For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname.
The current code used the client's `addr` as hostname in some cases, which
could contain the path for the unix-socket (`/var/run/docker.sock`), which
gets rejected by go1.20.6 and go1.19.11 because of a security fix for
[CVE-2023-29406 ][1], which was implemented in https://go.dev/issue/60374.
Prior versions go Go would clean the host header, and strip slashes in the
process, but go1.20.6 and go1.19.11 no longer do, and reject the host
header.
This patch introduces a `DummyHost` const, and uses this dummy host for
cases where we don't need an actual hostname.
Signed-off-by: jingxiaolu <lujingxiao@huawei.com>
(cherry picked from commit eedae47681500c0f38752cd3c0bf3d08d7b3c7fc)
fix #I6EOOP
docker pause/unpause with parallel docker exec can lead to freezing
state, set freezer.state to Thawed to increase freeze chances
(cherry picked from commit 6b695c68f87ef189c79797e95698ced4bf669f9d)
If image pull fails of context canceled, image layer will perform a
rollback operation. When image layer is released, the diff folder of layer
will be removed first, and then the digest folder will be removed.
If the diff folder fails to be removed, such as operation not permitted or
interrupted by others, both the digest folder and diff folder will remain
on the disk, this will cause image not be complete and not repairable.
So we should remove the digest folder first for image layers rollback
and ensure image can be re-pulled completely.
(cherry picked from commit 219f49ee216459dc50dcbddaade9828ad7fa31fb)
reason: update seccomp whitelist to Linux 5.10 syscall list to meet the
requirement that user uses image with new glibc version.
Signed-off-by: xiadanni <xiadanni1@huawei.com>
(cherry picked from commit ff5aa8ab6ec06b5101ef5787ca6f10e3f66c4a0f)
