{"action":"closed","number":14113,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14113","id":38297903,"html_url":"https://github.com/docker/docker/pull/14113","diff_url":"https://github.com/docker/docker/pull/14113.diff","patch_url":"https://github.com/docker/docker/pull/14113.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/14113","number":14113,"state":"closed","locked":false,"title":"Remerge of `docker exec --privileged` with better tests","user":{"login":"tjdett","id":437845,"avatar_url":"https://avatars.githubusercontent.com/u/437845?v=3","gravatar_id":"","url":"https://api.github.com/users/tjdett","html_url":"https://github.com/tjdett","followers_url":"https://api.github.com/users/tjdett/followers","following_url":"https://api.github.com/users/tjdett/following{/other_user}","gists_url":"https://api.github.com/users/tjdett/gists{/gist_id}","starred_url":"https://api.github.com/users/tjdett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjdett/subscriptions","organizations_url":"https://api.github.com/users/tjdett/orgs","repos_url":"https://api.github.com/users/tjdett/repos","events_url":"https://api.github.com/users/tjdett/events{/privacy}","received_events_url":"https://api.github.com/users/tjdett/received_events","type":"User","site_admin":false},"body":"This PR resolves #10348 with code originally provided in #12025 by @coolljt0725. In #13491 this functionality was removed because there were concerns that the implementation of `docker exec --privileged` was unsafe. The original test has now been modified to cover the situations cited in #13491 to demonstrate that the capabilities of `--privileged` do not leak as a side-effect.\r\n\r\nIn particular, is ensures:\r\n * Subsequent `docker exec` calls are unaffected by a previous `docker exec --privileged` call.\r\n * `--privileged` does not leak into the original run context.\r\n\r\n\r\n##### Re: general safety of `exec --privileged`\r\n\r\nThis test now at least covers the clear ways `exec --privileged` could go wrong. That doesn't mean `exec --privileged` is safe to run in an untrusted container (it certainly isn't without taking precautions) but that's equally true of [many things Docker currently allows you to do](http://www.slideshare.net/jpetazzo/is-it-safe-to-run-applications-in-linux-containers). Like `run --privileged` it's useful, and not unsafe if used in the correct context.\r\n\r\nPing @jfrazelle & @cpuguy83 ","created_at":"2015-06-23T03:21:25Z","updated_at":"2015-08-15T22:20:41Z","closed_at":"2015-08-15T22:20:41Z","merged_at":"2015-08-15T22:20:41Z","merge_commit_sha":"8403cc7907a669c140230e594b61b89cd28ca4b0","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/docker/pulls/14113/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/14113/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/14113/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/90326939c8089dbd7b59423415bc67cae6208b08","head":{"label":"dit4c:10348-exec-privileged","ref":"10348-exec-privileged","sha":"90326939c8089dbd7b59423415bc67cae6208b08","user":{"login":"dit4c","id":6935397,"avatar_url":"https://avatars.githubusercontent.com/u/6935397?v=3","gravatar_id":"","url":"https://api.github.com/users/dit4c","html_url":"https://github.com/dit4c","followers_url":"https://api.github.com/users/dit4c/followers","following_url":"https://api.github.com/users/dit4c/following{/other_user}","gists_url":"https://api.github.com/users/dit4c/gists{/gist_id}","starred_url":"https://api.github.com/users/dit4c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dit4c/subscriptions","organizations_url":"https://api.github.com/users/dit4c/orgs","repos_url":"https://api.github.com/users/dit4c/repos","events_url":"https://api.github.com/users/dit4c/events{/privacy}","received_events_url":"https://api.github.com/users/dit4c/received_events","type":"Organization","site_admin":false},"repo":{"id":37835402,"name":"docker","full_name":"dit4c/docker","owner":{"login":"dit4c","id":6935397,"avatar_url":"https://avatars.githubusercontent.com/u/6935397?v=3","gravatar_id":"","url":"https://api.github.com/users/dit4c","html_url":"https://github.com/dit4c","followers_url":"https://api.github.com/users/dit4c/followers","following_url":"https://api.github.com/users/dit4c/following{/other_user}","gists_url":"https://api.github.com/users/dit4c/gists{/gist_id}","starred_url":"https://api.github.com/users/dit4c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dit4c/subscriptions","organizations_url":"https://api.github.com/users/dit4c/orgs","repos_url":"https://api.github.com/users/dit4c/repos","events_url":"https://api.github.com/users/dit4c/events{/privacy}","received_events_url":"https://api.github.com/users/dit4c/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/dit4c/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/dit4c/docker","forks_url":"https://api.github.com/repos/dit4c/docker/forks","keys_url":"https://api.github.com/repos/dit4c/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dit4c/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dit4c/docker/teams","hooks_url":"https://api.github.com/repos/dit4c/docker/hooks","issue_events_url":"https://api.github.com/repos/dit4c/docker/issues/events{/number}","events_url":"https://api.github.com/repos/dit4c/docker/events","assignees_url":"https://api.github.com/repos/dit4c/docker/assignees{/user}","branches_url":"https://api.github.com/repos/dit4c/docker/branches{/branch}","tags_url":"https://api.github.com/repos/dit4c/docker/tags","blobs_url":"https://api.github.com/repos/dit4c/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dit4c/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dit4c/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/dit4c/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dit4c/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/dit4c/docker/languages","stargazers_url":"https://api.github.com/repos/dit4c/docker/stargazers","contributors_url":"https://api.github.com/repos/dit4c/docker/contributors","subscribers_url":"https://api.github.com/repos/dit4c/docker/subscribers","subscription_url":"https://api.github.com/repos/dit4c/docker/subscription","commits_url":"https://api.github.com/repos/dit4c/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/dit4c/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/dit4c/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/dit4c/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/dit4c/docker/contents/{+path}","compare_url":"https://api.github.com/repos/dit4c/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dit4c/docker/merges","archive_url":"https://api.github.com/repos/dit4c/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dit4c/docker/downloads","issues_url":"https://api.github.com/repos/dit4c/docker/issues{/number}","pulls_url":"https://api.github.com/repos/dit4c/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/dit4c/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/dit4c/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dit4c/docker/labels{/name}","releases_url":"https://api.github.com/repos/dit4c/docker/releases{/id}","created_at":"2015-06-22T03:04:55Z","updated_at":"2015-06-22T03:05:03Z","pushed_at":"2015-08-13T06:43:37Z","git_url":"git://github.com/dit4c/docker.git","ssh_url":"git@github.com:dit4c/docker.git","clone_url":"https://github.com/dit4c/docker.git","svn_url":"https://github.com/dit4c/docker","homepage":"http://www.docker.com","size":65506,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"650feb29f10bc2775877579c67534646949610f2","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2015-08-15T22:14:23Z","pushed_at":"2015-08-15T22:20:41Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":242834,"stargazers_count":24046,"watchers_count":24046,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":6115,"mirror_url":null,"open_issues_count":1078,"forks":6115,"open_issues":1078,"watchers":24046,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/14113"},"html":{"href":"https://github.com/docker/docker/pull/14113"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/14113"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/14113/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/14113/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/14113/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/90326939c8089dbd7b59423415bc67cae6208b08"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"comments":20,"review_comments":10,"commits":2,"additions":68,"deletions":17,"changed_files":7}}