bb577e6225
- Always clear SUSEConnect suse_* secrets when starting containers regardless of whether the daemon was built with SUSEConnect support. Not doing this causes containers from SUSEConnect-enabled daemons to fail to start when running with SUSEConnect-disabled (i.e. upstream) daemons. This was a long-standing issue with our secrets support but until recently this would've required migrating from SLE packages to openSUSE packages (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move away from in-built SUSEConnect support, this is now a practical issue users will run into. bsc#1244035 + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch - Rearrange patches: - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch + 0007-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch - 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch + 0008-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch + 0009-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch + 0010-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch + 0011-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch + 0012-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch + 0013-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - 0013-TESTS-backport-fixes-for-integration-tests.patch + 0014-TESTS-backport-fixes-for-integration-tests.patch
Aleksa Sarai2025-06-04 06:14:16 +00:00
390bf601fc
Accepting request 1282503 from home:cyphar:docker
Aleksa Sarai2025-06-04 06:14:16 +00:00
bdfa56d393
Accepting request 1268265 from Virtualization:containers
Ana Guerrero2025-04-10 19:59:20 +00:00
1b9577f500
Accepting request 1268265 from Virtualization:containers
Ana Guerrero2025-04-10 19:59:20 +00:00
47dc4f48fa
- Update to docker-buildx v0.22.0. Upstream changelog: <https://github.com/docker/buildx/releases/tag/v0.22.0> * Includes fixes for CVE-2025-0495. bsc#1239765 - Disable transparent SUSEConnect support for SLE-16. PED-12534 When this patchset was first added in 2013 (and rewritten over the years), there was no upstream way to easily provide SLE customers with a way to build container images based on SLE using the host subscription. However, with docker-buildx you can now define secrets for builds (this is not entirely transparent, but we can easily document this new requirement for SLE-16). Users should use RUN --mount=type=secret,id=SCCcredentials zypper -n ... in their Dockerfiles, and docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file . when doing their builds. - Now that the only blocker for docker-buildx support was removed for SLE-16, enable docker-buildx for SLE-16 as well. PED-8905
Aleksa Sarai2025-04-10 03:37:04 +00:00
1f8344d0f9
Accepting request 1268263 from home:cyphar:docker
Aleksa Sarai2025-04-10 03:37:04 +00:00
3b21671934
Accepting request 1256097 from home:cyphar:docker
Aleksa Sarai2025-03-26 02:43:22 +00:00
0d9bc8b632
Accepting request 1256097 from home:cyphar:docker
Aleksa Sarai2025-03-26 02:43:22 +00:00
87bc6e5edc
Accepting request 1255774 from Virtualization:containers
Ana Guerrero2025-03-25 21:11:17 +00:00
8a54fdc6c2
Accepting request 1255774 from Virtualization:containers
Ana Guerrero2025-03-25 21:11:17 +00:00
9e69e34cc5
- Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch * 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Move test-related patch to the end of the patch stack: - 0011-TESTS-backport-fixes-for-integration-tests.patch + 0013-TESTS-backport-fixes-for-integration-tests.patch
Aleksa Sarai2025-03-25 04:02:47 +00:00
509ddf3ea0
Accepting request 1255773 from home:cyphar:docker
Aleksa Sarai2025-03-25 04:02:47 +00:00
9c336ff601
Accepting request 1237207 from Virtualization:containers
Ana Guerrero2025-01-13 16:50:43 +00:00
6b71823f13
Accepting request 1237207 from Virtualization:containers
Ana Guerrero2025-01-13 16:50:43 +00:00
1ed3b74234
Accepting request 1230067 from home:cyphar:docker
Aleksa Sarai2024-12-11 10:51:10 +00:00
6baeb55273
Accepting request 1228306 from Virtualization:containers
Ana Guerrero2024-12-05 16:08:47 +00:00
4fd3b176a3
Accepting request 1228306 from Virtualization:containers
Ana Guerrero2024-12-05 16:08:47 +00:00
1a4287f660
- Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819
Aleksa Sarai2024-11-27 12:52:23 +00:00
2ff752171e
Accepting request 1226898 from home:cyphar:docker:no-buildx
Aleksa Sarai2024-11-27 12:52:23 +00:00
1d2100e493
Accepting request 1224329 from Virtualization:containers
Ana Guerrero2024-11-15 14:43:32 +00:00
6ff4a6c834
Accepting request 1224329 from Virtualization:containers
Ana Guerrero2024-11-15 14:43:32 +00:00
310b0df6c4
Re-add comment removed by auto-format.
Aleksa Sarai2024-11-15 00:49:44 +00:00
abc8f6ed35
Accepting request 1224328 from home:cyphar:docker
Aleksa Sarai2024-11-15 00:49:44 +00:00
a8cee429ef
- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Update --add-runtime to point to correct binary path.
Aleksa Sarai2024-11-15 00:13:41 +00:00
2eee18668a
Accepting request 1224191 from home:cyphar:docker
Aleksa Sarai2024-11-15 00:13:41 +00:00
Ana Guerrero
Danish Prakash
vlefebvre
rcmadhankumar
Aleksa Sarai
slfo-1.2
Aleksa Sarai
Dominique Leuenberger