Bump version to v1.6.0

Docker-DCO-1.1-Signed-off-by: Jessie Frazelle <princess@docker.com> (github: jfrazelle)

CHANGELOG.md

@@ -1,17 +1,5 @@
 # Changelog
 
-## 1.6.1 (2015-05-07)
-
-####  Security
-- Fix read/write /proc paths (CVE-2015-3630)
-- Prohibit VOLUME /proc and VOLUME / (CVE-2015-3631)
-- Fix opening of file-descriptor 1 (CVE-2015-3627)
-- Fix symlink traversal on container respawn allowing local privilege escalation (CVE-2015-3629)
-- Prohibit mount of /sys
-
-#### Runtime
-- Update Apparmor policy to not allow mounts
-
 ## 1.6.0 (2015-04-07)
 
 #### Builder
@@ -19,7 +7,6 @@
 + build containers with resource constraints, ie `docker build --cpu-shares=100 --memory=1024m...`
 + `commit --change` to apply specified Dockerfile instructions while committing the image
 + `import --change` to apply specified Dockerfile instructions while importing the image
-+ basic build cancellation
 
 #### Client
 + Windows Support

VERSION

@@ -1 +1 @@
-1.6.1
+1.6.0-rc6

contrib/init/upstart/docker.conf

@@ -49,7 +49,7 @@ post-start script
 	fi
 	if ! printf "%s" "$DOCKER_OPTS" | grep -qE -e '-H|--host'; then
 		while ! [ -e /var/run/docker.sock ]; do
-			initctl status $UPSTART_JOB | grep -qE "(stop|respawn)/" && exit 1
+			initctl status $UPSTART_JOB | grep -q "stop/" && exit 1
 			echo "Waiting for /var/run/docker.sock"
 			sleep 0.1
 		done

daemon/container.go

@@ -1379,7 +1379,6 @@ func (container *Container) startLogging() error {
 		if err != nil {
 			return err
 		}
-		container.LogPath = pth
 
 		dl, err := jsonfilelog.New(pth)
 		if err != nil {

daemon/daemon.go

@@ -287,8 +287,19 @@ func (daemon *Daemon) register(container *Container, updateSuffixarray bool) err
 		if err := container.ToDisk(); err != nil {
 			log.Debugf("saving stopped state to disk %s", err)
 		}
-	}
 
+		info := daemon.execDriver.Info(container.ID)
+		if !info.IsRunning() {
+			log.Debugf("Container %s was supposed to be running but is not.", container.ID)
+
+			log.Debugf("Marking as stopped")
+
+			container.SetStopped(&execdriver.ExitStatus{ExitCode: -127})
+			if err := container.ToDisk(); err != nil {
+				return err
+			}
+		}
+	}
 	return nil
 }
 

daemon/execdriver/native/create.go

@@ -6,10 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"path/filepath"
 	"strings"
 	"syscall"
 
 	"github.com/docker/docker/daemon/execdriver"
+	"github.com/docker/docker/pkg/symlink"
 	"github.com/docker/libcontainer/apparmor"
 	"github.com/docker/libcontainer/configs"
 	"github.com/docker/libcontainer/devices"
@@ -226,6 +228,10 @@ func (d *driver) setupMounts(container *configs.Config, c *execdriver.Command) e
 	container.Mounts = defaultMounts
 
 	for _, m := range c.Mounts {
+		dest, err := symlink.FollowSymlinkInScope(filepath.Join(c.Rootfs, m.Destination), c.Rootfs)
+		if err != nil {
+			return err
+		}
 		flags := syscall.MS_BIND | syscall.MS_REC
 		if !m.Writable {
 			flags |= syscall.MS_RDONLY
@@ -233,9 +239,10 @@ func (d *driver) setupMounts(container *configs.Config, c *execdriver.Command) e
 		if m.Slave {
 			flags |= syscall.MS_SLAVE
 		}
+
 		container.Mounts = append(container.Mounts, &configs.Mount{
 			Source:      m.Source,
-			Destination: m.Destination,
+			Destination: dest,
 			Device:      "bind",
 			Flags:       flags,
 		})

daemon/execdriver/native/driver.go

@@ -270,25 +270,29 @@ func (d *driver) Unpause(c *execdriver.Command) error {
 
 func (d *driver) Terminate(c *execdriver.Command) error {
 	defer d.cleanContainer(c.ID)
-	container, err := d.factory.Load(c.ID)
-	if err != nil {
-		return err
+	// lets check the start time for the process
+	active := d.activeContainers[c.ID]
+	if active == nil {
+		return fmt.Errorf("active container for %s does not exist", c.ID)
 	}
-	defer container.Destroy()
-	state, err := container.State()
+	state, err := active.State()
 	if err != nil {
 		return err
 	}
 	pid := state.InitProcessPid
+
 	currentStartTime, err := system.GetProcessStartTime(pid)
 	if err != nil {
 		return err
 	}
+
 	if state.InitProcessStartTime == currentStartTime {
 		err = syscall.Kill(pid, 9)
 		syscall.Wait4(pid, nil, 0, nil)
 	}
+
 	return err
+
 }
 
 func (d *driver) Info(id string) execdriver.Info {

daemon/execdriver/native/template/default_template.go

@@ -82,16 +82,9 @@ func New() *configs.Config {
 		},
 		MaskPaths: []string{
 			"/proc/kcore",
-			"/proc/latency_stats",
-			"/proc/timer_stats",
 		},
 		ReadonlyPaths: []string{
-			"/proc/asound",
-			"/proc/bus",
-			"/proc/fs",
-			"/proc/irq",
-			"/proc/sys",
-			"/proc/sysrq-trigger",
+			"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
 		},
 	}
 

daemon/logger/syslog/syslog.go

@@ -17,7 +17,7 @@ type Syslog struct {
 }
 
 func New(tag string) (logger.Logger, error) {
-	log, err := syslog.New(syslog.LOG_DAEMON, fmt.Sprintf("%s/%s", path.Base(os.Args[0]), tag))
+	log, err := syslog.New(syslog.LOG_USER, fmt.Sprintf("%s: <%s> ", path.Base(os.Args[0]), tag))
 	if err != nil {
 		return nil, err
 	}

daemon/networkdriver/bridge/driver.go

@@ -7,7 +7,6 @@ import (
 	"io/ioutil"
 	"net"
 	"os"
-	"os/exec"
 	"strings"
 	"sync"
 
@@ -107,13 +106,6 @@ func InitDriver(job *engine.Job) engine.Status {
 		fixedCIDR      = job.Getenv("FixedCIDR")
 		fixedCIDRv6    = job.Getenv("FixedCIDRv6")
 	)
-
-	// try to modprobe bridge first
-	// see gh#12177
-	if out, err := exec.Command("modprobe", "-va", "bridge", "nf_nat").Output(); err != nil {
-		log.Warnf("Running modprobe bridge nf_nat failed with message: %s, error: %v", out, err)
-	}
-
 	initPortMapper()
 
 	if defaultIP := job.Getenv("DefaultBindingIP"); defaultIP != "" {

docs/Dockerfile

@@ -4,20 +4,11 @@
 FROM docs/base:latest
 MAINTAINER Sven Dowideit <SvenDowideit@docker.com> (@SvenDowideit)
 
-# This section ensures we pull the correct version of each
-# sub project
-ENV COMPOSE_BRANCH 1.2.0
-ENV SWARM_BRANCH v0.2.0
-ENV MACHINE_BRANCH master
-ENV DISTRIB_BRANCH master
-
-
-
 # TODO: need the full repo source to get the git version info
 COPY . /src
 
 # Reset the /docs dir so we can replace the theme meta with the new repo's git info
-# RUN git reset --hard
+RUN git reset --hard
 
 # Then copy the desired docs into the /docs/sources/ dir
 COPY ./sources/ /docs/sources
@@ -32,77 +23,45 @@ COPY ./mkdocs.yml mkdocs.yml
 COPY ./s3_website.json s3_website.json
 COPY ./release.sh release.sh
 
-
-# Docker Distribution
-# 
-#ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/mkdocs.yml /docs/mkdocs-distribution.yml
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/images/notifications.png /docs/sources/registry/images/notifications.png
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/images/registry.png /docs/sources/registry/images/registry.png
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/overview.md /docs/sources/registry/overview.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/overview.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/deploying.md /docs/sources/registry/deploying.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/deploying.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/configuration.md /docs/sources/registry/configuration.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/configuration.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/storagedrivers.md /docs/sources/registry/storagedrivers.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/storagedrivers.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/notifications.md /docs/sources/registry/notifications.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/notifications.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/spec/api.md /docs/sources/registry/spec/api.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/spec/api.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/spec/json.md /docs/sources/registry/spec/json.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/spec/json.md
-
-ADD https://raw.githubusercontent.com/docker/distribution/${DISTRIB_BRANCH}/docs/spec/auth/token.md /docs/sources/registry/spec/auth/token.md
-RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/registry/spec/auth/token.md
-
 # Docker Swarm
-#ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/docs/mkdocs.yml /docs/mkdocs-swarm.yml
-ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/docs/index.md /docs/sources/swarm/index.md
+#ADD https://raw.githubusercontent.com/docker/swarm/master/docs/mkdocs.yml /docs/mkdocs-swarm.yml
+ADD https://raw.githubusercontent.com/docker/swarm/master/docs/index.md /docs/sources/swarm/index.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/swarm/index.md
-ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/discovery/README.md /docs/sources/swarm/discovery.md
+ADD https://raw.githubusercontent.com/docker/swarm/master/discovery/README.md /docs/sources/swarm/discovery.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/swarm/discovery.md
-ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/api/README.md /docs/sources/swarm/API.md
+ADD https://raw.githubusercontent.com/docker/swarm/master/api/README.md /docs/sources/swarm/API.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/swarm/API.md
-ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/scheduler/filter/README.md /docs/sources/swarm/scheduler/filter.md
+ADD https://raw.githubusercontent.com/docker/swarm/master/scheduler/filter/README.md /docs/sources/swarm/scheduler/filter.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/swarm/scheduler/filter.md
-ADD https://raw.githubusercontent.com/docker/swarm/${SWARM_BRANCH}/scheduler/strategy/README.md /docs/sources/swarm/scheduler/strategy.md
+ADD https://raw.githubusercontent.com/docker/swarm/master/scheduler/strategy/README.md /docs/sources/swarm/scheduler/strategy.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/swarm/scheduler/strategy.md
 
 # Docker Machine
-#ADD https://raw.githubusercontent.com/docker/machine/${MACHINE_BRANCH}/docs/mkdocs.yml /docs/mkdocs-machine.yml
-ADD https://raw.githubusercontent.com/docker/machine/${MACHINE_BRANCH}/docs/index.md /docs/sources/machine/index.md
+#ADD https://raw.githubusercontent.com/docker/machine/master/docs/mkdocs.yml /docs/mkdocs-machine.yml
+ADD https://raw.githubusercontent.com/docker/machine/master/docs/index.md /docs/sources/machine/index.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/machine/index.md
 
 # Docker Compose
-#ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/mkdocs.yml /docs/mkdocs-compose.yml
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/index.md /docs/sources/compose/index.md
+#ADD https://raw.githubusercontent.com/docker/compose/master/docs/mkdocs.yml /docs/mkdocs-compose.yml
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/index.md /docs/sources/compose/index.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/index.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/install.md /docs/sources/compose/install.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/install.md /docs/sources/compose/install.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/install.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/cli.md /docs/sources/compose/cli.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/cli.md /docs/sources/compose/cli.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/cli.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/yml.md /docs/sources/compose/yml.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/yml.md /docs/sources/compose/yml.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/yml.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/env.md /docs/sources/compose/env.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/env.md /docs/sources/compose/env.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/env.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/completion.md /docs/sources/compose/completion.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/completion.md /docs/sources/compose/completion.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/completion.md
 
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/django.md /docs/sources/compose/django.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/django.md /docs/sources/compose/django.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/django.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/rails.md /docs/sources/compose/rails.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/rails.md /docs/sources/compose/rails.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/rails.md
-ADD https://raw.githubusercontent.com/docker/compose/${COMPOSE_BRANCH}/docs/wordpress.md /docs/sources/compose/wordpress.md
+ADD https://raw.githubusercontent.com/docker/compose/master/docs/wordpress.md /docs/sources/compose/wordpress.md
 RUN sed -i.old '1s;^;no_version_dropdown: true;' /docs/sources/compose/wordpress.md
 
 # Then build everything together, ready for mkdocs
-RUN /docs/build.sh
+RUN /docs/build.sh

docs/man/docker-login.1.md

@@ -2,7 +2,7 @@
 % Docker Community
 % JUNE 2014
 # NAME
-docker-login - Register or log in to a Docker registry. 
+docker-login - Register or log in to a Docker registry server, if no server is specified "https://index.docker.io/v1/" is the default.
 
 # SYNOPSIS
 **docker login**
@@ -13,14 +13,9 @@ docker-login - Register or log in to a Docker registry.
 [SERVER]
 
 # DESCRIPTION
-Register or log in to a Docker Registry Service located on the specified
-`SERVER`.  You can specify a URL or a `hostname` for the `SERVER` value. If you
-do not specify a `SERVER`, the command uses Docker's public registry located at
-`https://registry-1.docker.io/` by default.  To get a username/password for Docker's public registry, create an account on Docker Hub.
-
-You can log into any public or private repository for which you have
-credentials.  When you log in, the command stores encoded credentials in
-`$HOME/.dockercfg` on Linux or `%USERPROFILE%/.dockercfg` on Windows.
+Register or Login to a docker registry server, if no server is
+specified "https://index.docker.io/v1/" is the default. If you want to
+login to a private registry you can specify this by adding the server name.
 
 # OPTIONS
 **-e**, **--email**=""
@@ -37,7 +32,7 @@ credentials.  When you log in, the command stores encoded credentials in
 
 # EXAMPLES
 
-## Login to a registry on your localhost
+## Login to a local registry
 
     # docker login localhost:8080
 
@@ -48,4 +43,3 @@ credentials.  When you log in, the command stores encoded credentials in
 April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>

docs/man/docker-logout.1.md

@@ -2,24 +2,23 @@
 % Docker Community
 % JUNE 2014
 # NAME
-docker-logout - Log out from a Docker Registry Service.
+docker-logout - Log out from a Docker registry, if no server is specified "https://index.docker.io/v1/" is the default.
 
 # SYNOPSIS
 **docker logout**
 [SERVER]
 
 # DESCRIPTION
-Log out of a Docker Registry Service located on the specified `SERVER`. You can
-specify a URL or a `hostname` for the `SERVER` value. If you do not specify a
-`SERVER`, the command attempts to log you out of Docker's public registry
-located at `https://registry-1.docker.io/` by default.  
+Log the user out from a Docker registry, if no server is
+specified "https://index.docker.io/v1/" is the default. If you want to
+log out from a private registry you can specify this by adding the server name.
 
 # OPTIONS
 There are no available options.
 
 # EXAMPLES
 
-## Log out from a registry on your localhost
+## Log out from a local registry
 
     # docker logout localhost:8080
 
@@ -29,4 +28,3 @@ There are no available options.
 # HISTORY
 June 2014, Originally compiled by Daniel, Dao Quang Minh (daniel at nitrous dot io)
 July 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>

docs/man/docker-pull.1.md

@@ -2,7 +2,7 @@
 % Docker Community
 % JUNE 2014
 # NAME
-docker-pull - Pull an image or a repository from a registry
+docker-pull - Pull an image or a repository from the registry
 
 # SYNOPSIS
 **docker pull**
@@ -12,12 +12,10 @@ NAME[:TAG]
 
 # DESCRIPTION
 
-This command pulls down an image or a repository from a registry. If
+This command pulls down an image or a repository from the registry. If
 there is more than one image for a repository (e.g., fedora) then all
 images for that repository name are pulled down including any tags.
-
-If you do not specify a `REGISTRY_HOST`, the command uses Docker's public
-registry located at `registry-1.docker.io` by default. 
+It is also possible to specify a non-default registry to pull from.
 
 # OPTIONS
 **-a**, **--all-tags**=*true*|*false*
@@ -47,7 +45,7 @@ registry located at `registry-1.docker.io` by default.
     fedora       heisenbug   105182bb5e8b    5 days ago   372.7 MB
     fedora       latest      105182bb5e8b    5 days ago   372.7 MB
 
-# Pull an image, manually specifying path to Docker's public registry and tag
+# Pull an image, manually specifying path to the registry and tag
 # Note that if the  image is previously downloaded then the status would be
 # 'Status: Image is up to date for registry.hub.docker.com/fedora:20'
 
@@ -69,5 +67,3 @@ April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
 August 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by John Willis <john.willis@docker.com>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>

docs/man/docker-push.1.md

@@ -2,18 +2,18 @@
 % Docker Community
 % JUNE 2014
 # NAME
-docker-push - Push an image or a repository to a registry
+docker-push - Push an image or a repository to the registry
 
 # SYNOPSIS
 **docker push**
 [**--help**]
-NAME[:TAG] | [REGISTRY_HOST[:REGISTRY_PORT]/]NAME[:TAG]
+NAME[:TAG]
 
 # DESCRIPTION
-
-This command pushes an image or a repository to a registry. If you do not
-specify a `REGISTRY_HOST`, the command uses Docker's public registry located at
-`registry-1.docker.io` by default. 
+Push an image or a repository to a registry. The default registry is the Docker 
+Hub located at [hub.docker.com](https://hub.docker.com/). However the 
+image can be pushed to another, perhaps private, registry as demonstrated in 
+the example below.
 
 # OPTIONS
 **--help**
@@ -28,10 +28,12 @@ and then committing it to a new image name:
 
     # docker commit c16378f943fe rhel-httpd
 
-Now, push the image to the registry using the image ID. In this example the
-registry is on host named `registry-host` and listening on port `5000`. To do
-this, tag the image with the host name or IP address, and the port of the
-registry:
+Now push the image to the registry using the image ID. In this example
+the registry is on host named registry-host and listening on port 5000.
+Default Docker commands will push to the default `hub.docker.com`
+registry. Instead, push to the local registry, which is on a host called
+registry-host*. To do this, tag the image with the host name or IP
+address, and the port of the registry:
 
     # docker tag rhel-httpd registry-host:5000/myadmin/rhel-httpd
     # docker push registry-host:5000/myadmin/rhel-httpd
@@ -47,5 +49,3 @@ listed.
 April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>
-

docs/man/docker-rmi.1.md

@@ -13,9 +13,10 @@ IMAGE [IMAGE...]
 
 # DESCRIPTION
 
-Removes one or more images from the host node. This does not remove images from
-a registry. You cannot remove an image of a running container unless you use the
-**-f** option. To see all images on a host use the **docker images** command.
+This will remove one or more images from the host node. This does not
+remove images from a registry. You cannot remove an image of a running
+container unless you use the **-f** option. To see all images on a host
+use the **docker images** command.
 
 # OPTIONS
 **-f**, **--force**=*true*|*false*
@@ -39,4 +40,3 @@ Here is an example of removing and image:
 April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>

docs/man/docker-search.1.md

@@ -14,9 +14,10 @@ TERM
 
 # DESCRIPTION
 
-Search Docker Hub for an image with that matches the specified `TERM`. The table
-of images returned displays the name, description (truncated by default), number
-of stars awarded, whether the image is official, and whether it is automated.
+Search an index for an image with that matches the term TERM. The table
+of images returned displays the name, description (truncated by default),
+number of stars awarded, whether the image is official, and whether it
+is automated.
 
 *Note* - Search queries will only return up to 25 results
 
@@ -35,9 +36,9 @@ of stars awarded, whether the image is official, and whether it is automated.
 
 # EXAMPLES
 
-## Search Docker Hub for ranked images
+## Search the registry for ranked images
 
-Search a registry for the term 'fedora' and only display those images
+Search the registry for the term 'fedora' and only display those images
 ranked 3 or higher:
 
     $ sudo docker search -s 3 fedora
@@ -47,9 +48,9 @@ ranked 3 or higher:
     mattdm/fedora-small   A small Fedora image on which to build. Co...  8
     goldmann/wildfly      A WildFly application server running on a ...  3               [OK]
 
-## Search Docker Hub for automated images
+## Search the registry for automated images
 
-Search Docker Hub for the term 'fedora' and only display automated images
+Search the registry for the term 'fedora' and only display automated images
 ranked 1 or higher:
 
     $ sudo docker search -s 1 -t fedora
@@ -61,5 +62,3 @@ ranked 1 or higher:
 April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>
-

docs/man/docker-tag.1.md

@@ -8,14 +8,11 @@ docker-tag - Tag an image into a repository
 **docker tag**
 [**-f**|**--force**[=*false*]]
 [**--help**]
-IMAGE[:TAG] [REGISTRY_HOST/][USERNAME/]NAME[:TAG]
+IMAGE[:TAG] [REGISTRYHOST/][USERNAME/]NAME[:TAG]
 
 # DESCRIPTION
-Assigns a new alias to an image in a registry. An alias refers to the
-entire image name including the optional `TAG` after the ':'. 
-
-If you do not specify a `REGISTRY_HOST`, the command uses Docker's public
-registry located at `registry-1.docker.io` by default. 
+This will give a new alias to an image in the repository. This refers to the
+entire image name including the optional TAG after the ':'. 
 
 # "OPTIONS"
 **-f**, **--force**=*true*|*false*
@@ -61,5 +58,3 @@ April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
 July 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-April 2015, updated by Mary Anthony for v2 <mary@docker.com>
-

docs/man/docker.1.md

@@ -172,10 +172,10 @@ inside it)
   Load an image from a tar archive
 
 **docker-login(1)**
-  Register or login to a Docker Registry Service
+  Register or Login to a Docker registry server
 
 **docker-logout(1)**
-  Log the user out of a Docker Registry Service
+  Log the user out of a Docker registry server
 
 **docker-logs(1)**
   Fetch the logs of a container
@@ -190,10 +190,10 @@ inside it)
   List containers
 
 **docker-pull(1)**
-  Pull an image or a repository from a Docker Registry Service
+  Pull an image or a repository from a Docker registry server
 
 **docker-push(1)**
-  Push an image or a repository to a Docker Registry Service
+  Push an image or a repository to a Docker registry server
 
 **docker-restart(1)**
   Restart a running container

docs/mkdocs.yml

@@ -132,19 +132,10 @@ pages:
 - ['swarm/scheduler/filter.md', 'Reference', 'Swarm filters']
 - ['swarm/API.md', 'Reference', 'Swarm API']
 - ['reference/api/index.md', '**HIDDEN**']
-- ['registry/overview.md', 'Reference', 'Docker Registry 2.0']
-- ['registry/deploying.md', 'Reference', '    ▪  Deploy a registry' ]
-- ['registry/configuration.md', 'Reference', '    ▪  Configure a registry' ]
-- ['registry/storagedrivers.md', 'Reference', '    ▪  Storage driver model' ]
-- ['registry/notifications.md', 'Reference', '    ▪  Work with notifications' ]
-- ['registry/spec/api.md', 'Reference', '    ▪  Registry Service API v2' ]
-- ['registry/spec/json.md', 'Reference', '    ▪  JSON format' ]
-- ['registry/spec/auth/token.md', 'Reference', '    ▪  Authenticate via central service' ]
-- ['reference/api/hub_registry_spec.md', 'Reference', 'Docker Hub and Registry 1.0']
-- ['reference/api/registry_api.md', 'Reference', '    ▪ Docker Registry API v1']
-- ['reference/api/registry_api_client_libraries.md', 'Reference', '    ▪ Docker Registry 1.0 API Client Libraries']
-#- ['reference/image-spec-v1.md', 'Reference', 'Docker Image Specification v1.0.0']
 - ['reference/api/docker-io_api.md', 'Reference', 'Docker Hub API']
+- ['reference/api/registry_api.md', 'Reference', 'Docker Registry API']
+- ['reference/api/registry_api_client_libraries.md', 'Reference', 'Docker Registry API Client Libraries']
+- ['reference/api/hub_registry_spec.md', 'Reference', 'Docker Hub and Registry Spec']
 #- ['reference/image-spec-v1.md', 'Reference', 'Docker Image Specification v1.0.0']
 - ['reference/api/docker_remote_api.md', 'Reference', 'Docker Remote API']
 - ['reference/api/docker_remote_api_v1.18.md', 'Reference', 'Docker Remote API v1.18']

docs/s3_website.json

@@ -39,8 +39,7 @@
     { "Condition": { "KeyPrefixEquals": "installation/openSUSE/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "installation/SUSE/" } },
     { "Condition": { "KeyPrefixEquals": "contributing/contributing/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "project/who-written-for/" } },
     { "Condition": { "KeyPrefixEquals": "contributing/devenvironment/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "project/set-up-prereqs/" } },
-    { "Condition": { "KeyPrefixEquals": "contributing/docs_style-guide/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "project/doc-style/" } },
-    { "Condition": { "KeyPrefixEquals": "registry/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "registry/overview/" } }
+    { "Condition": { "KeyPrefixEquals": "contributing/docs_style-guide/" }, "Redirect": { "HostName": "$BUCKET", "ReplaceKeyPrefixWith": "project/doc-style/" } }
   ]
 }
 

docs/sources/reference/api/docker_remote_api_v1.18.md

@@ -359,10 +359,7 @@ Return low-level information on the container `id`
 				"MaximumRetryCount": 2,
 				"Name": "on-failure"
 			},
-			"LogConfig": {
-				"Config": null,
-				"Type": "json-file"
-			},
+           "LogConfig": { "Type": "json-file", Config: {} },
 			"SecurityOpt": null,
 			"VolumesFrom": null,
 			"Ulimits": [{}]

docs/sources/reference/api/hub_registry_spec.md

@@ -2,7 +2,7 @@ page_title: Registry Documentation
 page_description: Documentation for docker Registry and Registry API
 page_keywords: docker, registry, api, hub
 
-# The Docker Hub and the Registry 1.0 spec
+# The Docker Hub and the Registry spec
 
 ## The three roles
 
@@ -28,9 +28,9 @@ The Docker Hub is authoritative for that information.
 There is only one instance of the Docker Hub, run and
 managed by Docker Inc.
 
-### Docker Registry 1.0
+### Registry
 
-The 1.0 registry has the following characteristics:
+The registry has the following characteristics:
 
  - It stores the images and the graph for a set of repositories
  - It does not have user accounts data

docs/sources/reference/api/registry_api.md

@@ -2,11 +2,11 @@ page_title: Registry API
 page_description: API Documentation for Docker Registry
 page_keywords: API, Docker, index, registry, REST, documentation
 
-# Docker Registry API v1
+# Docker Registry API
 
 ## Introduction
 
- - This is the REST API for the Docker Registry 1.0
+ - This is the REST API for the Docker Registry
  - It stores the images and the graph for a set of repositories
  - It does not have user accounts data
  - It has no notion of user accounts or authorization

docs/sources/reference/api/registry_api_client_libraries.md

@@ -2,7 +2,7 @@ page_title: Registry API Client Libraries
 page_description: Various client libraries available to use with the Docker registry API
 page_keywords: API, Docker, index, registry, REST, documentation, clients, C#, Erlang, Go, Groovy, Java, JavaScript, Perl, PHP, Python, Ruby, Rust, Scala
 
-# Docker Registry 1.0 API Client Libraries
+# Docker Registry API Client Libraries
 
 These libraries have not been tested by the Docker maintainers for
 compatibility. Please file issues with the library owners. If you find

hack/vendor.sh

@@ -75,7 +75,7 @@ rm -rf src/github.com/docker/distribution
 mkdir -p src/github.com/docker/distribution
 mv tmp-digest src/github.com/docker/distribution/digest
 
-clone git github.com/docker/libcontainer 1b471834b45063b61e0aedefbb1739a8f34b414e
+clone git github.com/docker/libcontainer bd8ec36106086f72b66e1be85a81202b93503e44
 # see src/github.com/docker/libcontainer/update-vendor.sh which is the "source of truth" for libcontainer deps (just like this file)
 rm -rf src/github.com/docker/libcontainer/vendor
 eval "$(grep '^clone ' src/github.com/docker/libcontainer/update-vendor.sh | grep -v 'github.com/codegangsta/cli' | grep -v 'github.com/Sirupsen/logrus')"

integration-cli/docker_cli_run_test.go

@@ -3436,72 +3436,3 @@ func TestRunPidHostWithChildIsKillable(t *testing.T) {
 	}
 	logDone("run - can kill container with pid-host and some childs of pid 1")
 }
-
-func TestRunWithTooSmallMemoryLimit(t *testing.T) {
-	defer deleteAllContainers()
-	// this memory limit is 1 byte less than the min, which is 4MB
-	// https://github.com/docker/docker/blob/v1.5.0/daemon/create.go#L22
-	out, _, err := runCommandWithOutput(exec.Command(dockerBinary, "run", "-m", "4194303", "busybox"))
-	if err == nil || !strings.Contains(out, "Minimum memory limit allowed is 4MB") {
-		t.Fatalf("expected run to fail when using too low a memory limit: %q", out)
-	}
-
-	logDone("run - can't set too low memory limit")
-}
-
-func TestRunWriteToProcAsound(t *testing.T) {
-	defer deleteAllContainers()
-	code, err := runCommand(exec.Command(dockerBinary, "run", "busybox", "sh", "-c", "echo 111 >> /proc/asound/version"))
-	if err == nil || code == 0 {
-		t.Fatal("standard container should not be able to write to /proc/asound")
-	}
-	logDone("run - ro write to /proc/asound")
-}
-
-func TestRunReadProcTimer(t *testing.T) {
-	defer deleteAllContainers()
-	out, code, err := runCommandWithOutput(exec.Command(dockerBinary, "run", "busybox", "cat", "/proc/timer_stats"))
-	if err != nil || code != 0 {
-		t.Fatal(err)
-	}
-	if strings.Trim(out, "\n ") != "" {
-		t.Fatalf("expected to receive no output from /proc/timer_stats but received %q", out)
-	}
-	logDone("run - read /proc/timer_stats")
-}
-
-func TestRunReadProcLatency(t *testing.T) {
-	// some kernels don't have this configured so skip the test if this file is not found
-	// on the host running the tests.
-	if _, err := os.Stat("/proc/latency_stats"); err != nil {
-		t.Skip()
-		return
-	}
-	defer deleteAllContainers()
-	out, code, err := runCommandWithOutput(exec.Command(dockerBinary, "run", "busybox", "cat", "/proc/latency_stats"))
-	if err != nil || code != 0 {
-		t.Fatal(err)
-	}
-	if strings.Trim(out, "\n ") != "" {
-		t.Fatalf("expected to receive no output from /proc/latency_stats but received %q", out)
-	}
-	logDone("run - read /proc/latency_stats")
-}
-
-func TestMountIntoProc(t *testing.T) {
-	defer deleteAllContainers()
-	code, err := runCommand(exec.Command(dockerBinary, "run", "-v", "/proc//sys", "busybox", "true"))
-	if err == nil || code == 0 {
-		t.Fatal("container should not be able to mount into /proc")
-	}
-	logDone("run - mount into proc")
-}
-
-func TestMountIntoSys(t *testing.T) {
-	defer deleteAllContainers()
-	code, err := runCommand(exec.Command(dockerBinary, "run", "-v", "/sys/", "busybox", "true"))
-	if err == nil || code == 0 {
-		t.Fatal("container should not be able to mount into /sys")
-	}
-	logDone("run - mount into sys")
-}

vendor/src/github.com/docker/libcontainer/SPEC.md

@@ -217,6 +217,17 @@ profile <profile_name> flags=(attach_disconnected,mediate_deleted) {
   file,
   umount,
 
+  mount fstype=tmpfs,
+  mount fstype=mqueue,
+  mount fstype=fuse.*,
+  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
+  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
+  mount fstype=fusectl -> /sys/fs/fuse/connections/,
+  mount fstype=securityfs -> /sys/kernel/security/,
+  mount fstype=debugfs -> /sys/kernel/debug/,
+  mount fstype=proc -> /proc/,
+  mount fstype=sysfs -> /sys/,
+
   deny @{PROC}/sys/fs/** wklx,
   deny @{PROC}/sysrq-trigger rwklx,
   deny @{PROC}/mem rwklx,
@@ -224,7 +235,9 @@ profile <profile_name> flags=(attach_disconnected,mediate_deleted) {
   deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
   deny @{PROC}/sys/kernel/*/** wklx,
 
-  deny mount,
+  deny mount options=(ro, remount) -> /,
+  deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
+  deny mount fstype=devpts,
 
   deny /sys/[^f]*/** wklx,
   deny /sys/f[^s]*/** wklx,

vendor/src/github.com/docker/libcontainer/apparmor/gen.go

@@ -27,6 +27,17 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   file,
   umount,
 
+  mount fstype=tmpfs,
+  mount fstype=mqueue,
+  mount fstype=fuse.*,
+  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
+  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
+  mount fstype=fusectl -> /sys/fs/fuse/connections/,
+  mount fstype=securityfs -> /sys/kernel/security/,
+  mount fstype=debugfs -> /sys/kernel/debug/,
+  mount fstype=proc -> /proc/,
+  mount fstype=sysfs -> /sys/,
+
   deny @{PROC}/sys/fs/** wklx,
   deny @{PROC}/sysrq-trigger rwklx,
   deny @{PROC}/mem rwklx,
@@ -34,7 +45,9 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
   deny @{PROC}/sys/kernel/*/** wklx,
 
-  deny mount,
+  deny mount options=(ro, remount) -> /,
+  deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
+  deny mount fstype=devpts,
 
   deny /sys/[^f]*/** wklx,
   deny /sys/f[^s]*/** wklx,

vendor/src/github.com/docker/libcontainer/rootfs_linux.go

@@ -11,7 +11,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/docker/docker/pkg/symlink"
 	"github.com/docker/libcontainer/configs"
 	"github.com/docker/libcontainer/label"
 )
@@ -35,6 +34,11 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
 	if err := setupPtmx(config, console); err != nil {
 		return newSystemError(err)
 	}
+	// stdin, stdout and stderr could be pointing to /dev/null from parent namespace.
+	// re-open them inside this namespace.
+	if err := reOpenDevNull(config.Rootfs); err != nil {
+		return newSystemError(err)
+	}
 	if err := setupDevSymlinks(config.Rootfs); err != nil {
 		return newSystemError(err)
 	}
@@ -49,9 +53,6 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
 	if err != nil {
 		return newSystemError(err)
 	}
-	if err := reOpenDevNull(config.Rootfs); err != nil {
-		return newSystemError(err)
-	}
 	if config.Readonlyfs {
 		if err := setReadonly(); err != nil {
 			return newSystemError(err)
@@ -104,16 +105,6 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 			// unable to bind anything to it.
 			return err
 		}
-		// ensure that the destination of the bind mount is resolved of symlinks at mount time because
-		// any previous mounts can invalidate the next mount's destination.
-		// this can happen when a user specifies mounts within other mounts to cause breakouts or other
-		// evil stuff to try to escape the container's rootfs.
-		if dest, err = symlink.FollowSymlinkInScope(filepath.Join(rootfs, m.Destination), rootfs); err != nil {
-			return err
-		}
-		if err := checkMountDestination(rootfs, dest); err != nil {
-			return err
-		}
 		if err := createIfNotExists(dest, stat.IsDir()); err != nil {
 			return err
 		}
@@ -141,29 +132,6 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 	return nil
 }
 
-// checkMountDestination checks to ensure that the mount destination is not over the
-// top of /proc or /sys.
-// dest is required to be an abs path and have any symlinks resolved before calling this function.
-func checkMountDestination(rootfs, dest string) error {
-	if filepath.Clean(rootfs) == filepath.Clean(dest) {
-		return fmt.Errorf("mounting into / is prohibited")
-	}
-	invalidDestinations := []string{
-		"/proc",
-		"/sys",
-	}
-	for _, invalid := range invalidDestinations {
-		path, err := filepath.Rel(filepath.Join(rootfs, invalid), dest)
-		if err != nil {
-			return err
-		}
-		if path == "." || !strings.HasPrefix(path, "..") {
-			return fmt.Errorf("%q cannot be mounted because it is located inside %q", dest, invalid)
-		}
-	}
-	return nil
-}
-
 func setupDevSymlinks(rootfs string) error {
 	var links = [][2]string{
 		{"/proc/self/fd", "/dev/fd"},
@@ -188,13 +156,11 @@ func setupDevSymlinks(rootfs string) error {
 	return nil
 }
 
-// If stdin, stdout, and/or stderr are pointing to `/dev/null` in the parent's rootfs
-// this method will make them point to `/dev/null` in this container's rootfs.  This
-// needs to be called after we chroot/pivot into the container's rootfs so that any
-// symlinks are resolved locally.
+// If stdin, stdout or stderr are pointing to '/dev/null' in the global mount namespace,
+// this method will make them point to '/dev/null' in this namespace.
 func reOpenDevNull(rootfs string) error {
 	var stat, devNullStat syscall.Stat_t
-	file, err := os.Open("/dev/null")
+	file, err := os.Open(filepath.Join(rootfs, "/dev/null"))
 	if err != nil {
 		return fmt.Errorf("Failed to open /dev/null - %s", err)
 	}

vendor/src/github.com/docker/libcontainer/rootfs_linux_test.go

@@ -1,37 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import "testing"
-
-func TestCheckMountDestOnProc(t *testing.T) {
-	dest := "/rootfs/proc/"
-	err := checkMountDestination("/rootfs", dest)
-	if err == nil {
-		t.Fatal("destination inside proc should return an error")
-	}
-}
-
-func TestCheckMountDestInSys(t *testing.T) {
-	dest := "/rootfs//sys/fs/cgroup"
-	err := checkMountDestination("/rootfs", dest)
-	if err == nil {
-		t.Fatal("destination inside proc should return an error")
-	}
-}
-
-func TestCheckMountDestFalsePositive(t *testing.T) {
-	dest := "/rootfs/sysfiles/fs/cgroup"
-	err := checkMountDestination("/rootfs", dest)
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestCheckMountRoot(t *testing.T) {
-	dest := "/rootfs"
-	err := checkMountDestination("/rootfs", dest)
-	if err == nil {
-		t.Fatal(err)
-	}
-}