diff --git a/23/cli/Dockerfile b/23/cli/Dockerfile deleted file mode 100644 index cad1a7f86..000000000 --- a/23/cli/Dockerfile +++ /dev/null @@ -1,161 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM alpine:3.18 - -RUN apk add --no-cache \ - ca-certificates \ -# DOCKER_HOST=ssh://... -- https://github.com/docker/cli/pull/1014 - openssh-client - -# ensure that nsswitch.conf is set up for Go's "netgo" implementation (which Docker explicitly uses) -# - https://github.com/moby/moby/blob/v20.10.21/hack/make.sh#L115 -# - https://github.com/golang/go/blob/go1.19.3/src/net/conf.go#L227-L303 -# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf -RUN [ -e /etc/nsswitch.conf ] && grep '^hosts: files dns' /etc/nsswitch.conf - -ENV DOCKER_VERSION 23.0.6 - -RUN set -eux; \ - \ - apkArch="$(apk --print-arch)"; \ - case "$apkArch" in \ - 'x86_64') \ - url='https://download.docker.com/linux/static/stable/x86_64/docker-23.0.6.tgz'; \ - ;; \ - 'armhf') \ - url='https://download.docker.com/linux/static/stable/armel/docker-23.0.6.tgz'; \ - ;; \ - 'armv7') \ - url='https://download.docker.com/linux/static/stable/armhf/docker-23.0.6.tgz'; \ - ;; \ - 'aarch64') \ - url='https://download.docker.com/linux/static/stable/aarch64/docker-23.0.6.tgz'; \ - ;; \ - *) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \ - esac; \ - \ - wget -O 'docker.tgz' "$url"; \ - \ - tar --extract \ - --file docker.tgz \ - --strip-components 1 \ - --directory /usr/local/bin/ \ - --no-same-owner \ - 'docker/docker' \ - ; \ - rm docker.tgz; \ - \ - docker --version - -ENV DOCKER_BUILDX_VERSION 0.11.2 -RUN set -eux; \ - \ - apkArch="$(apk --print-arch)"; \ - case "$apkArch" in \ - 'x86_64') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-amd64'; \ - sha256='311568ee69715abc46163fd688e56c77ab0144ff32e116d0f293bfc3470e75b7'; \ - ;; \ - 'armhf') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm-v6'; \ - sha256='c1bab0c7374406d5069f60b291971d71161fbd3c00e8a8fb1b68b9053eda8a4e'; \ - ;; \ - 'armv7') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm-v7'; \ - sha256='4defdf463ca2516d3f58fef69a6f78cbbb8baf16d936cdfc54df4a4be0d48f7f'; \ - ;; \ - 'aarch64') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm64'; \ - sha256='565e36085a35bba5104f37365ba796c111338eea1a0902b3a7ff42e2e1248815'; \ - ;; \ - 'ppc64le') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-ppc64le'; \ - sha256='c5f5cb9957890873a537c7ff5c4eef36132339622baeabb37a4b9b7251ddf836'; \ - ;; \ - 'riscv64') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-riscv64'; \ - sha256='c0adc4b4625f7e3df7dcdec840568f918673f2ed4bcd03ca1e63ea2a5627ca35'; \ - ;; \ - 's390x') \ - url='https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-s390x'; \ - sha256='02916c76c3872fd0b3fa57e71403fee92b6be10f350b96a5ff99e7914dd277b8'; \ - ;; \ - *) echo >&2 "warning: unsupported 'docker-buildx' architecture ($apkArch); skipping"; exit 0 ;; \ - esac; \ - \ - wget -O 'docker-buildx' "$url"; \ - echo "$sha256 *"'docker-buildx' | sha256sum -c -; \ - \ - plugin='/usr/local/libexec/docker/cli-plugins/docker-buildx'; \ - mkdir -p "$(dirname "$plugin")"; \ - mv -vT 'docker-buildx' "$plugin"; \ - chmod +x "$plugin"; \ - \ - docker buildx version - -ENV DOCKER_COMPOSE_VERSION 2.22.0 -RUN set -eux; \ - \ - apkArch="$(apk --print-arch)"; \ - case "$apkArch" in \ - 'x86_64') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-x86_64'; \ - sha256='e849450f1c5c20123aa7d63291e2a818b7a117f2e03e432853ece463dd09e67a'; \ - ;; \ - 'armhf') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-armv6'; \ - sha256='46cabb4363c5fa66e63c6055b1d0a6fe2c7995350e48f14816a752ae4132231d'; \ - ;; \ - 'armv7') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-armv7'; \ - sha256='1a0d500eaae3c4ddbfdeb566896207c0628a671065b95d0e8907bca58f91d312'; \ - ;; \ - 'aarch64') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-aarch64'; \ - sha256='572a22000d408fb524258b379bf272a007c8da977c3e8d47c34f4e45dd7b1932'; \ - ;; \ - 'ppc64le') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-ppc64le'; \ - sha256='4d1a3e89fdb7641422dc5cbcab48fd2da337b03265cb5ac2858c3425bacf952c'; \ - ;; \ - 'riscv64') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-riscv64'; \ - sha256='c45193b98c54e5a898e6b9095f70b0487599f19ce25b579ed2fcc3f868415aff'; \ - ;; \ - 's390x') \ - url='https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-s390x'; \ - sha256='716aded74df512728638f1fe53170c46d94c1a085bc5a24108ce7101bc37bd81'; \ - ;; \ - *) echo >&2 "warning: unsupported 'docker-compose' architecture ($apkArch); skipping"; exit 0 ;; \ - esac; \ - \ - wget -O 'docker-compose' "$url"; \ - echo "$sha256 *"'docker-compose' | sha256sum -c -; \ - \ - plugin='/usr/local/libexec/docker/cli-plugins/docker-compose'; \ - mkdir -p "$(dirname "$plugin")"; \ - mv -vT 'docker-compose' "$plugin"; \ - chmod +x "$plugin"; \ - \ - ln -sv "$plugin" /usr/local/bin/; \ - docker-compose --version; \ - docker compose version - -COPY modprobe.sh /usr/local/bin/modprobe -COPY docker-entrypoint.sh /usr/local/bin/ - -# https://github.com/docker-library/docker/pull/166 -# dockerd-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-generating TLS certificates -# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH -# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.) -ENV DOCKER_TLS_CERTDIR=/certs -# also, ensure the directory pre-exists and has wide enough permissions for "dockerd-entrypoint.sh" to create subdirectories, even when run in "rootless" mode -RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client -# (doing both /certs and /certs/client so that if Docker does a "copy-up" into a volume defined on /certs/client, it will "do the right thing" by default in a way that still works for rootless users) - -ENTRYPOINT ["docker-entrypoint.sh"] -CMD ["sh"] diff --git a/23/cli/docker-entrypoint.sh b/23/cli/docker-entrypoint.sh deleted file mode 100755 index d41cef8e3..000000000 --- a/23/cli/docker-entrypoint.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/sh -set -eu - -# first arg is `-f` or `--some-option` -if [ "${1#-}" != "$1" ]; then - set -- docker "$@" -fi - -# if our command is a valid Docker subcommand, let's invoke it through Docker instead -# (this allows for "docker run docker ps", etc) -if docker help "$1" > /dev/null 2>&1; then - set -- docker "$@" -fi - -_should_tls() { - [ -n "${DOCKER_TLS_CERTDIR:-}" ] \ - && [ -s "$DOCKER_TLS_CERTDIR/client/ca.pem" ] \ - && [ -s "$DOCKER_TLS_CERTDIR/client/cert.pem" ] \ - && [ -s "$DOCKER_TLS_CERTDIR/client/key.pem" ] -} - -# if we have no DOCKER_HOST but we do have the default Unix socket (standard or rootless), use it explicitly -if [ -z "${DOCKER_HOST:-}" ] && [ -S /var/run/docker.sock ]; then - export DOCKER_HOST=unix:///var/run/docker.sock -elif [ -z "${DOCKER_HOST:-}" ] && XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}" && [ -S "$XDG_RUNTIME_DIR/docker.sock" ]; then - export DOCKER_HOST="unix://$XDG_RUNTIME_DIR/docker.sock" -fi - -# if DOCKER_HOST isn't set (no custom setting, no default socket), let's set it to a sane remote value -if [ -z "${DOCKER_HOST:-}" ]; then - if _should_tls || [ -n "${DOCKER_TLS_VERIFY:-}" ]; then - export DOCKER_HOST='tcp://docker:2376' - else - export DOCKER_HOST='tcp://docker:2375' - fi -fi -if [ "${DOCKER_HOST#tcp:}" != "$DOCKER_HOST" ] \ - && [ -z "${DOCKER_TLS_VERIFY:-}" ] \ - && [ -z "${DOCKER_CERT_PATH:-}" ] \ - && _should_tls \ -; then - export DOCKER_TLS_VERIFY=1 - export DOCKER_CERT_PATH="$DOCKER_TLS_CERTDIR/client" -fi - -if [ "$1" = 'dockerd' ]; then - cat >&2 <<-'EOW' - - 📎 Hey there! It looks like you're trying to run a Docker daemon. - - You probably should use the "dind" image variant instead, something like: - - docker run --privileged --name some-docker ... docker:dind ... - - See https://hub.docker.com/_/docker/ for more documentation and usage examples. - - EOW - sleep 3 -fi - -exec "$@" diff --git a/23/cli/modprobe.sh b/23/cli/modprobe.sh deleted file mode 100755 index b357d893f..000000000 --- a/23/cli/modprobe.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh -set -eu - -# "modprobe" without modprobe -# https://twitter.com/lucabruno/status/902934379835662336 - -# this isn't 100% fool-proof, but it'll have a much higher success rate than simply using the "real" modprobe - -# Docker often uses "modprobe -va foo bar baz" -# so we ignore modules that start with "-" -for module; do - if [ "${module#-}" = "$module" ]; then - ip link show "$module" || true - lsmod | grep "$module" || true - fi -done - -# remove /usr/local/... from PATH so we can exec the real modprobe as a last resort -export PATH='/usr/sbin:/usr/bin:/sbin:/bin' -exec modprobe "$@" diff --git a/23/dind-rootless/Dockerfile b/23/dind-rootless/Dockerfile deleted file mode 100644 index d8db2e7c0..000000000 --- a/23/dind-rootless/Dockerfile +++ /dev/null @@ -1,55 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM docker:23-dind - -# busybox "ip" is insufficient: -# [rootlesskit:child ] error: executing [[ip tuntap add name tap0 mode tap] [ip link set tap0 address 02:50:00:00:00:01]]: exit status 1 -RUN apk add --no-cache iproute2 fuse-overlayfs - -# "/run/user/UID" will be used by default as the value of XDG_RUNTIME_DIR -RUN mkdir /run/user && chmod 1777 /run/user - -# create a default user preconfigured for running rootless dockerd -RUN set -eux; \ - adduser -h /home/rootless -g 'Rootless' -D -u 1000 rootless; \ - echo 'rootless:100000:65536' >> /etc/subuid; \ - echo 'rootless:100000:65536' >> /etc/subgid - -RUN set -eux; \ - \ - apkArch="$(apk --print-arch)"; \ - case "$apkArch" in \ - 'x86_64') \ - url='https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-23.0.6.tgz'; \ - ;; \ - 'aarch64') \ - url='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-23.0.6.tgz'; \ - ;; \ - *) echo >&2 "error: unsupported 'rootless.tgz' architecture ($apkArch)"; exit 1 ;; \ - esac; \ - \ - wget -O 'rootless.tgz' "$url"; \ - \ - tar --extract \ - --file rootless.tgz \ - --strip-components 1 \ - --directory /usr/local/bin/ \ - 'docker-rootless-extras/rootlesskit' \ - 'docker-rootless-extras/rootlesskit-docker-proxy' \ - 'docker-rootless-extras/vpnkit' \ - ; \ - rm rootless.tgz; \ - \ - rootlesskit --version; \ - vpnkit --version - -# pre-create "/var/lib/docker" for our rootless user -RUN set -eux; \ - mkdir -p /home/rootless/.local/share/docker; \ - chown -R rootless:rootless /home/rootless/.local/share/docker -VOLUME /home/rootless/.local/share/docker -USER rootless diff --git a/23/dind/Dockerfile b/23/dind/Dockerfile deleted file mode 100644 index 0cc939c33..000000000 --- a/23/dind/Dockerfile +++ /dev/null @@ -1,89 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM docker:23-cli - -# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies -RUN set -eux; \ - apk add --no-cache \ - btrfs-progs \ - e2fsprogs \ - e2fsprogs-extra \ - ip6tables \ - iptables \ - openssl \ - shadow-uidmap \ - xfsprogs \ - xz \ -# pigz: https://github.com/moby/moby/pull/35697 (faster gzip implementation) - pigz \ - ; \ -# only install zfs if it's available for the current architecture -# https://git.alpinelinux.org/cgit/aports/tree/main/zfs/APKBUILD?h=3.6-stable#n9 ("all !armhf !ppc64le" as of 2017-11-01) -# "apk info XYZ" exits with a zero exit code but no output when the package exists but not for this arch - if zfs="$(apk info --no-cache --quiet zfs)" && [ -n "$zfs" ]; then \ - apk add --no-cache zfs; \ - fi - -# TODO aufs-tools - -# set up subuid/subgid so that "--userns-remap=default" works out-of-the-box -RUN set -eux; \ - addgroup -S dockremap; \ - adduser -S -G dockremap dockremap; \ - echo 'dockremap:165536:65536' >> /etc/subuid; \ - echo 'dockremap:165536:65536' >> /etc/subgid - -RUN set -eux; \ - \ - apkArch="$(apk --print-arch)"; \ - case "$apkArch" in \ - 'x86_64') \ - url='https://download.docker.com/linux/static/stable/x86_64/docker-23.0.6.tgz'; \ - ;; \ - 'armhf') \ - url='https://download.docker.com/linux/static/stable/armel/docker-23.0.6.tgz'; \ - ;; \ - 'armv7') \ - url='https://download.docker.com/linux/static/stable/armhf/docker-23.0.6.tgz'; \ - ;; \ - 'aarch64') \ - url='https://download.docker.com/linux/static/stable/aarch64/docker-23.0.6.tgz'; \ - ;; \ - *) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \ - esac; \ - \ - wget -O 'docker.tgz' "$url"; \ - \ - tar --extract \ - --file docker.tgz \ - --strip-components 1 \ - --directory /usr/local/bin/ \ - --no-same-owner \ -# we exclude the CLI binary because we already extracted that over in the "docker:23-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer - --exclude 'docker/docker' \ - ; \ - rm docker.tgz; \ - \ - dockerd --version; \ - containerd --version; \ - ctr --version; \ - runc --version - -# https://github.com/docker/docker/tree/master/hack/dind -ENV DIND_COMMIT d58df1fc6c866447ce2cd129af10e5b507705624 - -RUN set -eux; \ - wget -O /usr/local/bin/dind "https://raw.githubusercontent.com/docker/docker/${DIND_COMMIT}/hack/dind"; \ - chmod +x /usr/local/bin/dind - -COPY dockerd-entrypoint.sh /usr/local/bin/ - -VOLUME /var/lib/docker -EXPOSE 2375 2376 - -ENTRYPOINT ["dockerd-entrypoint.sh"] -CMD [] diff --git a/23/dind/dockerd-entrypoint.sh b/23/dind/dockerd-entrypoint.sh deleted file mode 100755 index 00819384b..000000000 --- a/23/dind/dockerd-entrypoint.sh +++ /dev/null @@ -1,198 +0,0 @@ -#!/bin/sh -set -eu - -_tls_ensure_private() { - local f="$1"; shift - [ -s "$f" ] || openssl genrsa -out "$f" 4096 -} -_tls_san() { - { - ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }' - { - cat /etc/hostname - echo 'docker' - echo 'localhost' - hostname -f - hostname -s - } | sed 's/^/DNS:/' - [ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN" - } | sort -u | xargs printf '%s,' | sed "s/,\$//" -} -_tls_generate_certs() { - local dir="$1"; shift - - # if server/{ca,key,cert}.pem && !ca/key.pem, do NOTHING except verify (user likely managing CA themselves) - # if ca/key.pem || !ca/cert.pem, generate CA public if necessary - # if ca/key.pem, generate server public - # if ca/key.pem, generate client public - # (regenerating public certs every startup to account for SAN/IP changes and/or expiration) - - if [ -s "$dir/server/ca.pem" ] && [ -s "$dir/server/cert.pem" ] && [ -s "$dir/server/key.pem" ] && [ ! -s "$dir/ca/key.pem" ]; then - openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem" - return 0 - fi - - # https://github.com/FiloSottile/mkcert/issues/174 - local certValidDays='825' - - if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then - # if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA - mkdir -p "$dir/ca" - _tls_ensure_private "$dir/ca/key.pem" - openssl req -new -key "$dir/ca/key.pem" \ - -out "$dir/ca/cert.pem" \ - -subj '/CN=docker:dind CA' -x509 -days "$certValidDays" - fi - - if [ -s "$dir/ca/key.pem" ]; then - # if we have a CA private key, we should create/manage a server key - mkdir -p "$dir/server" - _tls_ensure_private "$dir/server/key.pem" - openssl req -new -key "$dir/server/key.pem" \ - -out "$dir/server/csr.pem" \ - -subj '/CN=docker:dind server' - cat > "$dir/server/openssl.cnf" <<-EOF - [ x509_exts ] - subjectAltName = $(_tls_san) - EOF - openssl x509 -req \ - -in "$dir/server/csr.pem" \ - -CA "$dir/ca/cert.pem" \ - -CAkey "$dir/ca/key.pem" \ - -CAcreateserial \ - -out "$dir/server/cert.pem" \ - -days "$certValidDays" \ - -extfile "$dir/server/openssl.cnf" \ - -extensions x509_exts - cp "$dir/ca/cert.pem" "$dir/server/ca.pem" - openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem" - fi - - if [ -s "$dir/ca/key.pem" ]; then - # if we have a CA private key, we should create/manage a client key - mkdir -p "$dir/client" - _tls_ensure_private "$dir/client/key.pem" - chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts - openssl req -new \ - -key "$dir/client/key.pem" \ - -out "$dir/client/csr.pem" \ - -subj '/CN=docker:dind client' - cat > "$dir/client/openssl.cnf" <<-'EOF' - [ x509_exts ] - extendedKeyUsage = clientAuth - EOF - openssl x509 -req \ - -in "$dir/client/csr.pem" \ - -CA "$dir/ca/cert.pem" \ - -CAkey "$dir/ca/key.pem" \ - -CAcreateserial \ - -out "$dir/client/cert.pem" \ - -days "$certValidDays" \ - -extfile "$dir/client/openssl.cnf" \ - -extensions x509_exts - cp "$dir/ca/cert.pem" "$dir/client/ca.pem" - openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem" - fi -} - -# no arguments passed -# or first arg is `-f` or `--some-option` -if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then - # set "dockerSocket" to the default "--host" *unix socket* value (for both standard or rootless) - uid="$(id -u)" - if [ "$uid" = '0' ]; then - dockerSocket='unix:///var/run/docker.sock' - else - # if we're not root, we must be trying to run rootless - : "${XDG_RUNTIME_DIR:=/run/user/$uid}" - dockerSocket="unix://$XDG_RUNTIME_DIR/docker.sock" - fi - case "${DOCKER_HOST:-}" in - unix://*) - dockerSocket="$DOCKER_HOST" - ;; - esac - - # add our default arguments - if [ -n "${DOCKER_TLS_CERTDIR:-}" ]; then - _tls_generate_certs "$DOCKER_TLS_CERTDIR" - # generate certs and use TLS if requested/possible (default in 19.03+) - set -- dockerd \ - --host="$dockerSocket" \ - --host=tcp://0.0.0.0:2376 \ - --tlsverify \ - --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ - --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ - --tlskey "$DOCKER_TLS_CERTDIR/server/key.pem" \ - "$@" - DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2376:2376/tcp" - else - # TLS disabled (-e DOCKER_TLS_CERTDIR='') or missing certs - set -- dockerd \ - --host="$dockerSocket" \ - --host=tcp://0.0.0.0:2375 \ - "$@" - DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" - fi -fi - -if [ "$1" = 'dockerd' ]; then - # explicitly remove Docker's default PID file to ensure that it can start properly if it was stopped uncleanly (and thus didn't clean up the PID file) - find /run /var/run -iname 'docker*.pid' -delete || : - - # XXX inject "docker-init" (tini) as pid1 to workaround https://github.com/docker-library/docker/issues/318 (zombie container-shim processes) - set -- docker-init -- "$@" - - if ! iptables -nL > /dev/null 2>&1; then - # if iptables fails to run, chances are high the necessary kernel modules aren't loaded (perhaps the host is using nftables with the translating "iptables" wrappers, for example) - # https://github.com/docker-library/docker/issues/350 - # https://github.com/moby/moby/issues/26824 - modprobe ip_tables || : - fi - - uid="$(id -u)" - if [ "$uid" != '0' ]; then - # if we're not root, we must be trying to run rootless - if ! command -v rootlesskit > /dev/null; then - echo >&2 "error: attempting to run rootless dockerd but missing 'rootlesskit' (perhaps the 'docker:dind-rootless' image variant is intended?)" - exit 1 - fi - user="$(id -un 2>/dev/null || :)" - if ! grep -qE "^($uid${user:+|$user}):" /etc/subuid || ! grep -qE "^($uid${user:+|$user}):" /etc/subgid; then - echo >&2 "error: attempting to run rootless dockerd but missing necessary entries in /etc/subuid and/or /etc/subgid for $uid" - exit 1 - fi - : "${XDG_RUNTIME_DIR:=/run/user/$uid}" - export XDG_RUNTIME_DIR - if ! mkdir -p "$XDG_RUNTIME_DIR" || [ ! -w "$XDG_RUNTIME_DIR" ] || ! mkdir -p "$HOME/.local/share/docker" || [ ! -w "$HOME/.local/share/docker" ]; then - echo >&2 "error: attempting to run rootless dockerd but need writable HOME ($HOME) and XDG_RUNTIME_DIR ($XDG_RUNTIME_DIR) for user $uid" - exit 1 - fi - if [ -f /proc/sys/kernel/unprivileged_userns_clone ] && unprivClone="$(cat /proc/sys/kernel/unprivileged_userns_clone)" && [ "$unprivClone" != '1' ]; then - echo >&2 "error: attempting to run rootless dockerd but need 'kernel.unprivileged_userns_clone' (/proc/sys/kernel/unprivileged_userns_clone) set to 1" - exit 1 - fi - if [ -f /proc/sys/user/max_user_namespaces ] && maxUserns="$(cat /proc/sys/user/max_user_namespaces)" && [ "$maxUserns" = '0' ]; then - echo >&2 "error: attempting to run rootless dockerd but need 'user.max_user_namespaces' (/proc/sys/user/max_user_namespaces) set to a sufficiently large value" - exit 1 - fi - # TODO overlay support detection? - exec rootlesskit \ - --net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \ - --mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \ - --disable-host-loopback \ - --port-driver=builtin \ - --copy-up=/etc \ - --copy-up=/run \ - ${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \ - "$@" - elif [ -x '/usr/local/bin/dind' ]; then - # if we have the (mostly defunct now) Docker-in-Docker wrapper script, use it - set -- '/usr/local/bin/dind' "$@" - fi -else - # if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too - set -- docker-entrypoint.sh "$@" -fi - -exec "$@" diff --git a/23/git/Dockerfile b/23/git/Dockerfile deleted file mode 100644 index cf58421bf..000000000 --- a/23/git/Dockerfile +++ /dev/null @@ -1,9 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM docker:23-dind - -RUN apk add --no-cache git diff --git a/23/windows/windowsservercore-1809/Dockerfile b/23/windows/windowsservercore-1809/Dockerfile deleted file mode 100644 index 3c335c5f9..000000000 --- a/23/windows/windowsservercore-1809/Dockerfile +++ /dev/null @@ -1,91 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM mcr.microsoft.com/windows/servercore:1809 - -# $ProgressPreference: https://github.com/PowerShell/PowerShell/issues/2138#issuecomment-251261324 -SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] - -# PATH isn't actually set in the Docker image, so we have to set it from within the container -RUN $newPath = ('{0}\docker;{1}' -f $env:ProgramFiles, $env:PATH); \ - Write-Host ('Updating PATH: {0}' -f $newPath); \ - [Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine); -# doing this first to share cache across versions more aggressively - -ENV DOCKER_VERSION 23.0.6 -ENV DOCKER_URL https://download.docker.com/win/static/stable/x86_64/docker-23.0.6.zip -# TODO ENV DOCKER_SHA256 -# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !! -# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though) - -RUN Write-Host ('Downloading {0} ...' -f $env:DOCKER_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_URL -OutFile 'docker.zip'; \ - \ - Write-Host 'Expanding ...'; \ - Expand-Archive docker.zip -DestinationPath $env:ProgramFiles; \ -# (this archive has a "docker/..." directory in it already) - \ - Write-Host 'Removing ...'; \ - Remove-Item @( \ - 'docker.zip', \ - ('{0}\docker\dockerd.exe' -f $env:ProgramFiles) \ - ) -Force; \ - \ - Write-Host 'Verifying install ("docker --version") ...'; \ - docker --version; \ - \ - Write-Host 'Complete.'; - -# https://github.com/docker-library/docker/issues/409#issuecomment-1462868414 -ENV DOCKER_BUILDX_VERSION 0.11.2 -ENV DOCKER_BUILDX_URL https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.windows-amd64.exe -ENV DOCKER_BUILDX_SHA256 d9419c0838c8a08c2da28fcee585f48926c4dd64e5be1d96eb55da12fa3332d9 -RUN $dir = ('{0}\docker\cli-plugins' -f $env:ProgramFiles); \ - Write-Host ('Creating {0} ...' -f $dir); \ - New-Item -ItemType Directory $dir -Force; \ - \ - $plugin = ('{0}\docker-buildx.exe' -f $dir); \ - Write-Host ('Downloading {0} ...' -f $env:DOCKER_BUILDX_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_BUILDX_URL -OutFile $plugin; \ - \ - Write-Host ('Verifying sha256 ({0}) ...' -f $env:DOCKER_BUILDX_SHA256); \ - if ((Get-FileHash $plugin -Algorithm sha256).Hash -ne $env:DOCKER_BUILDX_SHA256) { \ - Write-Host 'FAILED!'; \ - exit 1; \ - }; \ - \ - Write-Host 'Verifying install ("docker buildx version") ...'; \ - docker buildx version; \ - \ - Write-Host 'Complete.'; -ENV DOCKER_COMPOSE_VERSION 2.22.0 -ENV DOCKER_COMPOSE_URL https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-windows-x86_64.exe -ENV DOCKER_COMPOSE_SHA256 eeddd5d558d2711bd61a41f5761610b085d83e896617ff04aec8561b349a826c -RUN $dir = ('{0}\docker\cli-plugins' -f $env:ProgramFiles); \ - Write-Host ('Creating {0} ...' -f $dir); \ - New-Item -ItemType Directory $dir -Force; \ - \ - $plugin = ('{0}\docker-compose.exe' -f $dir); \ - Write-Host ('Downloading {0} ...' -f $env:DOCKER_COMPOSE_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_COMPOSE_URL -OutFile $plugin; \ - \ - Write-Host ('Verifying sha256 ({0}) ...' -f $env:DOCKER_COMPOSE_SHA256); \ - if ((Get-FileHash $plugin -Algorithm sha256).Hash -ne $env:DOCKER_COMPOSE_SHA256) { \ - Write-Host 'FAILED!'; \ - exit 1; \ - }; \ - \ - Write-Host 'Verifying install ("docker compose version") ...'; \ - docker compose version; \ - \ - $link = ('{0}\docker\docker-compose.exe' -f $env:ProgramFiles); \ - Write-Host ('Linking {0} to {1} ...' -f $plugin, $link); \ - New-Item -ItemType SymbolicLink -Path $link -Target $plugin; \ - \ - Write-Host 'Verifying install ("docker-compose --version") ...'; \ - docker-compose --version; \ - \ - Write-Host 'Complete.'; diff --git a/23/windows/windowsservercore-ltsc2022/Dockerfile b/23/windows/windowsservercore-ltsc2022/Dockerfile deleted file mode 100644 index 20b532d8a..000000000 --- a/23/windows/windowsservercore-ltsc2022/Dockerfile +++ /dev/null @@ -1,91 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM mcr.microsoft.com/windows/servercore:ltsc2022 - -# $ProgressPreference: https://github.com/PowerShell/PowerShell/issues/2138#issuecomment-251261324 -SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] - -# PATH isn't actually set in the Docker image, so we have to set it from within the container -RUN $newPath = ('{0}\docker;{1}' -f $env:ProgramFiles, $env:PATH); \ - Write-Host ('Updating PATH: {0}' -f $newPath); \ - [Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine); -# doing this first to share cache across versions more aggressively - -ENV DOCKER_VERSION 23.0.6 -ENV DOCKER_URL https://download.docker.com/win/static/stable/x86_64/docker-23.0.6.zip -# TODO ENV DOCKER_SHA256 -# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !! -# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though) - -RUN Write-Host ('Downloading {0} ...' -f $env:DOCKER_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_URL -OutFile 'docker.zip'; \ - \ - Write-Host 'Expanding ...'; \ - Expand-Archive docker.zip -DestinationPath $env:ProgramFiles; \ -# (this archive has a "docker/..." directory in it already) - \ - Write-Host 'Removing ...'; \ - Remove-Item @( \ - 'docker.zip', \ - ('{0}\docker\dockerd.exe' -f $env:ProgramFiles) \ - ) -Force; \ - \ - Write-Host 'Verifying install ("docker --version") ...'; \ - docker --version; \ - \ - Write-Host 'Complete.'; - -# https://github.com/docker-library/docker/issues/409#issuecomment-1462868414 -ENV DOCKER_BUILDX_VERSION 0.11.2 -ENV DOCKER_BUILDX_URL https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.windows-amd64.exe -ENV DOCKER_BUILDX_SHA256 d9419c0838c8a08c2da28fcee585f48926c4dd64e5be1d96eb55da12fa3332d9 -RUN $dir = ('{0}\docker\cli-plugins' -f $env:ProgramFiles); \ - Write-Host ('Creating {0} ...' -f $dir); \ - New-Item -ItemType Directory $dir -Force; \ - \ - $plugin = ('{0}\docker-buildx.exe' -f $dir); \ - Write-Host ('Downloading {0} ...' -f $env:DOCKER_BUILDX_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_BUILDX_URL -OutFile $plugin; \ - \ - Write-Host ('Verifying sha256 ({0}) ...' -f $env:DOCKER_BUILDX_SHA256); \ - if ((Get-FileHash $plugin -Algorithm sha256).Hash -ne $env:DOCKER_BUILDX_SHA256) { \ - Write-Host 'FAILED!'; \ - exit 1; \ - }; \ - \ - Write-Host 'Verifying install ("docker buildx version") ...'; \ - docker buildx version; \ - \ - Write-Host 'Complete.'; -ENV DOCKER_COMPOSE_VERSION 2.22.0 -ENV DOCKER_COMPOSE_URL https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-windows-x86_64.exe -ENV DOCKER_COMPOSE_SHA256 eeddd5d558d2711bd61a41f5761610b085d83e896617ff04aec8561b349a826c -RUN $dir = ('{0}\docker\cli-plugins' -f $env:ProgramFiles); \ - Write-Host ('Creating {0} ...' -f $dir); \ - New-Item -ItemType Directory $dir -Force; \ - \ - $plugin = ('{0}\docker-compose.exe' -f $dir); \ - Write-Host ('Downloading {0} ...' -f $env:DOCKER_COMPOSE_URL); \ - Invoke-WebRequest -Uri $env:DOCKER_COMPOSE_URL -OutFile $plugin; \ - \ - Write-Host ('Verifying sha256 ({0}) ...' -f $env:DOCKER_COMPOSE_SHA256); \ - if ((Get-FileHash $plugin -Algorithm sha256).Hash -ne $env:DOCKER_COMPOSE_SHA256) { \ - Write-Host 'FAILED!'; \ - exit 1; \ - }; \ - \ - Write-Host 'Verifying install ("docker compose version") ...'; \ - docker compose version; \ - \ - $link = ('{0}\docker\docker-compose.exe' -f $env:ProgramFiles); \ - Write-Host ('Linking {0} to {1} ...' -f $plugin, $link); \ - New-Item -ItemType SymbolicLink -Path $link -Target $plugin; \ - \ - Write-Host 'Verifying install ("docker-compose --version") ...'; \ - docker-compose --version; \ - \ - Write-Host 'Complete.'; diff --git a/24/cli/Dockerfile b/24/cli/Dockerfile index f65e8e54f..f02af6dc1 100644 --- a/24/cli/Dockerfile +++ b/24/cli/Dockerfile @@ -12,8 +12,8 @@ RUN apk add --no-cache \ openssh-client # ensure that nsswitch.conf is set up for Go's "netgo" implementation (which Docker explicitly uses) -# - https://github.com/moby/moby/blob/v20.10.21/hack/make.sh#L115 -# - https://github.com/golang/go/blob/go1.19.3/src/net/conf.go#L227-L303 +# - https://github.com/moby/moby/blob/v24.0.6/hack/make.sh#L111 +# - https://github.com/golang/go/blob/go1.19.13/src/net/conf.go#L227-L303 # - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf RUN [ -e /etc/nsswitch.conf ] && grep '^hosts: files dns' /etc/nsswitch.conf diff --git a/Dockerfile-cli.template b/Dockerfile-cli.template index be92d9521..1ae00e841 100644 --- a/Dockerfile-cli.template +++ b/Dockerfile-cli.template @@ -7,8 +7,8 @@ RUN apk add --no-cache \ openssh-client # ensure that nsswitch.conf is set up for Go's "netgo" implementation (which Docker explicitly uses) -# - https://github.com/moby/moby/blob/v20.10.21/hack/make.sh#L115 -# - https://github.com/golang/go/blob/go1.19.3/src/net/conf.go#L227-L303 +# - https://github.com/moby/moby/blob/v24.0.6/hack/make.sh#L111 +# - https://github.com/golang/go/blob/go1.19.13/src/net/conf.go#L227-L303 # - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf RUN [ -e /etc/nsswitch.conf ] && grep '^hosts: files dns' /etc/nsswitch.conf diff --git a/versions.json b/versions.json index 9a47dcf4b..5a9cf00e3 100644 --- a/versions.json +++ b/versions.json @@ -1,146 +1,4 @@ { - "23": { - "arches": { - "amd64": { - "dockerUrl": "https://download.docker.com/linux/static/stable/x86_64/docker-23.0.6.tgz", - "rootlessExtrasUrl": "https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-23.0.6.tgz" - }, - "arm32v6": { - "dockerUrl": "https://download.docker.com/linux/static/stable/armel/docker-23.0.6.tgz" - }, - "arm32v7": { - "dockerUrl": "https://download.docker.com/linux/static/stable/armhf/docker-23.0.6.tgz" - }, - "arm64v8": { - "dockerUrl": "https://download.docker.com/linux/static/stable/aarch64/docker-23.0.6.tgz", - "rootlessExtrasUrl": "https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-23.0.6.tgz" - }, - "windows-amd64": { - "dockerUrl": "https://download.docker.com/win/static/stable/x86_64/docker-23.0.6.zip" - } - }, - "buildx": { - "arches": { - "amd64": { - "file": "buildx-v0.11.2.linux-amd64", - "sha256": "311568ee69715abc46163fd688e56c77ab0144ff32e116d0f293bfc3470e75b7", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-amd64" - }, - "arm32v6": { - "file": "buildx-v0.11.2.linux-arm-v6", - "sha256": "c1bab0c7374406d5069f60b291971d71161fbd3c00e8a8fb1b68b9053eda8a4e", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm-v6" - }, - "arm32v7": { - "file": "buildx-v0.11.2.linux-arm-v7", - "sha256": "4defdf463ca2516d3f58fef69a6f78cbbb8baf16d936cdfc54df4a4be0d48f7f", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm-v7" - }, - "arm64v8": { - "file": "buildx-v0.11.2.linux-arm64", - "sha256": "565e36085a35bba5104f37365ba796c111338eea1a0902b3a7ff42e2e1248815", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-arm64" - }, - "ppc64le": { - "file": "buildx-v0.11.2.linux-ppc64le", - "sha256": "c5f5cb9957890873a537c7ff5c4eef36132339622baeabb37a4b9b7251ddf836", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-ppc64le" - }, - "riscv64": { - "file": "buildx-v0.11.2.linux-riscv64", - "sha256": "c0adc4b4625f7e3df7dcdec840568f918673f2ed4bcd03ca1e63ea2a5627ca35", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-riscv64" - }, - "s390x": { - "file": "buildx-v0.11.2.linux-s390x", - "sha256": "02916c76c3872fd0b3fa57e71403fee92b6be10f350b96a5ff99e7914dd277b8", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.linux-s390x" - }, - "windows-amd64": { - "file": "buildx-v0.11.2.windows-amd64.exe", - "sha256": "d9419c0838c8a08c2da28fcee585f48926c4dd64e5be1d96eb55da12fa3332d9", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.windows-amd64.exe" - }, - "windows-arm64v8": { - "file": "buildx-v0.11.2.windows-arm64.exe", - "sha256": "9278cb193ca5d508ff632416c07712a7d128349a1b2ede3085456758e2f90d3f", - "url": "https://github.com/docker/buildx/releases/download/v0.11.2/buildx-v0.11.2.windows-arm64.exe" - } - }, - "version": "0.11.2" - }, - "compose": { - "arches": { - "amd64": { - "file": "docker-compose-linux-x86_64", - "sha256": "e849450f1c5c20123aa7d63291e2a818b7a117f2e03e432853ece463dd09e67a", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-x86_64" - }, - "arm32v6": { - "file": "docker-compose-linux-armv6", - "sha256": "46cabb4363c5fa66e63c6055b1d0a6fe2c7995350e48f14816a752ae4132231d", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-armv6" - }, - "arm32v7": { - "file": "docker-compose-linux-armv7", - "sha256": "1a0d500eaae3c4ddbfdeb566896207c0628a671065b95d0e8907bca58f91d312", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-armv7" - }, - "arm64v8": { - "file": "docker-compose-linux-aarch64", - "sha256": "572a22000d408fb524258b379bf272a007c8da977c3e8d47c34f4e45dd7b1932", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-aarch64" - }, - "darwin-amd64": { - "file": "docker-compose-darwin-x86_64", - "sha256": "702d621e637fc9c8e833e031fd13fcee5c5fb82a926b4fba2f53bbf6a229a19d", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-darwin-x86_64" - }, - "darwin-arm64v8": { - "file": "docker-compose-darwin-aarch64", - "sha256": "e0d08ae27354354057c62e2fa80914e0955ec6335acfc6bc1fd7de53b8095f80", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-darwin-aarch64" - }, - "ppc64le": { - "file": "docker-compose-linux-ppc64le", - "sha256": "4d1a3e89fdb7641422dc5cbcab48fd2da337b03265cb5ac2858c3425bacf952c", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-ppc64le" - }, - "riscv64": { - "file": "docker-compose-linux-riscv64", - "sha256": "c45193b98c54e5a898e6b9095f70b0487599f19ce25b579ed2fcc3f868415aff", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-riscv64" - }, - "s390x": { - "file": "docker-compose-linux-s390x", - "sha256": "716aded74df512728638f1fe53170c46d94c1a085bc5a24108ce7101bc37bd81", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-linux-s390x" - }, - "windows-amd64": { - "file": "docker-compose-windows-x86_64.exe", - "sha256": "eeddd5d558d2711bd61a41f5761610b085d83e896617ff04aec8561b349a826c", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-windows-x86_64.exe" - }, - "windows-arm64v8": { - "file": "docker-compose-windows-aarch64.exe", - "sha256": "edd78984db5add5d793972372b9882adfc0a22f6dbc35b0c3a3a95ff1ec1851b", - "url": "https://github.com/docker/compose/releases/download/v2.22.0/docker-compose-windows-aarch64.exe" - } - }, - "version": "2.22.0" - }, - "dindCommit": "d58df1fc6c866447ce2cd129af10e5b507705624", - "variants": [ - "cli", - "dind", - "dind-rootless", - "git", - "windows/windowsservercore-ltsc2022", - "windows/windowsservercore-1809" - ], - "version": "23.0.6" - }, - "23-rc": null, "24": { "arches": { "amd64": {