Update containerd binary to v1.2.10 by tao12345666333 · Pull Request #39995 · moby/moby

tao12345666333 · 2019-09-27T03:51:50Z

- What I did

Update containerd to v1.2.10

The tenth patch release for containerd 1.2 includes only one main bug fix in the
CRI plugin, but includes updated vendors/build runtimes that fix 2 reported CVEs in
runc and the Golang 1.12 runtime respectively.

Notable Updates

Update the runc vendor to capture the fix for CVE-2019-16884. Fixed by PR Don't expose cgroups via the execdriver API. #3685

More details on the runc CVE in CVE-2019-16884: AppArmor can be bypassed by a malicious image that specifies a volume at /proc opencontainers/runc#2128, fixed by Only allow proc mount if it is procfs opencontainers/runc#2129

Update Golang runtime to 1.12.10 to handle CVE-2019-16276. More detail on the Golang CVE available in net/http: invalid headers are normalized, allowing request smuggling golang/go#34540

CRI fixes:

Fix a bug that the default UNIX path is not in the default OCI config via the CRI plugin. Reported in cri path issue containerd/cri#1279 and fixed by [release/1.2] Backport fix for default UNIX environment in OCI container config containerd/cri#1283

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

tao12345666333 · 2019-09-27T07:27:05Z

Flaky test

[2019-09-27T04:11:57.682Z] --- FAIL: TestInspect (11.92s)
[2019-09-27T04:11:57.682Z]     inspect_test.go:23: Creating a new daemon at: "/go/src/github.com/docker/docker/bundles/test-integration/TestInspect"
[2019-09-27T04:11:57.682Z]     inspect_test.go:39: timeout hit after 10s: waiting for tasks to enter run state. task failed with error: task: non-zero exit (1)

[2019-09-27T04:13:34.737Z] FAIL
[2019-09-27T04:13:34.737Z] 
[2019-09-27T04:13:34.737Z] === Failed
[2019-09-27T04:13:34.737Z] === FAIL: amd64.integration.service TestInspect (11.92s)
[2019-09-27T04:13:34.737Z]     inspect_test.go:23: Creating a new daemon at: "/go/src/github.com/docker/docker/bundles/test-integration/TestInspect"
[2019-09-27T04:13:34.737Z]     inspect_test.go:39: timeout hit after 10s: waiting for tasks to enter run state. task failed with error: task: non-zero exit (1)
[2019-09-27T04:13:34.737Z] 
[2019-09-27T04:13:34.737Z] 
[2019-09-27T04:13:34.737Z] DONE 19 tests, 1 failure in 178.848s

thaJeztah

Oh; we should also update runc, and perhaps update the vendored version of runc; I'll open a PR for that

full diff: moby/moby@b6684a4...a30990b relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix. This is to ensure that users of the homedir package cannot compile statically (`CGO_ENABLED=0`) without also setting the `osusergo` build tag. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a30990b relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix. This is to ensure that users of the homedir package cannot compile statically (`CGO_ENABLED=0`) without also setting the `osusergo` build tag. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: docker#2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a09e6e3 relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#40134 Revert "homedir: add cgo or osusergo buildtag constraints for unix" - reverts moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix, in favor of documenting when to set the `osusergo` build tag. The `osusergo` build-flag must be used when compiling a static binary with `cgo` enabled, and linking against `glibc`. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: docker#2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root - moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - updates/requires Microsoft/hscshim@2226e083fc390003ae5aa8325c3c92789afa0e7a Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a09e6e3 relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#40134 Revert "homedir: add cgo or osusergo buildtag constraints for unix" - reverts moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix, in favor of documenting when to set the `osusergo` build tag. The `osusergo` build-flag must be used when compiling a static binary with `cgo` enabled, and linking against `glibc`. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: #2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root - moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - updates/requires Microsoft/hscshim@2226e083fc390003ae5aa8325c3c92789afa0e7a Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 7f6cd64335dc631efaa8204c01f92aa40939073a Component: cli

Update containerd to v1.2.10

c4ec02b

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

tao12345666333 requested a review from tianon as a code owner September 27, 2019 03:51

thaJeztah added area/runtime Runtime area/security impact/changelog process/cherry-pick status/2-code-review labels Sep 27, 2019

thaJeztah approved these changes Sep 27, 2019

View reviewed changes

thaJeztah mentioned this pull request Sep 27, 2019

Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) #40001

Merged

AkihiroSuda approved these changes Sep 27, 2019

View reviewed changes

AkihiroSuda merged commit ada3c14 into moby:master Sep 27, 2019

This was referenced Sep 27, 2019

[19.03 backport] update containerd 1.2.10, runc v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) docker-archive/engine#385

Merged

[18.09 backport] update containerd 1.2.10, runc v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) docker-archive/engine#386

Merged

tao12345666333 deleted the update-containerd-v1.2.10 branch September 27, 2019 16:21

thaJeztah changed the title ~~Update containerd to v1.2.10~~ Update containerd binary to v1.2.10 Oct 15, 2019

thaJeztah added process/cherry-picked and removed process/cherry-pick labels Oct 20, 2019

thaJeztah mentioned this pull request Oct 23, 2019

Services: use ServiceStatus on API v1.41 and up docker/cli#2157

Merged

4 tasks

thaJeztah mentioned this pull request Oct 24, 2019

bump docker/docker to a09e6e323e55e1a9b21df9c2c555f5668df3ac9b docker/cli#2158

Merged

3 tasks

thaJeztah added this to the 20.03.0 milestone Apr 2, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update containerd binary to v1.2.10#39995

Update containerd binary to v1.2.10#39995
AkihiroSuda merged 1 commit intomoby:masterfrom
tao12345666333:update-containerd-v1.2.10

tao12345666333 commented Sep 27, 2019

Uh oh!

tao12345666333 commented Sep 27, 2019 •

edited

Loading

Uh oh!

thaJeztah left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tao12345666333 commented Sep 27, 2019

Notable Updates

Uh oh!

tao12345666333 commented Sep 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tao12345666333 commented Sep 27, 2019 •

edited

Loading