Bump version to 1.8.0

Signed-off-by: David Calavera <david.calavera@gmail.com>

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 1.8.0 (2015-08-06)
+## 1.8.0 (2015-07-24)
 
 ### Distribution
 
@@ -85,11 +85,6 @@
 - Fix error caused using default gateways outside of the allocated range
 - Format times in inspect command with a template as RFC3339Nano
 - Make registry client to accept 2xx and 3xx http status responses as successful
-- Fix race issue that caused the daemon to crash with certain layer downloads failed in a specific order.
-- Fix error when the docker ps format was not valid.
-- Remove redundant ip forward check.
-- Fix issue trying to push images to repository mirrors.
-- Fix error cleaning up network entrypoints when there is an initialization issue.
 
 ## 1.7.1 (2015-07-14)
 

VERSION

@@ -1 +1 @@
-1.8.0-rc3
+1.8.0-rc2

api/client/ps/custom.go

@@ -170,11 +170,9 @@ func customFormat(ctx Context, containers []types.Container) {
 		format += "\t{{.Size}}"
 	}
 
-	tmpl, err := template.New("").Parse(format)
+	tmpl, err := template.New("ps template").Parse(format)
 	if err != nil {
-		buffer.WriteString(fmt.Sprintf("Template parsing error: %v\n", err))
-		buffer.WriteTo(ctx.Output)
-		return
+		buffer.WriteString(fmt.Sprintf("Invalid `docker ps` format: %v\n", err))
 	}
 
 	for _, container := range containers {
@@ -183,9 +181,8 @@ func customFormat(ctx Context, containers []types.Container) {
 			c:     container,
 		}
 		if err := tmpl.Execute(buffer, containerCtx); err != nil {
-			buffer = bytes.NewBufferString(fmt.Sprintf("Template parsing error: %v\n", err))
-			buffer.WriteTo(ctx.Output)
-			return
+			buffer = bytes.NewBufferString(fmt.Sprintf("Invalid `docker ps` format: %v\n", err))
+			break
 		}
 		if table && len(header) == 0 {
 			header = containerCtx.fullHeader()

api/client/ps/custom_test.go

@@ -1,7 +1,6 @@
 package ps
 
 import (
-	"bytes"
 	"reflect"
 	"strings"
 	"testing"
@@ -11,7 +10,7 @@ import (
 	"github.com/docker/docker/pkg/stringid"
 )
 
-func TestContainerPsContext(t *testing.T) {
+func TestContainerContextID(t *testing.T) {
 	containerId := stringid.GenerateRandomID()
 	unix := time.Now().Unix()
 
@@ -87,16 +86,3 @@ func TestContainerPsContext(t *testing.T) {
 
 	}
 }
-
-func TestContainerPsFormatError(t *testing.T) {
-	out := bytes.NewBufferString("")
-	ctx := Context{
-		Format: "{{InvalidFunction}}",
-		Output: out,
-	}
-
-	customFormat(ctx, make([]types.Container, 0))
-	if out.String() != "Template parsing error: template: :1: function \"InvalidFunction\" not defined\n" {
-		t.Fatalf("Expected format error, got `%v`\n", out.String())
-	}
-}

contrib/builder/deb/debian-jessie/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM debian:jessie
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/debian-stretch/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM debian:stretch
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/debian-wheezy/Dockerfile

@@ -5,7 +5,7 @@
 FROM debian:wheezy
 RUN echo deb http://http.debian.net/debian wheezy-backports main > /etc/apt/sources.list.d/wheezy-backports.list
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/generate.sh

@@ -50,6 +50,7 @@ for version in "${versions[@]}"; do
 		build-essential # "essential for building Debian packages"
 		curl ca-certificates # for downloading Go
 		debhelper # for easy ".deb" building
+		dh-apparmor # for apparmor debhelper
 		dh-systemd # for systemd debhelper integration
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"

contrib/builder/deb/ubuntu-debootstrap-precise/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM ubuntu-debootstrap:precise
 
-RUN apt-get update && apt-get install -y bash-completion  build-essential curl ca-certificates debhelper  git libapparmor-dev  libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion  build-essential curl ca-certificates debhelper dh-apparmor  git libapparmor-dev  libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/ubuntu-debootstrap-trusty/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM ubuntu-debootstrap:trusty
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/ubuntu-debootstrap-vivid/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM ubuntu-debootstrap:vivid
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/builder/deb/ubuntu-debootstrap-wily/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM ubuntu-debootstrap:wily
 
-RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y bash-completion btrfs-tools build-essential curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libsqlite3-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.4.2
 RUN curl -fSL "https://storage.googleapis.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local

contrib/completion/bash/docker

@@ -27,7 +27,7 @@
 # This order should be applied to lists, alternatives and code blocks.
 
 __docker_q() {
-	docker ${host:+-H "$host"} ${config:+--config "$config"} 2>/dev/null "$@"
+	docker ${host:+-H "$host"} 2>/dev/null "$@"
 }
 
 __docker_containers_all() {
@@ -325,10 +325,6 @@ _docker_docker() {
 	"
 
 	case "$prev" in
-		--config)
-			_filedir -d
-			return
-			;;
 		--log-level|-l)
 			__docker_log_levels
 			return
@@ -1398,7 +1394,6 @@ _docker() {
 		--tlsverify
 	"
 	local global_options_with_args="
-		--config
 		--host -H
 		--log-level -l
 		--tlscacert
@@ -1406,7 +1401,7 @@ _docker() {
 		--tlskey
 	"
 
-	local host config
+	local host
 
 	COMPREPLY=()
 	local cur prev words cword
@@ -1421,11 +1416,6 @@ _docker() {
 				(( counter++ ))
 				host="${words[$counter]}"
 				;;
-			# save config so that completion can use custom configuration directories
-			--config)
-				(( counter++ ))
-				config="${words[$counter]}"
-				;;
 			$(__docker_to_extglob "$global_options_with_args") )
 				(( counter++ ))
 				;;

contrib/init/systemd/docker.service

@@ -5,7 +5,6 @@ After=network.target docker.socket
 Requires=docker.socket
 
 [Service]
-Type=notify
 ExecStart=/usr/bin/docker daemon -H fd://
 MountFlags=slave
 LimitNOFILE=1048576

daemon/create.go

@@ -66,6 +66,9 @@ func (daemon *Daemon) Create(config *runconfig.Config, hostConfig *runconfig.Hos
 	if err := daemon.mergeAndVerifyConfig(config, img); err != nil {
 		return nil, nil, err
 	}
+	if !config.NetworkDisabled && daemon.SystemConfig().IPv4ForwardingDisabled {
+		warnings = append(warnings, "IPv4 forwarding is disabled.")
+	}
 	if hostConfig == nil {
 		hostConfig = &runconfig.HostConfig{}
 	}

daemon/execdriver/native/apparmor.go

@@ -40,16 +40,20 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   file,
   umount,
 
+  signal (receive) peer=/usr/bin/docker,
+  signal (receive) peer=docker-unconfined,
+
   deny @{PROC}/sys/fs/** wklx,
   deny @{PROC}/fs/** wklx,
   deny @{PROC}/sysrq-trigger rwklx,
   deny @{PROC}/mem rwklx,
   deny @{PROC}/kmem rwklx,
-  deny @{PROC}/kcore rwklx,
+  deny @{PROC}/kore rwklx,
   deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
   deny @{PROC}/sys/kernel/*/** wklx,
 
   deny mount,
+  deny ptrace (trace) peer=docker-default,
 
   deny /sys/[^f]*/** wklx,
   deny /sys/f[^s]*/** wklx,
@@ -59,6 +63,21 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/firmware/efi/efivars/** rwklx,
   deny /sys/kernel/security/** rwklx,
 }
+
+profile docker-unconfined flags=(attach_disconnected,mediate_deleted,complain) {
+  #include <abstractions/base>
+
+  network,
+  capability,
+  file,
+  umount,
+  mount,
+  pivot_root,
+  change_profile -> *,
+
+  ptrace,
+  signal,
+}
 `
 
 func generateProfile(out io.Writer) error {

daemon/execdriver/native/create.go

@@ -198,8 +198,9 @@ func (d *driver) setPrivileged(container *configs.Config) (err error) {
 	container.Devices = hostDevices
 
 	if apparmor.IsEnabled() {
-		container.AppArmorProfile = "unconfined"
+		container.AppArmorProfile = "docker-unconfined"
 	}
+
 	return nil
 }
 

daemon/execdriver/native/driver.go

@@ -54,11 +54,11 @@ func NewDriver(root, initPath string, options []string) (*driver, error) {
 
 	if apparmor.IsEnabled() {
 		if err := installAppArmorProfile(); err != nil {
-			apparmorProfiles := []string{"docker-default"}
+			apparmor_profiles := []string{"docker-default", "docker-unconfined"}
 
 			// Allow daemon to run if loading failed, but are active
 			// (possibly through another run, manually, or via system startup)
-			for _, policy := range apparmorProfiles {
+			for _, policy := range apparmor_profiles {
 				if err := hasAppArmorProfileLoaded(policy); err != nil {
 					return nil, fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", policy)
 				}

docs/README.md

@@ -87,8 +87,8 @@ own.
 	container with this image.
 
 	The container exposes port 8000 on the localhost so that you can connect and
-	see your changes. If you use Docker Machine, the `docker-machine ip
-	<machine-name>` command gives you the address of your server.
+	see your changes. If you are running Boot2Docker, use the `boot2docker ip`
+	to get the address of your server.
 
 6.  Check your writing for style and mechanical errors.
 
@@ -158,20 +158,18 @@ update the root docs pages by running
 
      	$ make AWS_S3_BUCKET=dowideit-docs BUILD_ROOT=yes docs-release
 
-### Errors publishing using a Docker Machine VM
+### Errors publishing using Boot2Docker
 
-Sometimes, in a Windows or Mac environment, the publishing procedure returns this
+Sometimes, in a Boot2Docker environment, the publishing procedure returns this
 error:
 
 	Post http:///var/run/docker.sock/build?rm=1&t=docker-docs%3Apost-1.2.0-docs_update-2:
 	dial unix /var/run/docker.sock: no such file or directory.
 
-If this happens, set the Docker host. Run the following command to get the
+If this happens, set the Docker host. Run the following command to set the
 variables in your shell:
 
-		docker-machine env <machine-name>
-		
-Then, set your environment accordingly.
+		$ eval "$(boot2docker shellinit)"
 
 ## Cherry-picking documentation changes to update an existing release.
 

docs/articles/basics.md

@@ -47,6 +47,10 @@ image cache.
 > characters of the full image ID - which can be found using
 > `docker inspect` or `docker images --no-trunc=true`.
 
+> **Note:** if you are using a remote Docker daemon, such as Boot2Docker, 
+> then _do not_ type the `sudo` before the `docker` commands shown in the
+> documentation's examples.
+
 ## Running an interactive shell
 
 To run an interactive shell in the Ubuntu image:

docs/articles/https.md

@@ -58,7 +58,7 @@ First generate CA private and public keys:
     State or Province Name (full name) [Some-State]:Queensland
     Locality Name (eg, city) []:Brisbane
     Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc
-    Organizational Unit Name (eg, section) []:Sales
+    Organizational Unit Name (eg, section) []:Boot2Docker
     Common Name (e.g. server FQDN or YOUR name) []:$HOST
     Email Address []:Sven@home.org.au
 

docs/articles/systemd.md

@@ -33,33 +33,17 @@ If you want Docker to start at boot, you should also:
 There are a number of ways to configure the daemon flags and environment variables
 for your Docker daemon.
 
-The recommended way is to use a systemd drop-in file. These are local files in
-the `/etc/systemd/system/docker.service.d` directory. This could also be
-`/etc/systemd/system/docker.service`, which also works for overriding the
-defaults from `/lib/systemd/system/docker.service`.
+If the `docker.service` file is set to use an `EnvironmentFile`
+(often pointing to `/etc/sysconfig/docker`) then you can modify the
+referenced file.
 
-However, if you had previously used a package which had an `EnvironmentFile`
-(often pointing to `/etc/sysconfig/docker`) then for backwards compatibility,
-you drop a file in the `/etc/systemd/system/docker.service.d`
-directory including the following:
-
-    [Service]
-    EnvironmentFile=-/etc/sysconfig/docker
-    EnvironmentFile=-/etc/sysconfig/docker-storage
-    EnvironmentFile=-/etc/sysconfig/docker-network
-    ExecStart=
-    ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS \
-              $DOCKER_STORAGE_OPTIONS \
-              $DOCKER_NETWORK_OPTIONS \
-              $BLOCK_REGISTRY \
-              $INSECURE_REGISTRY
-
-To check if the `docker.service` uses an `EnvironmentFile`:
+Check if the `docker.service` uses an `EnvironmentFile`:
 
     $ sudo systemctl show docker | grep EnvironmentFile
     EnvironmentFile=-/etc/sysconfig/docker (ignore_errors=yes)
 
-Alternatively, find out where the service file is located:
+Alternatively, find out where the service file is located, and look for the
+property:
 
     $ sudo systemctl status docker | grep Loaded
        Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled)
@@ -85,20 +69,18 @@ In this example, we'll assume that your `docker.service` file looks something li
 
     [Service]
     Type=notify
-    ExecStart=/usr/bin/docker daemon -H fd://
+    EnvironmentFile=-/etc/sysconfig/docker
+    ExecStart=/usr/bin/docker daemon -H fd:// $OPTIONS
     LimitNOFILE=1048576
     LimitNPROC=1048576
 
     [Install]
     Also=docker.socket
 
-This will allow us to add extra flags via a drop-in file (mentioned above) by
-placing a file containing the following in the `/etc/systemd/system/docker.service.d`
-directory:
+This will allow us to add extra flags to the `/etc/sysconfig/docker` file by
+setting `OPTIONS`:
 
-    [Service]
-    ExecStart=
-    ExecStart=/usr/bin/docker daemon -H fd:// --graph /mnt/docker-data --storage-driver btrfs
+    OPTIONS="--graph /mnt/docker-data --storage-driver btrfs"
 
 You can also set other environment variables in this file, for example, the
 `HTTP_PROXY` environment variables described below.

docs/installation/windows.md

@@ -124,36 +124,40 @@ The Boot2Docker management tool provides several commands:
 
 ## Container port redirection
 
-If you are curious, the username for the Docker default user is `docker` and the
-password is `tcuser`. The latest version of `docker-machine` sets up a host only
-network adaptor which provides access to the container's ports.
+If you are curious, the username for the boot2docker default user is `docker`
+and the password is `tcuser`.
 
-If you run a container with a published port:
+The latest version of `boot2docker` sets up a host only network adaptor which
+provides access to the container's ports.
 
-    $ docker run --rm -i -t -p 80:80 nginx
+If you run a container with an exposed port:
 
-Then you should be able to access that nginx server using the IP address
-reported to you using:
+    docker run --rm -i -t -p 80:80 nginx
 
-    $ docker-machine ip
+Then you should be able to access that nginx server using the IP address reported
+to you using:
 
-Typically, the IP is 192.168.59.103, but it could get changed by VirtualBox's
-DHCP implementation.
+    boot2docker ip
+
+Typically, it is 192.168.59.103, but it could get changed by VirtualBox's DHCP
+implementation.
+
+For further information or to report issues, please see the [Boot2Docker site](http://boot2docker.io)
 
 ## Login with PUTTY instead of using the CMD
 
-Docker Machine generates and uses the public/private key pair in your
-`%USERPROFILE%\.ssh` directory so to log in you need to use the private key from
-this same directory. The private key needs to be converted into the format PuTTY
-uses. You can do this with
+Boot2Docker generates and uses the public/private key pair in your `%USERPROFILE%\.ssh`
+directory so to log in you need to use the private key from this same directory.
+
+The private key needs to be converted into the format PuTTY uses.
+
+You can do this with
 [puttygen](http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html):
 
-1. Open `puttygen.exe` and load ("File"->"Load" menu) the private key from
+- Open `puttygen.exe` and load ("File"->"Load" menu) the private key from
   `%USERPROFILE%\.ssh\id_boot2docker`
-
-2. Click "Save Private Key".
-
-3.  Use the saved file to login with PuTTY using `docker@127.0.0.1:2022`.
+- then click: "Save Private Key".
+- Then use the saved file to login with PuTTY using `docker@127.0.0.1:2022`.
 
 ## Uninstallation
 

docs/misc/faq.md

@@ -33,7 +33,7 @@ Docker currently runs only on Linux, but you can use VirtualBox to run Docker in
 a virtual machine on your box, and get the best of both worlds. Check out the
 [*Mac OS X*](../installation/mac/#macosx) and [*Microsoft
 Windows*](../installation/windows/#windows) installation guides. The small Linux
-distribution Docker Machine can be run inside virtual machines on these two
+distribution boot2docker can be run inside virtual machines on these two
 operating systems.
 
 > **Note:** if you are using a remote Docker daemon, such as Boot2Docker, 

docs/project/coding-style.md

@@ -26,9 +26,6 @@ program code and documentation code.
 * Run `gofmt -s -w file.go` on each changed file before
   committing your changes. Most editors have plug-ins that do this automatically.
 
-* Run `golint` on each changed file before
-  committing your changes.
-
 * Update the documentation when creating or modifying features. 
 
 * Commits that fix or close an issue should reference them in the commit message

docs/project/set-up-dev-env.md

@@ -29,7 +29,7 @@ you continue working with your fork on this branch.
 
 ##  Clean your host of Docker artifacts
 
-Docker developers run the latest stable release of the Docker software (with Docker Machine if their machine is Mac OS X). They clean their local
+Docker developers run the latest stable release of the Docker software (with Boot2Docker if their machine is Mac OS X). They clean their local
 hosts of unnecessary Docker artifacts such as stopped containers or unused
 images. Cleaning unnecessary artifacts isn't strictly necessary, but it is
 good practice, so it is included here.

docs/project/set-up-git.md

@@ -57,8 +57,8 @@ target="_blank">docker/docker repository</a>.
 
         $ cd ~
         
-    In Windows, you'll work in your Docker Quickstart Terminal window instead of
-    Powershell or a `cmd` window.
+  In Windows, you'll work in your Boot2Docker window instead of Powershell or
+  a `cmd` window.
 
 6. Create a `repos` directory.
 

docs/project/test-and-docs.md

@@ -317,9 +317,9 @@ can browse the docs.
 
 4. Enter the URL in your browser.
 
-    If you are using Docker Machine, replace the default localhost address
+    If you are running Boot2Docker, replace the default localhost address
     (0.0.0.0) with your DOCKERHOST value. You can get this value at any time by
-    entering `docker-machine ip <machine-name>` at the command line.
+    entering `boot2docker ip` at the command line.
 
 5. Once in the documentation, look for the red notice to verify you are seeing the correct build.
 

docs/reference/api/docker_remote_api_v1.18.md

@@ -49,11 +49,6 @@ List containers
                      "Created": 1367854155,
                      "Status": "Exit 0",
                      "Ports": [{"PrivatePort": 2222, "PublicPort": 3333, "Type": "tcp"}],
-                     "Labels": {
-                             "com.example.vendor": "Acme",
-                             "com.example.license": "GPL",
-                             "com.example.version": "1.0"
-                     },
                      "SizeRw": 12288,
                      "SizeRootFs": 0
              },
@@ -65,7 +60,6 @@ List containers
                      "Created": 1367854155,
                      "Status": "Exit 0",
                      "Ports": [],
-                     "Labels": {},
                      "SizeRw": 12288,
                      "SizeRootFs": 0
              },
@@ -77,7 +71,6 @@ List containers
                      "Created": 1367854154,
                      "Status": "Exit 0",
                      "Ports":[],
-                     "Labels": {},
                      "SizeRw":12288,
                      "SizeRootFs":0
              },
@@ -89,7 +82,6 @@ List containers
                      "Created": 1367854152,
                      "Status": "Exit 0",
                      "Ports": [],
-                     "Labels": {},
                      "SizeRw": 12288,
                      "SizeRootFs": 0
              }

docs/reference/api/docker_remote_api_v1.19.md

@@ -51,11 +51,6 @@ List containers
                  "Created": 1367854155,
                  "Status": "Exit 0",
                  "Ports": [{"PrivatePort": 2222, "PublicPort": 3333, "Type": "tcp"}],
-                 "Labels": {
-                         "com.example.vendor": "Acme",
-                         "com.example.license": "GPL",
-                         "com.example.version": "1.0"
-                 },
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          },
@@ -67,7 +62,6 @@ List containers
                  "Created": 1367854155,
                  "Status": "Exit 0",
                  "Ports": [],
-                 "Labels": {},
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          },
@@ -79,7 +73,6 @@ List containers
                  "Created": 1367854154,
                  "Status": "Exit 0",
                  "Ports":[],
-                 "Labels": {},
                  "SizeRw":12288,
                  "SizeRootFs":0
          },
@@ -91,7 +84,6 @@ List containers
                  "Created": 1367854152,
                  "Status": "Exit 0",
                  "Ports": [],
-                 "Labels": {},
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          }

docs/reference/api/docker_remote_api_v1.20.md

@@ -51,11 +51,6 @@ List containers
                  "Created": 1367854155,
                  "Status": "Exit 0",
                  "Ports": [{"PrivatePort": 2222, "PublicPort": 3333, "Type": "tcp"}],
-                 "Labels": {
-                         "com.example.vendor": "Acme",
-                         "com.example.license": "GPL",
-                         "com.example.version": "1.0"
-                 },
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          },
@@ -67,7 +62,6 @@ List containers
                  "Created": 1367854155,
                  "Status": "Exit 0",
                  "Ports": [],
-                 "Labels": {},
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          },
@@ -79,7 +73,6 @@ List containers
                  "Created": 1367854154,
                  "Status": "Exit 0",
                  "Ports":[],
-                 "Labels": {},
                  "SizeRw":12288,
                  "SizeRootFs":0
          },
@@ -91,7 +84,6 @@ List containers
                  "Created": 1367854152,
                  "Status": "Exit 0",
                  "Ports": [],
-                 "Labels": {},
                  "SizeRw": 12288,
                  "SizeRootFs": 0
          }

docs/reference/commandline/cli.md

@@ -10,6 +10,10 @@ parent = "smn_cli"
 
 # Using the command line
 
+> **Note:** If you are using a remote Docker daemon, such as Boot2Docker,
+> then _do not_ type the `sudo` before the `docker` commands shown in the
+> documentation's examples.
+
 To list available commands, either run `docker` with no parameters
 or execute `docker help`:
 

docs/security/apparmor.md

@@ -20,6 +20,10 @@ The `docker-default` profile the default for running
 containers. It is moderately protective while
 providing wide application compatability.
 
+The `docker-unconfined` profile is intended for
+privileged applications and is the default when runing
+a container with the *--privileged* flag.
+
 The system's standard `unconfined` profile inherits all
 system-wide policies, applying path-based policies
 intended for the host system inside of containers.

docs/userguide/dockerimages.md

@@ -256,7 +256,7 @@ Let's create a directory and a `Dockerfile` first.
     $ cd sinatra
     $ touch Dockerfile
 
-If you are using Docker Machine on Windows, you may access your host
+If you are using Boot2Docker on Windows, you may access your host
 directory by `cd` to `/c/Users/your_user_name`.
 
 Each instruction creates a new layer of the image. Let's look at a simple

docs/userguide/dockerizing.md

@@ -15,10 +15,9 @@ parent = "smn_applied"
 Docker allows you to run applications inside containers. Running an
 application inside a container takes a single command: `docker run`.
 
->**Note**: Depending on your Docker system configuration, you may be required to
->preface each `docker` command on this page with `sudo`. To avoid this behavior,
->your system administrator can create a Unix group called `docker` and add users
->to it. 
+> **Note:** if you are using a remote Docker daemon, such as Boot2Docker, 
+> then _do not_ type the `sudo` before the `docker` commands shown in the
+> documentation's examples.
 
 ## Hello world
 

docs/userguide/dockervolumes.md

@@ -90,13 +90,13 @@ You will notice in the above 'Volumes' is specifying the location on the host an
 In addition to creating a volume using the `-v` flag you can also mount a
 directory from your Docker daemon's host into a container.
 
->**Note**: If you are using Docker Machine on Mac or Windows, your Docker daemon
->only has limited access to your OS X/Windows filesystem. Docker Machine tries
->to auto-share your `/Users` (OS X) or `C:\Users` (Windows) directory - and so
->you can mount files or directories using `docker run -v
->/Users/<path>:/<container path> ...` (OS X) or `docker run -v
->/c/Users/<path>:/<container path ...` (Windows). All other paths come from your
->virtual machine's filesystem.
+> **Note:**
+> If you are using Boot2Docker, your Docker daemon only has limited access to
+> your OS X/Windows filesystem. Boot2Docker tries to auto-share your `/Users`
+> (OS X) or `C:\Users` (Windows) directory - and so you can mount files or directories
+> using `docker run -v /Users/<path>:/<container path> ...` (OS X) or
+> `docker run -v /c/Users/<path>:/<container path ...` (Windows). All other paths
+> come from the Boot2Docker virtual machine's filesystem.
 
     $ docker run -d -P --name web -v /src/webapp:/opt/webapp training/webapp python app.py
 

graph/pull.go

@@ -61,7 +61,7 @@ func (s *TagStore) Pull(image string, tag string, imagePullConfig *ImagePullConf
 		return err
 	}
 
-	endpoints, err := s.registryService.LookupPullEndpoints(repoInfo.CanonicalName)
+	endpoints, err := s.registryService.LookupEndpoints(repoInfo.CanonicalName)
 	if err != nil {
 		return err
 	}

graph/pull_v2.go

@@ -1,7 +1,6 @@
 package graph
 
 import (
-	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -109,7 +108,6 @@ type downloadInfo struct {
 	layer   distribution.ReadSeekCloser
 	size    int64
 	err     chan error
-	out     io.Writer // Download progress is written here.
 }
 
 type errVerification struct{}
@@ -119,7 +117,7 @@ func (errVerification) Error() string { return "verification failed" }
 func (p *v2Puller) download(di *downloadInfo) {
 	logrus.Debugf("pulling blob %q to %s", di.digest, di.img.ID)
 
-	out := di.out
+	out := p.config.OutStream
 
 	if c, err := p.poolAdd("pull", "img:"+di.img.ID); err != nil {
 		if c != nil {
@@ -193,7 +191,7 @@ func (p *v2Puller) download(di *downloadInfo) {
 	di.err <- nil
 }
 
-func (p *v2Puller) pullV2Tag(tag, taggedName string) (verified bool, err error) {
+func (p *v2Puller) pullV2Tag(tag, taggedName string) (bool, error) {
 	logrus.Debugf("Pulling tag from V2 registry: %q", tag)
 	out := p.config.OutStream
 
@@ -206,7 +204,7 @@ func (p *v2Puller) pullV2Tag(tag, taggedName string) (verified bool, err error)
 	if err != nil {
 		return false, err
 	}
-	verified, err = p.validateManifest(manifest, tag)
+	verified, err := p.validateManifest(manifest, tag)
 	if err != nil {
 		return false, err
 	}
@@ -214,27 +212,6 @@ func (p *v2Puller) pullV2Tag(tag, taggedName string) (verified bool, err error)
 		logrus.Printf("Image manifest for %s has been verified", taggedName)
 	}
 
-	// By using a pipeWriter for each of the downloads to write their progress
-	// to, we can avoid an issue where this function returns an error but
-	// leaves behind running download goroutines. By splitting the writer
-	// with a pipe, we can close the pipe if there is any error, consequently
-	// causing each download to cancel due to an error writing to this pipe.
-	pipeReader, pipeWriter := io.Pipe()
-	go func() {
-		if _, err := io.Copy(out, pipeReader); err != nil {
-			logrus.Errorf("error copying from layer download progress reader: %s", err)
-		}
-	}()
-	defer func() {
-		if err != nil {
-			// All operations on the pipe are synchronous. This call will wait
-			// until all current readers/writers are done using the pipe then
-			// set the error. All successive reads/writes will return with this
-			// error.
-			pipeWriter.CloseWithError(errors.New("download canceled"))
-		}
-	}()
-
 	out.Write(p.sf.FormatStatus(tag, "Pulling from %s", p.repo.Name()))
 
 	downloads := make([]downloadInfo, len(manifest.FSLayers))
@@ -265,7 +242,6 @@ func (p *v2Puller) pullV2Tag(tag, taggedName string) (verified bool, err error)
 		out.Write(p.sf.FormatProgress(stringid.TruncateID(img.ID), "Pulling fs layer", nil))
 
 		downloads[i].err = make(chan error)
-		downloads[i].out = pipeWriter
 		go p.download(&downloads[i])
 	}
 

graph/push.go

@@ -60,7 +60,7 @@ func (s *TagStore) Push(localName string, imagePushConfig *ImagePushConfig) erro
 		return err
 	}
 
-	endpoints, err := s.registryService.LookupPushEndpoints(repoInfo.CanonicalName)
+	endpoints, err := s.registryService.LookupEndpoints(repoInfo.CanonicalName)
 	if err != nil {
 		return err
 	}

hack/install.sh

@@ -51,32 +51,6 @@ echo_docker_as_nonroot() {
 	EOF
 }
 
-# Check if this is a forked Linux distro
-check_forked() {
-	# Check for lsb_release command existence, it usually exists in forked distros
-	if command_exists lsb_release; then
-		# Check if the `-u` option is supported
-		lsb_release -a -u > /dev/null 2>&1
-
-		# Check if the command has exited successfully, it means we're in a forked distro
-		if [ "$?" = "0" ]; then
-			# Print info about current distro
-			cat <<-EOF
-			You're using '$lsb_dist' version '$dist_version'.
-			EOF
-
-			# Get the upstream release info
-			lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[[:space:]]')
-			dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[[:space:]]')
-
-			# Print info about upstream distro
-			cat <<-EOF
-			Upstream release is '$lsb_dist' version '$dist_version'.
-			EOF
-		fi
-	fi
-}
-
 do_install() {
 	case "$(uname -m)" in
 		*64)
@@ -213,11 +187,8 @@ do_install() {
 
 
 	esac
+		
 
-	# Check if this is a forked Linux distro
-	check_forked
-
-	# Run setup for each distro accordingly
 	case "$lsb_dist" in
 		amzn)
 			(

hack/make/.build-deb/docker-engine.install

@@ -9,3 +9,4 @@ contrib/init/systemd/docker.socket lib/systemd/system/
 contrib/mk* usr/share/docker-engine/contrib/
 contrib/nuke-graph-directory.sh usr/share/docker-engine/contrib/
 contrib/syntax/nano/Dockerfile.nanorc usr/share/nano/
+contrib/apparmor/* etc/apparmor.d/

hack/make/.build-deb/rules

@@ -32,5 +32,9 @@ override_dh_installudev:
 	# match our existing priority
 	dh_installudev --priority=z80
 
+override_dh_install:
+	dh_install
+	dh_apparmor --profile-name=docker-engine -pdocker-engine
+
 %:
 	dh $@ --with=bash-completion $(shell command -v dh_systemd_enable > /dev/null 2>&1 && echo --with=systemd)

hack/make/.integration-daemon-start

@@ -35,6 +35,8 @@ if [ -z "$DOCKER_TEST_HOST" ]; then
 		(
 			set -x
 			/etc/init.d/apparmor start
+
+			/sbin/apparmor_parser -r -W -T contrib/apparmor/
 		)
 	fi
 

hack/make/ubuntu

@@ -72,6 +72,10 @@ bundle_ubuntu() {
 		done
 	done
 
+	# Include contributed apparmor policy
+	mkdir -p "$DIR/etc/apparmor.d/"
+	cp contrib/apparmor/* "$DIR/etc/apparmor.d/"
+
 	# Copy the binary
 	# This will fail if the binary bundle hasn't been built
 	mkdir -p "$DIR/usr/bin"
@@ -89,6 +93,10 @@ if [ "$1" = 'configure' ] && [ -z "$2" ]; then
 	fi
 fi
 
+if ( aa-status --enabled ); then
+	/sbin/apparmor_parser -r -W -T /etc/apparmor.d/docker-engine
+fi
+
 if ! { [ -x /sbin/initctl ] && /sbin/initctl version 2>/dev/null | grep -q upstart; }; then
 	# we only need to do this if upstart isn't in charge
 	update-rc.d docker defaults > /dev/null || true

hack/vendor.sh

@@ -21,7 +21,7 @@ clone git golang.org/x/net 3cffabab72adf04f8e3b01c5baf775361837b5fe https://gith
 clone hg code.google.com/p/gosqlite 74691fb6f837
 
 #get libnetwork packages
-clone git github.com/docker/libnetwork bd3eecc96f3c05a4acef1bedcf74397bc6850d22
+clone git github.com/docker/libnetwork 78fc31ddc425fb379765c6b7ab5b96748bd8fc08
 clone git github.com/armon/go-metrics eb0af217e5e9747e41dd5303755356b62d28e3ec
 clone git github.com/hashicorp/go-msgpack 71c2886f5a673a35f909803f38ece5810165097b
 clone git github.com/hashicorp/memberlist 9a1e242e454d2443df330bdd51a436d5a9058fc4

integration-cli/docker_cli_by_digest_test.go

@@ -446,7 +446,7 @@ func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
 	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
 	out, exitStatus, _ := dockerCmdWithError(c, "pull", imageReference)
 	if exitStatus == 0 {
-		c.Fatalf("expected a non-zero exit status but got %d: %s", exitStatus, out)
+		c.Fatalf("expected a zero exit status but got %d: %s", exitStatus, out)
 	}
 
 	expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest)

integration-cli/docker_cli_create_test.go

@@ -345,7 +345,6 @@ func (s *DockerTrustSuite) TestTrustedIsolatedCreate(c *check.C) {
 }
 
 func (s *DockerTrustSuite) TestCreateWhenCertExpired(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := s.setupTrustedImage(c, "trusted-create-expired")
 
 	// Certificates have 10 years of expiration

integration-cli/docker_cli_pull_test.go

@@ -225,7 +225,6 @@ func (s *DockerTrustSuite) TestUntrustedPull(c *check.C) {
 }
 
 func (s *DockerTrustSuite) TestPullWhenCertExpired(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := s.setupTrustedImage(c, "trusted-cert-expired")
 
 	// Certificates have 10 years of expiration
@@ -332,7 +331,6 @@ func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {
 }
 
 func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := fmt.Sprintf("%v/dockercliexpiredtimestamppull/trusted:latest", privateRegistryURL)
 	// tag the image and upload it to the private registry
 	dockerCmd(c, "tag", "busybox", repoName)

integration-cli/docker_cli_push_test.go

@@ -287,7 +287,6 @@ func (s *DockerTrustSuite) TestTrustedPushWithIncorrectPassphraseForNonRoot(c *c
 }
 
 func (s *DockerTrustSuite) TestTrustedPushWithExpiredSnapshot(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := fmt.Sprintf("%v/dockercliexpiredsnapshot/trusted:latest", privateRegistryURL)
 	// tag the image and upload it to the private registry
 	dockerCmd(c, "tag", "busybox", repoName)
@@ -323,7 +322,6 @@ func (s *DockerTrustSuite) TestTrustedPushWithExpiredSnapshot(c *check.C) {
 }
 
 func (s *DockerTrustSuite) TestTrustedPushWithExpiredTimestamp(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := fmt.Sprintf("%v/dockercliexpiredtimestamppush/trusted:latest", privateRegistryURL)
 	// tag the image and upload it to the private registry
 	dockerCmd(c, "tag", "busybox", repoName)

integration-cli/docker_cli_run_test.go

@@ -2632,7 +2632,6 @@ func (s *DockerTrustSuite) TestUntrustedRun(c *check.C) {
 }
 
 func (s *DockerTrustSuite) TestRunWhenCertExpired(c *check.C) {
-	c.Skip("Currently changes system time, causing instability")
 	repoName := s.setupTrustedImage(c, "trusted-run-expired")
 
 	// Certificates have 10 years of expiration

man/docker.1.md

@@ -50,15 +50,9 @@ To see the man page for a command run **man docker <command>**.
 **--default-gateway-v6**=""
   IPv6 address of the container default gateway
 
-**--default-ulimit**=[]
-  Set default ulimits for containers.
-
 **--dns**=""
   Force Docker to use specific DNS servers
 
-**--dns-search**=[]
-  DNS search domains to use.
-
 **-e**, **--exec-driver**=""
   Force Docker to use specific exec driver. Default is `native`.
 
@@ -66,7 +60,7 @@ To see the man page for a command run **man docker <command>**.
   Set exec driver options. See EXEC DRIVER OPTIONS.
 
 **--exec-root**=""
-  Path to use as the root of the Docker exec driver. Default is `/var/run/docker`.
+  Path to use as the root of the Docker execdriver. Default is `/var/run/docker`.
 
 **--fixed-cidr**=""
   IPv4 subnet for fixed IPs (e.g., 10.20.0.0/16); this subnet must be nested in the bridge subnet (which is defined by \-b or \-\-bip)
@@ -89,9 +83,6 @@ unix://[/path/to/socket] to use.
 **--icc**=*true*|*false*
   Allow unrestricted inter\-container and Docker daemon host communication. If disabled, containers can still be linked together using **--link** option (see **docker-run(1)**). Default is true.
 
-**--insecure-registry**=[]
-  Enable insecure registry communication.
-
 **--ip**=""
   Default IP address to use when binding container ports. Default is `0.0.0.0`.
 
@@ -140,19 +131,10 @@ unix://[/path/to/socket] to use.
 **--storage-opt**=[]
   Set storage driver options. See STORAGE DRIVER OPTIONS.
 
-**--tls**=*true*|*false*
+**-tls**=*true*|*false*
   Use TLS; implied by --tlsverify. Default is false.
 
-**--tlscacert**=~/.docker/ca.pem
-  Trust certs signed only by this CA.
-
-**--tlscert**=~/.docker/cert.pem
-  Path to TLS certificate file.
-
-**--tlskey**=~/.docker/key.pem
-  Path to TLS key file.
-
-**--tlsverify**=*true*|*false*
+**-tlsverify**=*true*|*false*
   Use TLS and verify the remote (daemon: verify client, client: verify daemon).
   Default is false.
 
@@ -260,10 +242,6 @@ inside it)
   Push an image or a repository to a Docker Registry
   See **docker-push(1)** for full documentation on the **push** command.
 
-**rename**
-  Rename a container.
-  See **docker-rename(1)** for full documentation on the **rename** command.
-
 **restart**
   Restart a running container
   See **docker-restart(1)** for full documentation on the **restart** command.
@@ -433,7 +411,7 @@ Example use: `docker -d --storage-opt dm.loopdatasize=200G`
 **Note**: This option configures devicemapper loopback, which should not be used in production.
 
 Specifies the size to use when creating the loopback file for the
-"metadata" device which is used for the thin pool. The default size
+"metadadata" device which is used for the thin pool. The default size
 is 2G. The file is sparse, so it will not initially take up
 this much space.
 
@@ -495,7 +473,7 @@ When `udev` sync support is `true`, then `devicemapper` and `udev` can
 coordinate the activation and deactivation of devices for containers.
 
 When `udev` sync support is `false`, a race condition occurs between
-the `devicemapper` and `udev` during create and cleanup. The race
+the`devicemapper` and `udev` during create and cleanup. The race
 condition results in errors and failures. (For information on these
 failures, see
 [docker#4036](https://github.com/docker/docker/issues/4036))

registry/service.go

@@ -108,40 +108,27 @@ func (s *Service) tlsConfigForMirror(mirror string) (*tls.Config, error) {
 	return s.TLSConfig(mirrorURL.Host)
 }
 
-// LookupPullEndpoints creates an list of endpoints to try to pull from, in order of preference.
+// LookupEndpoints creates an list of endpoints to try, in order of preference.
 // It gives preference to v2 endpoints over v1, mirrors over the actual
 // registry, and HTTPS over plain HTTP.
-func (s *Service) LookupPullEndpoints(repoName string) (endpoints []APIEndpoint, err error) {
-	return s.lookupEndpoints(repoName, false)
-}
-
-// LookupPushEndpoints creates an list of endpoints to try to push to, in order of preference.
-// It gives preference to v2 endpoints over v1, and HTTPS over plain HTTP.
-// Mirrors are not included.
-func (s *Service) LookupPushEndpoints(repoName string) (endpoints []APIEndpoint, err error) {
-	return s.lookupEndpoints(repoName, true)
-}
-
-func (s *Service) lookupEndpoints(repoName string, isPush bool) (endpoints []APIEndpoint, err error) {
+func (s *Service) LookupEndpoints(repoName string) (endpoints []APIEndpoint, err error) {
 	var cfg = tlsconfig.ServerDefault
 	tlsConfig := &cfg
 	if strings.HasPrefix(repoName, DefaultNamespace+"/") {
-		if !isPush {
-			// v2 mirrors for pull only
-			for _, mirror := range s.Config.Mirrors {
-				mirrorTLSConfig, err := s.tlsConfigForMirror(mirror)
-				if err != nil {
-					return nil, err
-				}
-				endpoints = append(endpoints, APIEndpoint{
-					URL: mirror,
-					// guess mirrors are v2
-					Version:      APIVersion2,
-					Mirror:       true,
-					TrimHostname: true,
-					TLSConfig:    mirrorTLSConfig,
-				})
+		// v2 mirrors
+		for _, mirror := range s.Config.Mirrors {
+			mirrorTLSConfig, err := s.tlsConfigForMirror(mirror)
+			if err != nil {
+				return nil, err
 			}
+			endpoints = append(endpoints, APIEndpoint{
+				URL: mirror,
+				// guess mirrors are v2
+				Version:      APIVersion2,
+				Mirror:       true,
+				TrimHostname: true,
+				TLSConfig:    mirrorTLSConfig,
+			})
 		}
 		// v2 registry
 		endpoints = append(endpoints, APIEndpoint{

vendor/src/github.com/docker/libnetwork/endpoint.go

@@ -415,8 +415,7 @@ func (ep *endpoint) Join(containerID string, options ...EndpointOption) error {
 	}
 	defer func() {
 		if err != nil {
-			// Do not alter global err variable, it's needed by the previous defer
-			if err := driver.Leave(nid, epid); err != nil {
+			if err = driver.Leave(nid, epid); err != nil {
 				log.Warnf("driver leave failed while rolling back join: %v", err)
 			}
 		}