh!

corhere commented Apr 18, 2024

Uh oh!

cpuguy83 commented May 2, 2024

Uh oh!

thaJeztah left a comment

Uh oh!

Uh oh!

Uh oh!

thaJeztah commented Jun 12, 2024

Uh oh!

thaJeztah Jun 15, 2024

Uh oh!

thaJeztah left a comment

Uh oh!

Uh oh!

Rebase #36720 "Add exec option to tmpfs" #46809

Rebase #36720 "Add exec option to tmpfs" #46809

Uh oh!

Conversation

dperny commented Nov 13, 2023 • edited by thaJeztah Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah Nov 13, 2023

Choose a reason for hiding this comment

Uh oh!

cpuguy83 left a comment

Choose a reason for hiding this comment

Uh oh!

cpuguy83 Jan 4, 2024

Choose a reason for hiding this comment

Uh oh!

corhere commented Apr 18, 2024

Uh oh!

cpuguy83 commented May 2, 2024

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

thaJeztah commented Jun 12, 2024

Uh oh!

thaJeztah Jun 15, 2024

Choose a reason for hiding this comment

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dperny commented Nov 13, 2023 •

edited by thaJeztah

Loading