Skip to content

Commit 4975dca

Browse files
tianontianon
committed
Update to 19.03.0 GA
1 parent cad4d26 commit 4975dca

File tree

8 files changed

+310
-1
lines changed

8 files changed

+310
-1
lines changed

‎.travis.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ services: docker
33

44
env:
55
- VERSION=19.03-rc
6+
- VERSION=19.03
67
- VERSION=18.09-rc
78
- VERSION=18.09
89

‎19.03/Dockerfile‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
FROM alpine:3.10
2+
3+
RUN apk add --no-cache \
4+
ca-certificates
5+
6+
# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
7+
# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
8+
# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
9+
# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
10+
RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
11+
12+
ENV DOCKER_CHANNEL stable
13+
ENV DOCKER_VERSION 19.03.0
14+
# TODO ENV DOCKER_SHA256
15+
# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !!
16+
# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though)
17+
18+
RUN set -eux; \
19+
\
20+
# this "case" statement is generated via "update.sh"
21+
apkArch="$(apk --print-arch)"; \
22+
case "$apkArch" in \
23+
# amd64
24+
x86_64) dockerArch='x86_64' ;; \
25+
# arm32v6
26+
armhf) dockerArch='armel' ;; \
27+
# arm32v7
28+
armv7) dockerArch='armhf' ;; \
29+
# arm64v8
30+
aarch64) dockerArch='aarch64' ;; \
31+
*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;;\
32+
esac; \
33+
\
34+
if ! wget -O docker.tgz "https://download.docker.com/linux/static/${DOCKER_CHANNEL}/${dockerArch}/docker-${DOCKER_VERSION}.tgz"; then \
35+
echo >&2 "error: failed to download 'docker-${DOCKER_VERSION}' from '${DOCKER_CHANNEL}' for '${dockerArch}'"; \
36+
exit 1; \
37+
fi; \
38+
\
39+
tar --extract \
40+
--file docker.tgz \
41+
--strip-components 1 \
42+
--directory /usr/local/bin/ \
43+
; \
44+
rm docker.tgz; \
45+
\
46+
dockerd --version; \
47+
docker --version
48+
49+
COPY modprobe.sh /usr/local/bin/modprobe
50+
COPY docker-entrypoint.sh /usr/local/bin/
51+
52+
# https://github.com/docker-library/docker/pull/166
53+
# dockerd-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-generating TLS certificates
54+
# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH
55+
# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.)
56+
ENV DOCKER_TLS_CERTDIR=/certs
57+
58+
ENTRYPOINT ["docker-entrypoint.sh"]
59+
CMD ["sh"]

‎19.03/dind/Dockerfile‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
FROM docker:19.03
2+
3+
# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
4+
RUN set -eux; \
5+
apk add --no-cache \
6+
btrfs-progs \
7+
e2fsprogs \
8+
e2fsprogs-extra \
9+
iptables \
10+
openssl \
11+
xfsprogs \
12+
xz \
13+
# pigz: https://github.com/moby/moby/pull/35697 (faster gzip implementation)
14+
pigz \
15+
; \
16+
# only install zfs if it's available for the current architecture
17+
# https://git.alpinelinux.org/cgit/aports/tree/main/zfs/APKBUILD?h=3.6-stable#n9 ("all !armhf !ppc64le" as of 2017-11-01)
18+
# "apk info XYZ" exits with a zero exit code but no output when the package exists but not for this arch
19+
if zfs="$(apk info --no-cache --quiet zfs)" && [ -n "$zfs" ]; then \
20+
apk add --no-cache zfs; \
21+
fi
22+
23+
# TODO aufs-tools
24+
25+
# set up subuid/subgid so that "--userns-remap=default" works out-of-the-box
26+
RUN set -x \
27+
&& addgroup -S dockremap \
28+
&& adduser -S -G dockremap dockremap \
29+
&& echo 'dockremap:165536:65536' >> /etc/subuid \
30+
&& echo 'dockremap:165536:65536' >> /etc/subgid
31+
32+
# https://github.com/docker/docker/tree/master/hack/dind
33+
ENV DIND_COMMIT 37498f009d8bf25fbb6199e8ccd34bed84f2874b
34+
35+
RUN set -eux; \
36+
wget -O /usr/local/bin/dind "https://raw.githubusercontent.com/docker/docker/${DIND_COMMIT}/hack/dind"; \
37+
chmod +x /usr/local/bin/dind
38+
39+
COPY dockerd-entrypoint.sh /usr/local/bin/
40+
41+
VOLUME /var/lib/docker
42+
EXPOSE 2375 2376
43+
44+
ENTRYPOINT ["dockerd-entrypoint.sh"]
45+
CMD []

‎19.03/dind/dockerd-entrypoint.sh‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
#!/bin/sh
2+
set -eu
3+
4+
_tls_ensure_private() {
5+
local f="$1"; shift
6+
[ -s "$f" ] || openssl genrsa -out "$f" 4196
7+
}
8+
_tls_san() {
9+
{
10+
ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }'
11+
{
12+
cat /etc/hostname
13+
echo 'docker'
14+
echo 'localhost'
15+
hostname -f
16+
hostname -s
17+
} | sed 's/^/DNS:/'
18+
[ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN"
19+
} | sort -u | xargs printf '%s,' | sed "s/,\$//"
20+
}
21+
_tls_generate_certs() {
22+
local dir="$1"; shift
23+
24+
# if ca/key.pem || !ca/cert.pem, generate CA public if necessary
25+
# if ca/key.pem, generate server public
26+
# if ca/key.pem, generate client public
27+
# (regenerating public certs every startup to account for SAN/IP changes and/or expiration)
28+
29+
# https://github.com/FiloSottile/mkcert/issues/174
30+
local certValidDays='825'
31+
32+
if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then
33+
# if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA
34+
mkdir -p "$dir/ca"
35+
_tls_ensure_private "$dir/ca/key.pem"
36+
openssl req -new -key "$dir/ca/key.pem" \
37+
-out "$dir/ca/cert.pem" \
38+
-subj '/CN=docker:dind CA' -x509 -days "$certValidDays"
39+
fi
40+
41+
if [ -s "$dir/ca/key.pem" ]; then
42+
# if we have a CA private key, we should create/manage a server key
43+
mkdir -p "$dir/server"
44+
_tls_ensure_private "$dir/server/key.pem"
45+
openssl req -new -key "$dir/server/key.pem" \
46+
-out "$dir/server/csr.pem" \
47+
-subj '/CN=docker:dind server'
48+
cat > "$dir/server/openssl.cnf" <<-EOF
49+
[ x509_exts ]
50+
subjectAltName = $(_tls_san)
51+
EOF
52+
openssl x509 -req \
53+
-in "$dir/server/csr.pem" \
54+
-CA "$dir/ca/cert.pem" \
55+
-CAkey "$dir/ca/key.pem" \
56+
-CAcreateserial \
57+
-out "$dir/server/cert.pem" \
58+
-days "$certValidDays" \
59+
-extfile "$dir/server/openssl.cnf" \
60+
-extensions x509_exts
61+
cp "$dir/ca/cert.pem" "$dir/server/ca.pem"
62+
openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem"
63+
fi
64+
65+
if [ -s "$dir/ca/key.pem" ]; then
66+
# if we have a CA private key, we should create/manage a client key
67+
mkdir -p "$dir/client"
68+
_tls_ensure_private "$dir/client/key.pem"
69+
openssl req -new \
70+
-key "$dir/client/key.pem" \
71+
-out "$dir/client/csr.pem" \
72+
-subj '/CN=docker:dind client'
73+
cat > "$dir/client/openssl.cnf" <<-'EOF'
74+
[ x509_exts ]
75+
extendedKeyUsage = clientAuth
76+
EOF
77+
openssl x509 -req \
78+
-in "$dir/client/csr.pem" \
79+
-CA "$dir/ca/cert.pem" \
80+
-CAkey "$dir/ca/key.pem" \
81+
-CAcreateserial \
82+
-out "$dir/client/cert.pem" \
83+
-days "$certValidDays" \
84+
-extfile "$dir/client/openssl.cnf" \
85+
-extensions x509_exts
86+
cp "$dir/ca/cert.pem" "$dir/client/ca.pem"
87+
openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem"
88+
fi
89+
}
90+
91+
# no arguments passed
92+
# or first arg is `-f` or `--some-option`
93+
if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
94+
# add our default arguments
95+
if [ -n "${DOCKER_TLS_CERTDIR:-}" ] \
96+
&& _tls_generate_certs "$DOCKER_TLS_CERTDIR" \
97+
&& [ -s "$DOCKER_TLS_CERTDIR/server/ca.pem" ] \
98+
&& [ -s "$DOCKER_TLS_CERTDIR/server/cert.pem" ] \
99+
&& [ -s "$DOCKER_TLS_CERTDIR/server/key.pem" ] \
100+
; then
101+
# generate certs and use TLS if requested/possible (default in 19.03+)
102+
set -- dockerd \
103+
--host=unix:///var/run/docker.sock \
104+
--host=tcp://0.0.0.0:2376 \
105+
--tlsverify \
106+
--tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \
107+
--tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \
108+
--tlskey "$DOCKER_TLS_CERTDIR/server/key.pem" \
109+
"$@"
110+
else
111+
# TLS disabled (-e DOCKER_TLS_CERTDIR='') or missing certs
112+
set -- dockerd \
113+
--host=unix:///var/run/docker.sock \
114+
--host=tcp://0.0.0.0:2375 \
115+
"$@"
116+
fi
117+
fi
118+
119+
if [ "$1" = 'dockerd' ]; then
120+
if [ -x '/usr/local/bin/dind' ]; then
121+
# if we have the (mostly defunct now) Docker-in-Docker wrapper script, use it
122+
set -- '/usr/local/bin/dind' "$@"
123+
fi
124+
125+
# explicitly remove Docker's default PID file to ensure that it can start properly if it was stopped uncleanly (and thus didn't clean up the PID file)
126+
find /run /var/run -iname 'docker*.pid' -delete
127+
fi
128+
129+
exec "$@"

‎19.03/docker-entrypoint.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/sh
2+
set -eu
3+
4+
# first arg is `-f` or `--some-option`
5+
if [ "${1#-}" != "$1" ]; then
6+
set -- docker "$@"
7+
fi
8+
9+
# if our command is a valid Docker subcommand, let's invoke it through Docker instead
10+
# (this allows for "docker run docker ps", etc)
11+
if docker help "$1" > /dev/null 2>&1; then
12+
set -- docker "$@"
13+
fi
14+
15+
_should_tls() {
16+
[ -n "${DOCKER_TLS_CERTDIR:-}" ] \
17+
&& [ -s "$DOCKER_TLS_CERTDIR/client/ca.pem" ] \
18+
&& [ -s "$DOCKER_TLS_CERTDIR/client/cert.pem" ] \
19+
&& [ -s "$DOCKER_TLS_CERTDIR/client/key.pem" ]
20+
}
21+
22+
# if DOCKER_HOST isn't set and we don't have the default unix socket, let's set DOCKER_HOST to a sane remote value
23+
if [ -z "${DOCKER_HOST:-}" ] && [ ! -S /var/run/docker.sock ]; then
24+
if _should_tls || [ -n "${DOCKER_TLS_VERIFY:-}" ]; then
25+
export DOCKER_HOST='tcp://docker:2376'
26+
else
27+
export DOCKER_HOST='tcp://docker:2375'
28+
fi
29+
fi
30+
if [ -n "${DOCKER_HOST:-}" ] && _should_tls; then
31+
export DOCKER_TLS_VERIFY=1
32+
export DOCKER_CERT_PATH="$DOCKER_TLS_CERTDIR/client"
33+
fi
34+
35+
if [ "$1" = 'dockerd' ]; then
36+
cat >&2 <<-'EOW'
37+
38+
📎 Hey there! It looks like you're trying to run a Docker daemon.
39+
40+
You probably should use the "dind" image variant instead, something like:
41+
42+
docker run --privileged --name some-docker ... docker:dind ...
43+
44+
See https://hub.docker.com/_/docker/ for more documentation and usage examples.
45+
46+
EOW
47+
sleep 3
48+
fi
49+
50+
exec "$@"

‎19.03/git/Dockerfile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FROM docker:19.03
2+
3+
RUN apk add --no-cache \
4+
git \
5+
openssh-client

‎19.03/modprobe.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/sh
2+
set -eu
3+
4+
# "modprobe" without modprobe
5+
# https://twitter.com/lucabruno/status/902934379835662336
6+
7+
# this isn't 100% fool-proof, but it'll have a much higher success rate than simply using the "real" modprobe
8+
9+
# Docker often uses "modprobe -va foo bar baz"
10+
# so we ignore modules that start with "-"
11+
for module; do
12+
if [ "${module#-}" = "$module" ]; then
13+
ip link show "$module" || true
14+
lsmod | grep "$module" || true
15+
fi
16+
done
17+
18+
# remove /usr/local/... from PATH so we can exec the real modprobe as a last resort
19+
export PATH='/usr/sbin:/usr/bin:/sbin:/bin'
20+
exec modprobe "$@"

‎generate-stackbrew-library.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ for version in "${versions[@]}"; do
8888
# if this is a "-rc" release, let's make sure the release it contains isn't already GA (and thus something we should not publish anymore)
8989
rcFullVersion="$(git show HEAD:"$rcVersion/Dockerfile" | awk '$1 == "ENV" && $2 == "DOCKER_VERSION" { print $3; exit }')"
9090
latestVersion="$({ echo "$fullVersion"; echo "$rcFullVersion"; } | sort -V | tail -1)"
91-
if [ "$latestVersion" = "$rcFullVersion" ]; then
91+
if [[ "$fullVersion" == "$rcFullVersion"* ]] || [ "$latestVersion" = "$rcFullVersion" ]; then
9292
# "x.y.z-rc1" == x.y.z*
9393
continue
9494
fi

0 commit comments

Comments
 (0)