{"push_id":907218486,"size":34,"distinct_size":34,"ref":"refs/heads/daemonauth","head":"e942d60c7c4716865bcda7b36cd13763ca307040","before":"2bd90f5bbb180998d3907a3596710d2947603643","commits":[{"sha":"f7ed97a6303787983f6f01f72afff74e7d2b0690","author":{"email":"f9809039ea4850e75dcb8d80b778844aa463358f@redhat.com","name":"Antonio Murdaca"},"message":"layer: layer_store.go: return on error\n\nSigned-off-by: Antonio Murdaca <runcom@redhat.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/f7ed97a6303787983f6f01f72afff74e7d2b0690"},{"sha":"755f8609f699a20cb47ec7269e3a9469541a9419","author":{"email":"787aefc6cbd2e3e8663c1f03b44afee9126bfa5e@gmail.com","name":"Ahmet Alp Balkan"},"message":"Add containers’ networks to /containers/json\n\nAfter addition of multi-host networking in Docker 1.9, Docker Remote\nAPI is still returning only the network specified during creation\nof the container in the “List Containers” (`/containers/json`) endpoint:\n\n    ...\n    \"HostConfig\": {\n      \"NetworkMode\": \"default\"\n    },\n\nThe list of networks containers are attached to is only available at\nGet Container (`/containers/<id>/json`) endpoint.\nThis does not allow applications utilizing multi-host networking to\nbe built on top of Docker Remote API.\n\nTherefore I added a simple `\"NetworkSettings\"` section to the\n`/containers/json` endpoint. This is not identical to the NetworkSettings\nreturned in Get Container (`/containers/<id>/json`) endpoint. It only\ncontains a single field `\"Networks\"`, which is essentially the same\nvalue shown in inspect output of a container.\n\nThis change adds the following section to the `/containers/json`:\n\n    \"NetworkSettings\": {\n      \"Networks\": {\n        \"bridge\": {\n          \"EndpointID\": \"2cdc4edb1ded3631c81f57966563e...\",\n          \"Gateway\": \"172.17.0.1\",\n          \"IPAddress\": \"172.17.0.2\",\n          \"IPPrefixLen\": 16,\n          \"IPv6Gateway\": \"\",\n          \"GlobalIPv6Address\": \"\",\n          \"GlobalIPv6PrefixLen\": 0,\n          \"MacAddress\": \"02:42:ac:11:00:02\"\n        }\n      }\n    }\n\nThis is of type `SummaryNetworkSettings` type, a minimal version of\n`api/types#NetworkSettings`.\n\nActually all I need is the network name and the IPAddress fields. If folks\nfind this addition too big, I can create a `SummaryEndpointSettings` field\nas well, containing just the IPAddress field.\n\nSigned-off-by: Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/755f8609f699a20cb47ec7269e3a9469541a9419"},{"sha":"a57478d65f1f5782cc746c260f9d841a0907ce54","author":{"email":"8ecfc6017a87905413dcd7d63696a2a4c351b604@docker.com","name":"Aaron Lehmann"},"message":"Do not fall back to the V1 protocol when we know we are talking to a V2 registry\n\nIf we detect a Docker-Distribution-Api-Version header indicating that\nthe registry speaks the V2 protocol, no fallback to V1 should take\nplace.\n\nThe same applies if a V2 registry operation succeeds while attempting a\npush or pull.\n\nSigned-off-by: Aaron Lehmann <aaron.lehmann@docker.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/a57478d65f1f5782cc746c260f9d841a0907ce54"},{"sha":"891bbc17ec2623897e32a3b9116cb2047ba70fdd","author":{"email":"8ecfc6017a87905413dcd7d63696a2a4c351b604@docker.com","name":"Aaron Lehmann"},"message":"Make v1 pull/push output consistent with v2\n\n- Use layer DiffIDs for progress output in v1 push. This makes the\n  output consistent with v2 pushes, which means that a fallback to v1\n  won't start progress bars for a different set of IDs.\n\n- Change wording used in v1 status updates to be consistent with v2.\n\nSigned-off-by: Aaron Lehmann <aaron.lehmann@docker.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/891bbc17ec2623897e32a3b9116cb2047ba70fdd"},{"sha":"e0db2fa4da8f4de861ff83e6f19e7e6d4251289d","author":{"email":"484c768444514799b39aebd3c7a0b244f5784570@cn.ibm.com","name":"Wen Cheng Ma"},"message":"Fix typo error and update index\n\nSigned-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/e0db2fa4da8f4de861ff83e6f19e7e6d4251289d"},{"sha":"cf0acc8eb9bb83f0f8d603d72aeb3eef10de9da2","author":{"email":"d2723fa9422d708ffbe34f96a6202f90270e0d97@demeester.fr","name":"Vincent Demeester"},"message":"Merge pull request #18622 from runcom/return-err\n\nlayer: layer_store.go: return on error","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/cf0acc8eb9bb83f0f8d603d72aeb3eef10de9da2"},{"sha":"0f749ad55ab794872e601b4f665b07c0be07abfc","author":{"email":"d2723fa9422d708ffbe34f96a6202f90270e0d97@demeester.fr","name":"Vincent Demeester"},"message":"Merge pull request #18559 from ahmetalpbalkan/return-container-networks\n\nProposal: Add container networks list to /containers/json","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/0f749ad55ab794872e601b4f665b07c0be07abfc"},{"sha":"597835e6454be55963959f5f9d586b71517a7f1e","author":{"email":"484c768444514799b39aebd3c7a0b244f5784570@cn.ibm.com","name":"Wen Cheng Ma"},"message":"Sync the docker network create api docs with the error code\n\nSigned-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/597835e6454be55963959f5f9d586b71517a7f1e"},{"sha":"46e3a249a1971f8697ca338c9b02e27d36ddab12","author":{"email":"f9809039ea4850e75dcb8d80b778844aa463358f@redhat.com","name":"Antonio Murdaca"},"message":"pkg: authorization: add Err to tweak response status code\n\nSigned-off-by: Antonio Murdaca <runcom@redhat.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/46e3a249a1971f8697ca338c9b02e27d36ddab12"},{"sha":"5baa93c04ef4a195df397914baf0a980c93d1271","author":{"email":"2b34a3e3e055981c6c83bcd4f9afd06751b4ac0e@users.noreply.github.com","name":"Sebastiaan van Stijn"},"message":"Merge pull request #18662 from runcom/pkg-authZ-response\n\npkg: authorization: add Err to tweak response status code","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/5baa93c04ef4a195df397914baf0a980c93d1271"},{"sha":"3f4dc492102bf4bceea92a59c78439420f7527c9","author":{"email":"2b34a3e3e055981c6c83bcd4f9afd06751b4ac0e@users.noreply.github.com","name":"Sebastiaan van Stijn"},"message":"Merge pull request #18743 from wenchma/plugin_not_found\n\nSync the docker network create api docs with the error code","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/3f4dc492102bf4bceea92a59c78439420f7527c9"},{"sha":"98be580794923df223ea623c55311c290d402c54","author":{"email":"f9809039ea4850e75dcb8d80b778844aa463358f@users.noreply.github.com","name":"Antonio Murdaca"},"message":"Merge pull request #18590 from aaronlehmann/limit-v1-fallbacks\n\nLimit v1 protocol fallbacks","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/98be580794923df223ea623c55311c290d402c54"},{"sha":"742fd4fa633bfb105e501b74cc27871a972e8001","author":{"email":"2b34a3e3e055981c6c83bcd4f9afd06751b4ac0e@users.noreply.github.com","name":"Sebastiaan van Stijn"},"message":"Merge pull request #18739 from wenchma/typo\n\nFix typo error and update index","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/742fd4fa633bfb105e501b74cc27871a972e8001"},{"sha":"4ce7428f4a0d1bd0fa46ba2114404909db3fbd12","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Documentation for proposed authn features\n\nThis patch contains the documentation portions of proposed\nauthentication changes discussed in PR#13697, previously proposed as a\ndocs-only change in PR#17412, for PR#18514.  To sum up:\n* The daemon requires clients to authenticate if it's started with the\n  -a/--authn flag, otherwise it doesn't, preserving the previous\n  behavior.\n* The specifics of how the daemon authenticates clients, and how the\n  client responds to a daemon's requirement for authentication, are\n  controlled by option values passed using the --authn-opt flag.\n\n* The daemon will offer support for HTTP Basic authentication if the\n  daemon is started with either the \"libsasl2\" or \"htpasswd\" authn\n  options set, using a \"realm\" name specified using the \"realm\" authn\n  option.\n* If the daemon is started with the \"htpasswd\" authn option, it will\n  call out to an \"htpasswd\" helper binary to check passwords using a\n  specified file.\n* If the daemon is started with the \"libsasl2\" authn option enabled and\n  built with support for it, it will call the SASL library to check\n  passwords.  The library can, in turn, be configured to ask saslauthd\n  to check passwords using whatever facilities it's configured to use.\n* If the daemon is built with GSSAPI support, it will check the default\n  keytab file, or one specified using the \"keytab\" authn option, for\n  acceptor creds, and if it finds them, will offer Negotiate\n  authentication.\n* If the daemon is started with the \"local-auth\" authn option enabled,\n  it will attempt to authenticate clients by asking the kernel to\n  identify the client user.  On Linux systems, this is done by reading\n  the client's UnixCredentials, and is only supported for \"unix\"\n  connections.\n* If the daemon is started with the \"certmap\" authn option, it will\n  attempt to use specified plugins to identify HTTPS clients by their\n  client certificates.\n* If the daemon is started with the \"plugins\" authn option, it will also\n  call out to authenticators implemented by the specified Docker\n  plugins.\n\n* When a daemon responds to a client request with a 401 error code, the\n  client will attempt to authenticate using whatever scheme the daemon\n  offers as part of the error message and try again.  The client has\n  built-in support for Basic, Negotiate, and Bearer schemes.\n* When attempting Basic authentication, the client will use a user name\n  passed in as the values for the \"basic.username\" authn option.  If one\n  is not specified on the command line, it will attempt to read the\n  value to use from the $DOCKER_AUTHN_USERID variable in the\n  environment.  It will also attempt to read a password from the\n  $DOCKER_AUTHN_PASSWORD variable in the environment.  If it's not able\n  to determine both a user name and a password, and the client has a\n  controlling terminal, it will then prompt for the values, unless the\n  \"interactive\" authn option has been set to \"false\".\n* When attempting Bearer authentication, the client will use a value\n  passed in as the value for the \"bearer.token\" authn option.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/4ce7428f4a0d1bd0fa46ba2114404909db3fbd12"},{"sha":"e8a9698426f0d06ed03408214bacdf6cb5bcafba","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Add a client-daemon authentication framework\n\nAdd the basic framework for requiring clients to authenticate to the\ndaemon when issuing requests to it.  This is mainly plumbing and wiring\nin the logic in both the client and the server.\n\nThe client and server both contain module-local lists of functions which\ncreate and return handlers for authentication schemes.  The\nimplementations register themselves at initialization time.  On clients,\nthe functions are used to create a set of AuthResponders which is\nindexed in the client map by the authentication schemes that they\nimplement.  On servers, the functions are used to create a list of\nAuthenticators in each server which has authentication enabled, each of\nwhich gets a crack at every client request.\n\nThe client will call the AuthResponder for a particular scheme if it\nreceives a 401 error, and if it signals that the client should try\nagain, it will do so, repeating the process until it receives a\nsuccessful result.  At that point, it will call the scheme's\nAuthCompleted callback to check if the server's reply is acceptable to\nit.\n\nThe server will call either the GetChallenge methods or CheckResponse\nmethods of its Authenticators for each request, depending on whether or\nnot the incoming request includes any Authorization headers.  If\nCheckResponse indicates that the client's identity has been verified,\ninformation about the authenticated user, and the name of the\nauthentication scheme that succeeded, will be added to the request\nstructure as a shared value so that it can be used later when we call\ninto authorization plugins.  The middleware for authorization is moved\nearlier in order to get the ordering right at run time.\n\nThe server's RequireAuthn flag can be found in its configuration\nstructure, and both client and server get an opportunity to retrieve\noption values, which are passed to the --authn-opt flag on the command\nline, from a map named AuthnOpts in the server configuration structure,\nor a map named authnOpts in the DockerCli object.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)\n\nFixed a bug which disabled persistent connections when docker authentication is required\n\nSigned-off-by: lior <lior@twistlock.com>","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/e8a9698426f0d06ed03408214bacdf6cb5bcafba"},{"sha":"5ebf41bb4765b7f97613960d226d66c306d281ec","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Vendor github.com/gorilla/{securecookie,sessions}\n\nWe'll need these to set cookies for clients, which is how we'll offload\nthe state of client-to-daemon authentication state to clients, to avoid\nhaving to hold any of that state in the daemon itself.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/5ebf41bb4765b7f97613960d226d66c306d281ec"},{"sha":"053f681c40c000a812132a6791559f19ee52bf2b","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Set and use cookies for client-to-daemon auth\n\nWhen we've authenticated a client, set a cookie that the client will be\nable to use to avoid having to authenticate any subsequent requests that\nit will issue before we exit.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/053f681c40c000a812132a6791559f19ee52bf2b"},{"sha":"5245558818d0032d433ab1b9ca749bf9111cc506","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Add authentication via external plugins\n\nAdd a call to the Authentication.GetChallenge() API provided by one or\nmore \"Authentication\" plugins, whose names can be passed to the daemon\nas a list of values for the \"plugins\" authentication option, and which\nprovide headers to send back to a client that sent us a request with no\n\"Authorization\" header.  Call the plugin Authentication.CheckResponse()\nmethods when the client request includes at least one \"Authorization\"\nheader, and if any plugin returns a usable User structure, accept it as\nproof of the client's identity.\n\nWe can't do the client part of authentication using plugins, because\nit's not really useful to require the client to use plugins which have\nto be registered in a central location and ensure that a plugin is\nrunning, so the client still has to be taught how to respond to\nparticular authentication requirements directly.\n\nSome of the server bits we add later in the patch series could be moved\nout to plugins.  We're already linking with libraries for the client's\nsake, so using a plugin for Negotiate instead of calling the APIs\ndirectly doesn't avoid the linking dependency.  The client socket can't\nbe passed to a plugin, so looking up the user's identity using the\nsocket descriptor and some help from the kernel is not something that\ncan be done via a plugin.\n\nThat said, plugins remain a viable method for implementing additional\nways to check passwords for Basic authentiation, for verifying Bearer\ntokens, and for supporting other schemes which the connecting client may\nsupport.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/5245558818d0032d433ab1b9ca749bf9111cc506"},{"sha":"7db9c436e9bd1e7b10400df1fa5572518c7461c5","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Add authentication from examining client certs\n\nAdd a call to the MapClientCertificateToUser() API provided by one or\nmore \"ClientCertificateMapper\" plugins, whose names are passed in as a\nlist of values of the \"certmap\" authentication option, and which takes a\nbinary certificate and returns a user information structure, for mapping\na client's certificate to an user identity as a means of authenticating\nclients.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/7db9c436e9bd1e7b10400df1fa5572518c7461c5"},{"sha":"48fa10d60e4778300762aa6652dab8a9f8b631f1","author":{"email":"f562fcb2a0b898bf0be1afc867ea92325d8f825f@redhat.com","name":"Nalin Dahyabhai"},"message":"Add authentication by asking the kernel\n\nOn Linux systems, if the \"local-auth=true\" authentication option is\nused, ask the kernel for the Uid on the other end of a Unix socket\nconnection, and look up the name of the user.  This provides an implicit\nauthentication for the common cases.\n\nNote that the lookup is currently only supported for non-static builds,\nbecause we use the standard library's lookup logic, which only returns\nan error in static builds.\n\nSigned-off-by: Nalin Dahyabhai <nalin@redhat.com> (github: nalind)","distinct":true,"url":"https://api.github.com/repos/nalind/docker/commits/48fa10d60e4778300762aa6652dab8a9f8b631f1"}]}