summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFélix Piédallu <felix.piedallu@non.se.com>2026-02-23 17:35:58 +0100
committerBruce Ashfield <bruce.ashfield@gmail.com>2026-02-26 13:20:27 -0500
commit1ff2a1b03cdf2df0f5093f286961d6b3150e0807 (patch)
treea457d81ba3ed1c43dd16fb30def3640c2dcc1b4c
parentd6a2bf358a77f2330dee3ca2984f2b623e5020e3 (diff)
downloadmeta-virtualization-1ff2a1b03cdf2df0f5093f286961d6b3150e0807.tar.gz
docker-moby: Update to v25.0.9
This is the latest point release of v25.0 that supports Go v1.22 Bumping moby to version v25.0.14, which comprises the following commits: 89a48b65fc Dockerfile: update runc binary to v1.2.5 aae4029600 update to go1.22.12 a2802d0746 update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336) 9281aea6ce ci: update base container to alpine20 for buildkit workflow b1d6fd957d gha: set arm64 GO_VERSION to 1.22.10 7540f88434 ci: switch from jenkins to gha for arm64 build and tests f8d9617c43 ci(bin-image): fix bake build bec5e8eed1 ci: update bake-action to v6 fcb50183e4 Dockerfile: update runc binary to v1.2.4 20af9f77a6 Dockerfile: update containerd to v1.7.25 7d20eee4fd Dockerfile: update runc binary to v1.2.3 eacc3610f9 libnetwork/drivers/bridge: setupIPChains: fix defer checking wrong err 842024e721 update xx to v1.6.1 for compatibility with alpine 3.21 96b8a34d2b Dockerfile: update xx to v1.5.0 5ed63409a2 Dockerfile: update xx to v1.4.0 03885ae2c0 update to go1.22.10 ddc8a15eb5 Dockerd rootless: make {/etc,/var/run}/cdi available 6648f3a10e c8d/tag: Don't log a warning if the source image is not dangling 6f497b2d51 Dockerfile: update to runc v1.2.2 01c163d4ee Dockerfile: update containerd to v1.7.24 708c8dc304 gha: shorter time limits for smoke, validate f6bcbab7a1 gha: use "ubuntu-24.04" instead of "ubuntu-latest" 2de8143fa6 gha: dco: small tweaks to running the container e0857ef530 gha: dco: update ALPINE_VERSION to 3.20 1b7b596513 gha: build (binary), build (dynbinary): limit to 20 minutes 2e43cd5450 gha: dco: limit to 10 minutes bdb21cd779 integration: add wait 911478fb28 Jenkinsfile: modprobe br_netfilter 2278d180a7 daemon: use OwnCgroupPath in withCgroups a6d1d0693f vendor: github.com/golang-jwt/jwt/v4@v4.5.1 0ed4861f9c update to go1.22.9 2df019330c update runc binary to 1.1.14 e6de0b8f3b update runc binary to v1.1.13 cb56070132 volume: VolumesService.Create: fix log-level for debug logs 480b01a532 volume/mounts: fix anonymous volume not being labeled f7b7ec14b8 volume/service: change some logs to use structured logs 60eece38cd Fix: setup user chains even if there are running containers 54ac8bbe37 cmd/dockerd: Add workaround for OTEL meter leak 6e1af3d5d8 gha: remove stray double empty line 0eae0850ac gha: restrict cross and bin-image to 20 minutes e6a2c9bebb gha: add guardrails timeouts on all jobs 4b98bfd07d gha: buildkit: make sure expected Go version is installed ae548176dc update to go1.22.8 122682205f Dockerfile: update containerd binary to v1.7.22 9f102b3b5b Dockerfile: update containerd binary to v1.7.21 (static binaries and CI only) 75891766e4 man: dockerd: add description for --log-format option 3ec9003a14 Update dlv in the dev-env caef5cc70c Explicitly disable nvidia device injection for --gpus=0 34471d3259 seccomp: add riscv64 mapping to seccomp_linux.go bec84c9c31 update to go1.22.7 d0315c9824 golangci-lint: temporarily disable G115: integer overflow conversion ff546aff14 update golangci-lint to v1.60.2 15db81eeaa update to go1.22.6 23af4b75e9 hack/make/.binary: set CGO_LDFLAGS=-latomic for arm/v5 da8bfd963e hack/make/.binary: set CCGO_CFLAGS=-Wno-atomic-alignment for arm/v5 0ce4415ff2 daemon: fix non-constant format string in call (govet) 14a48ac308 api/types: fix non-constant format string in call (govet) c50e7e6ca2 api/server/router: fix non-constant format string in call (govet) 2a4ea4749d container/stream: fix non-constant format string in call (govet) b536253047 libnetwork/drivers/bridge: fix non-constant format string in call (govet) 3216abd8db volume/testutils: fix non-constant format string in call (govet) dd5a6fdbac builder/dockerfile: parseChownFlag: fix non-constant format string in call (govet) 0c5e131330 layer: ignore G602: slice index out of range (gosec) b50a85d0ed cmd/dockerd: fix non-constant format string in call (govet) 8105391708 libnetwork: fix non-constant format string in call (govet) 6209d5bd68 integration-cli: fix non-constant format string in call (govet) 25cffb9dec integration-cli: DockerSwarmSuite: rm redundant Fprintf, handle errors 21279f652e integration-cli: DockerNetworkSuite: rm redundant Fprintf, handle errors a27066d1ca integration-cli: use erors.New() instead of fmt.Errorf e88d4ea298 libnetwork: TestDNSOptions: remove redundant skip check 613d955d38 integration-cli: remove redundant platform checks e962b3e06e update to go1.21.13 33dbea3c37 vendor: github.com/Microsoft/go-winio v0.6.2 5e46424b29 vendor: golang.org/x/tools v0.16.0 5ca50f5c24 vendor: golang.org/x/mod v0.17.0 a599caf7e9 update golangci-lint to v1.59.1 89903672a7 pkg/archive: reformat code to make #nosec comment work again dbf6db9306 builder/remotecontext: reformat code to make #nosec comment work again 55a4cadaa5 man: create parent directories in install recipe 042dad56d0 man: support bringing your own go-md2man 553d915ef4 man: build dockerd man pages using make c70f626351 Removed all mentions of "please" from docs and messages 5966382473 docs: add default-network-opt daemon option 3edc25412a docs: remove devicemapper 65906e44b0 man/dockerd.8: assorted formatting fixes a298720e8f man/dockerd.8: escape asterisks and underscores 88a3e540c9 docs: update dockerd usage output for new proxy-options 90fc11f69a Fix styling of arguments 182df40d13 Fix the max-concurrent-downloads and max-concurrent-uploads configs documentation 2544c68655 docs: remove documentation about deprecated cluster-store be77069539 Document `--validate` daemon option 0299ca1d73 Update man-page source MarkDown to work with go-md2man v2 aff4659c67 docs: update for cgroup v2 and rootless c47231e5cf docker run: specify cgroup namespace mode with --cgroupns 962f331e76 daemon: document --max-download-attempts option 71f9bfe47f Update document links and title. 017213c2b0 Allow user to specify default address pools for docker networks This is separate commit for CLI files to address PR 36054 210f03082b Update docs and completion-scripts for deprecated features 2f78133a0a Added docs for dockerd 675593bb4f fix a number of minor typos 9c291b1745 Introduce/document new IPC modes a23ff1bb1a docs: add documentation for dm.libdm_log_level c78cecd77f Restore dockerd man page f14cf10618 gha: set permissions to read-only by default 0cd951e4dd api: adjust health start interval on swarm update d151b0f87f vendor: OTEL v0.46.1 / v1.21.0 30f8908102 github/ci: Check if backport is opened against the expected branch 7454d6a2e6 ci: update workflow artifacts retention e8ecb9c76d update containerd binary to v1.7.20 e6cae1f237 update containerd binary to v1.7.19 8ec448db6b update containerd binary to v1.7.18 274310807e integration/TestDiskUsage: Make 4096 also a 'empty' value 886e726984 Dockerfile: update containerd binary to v1.7.17 (static binaries and CI only) a0f0f7e77e update containerd binary to v1.7.15 91903e81ca If url includes scheme, urlPath will drop hostname, which would not match the auth check ccfe0a41d4 Authz plugin security fixes for 0-length content and path validation Signed-off-by: Jameson Hyde <jameson.hyde@docker.com> d046451b34 update to go1.21.12 [part 2] e16a25e442 update to go1.21.12 b1aac1b134 update to go1.21.11 fffbe84ded Makefile: Pass PAGER/GIT_PAGER variable 9f6600deed builder/mobyexporter: Add missing nil check 70fe516b46 don't depend on containerd platform.Parse to return a typed error f7ce828e9e Fix issue where node promotion could fail 98ddccbbfe apparmor: Allow confined runc to kill containers 637205391b update to go1.21.10 3d56d734db vendor: google.golang.org/protobuf v1.33.0, github.com/golang/protobuf v1.5.4 0a2f5085ee vendor: cloud.google.com/go/logging v1.8.1 3141ea5c8b vendor: golang.org/x/mod v0.13.0, golang.org/x/tools v0.13.0 4f25076181 vendor: golang.org/x/sync v0.5.0 d93cc7edc0 nil dereference fix on image history Created value ee5909c2d0 vendor: golang.org/x/net v0.23.0 f37d6f5f48 vendor: golang.org/x/net v0.22.0, golang.org/x/crypto v0.21.0 fd828b6766 go.mod: golang.org/x/sys v0.18.0 584a30c772 awslogs: Replace depreacted WithEndpointResolver usage 60605eb1da vendor: bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs to v1.32.0 71b8e0339c vendor: bump github.com/aws/aws-sdk-go-v2 to v1.24.1 08e8912d7c ci/validate-pr: Use `::error::` command to print errors e2e670299f Fix cases where we are wrapping a nil error 935787c19c save: Remove platform from config descriptor bd19301d9e ci: Require changelog description 50bd133ad3 update to go1.21.9 a987bc5ad0 libnet: Don't forward to upstream resolvers on internal nw 20c205fd3a Environment variable to override resolv.conf path. 4be97233cc daemon: move getUnprivilegedMountFlags to internal package 7ed7e6caf6 plugin: fix mounting /etc/hosts when running in UserNS 81ad7062f0 rootless: fix `open /etc/docker/plugins: permission denied` 02d4ee3f9a Makefile: generate-files: fix check for empty TMP_OUT 478f6b097d volume: Don't decrement refcount below 0 d250e13945 builder-next: fix missing lock in ensurelayer d0d85f6438 daemon: overlay2: remove world writable permission from the lower file 0451b287dc Don't create endpoint config for MAC addr config migration d27fe2558d dockerd-rootless-setuptool.sh: check RootlessKit functionality 77de535364 Dockerfile: update RootlessKit to v2.0.2 2d347024d1 update to go1.21.8 f66b5f642e Test DNS on Windows 'nat' networks fa4ea308f0 c8d/windows: Temporarily skip two failing tests d66e0fb7b1 Set up DNS names for Windows default network 7a4abb8c77 ci: set codecov token 81a83f0544 Simplify macvlan/ipvlan integration test structure abcd6f8a46 Run the macvlan/ipvlan integration tests f7be6dcba6 integration: Reset `OTEL_EXPORTER_OTLP_ENDPOINT` for sub-daemons 10609544e5 update to go1.21.7 be59afce2d c8d/pull: Output truncated id for `Pulling fs layer` 97951c39fb c8d/pull: Don't emit `Downloading` with 0 progress 2001813571 c8d/pull: Emit `Pulling fs layer` 8e3bcf1974 pkg/streamformatter: Make `progressOutput` concurrency safe 27f36f42a4 builder/dockerfile: ADD with best-effort xattrs 1ae019fca2 Don't enforce new validation rules for existing networks c761353e7c Make 'internal' bridge networks accessible from host 10bc347b03 ci: Update `teststat` to v0.1.25 94137f6df5 client: fix connection-errors being shadowed by API version mismatch errors dd5faa9d4f ci: Make `find` for test reports more specific 012bfd33e5 client: doRequest: make sure we return a connection-error 3ec1946ce1 client: NegotiateAPIVersion: do not ignore (connection) errors from Ping 200a2c3576 client: fix TestPingWithError 70c05fe10c libcontainerd: change the digest used when restoring e85cef89fa api/pre-1.44: Default `ReadOnlyNonRecursive` to true a72294a668 mounts/validate: Don't check source exists with CreateMountpoint 9ee331235a integration: Add container.Output utility 5d9e13bc84 api: omit missing Created field from ImageInspect response bb66c3ca04 api/history: Mention empty `Created` fa3a64f2bc Set `Created` to `0001-01-01T00:00:00Z` on older API versions Signed-off-by: Félix Piédallu <felix.piedallu@non.se.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Diffstat
-rw-r--r--recipes-containers/docker/docker-moby_git.bb7
-rw-r--r--recipes-containers/docker/files/CVE-2024-29018.patch344
-rw-r--r--recipes-containers/docker/files/CVE-2024-36620.patch39
-rw-r--r--recipes-containers/docker/files/CVE-2024-36621.patch82
4 files changed, 2 insertions, 470 deletions
diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb
index dd6dac05..e66416db 100644
--- a/recipes-containers/docker/docker-moby_git.bb
+++ b/recipes-containers/docker/docker-moby_git.bb
@@ -44,7 +44,7 @@ DESCRIPTION = "Linux container runtime \
44# so we get that tag, and make it our SRCREVS: 44# so we get that tag, and make it our SRCREVS:
45# 45#
46 46
47SRCREV_moby = "f417435e5f6216828dec57958c490c4f8bae4f98" 47SRCREV_moby = "a926bec8fc91332410133b24f3e9e3f5add13b48"
48SRCREV_libnetwork = "3797618f9a38372e8107d8c06f6ae199e1133ae8" 48SRCREV_libnetwork = "3797618f9a38372e8107d8c06f6ae199e1133ae8"
49SRCREV_cli = "43987fca488a535d810c429f75743d8c7b63bf4f" 49SRCREV_cli = "43987fca488a535d810c429f75743d8c7b63bf4f"
50SRCREV_FORMAT = "moby_libnetwork" 50SRCREV_FORMAT = "moby_libnetwork"
@@ -56,9 +56,6 @@ SRC_URI = "\
56 file://0001-libnetwork-use-GO-instead-of-go.patch \ 56 file://0001-libnetwork-use-GO-instead-of-go.patch \
57 file://0001-cli-use-external-GO111MODULE-and-cross-compiler.patch \ 57 file://0001-cli-use-external-GO111MODULE-and-cross-compiler.patch \
58 file://0001-dynbinary-use-go-cross-compiler.patch;patchdir=src/import \ 58 file://0001-dynbinary-use-go-cross-compiler.patch;patchdir=src/import \
59 file://CVE-2024-36620.patch;patchdir=src/import \
60 file://CVE-2024-36621.patch;patchdir=src/import \
61 file://CVE-2024-29018.patch;patchdir=src/import \
62 " 59 "
63 60
64DOCKER_COMMIT = "${SRCREV_moby}" 61DOCKER_COMMIT = "${SRCREV_moby}"
@@ -69,7 +66,7 @@ require docker.inc
69LICENSE = "Apache-2.0" 66LICENSE = "Apache-2.0"
70LIC_FILES_CHKSUM = "file://src/import/LICENSE;md5=4859e97a9c7780e77972d989f0823f28" 67LIC_FILES_CHKSUM = "file://src/import/LICENSE;md5=4859e97a9c7780e77972d989f0823f28"
71 68
72DOCKER_VERSION = "25.0.3" 69DOCKER_VERSION = "25.0.9"
73PV = "${DOCKER_VERSION}+git${SRCREV_moby}" 70PV = "${DOCKER_VERSION}+git${SRCREV_moby}"
74 71
75CVE_PRODUCT = "docker mobyproject:moby" 72CVE_PRODUCT = "docker mobyproject:moby"
diff --git a/recipes-containers/docker/files/CVE-2024-29018.patch b/recipes-containers/docker/files/CVE-2024-29018.patch
deleted file mode 100644
index f3c800ff..00000000
--- a/recipes-containers/docker/files/CVE-2024-29018.patch
+++ /dev/null
@@ -1,344 +0,0 @@
1From 20c205fd3a0081d005958eff690e2b34df1c5e5e Mon Sep 17 00:00:00 2001
2From: Rob Murray <rob.murray@docker.com>
3Date: Tue, 19 Mar 2024 11:19:30 +0000
4Subject: [PATCH 1/2] Environment variable to override resolv.conf path.
5
6If env var DOCKER_TEST_RESOLV_CONF_PATH is set, treat it as an override
7for the 'resolv.conf' path.
8
9Added as part of resolv.conf refactoring, but needed by back-ported test
10TestInternalNetworkDNS.
11
12Signed-off-by: Rob Murray <rob.murray@docker.com>
13
14CVE: CVE-2024-29018
15Upstream-Status: Backport [https://github.com/moby/moby/commit/e63daec8672d77ac0b2b5c262ef525c7cf17fd20]
16Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
17---
18 daemon/container_operations_unix.go | 20 +--
19 integration/networking/resolvconf_test.go | 142 ++++++++++++++++++++++
20 libnetwork/endpoint.go | 12 +-
21 libnetwork/resolver.go | 17 ++-
22 libnetwork/sandbox_dns_unix.go | 9 +-
23 5 files changed, 182 insertions(+), 18 deletions(-)
24 create mode 100644 integration/networking/resolvconf_test.go
25
26diff --git a/daemon/container_operations_unix.go b/daemon/container_operations_unix.go
27index 6a23a4ca92..e9be1b4e72 100644
28--- a/daemon/container_operations_unix.go
29+++ b/daemon/container_operations_unix.go
30@@ -380,6 +380,7 @@ func serviceDiscoveryOnDefaultNetwork() bool {
31
32 func setupPathsAndSandboxOptions(container *container.Container, cfg *config.Config, sboxOptions *[]libnetwork.SandboxOption) error {
33 var err error
34+ var originResolvConfPath string
35
36 // Set the correct paths for /etc/hosts and /etc/resolv.conf, based on the
37 // networking-mode of the container. Note that containers with "container"
38@@ -393,8 +394,8 @@ func setupPathsAndSandboxOptions(container *container.Container, cfg *config.Con
39 *sboxOptions = append(
40 *sboxOptions,
41 libnetwork.OptionOriginHostsPath("/etc/hosts"),
42- libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"),
43 )
44+ originResolvConfPath = "/etc/resolv.conf"
45 case container.HostConfig.NetworkMode.IsUserDefined():
46 // The container uses a user-defined network. We use the embedded DNS
47 // server for container name resolution and to act as a DNS forwarder
48@@ -407,10 +408,7 @@ func setupPathsAndSandboxOptions(container *container.Container, cfg *config.Con
49 // If systemd-resolvd is used, the "upstream" DNS servers can be found in
50 // /run/systemd/resolve/resolv.conf. We do not query those DNS servers
51 // directly, as they can be dynamically reconfigured.
52- *sboxOptions = append(
53- *sboxOptions,
54- libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"),
55- )
56+ originResolvConfPath = "/etc/resolv.conf"
57 default:
58 // For other situations, such as the default bridge network, container
59 // discovery / name resolution is handled through /etc/hosts, and no
60@@ -423,11 +421,15 @@ func setupPathsAndSandboxOptions(container *container.Container, cfg *config.Con
61 // DNS servers on the host can be dynamically updated.
62 //
63 // Copy the host's resolv.conf for the container (/run/systemd/resolve/resolv.conf or /etc/resolv.conf)
64- *sboxOptions = append(
65- *sboxOptions,
66- libnetwork.OptionOriginResolvConfPath(cfg.GetResolvConf()),
67- )
68+ originResolvConfPath = cfg.GetResolvConf()
69+ }
70+
71+ // Allow tests to point at their own resolv.conf file.
72+ if envPath := os.Getenv("DOCKER_TEST_RESOLV_CONF_PATH"); envPath != "" {
73+ log.G(context.TODO()).Infof("Using OriginResolvConfPath from env: %s", envPath)
74+ originResolvConfPath = envPath
75 }
76+ *sboxOptions = append(*sboxOptions, libnetwork.OptionOriginResolvConfPath(originResolvConfPath))
77
78 container.HostsPath, err = container.GetRootResourcePath("hosts")
79 if err != nil {
80diff --git a/integration/networking/resolvconf_test.go b/integration/networking/resolvconf_test.go
81new file mode 100644
82index 0000000000..60c8b1bc9a
83--- /dev/null
84+++ b/integration/networking/resolvconf_test.go
85@@ -0,0 +1,142 @@
86+package networking
87+
88+import (
89+ "net"
90+ "os"
91+ "testing"
92+
93+ containertypes "github.com/docker/docker/api/types/container"
94+ "github.com/docker/docker/integration/internal/container"
95+ "github.com/docker/docker/integration/internal/network"
96+ "github.com/docker/docker/testutil/daemon"
97+ "github.com/miekg/dns"
98+ "gotest.tools/v3/assert"
99+ is "gotest.tools/v3/assert/cmp"
100+ "gotest.tools/v3/skip"
101+)
102+
103+// writeTempResolvConf writes a resolv.conf that only contains a single
104+// nameserver line, with address addr.
105+// It returns the name of the temp file.
106+func writeTempResolvConf(t *testing.T, addr string) string {
107+ t.Helper()
108+ // Not using t.TempDir() here because in rootless mode, while the temporary
109+ // directory gets mode 0777, it's a subdir of an 0700 directory owned by root.
110+ // So, it's not accessible by the daemon.
111+ f, err := os.CreateTemp("", "resolv.conf")
112+ assert.NilError(t, err)
113+ t.Cleanup(func() { os.Remove(f.Name()) })
114+ err = f.Chmod(0644)
115+ assert.NilError(t, err)
116+ f.Write([]byte("nameserver " + addr + "\n"))
117+ return f.Name()
118+}
119+
120+const dnsRespAddr = "10.11.12.13"
121+
122+// startDaftDNS starts and returns a really, really daft DNS server that only
123+// responds to type-A requests, and always with address dnsRespAddr.
124+func startDaftDNS(t *testing.T, addr string) *dns.Server {
125+ serveDNS := func(w dns.ResponseWriter, query *dns.Msg) {
126+ if query.Question[0].Qtype == dns.TypeA {
127+ resp := &dns.Msg{}
128+ resp.SetReply(query)
129+ answer := &dns.A{
130+ Hdr: dns.RR_Header{
131+ Name: query.Question[0].Name,
132+ Rrtype: dns.TypeA,
133+ Class: dns.ClassINET,
134+ Ttl: 600,
135+ },
136+ }
137+ answer.A = net.ParseIP(dnsRespAddr)
138+ resp.Answer = append(resp.Answer, answer)
139+ _ = w.WriteMsg(resp)
140+ }
141+ }
142+
143+ conn, err := net.ListenUDP("udp", &net.UDPAddr{
144+ IP: net.ParseIP(addr),
145+ Port: 53,
146+ })
147+ assert.NilError(t, err)
148+
149+ server := &dns.Server{Handler: dns.HandlerFunc(serveDNS), PacketConn: conn}
150+ go func() {
151+ _ = server.ActivateAndServe()
152+ }()
153+
154+ return server
155+}
156+
157+// Check that when a container is connected to an internal network, DNS
158+// requests sent to daemon's internal DNS resolver are not forwarded to
159+// an upstream resolver listening on a localhost address.
160+// (Assumes the host does not already have a DNS server on 127.0.0.1.)
161+func TestInternalNetworkDNS(t *testing.T) {
162+ skip.If(t, testEnv.DaemonInfo.OSType == "windows", "No resolv.conf on Windows")
163+ skip.If(t, testEnv.IsRootless, "Can't use resolver on host in rootless mode")
164+ ctx := setupTest(t)
165+
166+ // Start a DNS server on the loopback interface.
167+ server := startDaftDNS(t, "127.0.0.1")
168+ defer server.Shutdown()
169+
170+ // Set up a temp resolv.conf pointing at that DNS server, and a daemon using it.
171+ tmpFileName := writeTempResolvConf(t, "127.0.0.1")
172+ d := daemon.New(t, daemon.WithEnvVars("DOCKER_TEST_RESOLV_CONF_PATH="+tmpFileName))
173+ d.StartWithBusybox(ctx, t, "--experimental", "--ip6tables")
174+ defer d.Stop(t)
175+
176+ c := d.NewClientT(t)
177+ defer c.Close()
178+
179+ intNetName := "intnet"
180+ network.CreateNoError(ctx, t, c, intNetName,
181+ network.WithDriver("bridge"),
182+ network.WithInternal(),
183+ )
184+ defer network.RemoveNoError(ctx, t, c, intNetName)
185+
186+ extNetName := "extnet"
187+ network.CreateNoError(ctx, t, c, extNetName,
188+ network.WithDriver("bridge"),
189+ )
190+ defer network.RemoveNoError(ctx, t, c, extNetName)
191+
192+ // Create a container, initially with external connectivity.
193+ // Expect the external DNS server to respond to a request from the container.
194+ ctrId := container.Run(ctx, t, c, container.WithNetworkMode(extNetName))
195+ defer c.ContainerRemove(ctx, ctrId, containertypes.RemoveOptions{Force: true})
196+ res, err := container.Exec(ctx, c, ctrId, []string{"nslookup", "test.example"})
197+ assert.NilError(t, err)
198+ assert.Check(t, is.Equal(res.ExitCode, 0))
199+ assert.Check(t, is.Contains(res.Stdout(), dnsRespAddr))
200+
201+ // Connect the container to the internal network as well.
202+ // External DNS should still be used.
203+ err = c.NetworkConnect(ctx, intNetName, ctrId, nil)
204+ assert.NilError(t, err)
205+ res, err = container.Exec(ctx, c, ctrId, []string{"nslookup", "test.example"})
206+ assert.NilError(t, err)
207+ assert.Check(t, is.Equal(res.ExitCode, 0))
208+ assert.Check(t, is.Contains(res.Stdout(), dnsRespAddr))
209+
210+ // Disconnect from the external network.
211+ // Expect no access to the external DNS.
212+ err = c.NetworkDisconnect(ctx, extNetName, ctrId, true)
213+ assert.NilError(t, err)
214+ res, err = container.Exec(ctx, c, ctrId, []string{"nslookup", "test.example"})
215+ assert.NilError(t, err)
216+ assert.Check(t, is.Equal(res.ExitCode, 1))
217+ assert.Check(t, is.Contains(res.Stdout(), "SERVFAIL"))
218+
219+ // Reconnect the external network.
220+ // Check that the external DNS server is used again.
221+ err = c.NetworkConnect(ctx, extNetName, ctrId, nil)
222+ assert.NilError(t, err)
223+ res, err = container.Exec(ctx, c, ctrId, []string{"nslookup", "test.example"})
224+ assert.NilError(t, err)
225+ assert.Check(t, is.Equal(res.ExitCode, 0))
226+ assert.Check(t, is.Contains(res.Stdout(), dnsRespAddr))
227+}
228diff --git a/libnetwork/endpoint.go b/libnetwork/endpoint.go
229index d9c257dc68..3ca546a4ac 100644
230--- a/libnetwork/endpoint.go
231+++ b/libnetwork/endpoint.go
232@@ -538,8 +538,13 @@ func (ep *Endpoint) sbJoin(sb *Sandbox, options ...EndpointOption) (err error) {
233 return sb.setupDefaultGW()
234 }
235
236- moveExtConn := sb.getGatewayEndpoint() != extEp
237+ currentExtEp := sb.getGatewayEndpoint()
238+ // Enable upstream forwarding if the sandbox gained external connectivity.
239+ if sb.resolver != nil {
240+ sb.resolver.SetForwardingPolicy(currentExtEp != nil)
241+ }
242
243+ moveExtConn := currentExtEp != extEp
244 if moveExtConn {
245 if extEp != nil {
246 log.G(context.TODO()).Debugf("Revoking external connectivity on endpoint %s (%s)", extEp.Name(), extEp.ID())
247@@ -735,6 +740,11 @@ func (ep *Endpoint) sbLeave(sb *Sandbox, force bool, options ...EndpointOption)
248
249 // New endpoint providing external connectivity for the sandbox
250 extEp = sb.getGatewayEndpoint()
251+ // Disable upstream forwarding if the sandbox lost external connectivity.
252+ if sb.resolver != nil {
253+ sb.resolver.SetForwardingPolicy(extEp != nil)
254+ }
255+
256 if moveExtConn && extEp != nil {
257 log.G(context.TODO()).Debugf("Programming external connectivity on endpoint %s (%s)", extEp.Name(), extEp.ID())
258 extN, err := extEp.getNetworkFromStore()
259diff --git a/libnetwork/resolver.go b/libnetwork/resolver.go
260index 9df2154499..5d5686fc86 100644
261--- a/libnetwork/resolver.go
262+++ b/libnetwork/resolver.go
263@@ -9,6 +9,7 @@ import (
264 "strconv"
265 "strings"
266 "sync"
267+ "sync/atomic"
268 "time"
269
270 "github.com/containerd/log"
271@@ -75,7 +76,7 @@ type Resolver struct {
272 tcpListen *net.TCPListener
273 err error
274 listenAddress string
275- proxyDNS bool
276+ proxyDNS atomic.Bool
277 startCh chan struct{}
278 logger *log.Entry
279
280@@ -85,15 +86,17 @@ type Resolver struct {
281
282 // NewResolver creates a new instance of the Resolver
283 func NewResolver(address string, proxyDNS bool, backend DNSBackend) *Resolver {
284- return &Resolver{
285+ r := &Resolver{
286 backend: backend,
287- proxyDNS: proxyDNS,
288 listenAddress: address,
289 err: fmt.Errorf("setup not done yet"),
290 startCh: make(chan struct{}, 1),
291 fwdSem: semaphore.NewWeighted(maxConcurrent),
292 logInverval: rate.Sometimes{Interval: logInterval},
293 }
294+ r.proxyDNS.Store(proxyDNS)
295+
296+ return r
297 }
298
299 func (r *Resolver) log(ctx context.Context) *log.Entry {
300@@ -194,6 +197,12 @@ func (r *Resolver) SetExtServers(extDNS []extDNSEntry) {
301 }
302 }
303
304+// SetForwardingPolicy re-configures the embedded DNS resolver to either enable or disable forwarding DNS queries to
305+// external servers.
306+func (r *Resolver) SetForwardingPolicy(policy bool) {
307+ r.proxyDNS.Store(policy)
308+}
309+
310 // NameServer returns the IP of the DNS resolver for the containers.
311 func (r *Resolver) NameServer() string {
312 return r.listenAddress
313@@ -421,7 +430,7 @@ func (r *Resolver) serveDNS(w dns.ResponseWriter, query *dns.Msg) {
314 return
315 }
316
317- if r.proxyDNS {
318+ if r.proxyDNS.Load() {
319 // If the user sets ndots > 0 explicitly and the query is
320 // in the root domain don't forward it out. We will return
321 // failure and let the client retry with the search domain
322diff --git a/libnetwork/sandbox_dns_unix.go b/libnetwork/sandbox_dns_unix.go
323index e30f394057..9f7a1c4671 100644
324--- a/libnetwork/sandbox_dns_unix.go
325+++ b/libnetwork/sandbox_dns_unix.go
326@@ -30,10 +30,11 @@ const (
327 func (sb *Sandbox) startResolver(restore bool) {
328 sb.resolverOnce.Do(func() {
329 var err error
330- // The embedded resolver is always started with proxyDNS set as true, even when the sandbox is only attached to
331- // an internal network. This way, it's the driver responsibility to make sure `connect` syscall fails fast when
332- // no external connectivity is available (eg. by not setting a default gateway).
333- sb.resolver = NewResolver(resolverIPSandbox, true, sb)
334+ // The resolver is started with proxyDNS=false if the sandbox does not currently
335+ // have a gateway. So, if the Sandbox is only connected to an 'internal' network,
336+ // it will not forward DNS requests to external resolvers. The resolver's
337+ // proxyDNS setting is then updated as network Endpoints are added/removed.
338+ sb.resolver = NewResolver(resolverIPSandbox, sb.getGatewayEndpoint() != nil, sb)
339 defer func() {
340 if err != nil {
341 sb.resolver = nil
342--
3432.50.1
344
diff --git a/recipes-containers/docker/files/CVE-2024-36620.patch b/recipes-containers/docker/files/CVE-2024-36620.patch
deleted file mode 100644
index 03628fb3..00000000
--- a/recipes-containers/docker/files/CVE-2024-36620.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From ab570ab3d62038b3d26f96a9bb585d0b6095b9b4 Mon Sep 17 00:00:00 2001
2From: Christopher Petito <47751006+krissetto@users.noreply.github.com>
3Date: Fri, 19 Apr 2024 10:44:30 +0000
4Subject: [PATCH] nil dereference fix on image history Created value
5
6Issue was caused by the changes here https://github.com/moby/moby/pull/45504
7First released in v25.0.0-beta.1
8
9CVE: CVE-2024-36620
10
11Upstream-Status: Backport [https://github.com/moby/moby/commit/ab570ab3d62038b3d26f96a9bb585d0b6095b9b4]
12
13Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
14---
15 daemon/images/image_history.go | 6 +++++-
16 1 file changed, 5 insertions(+), 1 deletion(-)
17
18diff --git a/daemon/images/image_history.go b/daemon/images/image_history.go
19index dcf7a906aa..e5adda8639 100644
20--- a/daemon/images/image_history.go
21+++ b/daemon/images/image_history.go
22@@ -41,10 +41,14 @@ func (i *ImageService) ImageHistory(ctx context.Context, name string) ([]*image.
23 layer.ReleaseAndLog(i.layerStore, l)
24 layerCounter++
25 }
26+ var created int64
27+ if h.Created != nil {
28+ created = h.Created.Unix()
29+ }
30
31 history = append([]*image.HistoryResponseItem{{
32 ID: "<missing>",
33- Created: h.Created.Unix(),
34+ Created: created,
35 CreatedBy: h.CreatedBy,
36 Comment: h.Comment,
37 Size: layerSize,
38--
392.40.0
diff --git a/recipes-containers/docker/files/CVE-2024-36621.patch b/recipes-containers/docker/files/CVE-2024-36621.patch
deleted file mode 100644
index 6560f46a..00000000
--- a/recipes-containers/docker/files/CVE-2024-36621.patch
+++ /dev/null
@@ -1,82 +0,0 @@
1From 37545cc644344dcb576cba67eb7b6f51a463d31e Mon Sep 17 00:00:00 2001
2From: Tonis Tiigi <tonistiigi@gmail.com>
3Date: Wed, 6 Mar 2024 23:11:32 -0800
4Subject: [PATCH] builder-next: fix missing lock in ensurelayer
5
6When this was called concurrently from the moby image
7exporter there could be a data race where a layer was
8written to the refs map when it was already there.
9
10In that case the reference count got mixed up and on
11release only one of these layers was actually released.
12
13CVE: CVE-2024-36621
14
15Upstream-Status: Backport [https://github.com/moby/moby/commit/37545cc644344dcb576cba67eb7b6f51a463d31e]
16
17Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
18---
19 .../builder-next/adapters/snapshot/layer.go | 3 +++
20 .../adapters/snapshot/snapshot.go | 19 +++++++++++--------
21 2 files changed, 14 insertions(+), 8 deletions(-)
22
23diff --git a/builder/builder-next/adapters/snapshot/layer.go b/builder/builder-next/adapters/snapshot/layer.go
24index 73120ea70b..fc83058339 100644
25--- a/builder/builder-next/adapters/snapshot/layer.go
26+++ b/builder/builder-next/adapters/snapshot/layer.go
27@@ -22,6 +22,9 @@ func (s *snapshotter) GetDiffIDs(ctx context.Context, key string) ([]layer.DiffI
28 }
29
30 func (s *snapshotter) EnsureLayer(ctx context.Context, key string) ([]layer.DiffID, error) {
31+ s.layerCreateLocker.Lock(key)
32+ defer s.layerCreateLocker.Unlock(key)
33+
34 diffIDs, err := s.GetDiffIDs(ctx, key)
35 if err != nil {
36 return nil, err
37diff --git a/builder/builder-next/adapters/snapshot/snapshot.go b/builder/builder-next/adapters/snapshot/snapshot.go
38index a0d28ad984..510ffefb49 100644
39--- a/builder/builder-next/adapters/snapshot/snapshot.go
40+++ b/builder/builder-next/adapters/snapshot/snapshot.go
41@@ -17,6 +17,7 @@ import (
42 "github.com/moby/buildkit/identity"
43 "github.com/moby/buildkit/snapshot"
44 "github.com/moby/buildkit/util/leaseutil"
45+ "github.com/moby/locker"
46 "github.com/opencontainers/go-digest"
47 "github.com/pkg/errors"
48 bolt "go.etcd.io/bbolt"
49@@ -51,10 +52,11 @@ type checksumCalculator interface {
50 type snapshotter struct {
51 opt Opt
52
53- refs map[string]layer.Layer
54- db *bolt.DB
55- mu sync.Mutex
56- reg graphIDRegistrar
57+ refs map[string]layer.Layer
58+ db *bolt.DB
59+ mu sync.Mutex
60+ reg graphIDRegistrar
61+ layerCreateLocker *locker.Locker
62 }
63
64 // NewSnapshotter creates a new snapshotter
65@@ -71,10 +73,11 @@ func NewSnapshotter(opt Opt, prevLM leases.Manager, ns string) (snapshot.Snapsho
66 }
67
68 s := &snapshotter{
69- opt: opt,
70- db: db,
71- refs: map[string]layer.Layer{},
72- reg: reg,
73+ opt: opt,
74+ db: db,
75+ refs: map[string]layer.Layer{},
76+ reg: reg,
77+ layerCreateLocker: locker.New(),
78 }
79
80 slm := newLeaseManager(s, prevLM)
81--
822.40.0
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-03-19 12:14:52 +0000