Tonis Tiigi
acaf251f0b
Extend the built-in policy to validate signed moby/buildkit release and floating tags before docker-container builders are created. Pull the image first, inspect it through Docker, and bind verification to the descriptor digest. Resolve signature attestations through the BuildKit API embedded in the Docker daemon. If pulling fails, use a local image while applying the same verification when the containerd image store exposes an immutable descriptor. Keep the classic image-store behavior unchanged because no descriptor is available. Allow unmanaged repositories and digest-only references unchanged. Add the allow-untrusted-image driver option as an explicit verification bypass. Document the behavior and add policy, digest-pinning, and local fallback coverage. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
136 lines
3.0 KiB
Go
136 lines
3.0 KiB
Go
package docker
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/docker/buildx/driver"
|
|
dockeropts "github.com/docker/cli/opts"
|
|
dockerclient "github.com/moby/moby/client"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
const prioritySupported = 30
|
|
const priorityUnsupported = 70
|
|
const defaultRestartPolicy = "unless-stopped"
|
|
|
|
func init() {
|
|
driver.Register(&factory{})
|
|
}
|
|
|
|
type factory struct {
|
|
}
|
|
|
|
func (*factory) Name() string {
|
|
return "docker-container"
|
|
}
|
|
|
|
func (*factory) Usage() string {
|
|
return "docker-container"
|
|
}
|
|
|
|
func (*factory) Priority(ctx context.Context, endpoint string, api dockerclient.APIClient, dialMeta map[string][]string) int {
|
|
if api == nil {
|
|
return priorityUnsupported
|
|
}
|
|
return prioritySupported
|
|
}
|
|
|
|
func (f *factory) New(ctx context.Context, cfg driver.InitConfig) (driver.Driver, error) {
|
|
if cfg.DockerAPI == nil {
|
|
return nil, errors.Errorf("%s driver requires docker API access", f.Name())
|
|
}
|
|
rp, err := dockeropts.ParseRestartPolicy(defaultRestartPolicy)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
d := &Driver{
|
|
factory: f,
|
|
InitConfig: cfg,
|
|
restartPolicy: rp,
|
|
writeProvenanceGHA: true,
|
|
}
|
|
var gpus dockeropts.GpuOpts
|
|
if err := gpus.Set("all"); err == nil {
|
|
if v := gpus.Value(); len(v) > 0 {
|
|
d.gpus = v
|
|
}
|
|
}
|
|
for k, v := range cfg.DriverOpts {
|
|
switch {
|
|
case k == "network":
|
|
d.netMode = v
|
|
case k == "image":
|
|
d.image = v
|
|
case k == "memory":
|
|
if err := d.memory.Set(v); err != nil {
|
|
return nil, err
|
|
}
|
|
case k == "memory-swap":
|
|
if err := d.memorySwap.Set(v); err != nil {
|
|
return nil, err
|
|
}
|
|
case k == "cpu-period":
|
|
vv, err := strconv.ParseInt(v, 10, 0)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
d.cpuPeriod = vv
|
|
case k == "cpu-quota":
|
|
vv, err := strconv.ParseInt(v, 10, 0)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
d.cpuQuota = vv
|
|
case k == "cpu-shares":
|
|
vv, err := strconv.ParseInt(v, 10, 0)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
d.cpuShares = vv
|
|
case k == "cpuset-cpus":
|
|
d.cpusetCpus = v
|
|
case k == "cpuset-mems":
|
|
d.cpusetMems = v
|
|
case k == "cgroup-parent":
|
|
d.cgroupParent = v
|
|
case k == "restart-policy":
|
|
d.restartPolicy, err = dockeropts.ParseRestartPolicy(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
case k == "default-load":
|
|
d.defaultLoad, err = strconv.ParseBool(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
case strings.HasPrefix(k, "env."):
|
|
envName := strings.TrimPrefix(k, "env.")
|
|
if envName == "" {
|
|
return nil, errors.Errorf("invalid env option %q, expecting env.FOO=bar", k)
|
|
}
|
|
d.env = append(d.env, fmt.Sprintf("%s=%s", envName, v))
|
|
case k == "provenance-add-gha":
|
|
d.writeProvenanceGHA, err = strconv.ParseBool(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
case k == "allow-untrusted-image":
|
|
d.allowUntrustedImage, err = strconv.ParseBool(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
default:
|
|
return nil, errors.Errorf("invalid driver option %s for docker-container driver", k)
|
|
}
|
|
}
|
|
|
|
return d, nil
|
|
}
|
|
|
|
func (f *factory) AllowsInstances() bool {
|
|
return true
|
|
}
|