Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Raj Chaudhuri
|
e42bc298a4 | ||
|
Raj Chaudhuri
|
78f596fbda | ||
|
Raj Chaudhuri
|
c3cc2107c6 | ||
|
Raj Chaudhuri
|
ac180cfc10 | ||
|
Raj Chaudhuri
|
ff91a56fc4 |
No files matched your search
@@ -1,3 +1,19 @@
|
||||
## Release 2.8.6
|
||||
|
||||
From this release onwards, the Docker V2 Plugin will be published for all supported architectures. It will be named using the pattern `rajchaudhuri/net-plugin:<version>-<arch>`. The latest version will also be published as `rajchaudhuri/net-plugin:latest_release-<arch>`. Supported architectures are `amd64`,`arm`,`arm64`,`ppc64le` and `s390x`. It can be installed on a Swarm-mode-enabled Docker host as follows:
|
||||
|
||||
```bash
|
||||
ARCH=$(docker version -f '{{.Server.Arch}}')
|
||||
docker plugin install rajchaudhuri/net-plugin:latest_release-$ARCH
|
||||
```
|
||||
|
||||
## Release 2.8.5
|
||||
|
||||
This release has upgraded dependencies based on CVE recommendations.
|
||||
|
||||
* Build with Go version 1.21.9
|
||||
* A dependency has been updated
|
||||
|
||||
## Release 2.8.4
|
||||
|
||||
The alpine base image used by `weave-kube` and `weave-npc` was upgraded to version 3.19.1 in the previous release. In this version, the default iptables backend is nftables, and the legacy backend is not included. Our scripts and programs assume legacy as the default backend, and change to nft if autodetected, or if we ask for it. So, the build Dockerfile (reweave/build/Dockerfile) was changed to also install the Alpine `iptables-legacy` package , and change the `iptables-{save,restore}` symbolic links to point to the legacy backend by default.
|
||||
|
||||
@@ -14,10 +14,10 @@ The history of the ReWeave effort can be found in [HISTORY.md](HISTORY.md).
|
||||
On a newly created Kubernetes cluster, the Weave Net CNI pluging can be installed by running the following command:
|
||||
|
||||
```
|
||||
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.28/net.yaml
|
||||
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.29/net.yaml
|
||||
```
|
||||
|
||||
Replace `v1.28` with the version on Kubernetes on your cluster.
|
||||
Replace `v1.29` with the version on Kubernetes on your cluster.
|
||||
|
||||
That endpoint is provided by the companion project [weave-endpoint](https://github.com/rajch/weave-endpoint).
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ require (
|
||||
github.com/containernetworking/cni v1.1.2
|
||||
github.com/containernetworking/plugins v1.2.0
|
||||
github.com/coreos/go-iptables v0.6.0
|
||||
github.com/docker/docker v24.0.7+incompatible
|
||||
github.com/docker/docker v24.0.9+incompatible
|
||||
github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b
|
||||
github.com/docker/machine v0.14.0
|
||||
github.com/fsouza/go-dockerclient v1.10.0
|
||||
|
||||
@@ -85,8 +85,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/docker/distribution v2.8.2-beta.1+incompatible h1:gILO60VLD2v28ozemv4aAwDb8ds5U2O/vD/sBXbd7Rw=
|
||||
github.com/docker/distribution v2.8.2-beta.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
|
||||
github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
|
||||
github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0=
|
||||
github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
|
||||
github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
|
||||
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
|
||||
|
||||
@@ -97,6 +97,14 @@
|
||||
"value"
|
||||
],
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"description": "Whether to use the version check feature of Weave Net",
|
||||
"name": "CHECKPOINT_DISABLE",
|
||||
"settable": [
|
||||
"value"
|
||||
],
|
||||
"value": "1"
|
||||
}
|
||||
],
|
||||
"network": {
|
||||
|
||||
+35
-1
@@ -2,7 +2,40 @@
|
||||
|
||||
All changes made to the weave net codebase during the reweave effort will be documented in this file.
|
||||
|
||||
## 2.8.4
|
||||
## 2.8.6
|
||||
|
||||
### Changed
|
||||
|
||||
* Changed version in `reweave/Makefile` to 2.8.6
|
||||
* Modified reweave and main CHANGELOG.md
|
||||
* Modified `reweave/Makefile` to ensure that `make build-plugin` builds the plugin only for the host architecture
|
||||
* Made some documentation changes
|
||||
|
||||
## 2.8.6-beta1
|
||||
|
||||
### Changed
|
||||
|
||||
* Changed the V2 plugin build and clean tools to build (and clean) multiple architecture-specific plugins per version, since Docker Managed Plugins are not multi-architecture capable
|
||||
* Changed the V2 plugin configuration `prog/net-plugin/config.json` to include `CHECKPOINT_DISABLE` as an option, set to `1` by default to disable latest version checking.
|
||||
* Changed the `weave` script to include `export CHECKPOINT_DISABLE=`. This will disable latest version checking for the legacy plugin as well.
|
||||
* Changed the documentation in the `website` directory as appropriate.
|
||||
|
||||
## 2.8.5
|
||||
|
||||
### Changed
|
||||
|
||||
* Changed version in `reweave/Makefile` to 2.8.5
|
||||
* Modified reweave and main CHANGELOG.md
|
||||
|
||||
## 2.8.5-beta1 (ac180cfc)
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded github.com/docker/docker to 24.0.9+incompatible
|
||||
* Ran `go mod vendor`
|
||||
* Modified `reweave/build/Dockerfile`, to cater for timeouts and other errors during `apt` operations
|
||||
|
||||
## 2.8.4 (c3afe552)
|
||||
|
||||
### Changed
|
||||
|
||||
@@ -224,6 +257,7 @@ A new build process was created here.
|
||||
* Multi-stage Dockerfile, and a Makefile for the second stage, in `reweave/build`
|
||||
|
||||
### Changed
|
||||
|
||||
* Included image building targets in Makefile directly under `reweave`
|
||||
* Changed `IMAGE_VERSION` to `2.8.2-beta0` in Makefile directly under `reweave`
|
||||
* The Alpine base image for all weave net images was set to `alpine:3.17.2` via the multi-stage Dockerfile
|
||||
|
||||
+2
-1
@@ -1,4 +1,4 @@
|
||||
IMAGE_VERSION ?= 2.8.4
|
||||
IMAGE_VERSION ?= 2.8.6
|
||||
REGISTRY_USER ?= rajchaudhuri
|
||||
|
||||
ALPINE_BASEIMAGE ?= alpine:3.19.1
|
||||
@@ -15,6 +15,7 @@ build-images: submodule
|
||||
.PHONY: build-plugin
|
||||
build-plugin: ../prog/net-plugin/launch.sh ../prog/net-plugin/config.json
|
||||
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
|
||||
PLATFORMS="$$(docker version -f '{{ .Server.Arch }}')" \
|
||||
tools/build-plugin.sh
|
||||
|
||||
.PHONY: build
|
||||
|
||||
@@ -7,7 +7,7 @@ ARG ALPINE_BASEIMAGE=alpine:3.19.1
|
||||
# It will be built only once for a given build platform. Subsequent
|
||||
# stages will start from this and cross-compile for each target
|
||||
# architecture.
|
||||
FROM --platform=${BUILDPLATFORM} golang:1.21.6-bullseye AS builderbase
|
||||
FROM --platform=${BUILDPLATFORM} golang:1.21.9-bullseye AS builderbase
|
||||
|
||||
# Support Raspberry Pi 2 and newer
|
||||
ENV GOARM 7
|
||||
@@ -23,8 +23,10 @@ ENV DEB_CROSSPLATFORMS \
|
||||
|
||||
# Install the build-essential and crossbuild-essential-ARCH packages
|
||||
RUN <<EOCROSSCOMPILERS
|
||||
set -e
|
||||
echo 'Acquire::Retries "6";' > /etc/apt/apt.conf.d/80-retries
|
||||
for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done
|
||||
apt-get update
|
||||
apt-get update
|
||||
apt-get install -y build-essential
|
||||
for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done
|
||||
apt-get clean
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "19", "color": "orange"}
|
||||
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "18", "color": "orange"}
|
||||
+77
-85
@@ -1,9 +1,9 @@
|
||||
# Vulnerability Report
|
||||
|
||||
```
|
||||
Report date: 2024-03-20
|
||||
Unique vulnerability count: 19
|
||||
Images version: 2.8.4
|
||||
Report date: 2024-04-10
|
||||
Unique vulnerability count: 18
|
||||
Images version: 2.8.6
|
||||
```
|
||||
|
||||
## Scanner Details
|
||||
@@ -23,101 +23,93 @@ Supported DB Schema: 5
|
||||
|
||||
## Vulnerabilities
|
||||
|
||||
### weave-kube: (19)
|
||||
### weave-kube: (18)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
```
|
||||
|
||||
### weave-npc: (17)
|
||||
### weave-npc: (12)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
```
|
||||
|
||||
### weave: (19)
|
||||
### weave: (18)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
```
|
||||
|
||||
### weaveexec: (19)
|
||||
### weaveexec: (18)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
|
||||
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
```
|
||||
|
||||
@@ -6,33 +6,79 @@ set -e
|
||||
: "${IMAGE_VERSION:=}"
|
||||
: "${REGISTRY_USER:=}"
|
||||
|
||||
# This variable is used to flag plugin publishing
|
||||
: "${PUBLISH:=}"
|
||||
|
||||
if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then
|
||||
>&2 echo "Please provide valid values for IMAGE_VERSION and REGISTRY_USER."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# To build the plugin for multiple architecture, the
|
||||
# local Docker engine needs to have the containerd
|
||||
# snapshotter enabled.
|
||||
if [ "overlayfs" != "$(docker info -f '{{.Driver}}')" ]; then
|
||||
echo "To ensure that the plugin can be built for multiple architectures, the"
|
||||
echo "Docker Engine needs to have the containerd image store feature enabled."
|
||||
echo "Please see https://docs.docker.com/storage/containerd/ to find out how."
|
||||
echo "Run this build again after enabling it."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
# This variable is used to control the architectures for
|
||||
# which the plugin will be built.
|
||||
: "${PLATFORMS:=amd64,arm,arm64,ppc64le,s390x}"
|
||||
|
||||
# This variable is used to flag plugin publishing
|
||||
: "${PUBLISH:=}"
|
||||
|
||||
WEAVER_IMAGE=${REGISTRY_USER}/weave:${IMAGE_VERSION}
|
||||
PLUGIN_IMAGE=${REGISTRY_USER}/net-plugin:${IMAGE_VERSION}
|
||||
PLUGIN_BUILD_IMG="plugin-builder"
|
||||
PLUGIN_PARENT_DIR="../prog/net-plugin"
|
||||
PLUGIN_WORK_DIR="${PLUGIN_PARENT_DIR}/rootfs"
|
||||
|
||||
docker container rm -f ${PLUGIN_BUILD_IMG} 2>/dev/null
|
||||
docker container create --name=${PLUGIN_BUILD_IMG} "${WEAVER_IMAGE}" true
|
||||
rm -rf ${PLUGIN_WORK_DIR}
|
||||
mkdir ${PLUGIN_WORK_DIR}
|
||||
docker export ${PLUGIN_BUILD_IMG} | tar -x -C ${PLUGIN_WORK_DIR}
|
||||
docker container rm -f ${PLUGIN_BUILD_IMG}
|
||||
cp "${PLUGIN_PARENT_DIR}/launch.sh" "${PLUGIN_WORK_DIR}/home/weave/launch.sh"
|
||||
set +e
|
||||
docker plugin disable "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
docker plugin rm "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
set -e
|
||||
docker plugin create "${PLUGIN_IMAGE}" "${PLUGIN_PARENT_DIR}"
|
||||
# $1 - Architecture to build for
|
||||
build_plugin() {
|
||||
PLUGIN_ARCH=${1:-amd64}
|
||||
PLUGIN_IMAGE=${REGISTRY_USER}/net-plugin:${IMAGE_VERSION}-${PLUGIN_ARCH}
|
||||
PLUGIN_BUILD_IMG="plugin-builder-${PLUGIN_ARCH}"
|
||||
PLUGIN_PARENT_DIR="../prog/net-plugin"
|
||||
PLUGIN_WORK_DIR="${PLUGIN_PARENT_DIR}/rootfs"
|
||||
|
||||
if [ "${PUBLISH}" = "true" ]; then
|
||||
docker plugin push "${PLUGIN_IMAGE}"
|
||||
fi
|
||||
echo "Building ${PLUGIN_IMAGE}..."
|
||||
|
||||
docker container rm -f "${PLUGIN_BUILD_IMG}" 2>/dev/null
|
||||
docker container create --platform="${PLUGIN_ARCH}" --name="${PLUGIN_BUILD_IMG}" "${WEAVER_IMAGE}" true
|
||||
rm -rf ${PLUGIN_WORK_DIR}
|
||||
mkdir ${PLUGIN_WORK_DIR}
|
||||
docker export "${PLUGIN_BUILD_IMG}" | tar -x -C ${PLUGIN_WORK_DIR}
|
||||
docker container rm -f "${PLUGIN_BUILD_IMG}"
|
||||
cp "${PLUGIN_PARENT_DIR}/launch.sh" "${PLUGIN_WORK_DIR}/home/weave/launch.sh"
|
||||
set +e
|
||||
docker plugin disable "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
docker plugin rm "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
set -e
|
||||
docker plugin create "${PLUGIN_IMAGE}" "${PLUGIN_PARENT_DIR}"
|
||||
|
||||
if [ "${PUBLISH}" = "true" ]; then
|
||||
echo "Pushing ${PLUGIN_IMAGE}..."
|
||||
docker plugin push "${PLUGIN_IMAGE}"
|
||||
|
||||
# If this is not a beta release, also create a "latest-release-$ARCH"
|
||||
# plugin.
|
||||
case "$IMAGE_VERSION" in
|
||||
*-beta*) IS_BETA=1 ;;
|
||||
*) IS_BETA= ;;
|
||||
esac
|
||||
|
||||
if [ -z ${IS_BETA} ]; then
|
||||
echo "Tagging ${PLUGIN_IMAGE} as latest_release..."
|
||||
LATEST_IMAGE=${REGISTRY_USER}/net-plugin:latest_release-${PLUGIN_ARCH}
|
||||
docker plugin create "${LATEST_IMAGE}" "${PLUGIN_PARENT_DIR}"
|
||||
echo "Pushing ${LATEST_IMAGE}..."
|
||||
docker plugin push "${LATEST_IMAGE}"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
echo "Done."
|
||||
}
|
||||
|
||||
for i in $( echo "$PLATFORMS" | tr ',' ' '); do
|
||||
build_plugin "$i"
|
||||
done
|
||||
@@ -11,6 +11,22 @@ if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
PLUGIN_IMAGE=${REGISTRY_USER}/net-plugin:${IMAGE_VERSION}
|
||||
# This variable is used to control the architectures for
|
||||
# which the plugin will be built.
|
||||
: "${PLATFORMS:=amd64,arm,arm64,ppc64le,s390x}"
|
||||
|
||||
docker plugin rm "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
# $1 - Architecture to build for
|
||||
delete_plugin() {
|
||||
PLUGIN_ARCH=${1:-amd64}
|
||||
PLUGIN_IMAGE=${REGISTRY_USER}/net-plugin:${IMAGE_VERSION}-${PLUGIN_ARCH}
|
||||
echo "Deleting plugin ${PLUGIN_IMAGE}..."
|
||||
set +e
|
||||
docker plugin rm "${PLUGIN_IMAGE}" 2>/dev/null
|
||||
set -e
|
||||
}
|
||||
|
||||
for i in $( echo "$PLATFORMS" | tr ',' ' '); do
|
||||
delete_plugin "$i"
|
||||
done
|
||||
|
||||
rm -rf "../prog/net-plugin/rootfs"
|
||||
@@ -27,7 +27,7 @@ for im in ${IMAGE_LIST};do
|
||||
done
|
||||
|
||||
#UNIQUECOUNT=$(tail -n +2 -q "${SCANDIR}/weave-npc-list-vulns.txt" "${SCANDIR}/weave-kube-list-vulns.txt" | sort -u | wc -l)
|
||||
UNIQUECOUNT=$(tail -n +2 -q "${SCANDIR}"/*-list-vulns.txt | sort -u | wc -l)
|
||||
UNIQUECOUNT=$(tail -n +2 -q "${SCANDIR}"/*-list-vulns.txt | sed -e "s/\s\{2,\}/,/g" | sort -u | wc -l)
|
||||
BADGECOLOR="blue"
|
||||
|
||||
if [ "$UNIQUECOUNT" -gt "0" ]; then
|
||||
|
||||
+1
-3
@@ -3011,8 +3011,6 @@ definitions:
|
||||
Name: "journald"
|
||||
- Type: "Log"
|
||||
Name: "json-file"
|
||||
- Type: "Log"
|
||||
Name: "logentries"
|
||||
- Type: "Log"
|
||||
Name: "splunk"
|
||||
- Type: "Log"
|
||||
@@ -5334,7 +5332,7 @@ definitions:
|
||||
type: "array"
|
||||
items:
|
||||
type: "string"
|
||||
example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "logentries", "splunk", "syslog"]
|
||||
example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "splunk", "syslog"]
|
||||
|
||||
|
||||
RegistryServiceConfig:
|
||||
|
||||
+6
-2
@@ -66,8 +66,12 @@ func (cli *Client) ContainerWait(ctx context.Context, containerID string, condit
|
||||
//
|
||||
// If there's a JSON parsing error, read the real error message
|
||||
// off the body and send it to the client.
|
||||
_, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit))
|
||||
errC <- errors.New(responseText.String())
|
||||
if errors.As(err, new(*json.SyntaxError)) {
|
||||
_, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit))
|
||||
errC <- errors.New(responseText.String())
|
||||
} else {
|
||||
errC <- err
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
|
||||
+4
-10
@@ -11,17 +11,11 @@ import (
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"sync"
|
||||
"syscall"
|
||||
|
||||
"github.com/opencontainers/runc/libcontainer/user"
|
||||
)
|
||||
|
||||
var (
|
||||
entOnce sync.Once
|
||||
getentCmd string
|
||||
)
|
||||
|
||||
func mkdirAs(path string, mode os.FileMode, owner Identity, mkAll, chownExisting bool) error {
|
||||
path, err := filepath.Abs(path)
|
||||
if err != nil {
|
||||
@@ -162,10 +156,10 @@ func getentGroup(name string) (user.Group, error) {
|
||||
}
|
||||
|
||||
func callGetent(database, key string) (io.Reader, error) {
|
||||
entOnce.Do(func() { getentCmd, _ = resolveBinary("getent") })
|
||||
// if no `getent` command on host, can't do anything else
|
||||
if getentCmd == "" {
|
||||
return nil, fmt.Errorf("unable to find getent command")
|
||||
getentCmd, err := resolveBinary("getent")
|
||||
// if no `getent` command within the execution environment, can't do anything else
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to find getent command: %w", err)
|
||||
}
|
||||
command := exec.Command(getentCmd, database, key)
|
||||
// we run getent within container filesystem, but without /dev so /dev/null is not available for exec to mock stdin
|
||||
|
||||
+21
@@ -3,11 +3,15 @@ package ioutils // import "github.com/docker/docker/pkg/ioutils"
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"runtime/debug"
|
||||
"sync/atomic"
|
||||
|
||||
// make sure crypto.SHA256, crypto.sha512 and crypto.SHA384 are registered
|
||||
// TODO remove once https://github.com/opencontainers/go-digest/pull/64 is merged.
|
||||
_ "crypto/sha256"
|
||||
_ "crypto/sha512"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// ReadCloserWrapper wraps an io.Reader, and implements an io.ReadCloser
|
||||
@@ -16,10 +20,15 @@ import (
|
||||
type ReadCloserWrapper struct {
|
||||
io.Reader
|
||||
closer func() error
|
||||
closed atomic.Bool
|
||||
}
|
||||
|
||||
// Close calls back the passed closer function
|
||||
func (r *ReadCloserWrapper) Close() error {
|
||||
if !r.closed.CompareAndSwap(false, true) {
|
||||
subsequentCloseWarn("ReadCloserWrapper")
|
||||
return nil
|
||||
}
|
||||
return r.closer()
|
||||
}
|
||||
|
||||
@@ -87,6 +96,7 @@ type cancelReadCloser struct {
|
||||
cancel func()
|
||||
pR *io.PipeReader // Stream to read from
|
||||
pW *io.PipeWriter
|
||||
closed atomic.Bool
|
||||
}
|
||||
|
||||
// NewCancelReadCloser creates a wrapper that closes the ReadCloser when the
|
||||
@@ -146,6 +156,17 @@ func (p *cancelReadCloser) closeWithError(err error) {
|
||||
// Close closes the wrapper its underlying reader. It will cause
|
||||
// future calls to Read to return io.EOF.
|
||||
func (p *cancelReadCloser) Close() error {
|
||||
if !p.closed.CompareAndSwap(false, true) {
|
||||
subsequentCloseWarn("cancelReadCloser")
|
||||
return nil
|
||||
}
|
||||
p.closeWithError(io.EOF)
|
||||
return nil
|
||||
}
|
||||
|
||||
func subsequentCloseWarn(name string) {
|
||||
logrus.Error("subsequent attempt to close " + name)
|
||||
if logrus.GetLevel() >= logrus.DebugLevel {
|
||||
logrus.Errorf("stack trace: %s", string(debug.Stack()))
|
||||
}
|
||||
}
|
||||
+9
-1
@@ -1,6 +1,9 @@
|
||||
package ioutils // import "github.com/docker/docker/pkg/ioutils"
|
||||
|
||||
import "io"
|
||||
import (
|
||||
"io"
|
||||
"sync/atomic"
|
||||
)
|
||||
|
||||
// NopWriter represents a type which write operation is nop.
|
||||
type NopWriter struct{}
|
||||
@@ -29,9 +32,14 @@ func (f *NopFlusher) Flush() {}
|
||||
type writeCloserWrapper struct {
|
||||
io.Writer
|
||||
closer func() error
|
||||
closed atomic.Bool
|
||||
}
|
||||
|
||||
func (r *writeCloserWrapper) Close() error {
|
||||
if !r.closed.CompareAndSwap(false, true) {
|
||||
subsequentCloseWarn("WriteCloserWrapper")
|
||||
return nil
|
||||
}
|
||||
return r.closer()
|
||||
}
|
||||
|
||||
|
||||
Vendored
+1
-1
@@ -95,7 +95,7 @@ github.com/davecgh/go-spew/spew
|
||||
## explicit
|
||||
github.com/docker/distribution/digestset
|
||||
github.com/docker/distribution/reference
|
||||
# github.com/docker/docker v24.0.7+incompatible
|
||||
# github.com/docker/docker v24.0.9+incompatible
|
||||
## explicit
|
||||
github.com/docker/docker/api
|
||||
github.com/docker/docker/api/types
|
||||
|
||||
@@ -3,6 +3,9 @@ set -e
|
||||
|
||||
[ -n "$WEAVE_DEBUG" ] && set -x
|
||||
|
||||
# There is no longer a checkpoint service
|
||||
export CHECKPOINT_DISABLE=1
|
||||
|
||||
# Release Version
|
||||
SCRIPT_VERSION="unreleased"
|
||||
IMAGE_VERSION=latest
|
||||
|
||||
+4
-2
@@ -118,12 +118,14 @@ network does not block ESP traffic (IP protocol 50). For instance
|
||||
on Google Cloud Platform a firewall rule for allowing ESP traffic has
|
||||
to be installed.
|
||||
|
||||
**<a name="own-image"></a>Q: Why do you use your own Docker image `weaveworks/ubuntu`?**
|
||||
~~**<a name="own-image"></a>Q: Why do you use your own Docker image `weaveworks/ubuntu`?**
|
||||
|
||||
The official Ubuntu image does not contain the `ping` and `nc`
|
||||
commands which are used in many of our examples throughout the
|
||||
documentation. The `weaveworks/ubuntu` image is simply the official
|
||||
Ubuntu image with those two commands added.
|
||||
Ubuntu image with those two commands added.~~
|
||||
We now use the official `alpine:latest` image, which already has
|
||||
these two commands.
|
||||
|
||||
|
||||
**See Also**
|
||||
|
||||
+12
-2
@@ -14,9 +14,9 @@ If you are here for the most popular use of Weave Net - the famous one-line inst
|
||||
You can install Weave Net on a Kubernetes cluster using:
|
||||
|
||||
```bash
|
||||
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.25/net.yaml
|
||||
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.29/net.yaml
|
||||
```
|
||||
where the `v1.25` part can be replaced with any kubernetes version, the minimum being `v1.8`.
|
||||
where the `v1.29` part can be replaced with any Kubernetes version, the minimum being `v1.8`.
|
||||
|
||||
If you prefer the older method using `kubectl version`, that works too:
|
||||
|
||||
@@ -33,6 +33,16 @@ kubectl apply -f https://github.com/rajch/weave/releases/latest/download/weave-d
|
||||
|
||||
More details, and options can be found on the [Integrating Kubernetes via the Addon]({{ '/kubernetes/kube-addon' | relative_url }}) page.
|
||||
|
||||
## Using Weave as a (legacy) Docker Plugin
|
||||
|
||||
See [Installing Weave Net]({{ '/install/installing-weave' | relative_url }}), and then [Launching Weave Net]({{ '/install/using-weave' | relative_url }}).
|
||||
|
||||
## Using Weave as a Docker Managed (V2) Plugin in Swarm Mode
|
||||
|
||||
See [Integrating Docker via the Network Plugin (V2)]({{ '/install/plugin/plugin-v2' | relative_url }}).
|
||||
|
||||
**Note:** From version 2.8.6 onwards, the Docker V2 plugin is available for amd64, arm, arm64, ppc64le and s390x architectures. Prior to this, it was only available for amd64.
|
||||
|
||||
## All other uses, and more
|
||||
|
||||
For all other uses, proceed to the [Weave Net overview]({{ '/overview' | relative_url }}).
|
||||
|
||||
@@ -15,9 +15,11 @@ Install Weave Net by running the following:
|
||||
|
||||
~~If you are on OSX and you are using Docker Machine ensure that a VM is running and configured
|
||||
before downloading Weave Net. To set up a VM see [the Docker Machine
|
||||
documentation](https://docs.docker.com/installation/mac/#from-your-shell) or refer to ["Part 1: Launching Weave Net with Docker Machine"](https://web.archive.org/web/20231002233731/https://www.weave.works/guides/part-1-launching-weave-net-with-docker-machine/).~~
|
||||
documentation](https://docs.docker.com/installation/mac/#from-your-shell) or refer to ["Part 1: Launching Weave Net with Docker Machine"](https://web.archive.org/web/20231002233731/https://www.weave.works/guides/part-1-launching-weave-net-with-docker-machine/).
|
||||
|
||||
After your VM is setup with Docker Machine, Weave Net can be launched directly from the OSX host. Weave Net respects the environment variable `DOCKER_HOST`, so that you can run and control a Weave Network locally on a remote host. See [Using The Weave Docker API Proxy]({{ '/tasks/weave-docker-api/using-proxy' | relative_url }}).
|
||||
After your VM is setup with Docker Machine, Weave Net can be launched directly from the OSX host.~~
|
||||
|
||||
Weave Net respects the environment variable `DOCKER_HOST`, so that you can run and control a Weave Network locally on a remote host. See [Using The Weave Docker API Proxy]({{ '/tasks/weave-docker-api/using-proxy' | relative_url }}).
|
||||
|
||||
With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weave network and deploy apps onto it. See [Launching Weave Net]({{ '/install/using-weave' | relative_url }}).
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ search_type: Documentation
|
||||
The Weave Net legacy plugin actually provides *two* network drivers to Docker -
|
||||
one named `weavemesh` that can operate without a cluster store and another one
|
||||
named `weave` that can only work with one (like Docker's overlay driver), while
|
||||
the V2 plugin provides *one* - `weaveworks/net-plugin:latest_release`
|
||||
the V2 plugin provides *one* - `rajchaudhuri/net-plugin:latest_release-<architecture>`
|
||||
operating only in swarm mode.
|
||||
|
||||
### weavemesh driver
|
||||
@@ -41,7 +41,7 @@ The plugin accepts the following options via `docker network create ... --opt`:
|
||||
network created when the plugin is first launched has the multicast
|
||||
option turned on, but for any networks you create it defaults to off.
|
||||
|
||||
### weaveworks/net-plugin:latest_release driver
|
||||
### rajchaudhuri/net-plugin:latest_release-<architecture> driver
|
||||
|
||||
* The driver runs within the plugin V2.
|
||||
* Requires Docker to run in [swarm mode](https://docs.docker.com/engine/swarm/swarm-mode/).
|
||||
|
||||
@@ -19,7 +19,23 @@ mode and requires Docker version 1.13 or later.
|
||||
To install the plugin run the following command on _each_ host already
|
||||
participating in a Swarm cluster, i.e. on all master and worker nodes:
|
||||
|
||||
$ docker plugin install weaveworks/net-plugin:latest_release
|
||||
$ docker plugin install rajchaudhuri/net-plugin:latest_release-<architecture>
|
||||
|
||||
Here, <architecture> is the processor architecture on which your Docker Engine runs.
|
||||
It is a necessary part of the plugin name, because Docker currently does not support
|
||||
multi-architecture plugins. The Weave Net Plugin V2 is available for the following
|
||||
architectures:
|
||||
|
||||
* amd64
|
||||
* arm
|
||||
* arm64
|
||||
* ppc64le
|
||||
* s390x
|
||||
|
||||
You can use the following commands to install the plugin appropriate to your architecture:
|
||||
|
||||
$ ARCH=$(docker version -f '{{.Server.Arch}}')
|
||||
$ docker plugin install rajchaudhuri/net-plugin:latest_release-$ARCH
|
||||
|
||||
Docker will pull the plugin from Docker Store, and it will ask to grant
|
||||
privileges before installing the plugin. Afterwards, it will start `weaver`
|
||||
@@ -29,7 +45,7 @@ process which will try to connect to Swarm masters running Weave Net.
|
||||
|
||||
There are several configuration parameters which can be set with:
|
||||
|
||||
$ docker plugin set weaveworks/net-plugin:latest_release PARAM=VALUE
|
||||
$ docker plugin set rajchaudhuri/net-plugin:latest_release-$ARCH PARAM=VALUE
|
||||
|
||||
The parameters include:
|
||||
|
||||
@@ -49,31 +65,38 @@ The parameters include:
|
||||
|
||||
Before setting any parameter, the plugin has to be disabled with:
|
||||
|
||||
$ docker plugin disable weaveworks/net-plugin:latest_release
|
||||
$ docker plugin disable rajchaudhuri/net-plugin:latest_release-$ARCH
|
||||
|
||||
To re-enable the plugin run the following command:
|
||||
|
||||
$ docker plugin enable weaveworks/net-plugin:latest_release
|
||||
$ docker plugin enable rajchaudhuri/net-plugin:latest_release-$ARCH
|
||||
|
||||
### <a name="usage"></a>Running Services or Containers Using the Plugin
|
||||
|
||||
After you have launched the plugin, you can create a network for Docker Swarm
|
||||
services by running the following command on any Docker Swarm master node:
|
||||
|
||||
$ docker network create --driver=weaveworks/net-plugin:latest_release mynetwork
|
||||
$ docker network create --driver=rajchaudhuri/net-plugin:latest_release-$ARCH mynetwork
|
||||
|
||||
Or you can create a network for any Docker container with:
|
||||
|
||||
$ docker network create --driver=weaveworks/net-plugin:latest_release --attachable mynetwork
|
||||
$ docker network create --driver=rajchaudhuri/net-plugin:latest_release-$ARCH --attachable mynetwork
|
||||
|
||||
To start a service attached to the network run, for example:
|
||||
|
||||
$ docker service create --network=mynetwork ...
|
||||
|
||||
Or to start a container:
|
||||
To ensure that name resolution (service discovery) works as expected, do one of the following:
|
||||
|
||||
* Include `--endpoint-mode=dnsrr` while creating a service. This will correctly resolve the service name to the load-balanced IP address of one of the task containers.
|
||||
* OR, include `--hostname=SOMENAME` while creating a servce. This will also resolve `SOMENAME` to the load-balanced IP address of one of the task containers.
|
||||
|
||||
To start a container:
|
||||
|
||||
$ docker run --network=mynetwork ...
|
||||
|
||||
This does not require a `--hostname` option. The container name and any network aliases will correctly resolve to the container's IP address.
|
||||
|
||||
**See Also**
|
||||
|
||||
* [Integrating Docker via the Network Plugin (Legacy)]({{ '/install/plugin/plugin' | relative_url }})
|
||||
|
||||
@@ -20,7 +20,7 @@ See [Launching Weave Net]({{ '/install/using-weave#peer-connections' | relative_
|
||||
|
||||
After you've launched Weave Net and peered your hosts, you can start containers using the following, for example:
|
||||
|
||||
$ docker run --net=weave -ti weaveworks/ubuntu
|
||||
$ docker run --net=weave -ti alpine:latest
|
||||
|
||||
on any of the hosts, and they can all communicate with each other
|
||||
using any protocol, even multicast.
|
||||
@@ -29,8 +29,8 @@ In order to use Weave Net's [Service Discovery]({{ '/tasks/weavedns/weavedns' |
|
||||
must pass the additional arguments `--dns` and `-dns-search`, for
|
||||
which a helper is provided in the Weave script:
|
||||
|
||||
$ docker run --net=weave -h foo.weave.local $(weave dns-args) -tdi weaveworks/ubuntu
|
||||
$ docker run --net=weave -h bar.weave.local $(weave dns-args) -ti weaveworks/ubuntu
|
||||
$ docker run --net=weave -h foo.weave.local $(weave dns-args) -tdi alpine:latest
|
||||
$ docker run --net=weave -h bar.weave.local $(weave dns-args) -ti alpine:latest
|
||||
# ping foo
|
||||
|
||||
|
||||
@@ -43,11 +43,11 @@ Just launch the Weave Net router onto each host and make a peer connection with
|
||||
|
||||
then run your containers using the Docker command-line:
|
||||
|
||||
host1$ docker run --net=weave -ti weaveworks/ubuntu
|
||||
host1$ docker run --net=weave -ti alpine:latest
|
||||
root@1458e848cd90:/# hostname -i
|
||||
10.32.0.2
|
||||
|
||||
host2$ docker run --net=weave -ti weaveworks/ubuntu
|
||||
host2$ docker run --net=weave -ti alpine:latest
|
||||
root@8cc4b5dc5722:/# ping 10.32.0.2
|
||||
|
||||
PING 10.32.0.2 (10.32.0.2) 56(84) bytes of data.
|
||||
|
||||
@@ -21,13 +21,13 @@ On `$HOST1` run:
|
||||
|
||||
host1$ weave launch
|
||||
host1$ eval $(weave env)
|
||||
host1$ docker run --name a1 -ti weaveworks/ubuntu
|
||||
host1$ docker run --name a1 -ti alpine:latest
|
||||
|
||||
Where,
|
||||
|
||||
* The first line runs Weave Net.
|
||||
* The second line configures the Weave Net environment, so that containers launched via the Docker command line are automatically attached to the Weave network, and,
|
||||
* The third line runs the [application container]({{ '/faq#own-image' | relative_url }}) using [a Docker command](https://docs.docker.com/reference/cli/docker/container/run/).
|
||||
* The second line configures the Docker environment to use the [Weave Net Docker API Proxy]({{ '/tasks/weave-docker-api/weave-docker-api' | relative_url }}), so that containers launched via the Docker command line are automatically attached to the Weave network, and,
|
||||
* The third line runs an application container using [a Docker command](https://docs.docker.com/reference/cli/docker/container/run/).
|
||||
|
||||
> **Note** If the first command results in an error like
|
||||
> ```
|
||||
@@ -44,7 +44,7 @@ Where,
|
||||
> host1$ sudo -s
|
||||
> host1# weave launch
|
||||
> host1# eval $(weave env)
|
||||
> host1# docker run --name a1 -ti weaveworks/ubuntu
|
||||
> host1# docker run --name a1 -ti alpine:latest
|
||||
> ```
|
||||
> Do *not* prefix individual commands with `sudo`, since some commands
|
||||
> modify environment entries and hence they all need to be executed from
|
||||
@@ -63,7 +63,7 @@ To launch Weave Net on an additional host and create a peer connection, run the
|
||||
|
||||
host2$ weave launch $HOST1
|
||||
host2$ eval $(weave env)
|
||||
host2$ docker run --name a2 -ti weaveworks/ubuntu
|
||||
host2$ docker run --name a2 -ti alpine:latest
|
||||
|
||||
As noted above, the same steps are repeated for `$HOST2`. The only difference, besides the application container’s name, is that `$HOST2` is told to peer with Weave Net on `$HOST1` during launch.
|
||||
|
||||
|
||||
@@ -79,7 +79,7 @@ See [Integrating Docker via the API Proxy]({{ '/tasks/weave-docker-api/weave-doc
|
||||
Weave Net can also be used as a [Docker plugin](https://docs.docker.com/engine/extend/plugins_network/). A Docker network
|
||||
named `weave` is created by `weave launch`, which is used as follows:
|
||||
|
||||
$ docker run --net=weave -ti weaveworks/ubuntu
|
||||
$ docker run --net=weave -ti alpine:latest
|
||||
|
||||
Using the Weave plugin enables you to take advantage of [Docker's network functionality](https://docs.docker.com/engine/extend/plugins_network/).
|
||||
|
||||
@@ -108,11 +108,11 @@ For a discussion on how Weave Net uses IPAM, see [Automatic IP Address Managemen
|
||||
|
||||
### <a name="naming-and-discovery"></a>Naming and Discovery
|
||||
|
||||
Named containers are automatically registered in [weaveDNS]({{ '/tasks/weavedns/weavedns' | relative_url }}),
|
||||
Containers with a hostname are automatically registered in [weaveDNS]({{ '/tasks/weavedns/weavedns' | relative_url }}),
|
||||
and are discoverable by using standard, simple name lookups:
|
||||
|
||||
host1$ docker run -dti --name=service weaveworks/ubuntu
|
||||
host1$ docker run -ti weaveworks/ubuntu
|
||||
host1$ docker run -dti --name=service --hostname=service.weave.local alpine:latest
|
||||
host1$ docker run -ti alpine:latest
|
||||
root@7b21498fb103:/# ping service
|
||||
|
||||
WeaveDNS also supports [load balancing]({{ '/tasks/weavedns/load-balance-fault-weavedns' | relative_url }}), [fault resilience]({{ '/tasks/weavedns/load-balance-fault-weavedns' | relative_url }}) and [hot swapping]( {{ '/tasks/weavedns/managing-entries-weavedns' | relative_url }}).
|
||||
|
||||
@@ -16,13 +16,13 @@ allocation of an address from a particular subnet, set the
|
||||
`WEAVE_CIDR` environment variable to `net:<subnet>` when creating the
|
||||
container, for example:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR=net:10.2.7.0/24 -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR=net:10.2.7.0/24 -ti alpine:latest
|
||||
|
||||
You can ask for multiple addresses in different subnets and add in
|
||||
manually-assigned addresses (outside the automatic allocation range),
|
||||
for instance:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR="net:10.2.7.0/24 net:10.2.8.0/24 ip:10.3.9.1/24" -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR="net:10.2.7.0/24 net:10.2.8.0/24 ip:10.3.9.1/24" -ti alpine:latest
|
||||
|
||||
>**Note:** The ".0" and ".-1" addresses in a subnet are not used, as required by
|
||||
[RFC 1122](https://tools.ietf.org/html/rfc1122#page-29)).
|
||||
|
||||
@@ -37,12 +37,12 @@ For example, we can launch a couple of containers on `$HOST1` and
|
||||
|
||||
On `$HOST1`:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR=10.2.1.1/24 -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR=10.2.1.1/24 -ti alpine:latest
|
||||
root@7ca0f6ecf59f:/#
|
||||
|
||||
And `$HOST2`:
|
||||
|
||||
host2$ docker run -e WEAVE_CIDR=10.2.1.2/24 -ti weaveworks/ubuntu
|
||||
host2$ docker run -e WEAVE_CIDR=10.2.1.2/24 -ti alpine:latest
|
||||
root@04c4831fafd3:/#
|
||||
|
||||
Then test that the container on `$HOST2` can be reached from the container on `$HOST1`:
|
||||
|
||||
@@ -27,13 +27,13 @@ specified.
|
||||
|
||||
Next, launch the two netcat containers onto the default subnet:
|
||||
|
||||
host1$ docker run --name a1 -ti weaveworks/ubuntu
|
||||
host2$ docker run --name a2 -ti weaveworks/ubuntu
|
||||
host1$ docker run --name a1 -ti alpine:latest
|
||||
host2$ docker run --name a2 -ti alpine:latest
|
||||
|
||||
And then to test the isolation, launch a few more containers onto a different subnet:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b1 -ti weaveworks/ubuntu
|
||||
host2$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b2 -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b1 -ti alpine:latest
|
||||
host2$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b2 -ti alpine:latest
|
||||
|
||||
Ping each container to confirm that they can talk to each other, but not to the containers of our first subnet:
|
||||
|
||||
@@ -55,7 +55,7 @@ Ping each container to confirm that they can talk to each other, but not to the
|
||||
|
||||
If required, a container can also be attached to multiple subnets when it is started using:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR="net:default net:10.2.2.0/24" -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR="net:default net:10.2.2.0/24" -ti alpine:latest
|
||||
|
||||
`net:default` is used to request the allocation of an address from the default subnet in addition to one from an explicitly specified range.
|
||||
|
||||
|
||||
@@ -9,13 +9,13 @@ When containers may not know the network to which they will be attached, Weave N
|
||||
|
||||
To illustrate...
|
||||
|
||||
host1$ C=$(docker run -e WEAVE_CIDR=none -dti weaveworks/ubuntu)
|
||||
host1$ C=$(docker run -e WEAVE_CIDR=none -dti alpine:latest)
|
||||
host1$ weave attach $C
|
||||
10.2.1.3
|
||||
|
||||
where,
|
||||
|
||||
* `C=$(docker run -e WEAVE_CIDR=none -dti weaveworks/ubuntu)` starts a container and assigns its ID to a variable
|
||||
* `C=$(docker run -e WEAVE_CIDR=none -dti alpine:latest)` starts a container and assigns its ID to a variable
|
||||
* `weave attach` – the Weave Net command to attach to the specified container
|
||||
* `10.2.1.3` - the allocated IP address output by `weave attach`, in this case in the default subnet
|
||||
|
||||
@@ -25,7 +25,7 @@ If `weave attach` sees the container has a hostname with a
|
||||
domain-name, it will add those into WeaveDNS (unless you turn this off
|
||||
with the `--without-dns` argument).
|
||||
|
||||
host1$ docker run -dti --name=c1 --hostname=c1.weave.local weaveworks/ubuntu
|
||||
host1$ docker run -dti --name=c1 --hostname=c1.weave.local alpine:latest
|
||||
host1$ weave attach c1
|
||||
10.32.0.1
|
||||
host1$ weave dns-lookup c1
|
||||
|
||||
@@ -38,7 +38,7 @@ For example, you can launch the proxy using all three flags, as follows:
|
||||
|
||||
After launching the Weave Net proxy with these flags, running a container named `aws-12798186823-foo` without labels results in weaveDNS registering the hostname `my-app-foo` and not `aws-12798186823-foo`.
|
||||
|
||||
host1$ docker run -ti --name=aws-12798186823-foo weaveworks/ubuntu ping my-app-foo
|
||||
host1$ docker run -ti --name=aws-12798186823-foo alpine:latest ping my-app-foo
|
||||
PING my-app-foo.weave.local (10.32.0.2) 56(84) bytes of data.
|
||||
64 bytes from my-app-foo.weave.local (10.32.0.2): icmp_seq=1 ttl=64 time=0.027 ms
|
||||
64 bytes from my-app-foo.weave.local (10.32.0.2): icmp_seq=2 ttl=64 time=0.067 ms
|
||||
@@ -46,7 +46,7 @@ After launching the Weave Net proxy with these flags, running a container named
|
||||
Also, running a container named `foo` with the label
|
||||
`hostname-label=aws-12798186823-foo` leads to the same hostname registration.
|
||||
|
||||
host1$ docker run -ti --name=foo --label=hostname-label=aws-12798186823-foo weaveworks/ubuntu ping my-app-foo
|
||||
host1$ docker run -ti --name=foo --label=hostname-label=aws-12798186823-foo alpine:latest ping my-app-foo
|
||||
PING my-app-foo.weave.local (10.32.0.2) 56(84) bytes of data.
|
||||
64 bytes from my-app-foo.weave.local (10.32.0.2): icmp_seq=1 ttl=64 time=0.031 ms
|
||||
64 bytes from my-app-foo.weave.local (10.32.0.2): icmp_seq=2 ttl=64 time=0.042 ms
|
||||
|
||||
@@ -9,16 +9,16 @@ If [automatic IP address allocation]({{ '/tasks/ipam/ipam' | relative_url }}) is
|
||||
then containers started via the proxy are automatically assigned an IP address, *without having to specify any
|
||||
special environment variables or any other options*.
|
||||
|
||||
host1$ docker run -ti weaveworks/ubuntu
|
||||
host1$ docker run -ti alpine:latest
|
||||
|
||||
To use a specific subnet, you can pass a `WEAVE_CIDR` to the container, for example:
|
||||
|
||||
host1$ docker run -ti -e WEAVE_CIDR=net:10.32.2.0/24 weaveworks/ubuntu
|
||||
host1$ docker run -ti -e WEAVE_CIDR=net:10.32.2.0/24 alpine:latest
|
||||
|
||||
To start a container without connecting it to the Weave network, pass
|
||||
`WEAVE_CIDR=none`, for example:
|
||||
|
||||
host1$ docker run -ti -e WEAVE_CIDR=none weaveworks/ubuntu
|
||||
host1$ docker run -ti -e WEAVE_CIDR=none alpine:latest
|
||||
|
||||
### Disabling Automatic IP Address Allocation
|
||||
|
||||
@@ -34,7 +34,7 @@ Containers started with a `WEAVE_CIDR` environment variable are handled as befor
|
||||
To automatically assign an address in this mode, start the
|
||||
container with a blank `WEAVE_CIDR`, for example:
|
||||
|
||||
host1$ docker run -ti -e WEAVE_CIDR="" weaveworks/ubuntu
|
||||
host1$ docker run -ti -e WEAVE_CIDR="" alpine:latest
|
||||
|
||||
**See Also**
|
||||
|
||||
|
||||
@@ -17,17 +17,17 @@ Weave network.
|
||||
|
||||
To create and start a container via the Weave Net proxy run:
|
||||
|
||||
host1$ docker run -ti weaveworks/ubuntu
|
||||
host1$ docker run -ti alpine:latest
|
||||
|
||||
or, equivalently run:
|
||||
|
||||
host1$ docker create -ti --name=foo weaveworks/ubuntu
|
||||
host1$ docker create -ti --name=foo alpine:latest
|
||||
host1$ docker start foo
|
||||
|
||||
Specific IP addresses and networks can be supplied in the `WEAVE_CIDR`
|
||||
environment variable, for example:
|
||||
|
||||
host1$ docker run -e WEAVE_CIDR=10.2.1.1/24 -ti weaveworks/ubuntu
|
||||
host1$ docker run -e WEAVE_CIDR=10.2.1.1/24 -ti alpine:latest
|
||||
|
||||
Multiple IP addresses and networks can be supplied in the `WEAVE_CIDR`
|
||||
variable by space-separating them, as in
|
||||
|
||||
@@ -16,7 +16,7 @@ some ping tests.
|
||||
```
|
||||
host2$ weave launch $HOST1
|
||||
host2$ eval $(weave env)
|
||||
host2$ docker run -dti --name=pingme weaveworks/ubuntu
|
||||
host2$ docker run -dti --name=pingme alpine:latest
|
||||
|
||||
root@ubuntu:/# ping -nq -c 1 pingme
|
||||
PING pingme.weave.local (10.32.0.2) 56(84) bytes of data.
|
||||
|
||||
@@ -26,7 +26,7 @@ behaviour.
|
||||
docker run -ti \
|
||||
--dns-search=zone1.weave.local --dns-search=zone2.weave.local \
|
||||
--dns-search=corp1.com --dns-search=corp2.com \
|
||||
--dns-search=weave.local weaveworks/ubuntu
|
||||
--dns-search=weave.local alpine:latest
|
||||
```
|
||||
|
||||
## <a name="local-domain"></a>Using a different local domain
|
||||
|
||||
@@ -17,7 +17,7 @@ If you want to give the container a name in DNS *other* than its
|
||||
hostname, you can register it using the `dns-add` command. For example:
|
||||
|
||||
```
|
||||
$ C=$(docker run -ti weaveworks/ubuntu)
|
||||
$ C=$(docker run -ti alpine:latest)
|
||||
$ weave dns-add $C -h pingme2.weave.local
|
||||
```
|
||||
|
||||
|
||||
@@ -28,8 +28,8 @@ resolution, and will register themselves if they either have a
|
||||
hostname in the weaveDNS domain (`weave.local` by default) or are given an explicit container name:
|
||||
|
||||
```
|
||||
host1$ docker run -dti --name=pingme weaveworks/ubuntu
|
||||
host1$ docker run -ti --hostname=ubuntu.weave.local weaveworks/ubuntu
|
||||
host1$ docker run -dti --name=pingme alpine:latest
|
||||
host1$ docker run -ti --hostname=ubuntu.weave.local alpine:latest
|
||||
root@ubuntu:/# ping pingme
|
||||
...
|
||||
```
|
||||
@@ -37,8 +37,8 @@ root@ubuntu:/# ping pingme
|
||||
Moreover, weaveDNS always register all network aliases (--network-alias option to docker run).
|
||||
|
||||
```
|
||||
host1$ docker run --network weave --network-alias pingme --network-alias pingme2 -dti weaveworks/ubuntu
|
||||
host1$ docker run --network weave --hostname=ubuntu.weave.local -ti weaveworks/ubuntu
|
||||
host1$ docker run --network weave --network-alias pingme --network-alias pingme2 -dti alpine:latest
|
||||
host1$ docker run --network weave --hostname=ubuntu.weave.local -ti alpine:latest
|
||||
root@ubuntu:/# ping pingme
|
||||
...
|
||||
root@ubuntu:/# ping pingme2
|
||||
|
||||
Reference in new issue
Block a user