cf42812621
- Enable SELinux in default daemon.json config (--selinux-enabled). This has no practical impact on non-SELinux systems. bsc#1252290
Aleksa Sarai2025-10-29 07:18:57 +00:00
63299d6cec
Accepting request 1307635 from Virtualization:containers
Ana Guerrero2025-09-30 15:40:32 +00:00
5b4d97ced4
- Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508
Aleksa Sarai2025-09-29 05:43:47 +00:00
451c8ce3cb
Accepting request 1284722 from Virtualization:containers
Ana Guerrero2025-07-01 09:34:07 +00:00
84dfc0f999
Accepting request 1284721 from home:cyphar:docker
Aleksa Sarai2025-06-11 08:30:48 +00:00
a5826f5486
Accepting request 1283417 from Virtualization:containers
Ana Guerrero2025-06-06 20:41:49 +00:00
bd8116a690
- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150
Aleksa Sarai2025-06-05 16:35:01 +00:00
bb577e6225
- Always clear SUSEConnect suse_* secrets when starting containers regardless of whether the daemon was built with SUSEConnect support. Not doing this causes containers from SUSEConnect-enabled daemons to fail to start when running with SUSEConnect-disabled (i.e. upstream) daemons. This was a long-standing issue with our secrets support but until recently this would've required migrating from SLE packages to openSUSE packages (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move away from in-built SUSEConnect support, this is now a practical issue users will run into. bsc#1244035 + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch - Rearrange patches: - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch + 0007-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch - 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch + 0008-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch + 0009-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch + 0010-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch + 0011-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch + 0012-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch + 0013-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - 0013-TESTS-backport-fixes-for-integration-tests.patch + 0014-TESTS-backport-fixes-for-integration-tests.patch
Aleksa Sarai2025-06-04 06:14:16 +00:00
bdfa56d393
Accepting request 1268265 from Virtualization:containers
Ana Guerrero2025-04-10 19:59:20 +00:00
47dc4f48fa
- Update to docker-buildx v0.22.0. Upstream changelog: <https://github.com/docker/buildx/releases/tag/v0.22.0> * Includes fixes for CVE-2025-0495. bsc#1239765 - Disable transparent SUSEConnect support for SLE-16. PED-12534 When this patchset was first added in 2013 (and rewritten over the years), there was no upstream way to easily provide SLE customers with a way to build container images based on SLE using the host subscription. However, with docker-buildx you can now define secrets for builds (this is not entirely transparent, but we can easily document this new requirement for SLE-16). Users should use RUN --mount=type=secret,id=SCCcredentials zypper -n ... in their Dockerfiles, and docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file . when doing their builds. - Now that the only blocker for docker-buildx support was removed for SLE-16, enable docker-buildx for SLE-16 as well. PED-8905
Aleksa Sarai2025-04-10 03:37:04 +00:00
3b21671934
Accepting request 1256097 from home:cyphar:docker
Aleksa Sarai2025-03-26 02:43:22 +00:00
87bc6e5edc
Accepting request 1255774 from Virtualization:containers
Ana Guerrero2025-03-25 21:11:17 +00:00
9e69e34cc5
- Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch * 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Move test-related patch to the end of the patch stack: - 0011-TESTS-backport-fixes-for-integration-tests.patch + 0013-TESTS-backport-fixes-for-integration-tests.patch
Aleksa Sarai2025-03-25 04:02:47 +00:00
9c336ff601
Accepting request 1237207 from Virtualization:containers
Ana Guerrero2025-01-13 16:50:43 +00:00
6baeb55273
Accepting request 1228306 from Virtualization:containers
Ana Guerrero2024-12-05 16:08:47 +00:00
1a4287f660
- Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819
Aleksa Sarai2024-11-27 12:52:23 +00:00
1d2100e493
Accepting request 1224329 from Virtualization:containers
Ana Guerrero2024-11-15 14:43:32 +00:00
310b0df6c4
Re-add comment removed by auto-format.
Aleksa Sarai2024-11-15 00:49:44 +00:00
a8cee429ef
- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Update --add-runtime to point to correct binary path.
Aleksa Sarai2024-11-15 00:13:41 +00:00
Ana Guerrero
Aleksa Sarai
slfo-main
Aleksa Sarai
Dominique Leuenberger