Browse Source
dockerd: Updated to 20.10.0
* SELinux and Seccomp are now enabled via the kernel options themselves * Config.in now uses CGroupsV2 by default but optionally allows V1 Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>lilik-openwrt-22.03
Gerard Ryan
4 years ago
committed by
Daniel Golle
Daniel Golle
4 changed files with 95 additions and 178 deletions
Split View
Diff Options
-
+28 -49utils/dockerd/Config.in
-
+58 -62utils/dockerd/Makefile
-
+9 -9utils/dockerd/patches/001-libdevmapper_name_fix.patch
-
+0 -58utils/dockerd/patches/002-imporve-hardcoded-CC-on-cross-compile.patch
+ 28
- 49
utils/dockerd/Config.in
View File
| @ -1,95 +1,74 @@ | |||
| config DOCKER_KERNEL_OPTIONS | |||
| bool "Enable Basic kernel support for Docker" | |||
| depends on PACKAGE_docker-ce | |||
| default y | |||
| select KERNEL_CGROUPS | |||
| select KERNEL_CGROUP_CPUACCT | |||
| select KERNEL_CGROUP_DEVICE | |||
| select KERNEL_CGROUP_FREEZER | |||
| select KERNEL_CGROUP_SCHED | |||
| select KERNEL_NAMESPACES | |||
| select KERNEL_CPUSETS | |||
| select KERNEL_MEMCG | |||
| select KERNEL_KEYS | |||
| select KERNEL_POSIX_MQUEUE | |||
| help | |||
| Select needed kernel options for Docker. Options include | |||
| cgroups, namespaces and other miscellaneous options. | |||
| see also https://github.com/docker/engine/blob/master/contrib/check-config.sh | |||
| # These options are mostly specified by https://github.com/moby/moby/blob/master/contrib/check-config.sh | |||
| config DOCKER_SECCOMP | |||
| bool "Enable support for seccomp in Docker" | |||
| depends on PACKAGE_docker-ce | |||
| config DOCKER_CGROUP_OPTIONS | |||
| bool "Enable available kernel support for CGroupsV1" | |||
| default n | |||
| select KERNEL_SECCOMP | |||
| select PACKAGE_libseccomp | |||
| depends on PACKAGE_dockerd | |||
| select KERNEL_CGROUP_DEVICE | |||
| select KERNEL_CGROUP_FREEZER | |||
| select KERNEL_NET_CLS_CGROUP | |||
| select KERNEL_CGROUP_NET_PRIO | |||
| select PACKAGE_cgroupfs-mount | |||
| help | |||
| Build Docker with support for seccomp filters. | |||
| Select libseccomp which also pulls-in the needed kernel features. | |||
| Selects kernel options to enable CGroups V1. | |||
| config DOCKER_RES_SHAPE | |||
| bool "Enables support for resource shaping" | |||
| depends on PACKAGE_docker-ce | |||
| config DOCKER_OPTIONAL_FEATURES | |||
| bool "Enable optional kernel support for Docker" | |||
| default n | |||
| select KERNEL_MEMCG_SWAP | |||
| depends on PACKAGE_dockerd | |||
| select KERNEL_MEMCG_SWAP_ENABLED | |||
| select KERNEL_BLK_DEV_THROTTLING | |||
| select KERNEL_CFQ_GROUP_IOSCHED | |||
| select KERNEL_CGROUP_PERF | |||
| select KERNEL_CGROUP_HUGETLB | |||
| select KERNEL_FAIR_GROUP_SCHED | |||
| select KERNEL_NET_CLS_CGROUP | |||
| select KERNEL_CGROUP_NET_CLASSID | |||
| select KERNEL_CGROUP_NET_PRIO | |||
| select KERNEL_CFS_BANDWIDTH | |||
| select KERNEL_RT_GROUP_SCHED | |||
| help | |||
| Select 'Optional Features' kernel options for Docker that are unselected. | |||
| See https://github.com/moby/moby/blob/master/contrib/check-config.sh | |||
| menu "Network" | |||
| depends on PACKAGE_docker-ce | |||
| depends on PACKAGE_dockerd | |||
| config DOCKER_NET_OVERLAY | |||
| bool "Enables the Overlay network feature" | |||
| bool "Includes the Overlay network feature" | |||
| default n | |||
| select PACKAGE_kmod-udptunnel4 | |||
| select PACKAGE_kmod-vxlan | |||
| help | |||
| Selects kernel options for the Overlay network feature. | |||
| Includes udptunnel4 | |||
| Selects kmod-vxlan for the Overlay network feature. | |||
| config DOCKER_NET_ENCRYPT | |||
| bool "Enable encrypted networking kernel support" | |||
| bool "Includes encrypted networking kernel modules" | |||
| depends on DOCKER_NET_OVERLAY | |||
| default n | |||
| select PACKAGE_kmod-ipsec | |||
| select PACKAGE_kmod-ipsec4 | |||
| select PACKAGE_kmod-crypto-gcm | |||
| select PACKAGE_kmod-crypto-seqiv | |||
| select PACKAGE_kmod-crypto-ghash | |||
| select PACKAGE_kmod-ipsec | |||
| help | |||
| Select needed kernel options for encrypted networking support. | |||
| Select needed kernel modules for encrypted networking support. | |||
| config DOCKER_NET_MACVLAN | |||
| bool "Enables macvlan kernel support" | |||
| bool "Includes macvlan kernel modules" | |||
| default n | |||
| select PACKAGE_kmod-macvlan | |||
| select PACKAGE_kmod-dummy | |||
| config DOCKER_NET_TFTP | |||
| bool "Enable ftp/tftp client kernel support" | |||
| bool "Includes ftp/tftp client kernel modules" | |||
| default n | |||
| select PACKAGE_kmod-nf-nathelper | |||
| select PACKAGE_kmod-nf-nathelper-extra | |||
| endmenu | |||
| menu "Storage" | |||
| depends on PACKAGE_docker-ce | |||
| depends on PACKAGE_dockerd | |||
| config DOCKER_STO_EXT4 | |||
| bool "Enables support for ext3 or ext4 as the backing filesystem" | |||
| default n | |||
| select KERNEL_EXT4_FS_POSIX_ACL | |||
| select KERNEL_EXT4_FS_SECURITY | |||
| config DOCKER_STO_BTRFS | |||
| bool "Enables support for btrfs as the backing filesystem" | |||
| default n | |||
| select PACKAGE_kmod-fs-btrfs | |||
| select KERNEL_BTRFS_FS_POSIX_ACL | |||
| endmenu | |||
+ 58
- 62
utils/dockerd/Makefile
View File
+ 9
- 9
utils/dockerd/patches/001-libdevmapper_name_fix.patch
View File
| @ -1,13 +1,13 @@ | |||
| Index: docker-ce-18.09.0/components/engine/hack/make.sh | |||
| Index: docker-ce-20.10.0/hack/make.sh | |||
| =================================================================== | |||
| --- docker-ce-18.09.0.orig/components/engine/hack/make.sh | |||
| +++ docker-ce-18.09.0/components/engine/hack/make.sh | |||
| @@ -129,7 +129,7 @@ fi | |||
| --- docker-ce-20.10.0.orig/hack/make.sh | |||
| +++ docker-ce-20.10.0/hack/make.sh | |||
| @@ -95,7 +95,7 @@ fi | |||
| # with a newer libdevmapper than the one it was built with. | |||
| if \ | |||
| if | |||
| command -v gcc &> /dev/null \ | |||
| - && ! ( echo -e '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }'| gcc -xc - -o /dev/null $(pkg-config --libs devmapper) &> /dev/null ) \ | |||
| + && ! ( echo -e '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }'| gcc -xc - -o /dev/null $(pkg-config --libs libdevmapper) &> /dev/null ) \ | |||
| ; then | |||
| - && ! (echo -e '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }' | gcc -xc - -o /dev/null $(pkg-config --libs devmapper) &> /dev/null) \ | |||
| + && ! (echo -e '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }' | gcc -xc - -o /dev/null $(pkg-config --libs libdevmapper) &> /dev/null) \ | |||
| ; | |||
| then | |||
| add_buildtag libdm dlsym_deferred_remove | |||
| fi | |||
+ 0
- 58
utils/dockerd/patches/002-imporve-hardcoded-CC-on-cross-compile.patch
View File
| @ -1,58 +0,0 @@ | |||
| From 2fdfb4404ab811cb00227a3de111437b829e55cf Mon Sep 17 00:00:00 2001 | |||
| From: Hongxu Jia <hongxu.jia@windriver.com> | |||
| Date: Wed, 17 Jul 2019 17:34:04 +0800 | |||
| Subject: [PATCH] imporve hardcoded CC on cross compile | |||
| Since commit applied in moby [61a3285 Support cross-compile for arm] | |||
| it hardcoded var-CC to support cross-compile for arm | |||
| Correct it with "${parameter:-word}" format, it is helpful for user | |||
| define toolchains | |||
| (Use Default Values. If parameter is unset or null, the expansion of | |||
| word is substituted. Otherwise, the value of parameter is substituted.) | |||
| Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> | |||
| Upstream-commit: 3c701e4db1b8646c2324ae524b4e7ca1b1147a07 | |||
| Component: engine | |||
| --- | |||
| components/engine/hack/make/.binary | 10 +++++----- | |||
| 1 file changed, 5 insertions(+), 5 deletions(-) | |||
| diff --git a/components/engine/hack/make/.binary b/components/engine/hack/make/.binary | |||
| index 53de6749e5..66f4ca05f3 100644 | |||
| --- a/components/engine/hack/make/.binary | |||
| +++ b/components/engine/hack/make/.binary | |||
| @@ -44,27 +44,27 @@ if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARC | |||
| # must be cross-compiling! | |||
| case "$(go env GOOS)/$(go env GOARCH)" in | |||
| windows/amd64) | |||
| - export CC=x86_64-w64-mingw32-gcc | |||
| + export CC="${CC:-x86_64-w64-mingw32-gcc}" | |||
| export CGO_ENABLED=1 | |||
| ;; | |||
| linux/arm) | |||
| case "${GOARM}" in | |||
| 5|"") | |||
| - export CC=arm-linux-gnueabi-gcc | |||
| + export CC="${CC:-arm-linux-gnueabi-gcc}" | |||
| export CGO_ENABLED=1 | |||
| ;; | |||
| 7) | |||
| - export CC=arm-linux-gnueabihf-gcc | |||
| + export CC="${CC:-arm-linux-gnueabihf-gcc}" | |||
| export CGO_ENABLED=1 | |||
| ;; | |||
| esac | |||
| ;; | |||
| linux/arm64) | |||
| - export CC=aarch64-linux-gnu-gcc | |||
| + export CC="${CC:-aarch64-linux-gnu-gcc}" | |||
| export CGO_ENABLED=1 | |||
| ;; | |||
| linux/amd64) | |||
| - export CC=x86_64-linux-gnu-gcc | |||
| + export CC="${CC:-x86_64-linux-gnu-gcc}" | |||
| export CGO_ENABLED=1 | |||
| ;; | |||
| esac | |||