{"push_id":819545260,"size":9,"distinct_size":9,"ref":"refs/heads/userns-impl","head":"2744b7549d80861fc8ecac25aba2f103ae0b12bf","before":"d263c0b2ef5aac6d7b09c69ffcbde71dc6e12c9e","commits":[{"sha":"9bb4c32a160100f01968bc9b1f8e22857e7edfb1","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Move user namespace/remapped root to experimental build\n\nThis moves the UI and base configuration settings to only be accessible\nfrom the experimental build. The uid and gid maps will be in the daemon\nconfiguration, but will be nil, effectively turning off any support for\nuser namespaces in the daemon and containers run on the daemon.  The\n`--root` setting is now available in the experimental build tag with the\nsame features as before.\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/9bb4c32a160100f01968bc9b1f8e22857e7edfb1"},{"sha":"08d2ec723cf99d8987f0de3b1d99b55ba3a81eff","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Cgroup remount as read-only not possible in a user namespace\n\nUntil a long-term kernel-level mount/remount solution exists for user\nnamespaces, we will not keep the readonly remount flag for cgroups when\nuser namespaces are in use\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/08d2ec723cf99d8987f0de3b1d99b55ba3a81eff"},{"sha":"68ac50eadc9bf766d4351039162d21c0805af3db","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Correct implementation re: new adds: golint + windows graph\n\nSince the code was initially written the golint validation has been\nadded to the build/CI.  This commit corrects all the errors from this\nnew validation bundle.\n\nAlso, the Windows graphdriver has been added and needs to support the\nparameters for uid/gid maps in the various archive and graphdriver\npackages (even though they are ignored in the Windows impl.)\n\nAlso update devmapper Init call for new test added recently\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/68ac50eadc9bf766d4351039162d21c0805af3db"},{"sha":"9f1cf6e1ff986eee4f9139a512501d93cf8950eb","author":{"email":"4efb7da3e38416208b41d8021a942884d8a9435c@docker.com","name":"Alexander Morozov"},"message":"Chown workdir/work after mount\n\nPermissions for this directory is needed in user namespace for overlayfs\nto move dirs from lower to upper.\n\nSigned-off-by: Alexander Morozov <lk4d4@docker.com>\nDocker-DCO-1.1-Signed-off-by: Alexander Morozov <lk4d4@docker.com>","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/9f1cf6e1ff986eee4f9139a512501d93cf8950eb"},{"sha":"ea66129095ac0d3b1ea86407eda0162b8ea79823","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Correct perms for new shm and mqueue metadata locations\n\nCorrect ownership at creation time when user namespaces are in use.\nAlso correct the special network binds which were no longer working\ndue to changes in bind/volume/container mount points code reworks.\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/ea66129095ac0d3b1ea86407eda0162b8ea79823"},{"sha":"458788df12f688318cc31d8148bc6859d4520784","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Fix known issues during userns testing\n\n- Fix --root=0:0 (or --root=root) to not try and enable user namespaces.\n  It becomes a no-op and outputs a warning in the daemon log\n\n- Fix --root=default code flow to look for \"dockroot\" user/group after\n  initial startup. Also fix useradd/adduser symlink trickiness on Fedora\n\n- Fix ownership of files in build by remapped root to not cause archive\n  translation errors (files will remain untranslated if already owned\n  by the remapped root UID/GID). Also solve export/import with the same\n  issue on translation errors.\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/458788df12f688318cc31d8148bc6859d4520784"},{"sha":"2d3ba450c4a15b9844bf4e190bea1e4476734f37","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Fix exec user setting and stdio pipe permissions in execdriver\n\nCompletes the solution for stdio pipe ownership when user namespaces are\nenabled. The runc changes only corrected the runc-based runtime\nownership, as the execdriver and Docker daemon had its own pipe\nmanagement code for non-tty.\n\nAlso, runc changes fixed exec join user namespace, but didn't correct\nactually setting the uid/gid to zero to get proper setuid/gid settings\nwhen exec'ing into a user namespaced container.\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/2d3ba450c4a15b9844bf4e190bea1e4476734f37"},{"sha":"51d46263bc43509ee1e7061b2dff17321e3b7b36","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"Change remapping to use /etc/sub{uid,gid} information of --root setting\n\nInstead of a single remapping of the root uid/gid, we will now use the\nfull range for the user/group specified in --root as a single contiguous\nmapping of root + the ID space.\n\nIf the user/group specified has no entries in /etc/sub{uid,gid} then the\ndaemon will refuse to start. On distros with proper support, using\n`--root=default` will both create a user/group for this purpose and then\nread the created ranges in /etc/sub{uid,gid}, keeping the user/admin\nfrom having to do any specific setup to get user namespaces operational.\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/51d46263bc43509ee1e7061b2dff17321e3b7b36"},{"sha":"2744b7549d80861fc8ecac25aba2f103ae0b12bf","author":{"email":"dbac1f450dc8326caa7ba104b384a0eca642250c@linux.vnet.ibm.com","name":"Phil Estes"},"message":"pkg/directory and experimental test updates\n\nUpdate the move-to-subdir function and add a test per PR comments.\n\nUpdate the experimental daemon test to handle the new\nsubuid/subgid-based mapping\n\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)","distinct":true,"url":"https://api.github.com/repos/estesp/docker/commits/2744b7549d80861fc8ecac25aba2f103ae0b12bf"}]}