Signed-off-by: Rob Murray <[email protected]>
(cherry picked from commit 8b0e94f)
Signed-off-by: Austin Vazquez <[email protected]>

…a7d42391a3961e795b33976256c9-27.x

[27.x backport] Update dlv in the dev-env

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 2b6550b)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

The --feature flag allows the boolean value to be omitted.
If only a name is provided, the default is "true".

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 50e83a0)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

The value is optional for SetOpts (and NamedSetOpts), and implied
"true" when omitted.

This patch adds a test-case for this.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 758cca6)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 908bb95)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit c2fc1f4)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

[27.x backport] dockerd: fix docs, improve validation and improve coverage of "--feature" flag

This option was added in a08abec,
as part of Docker v25.0, but did not update the docs and manpage.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 45a9dde)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Update the buildx cli plugin used in the dev-container

full diff: docker/buildx@0.17.0...0.17.1

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 3d4831a)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Update the compose cli plugin used in the dev-container

full diff: docker/compose@v2.29.2...v2.29.4

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 605f511)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

…gformat

[27.x backport] man: dockerd: add description for --log-format option

Kernel module br_netfilter is loaded when the daemon starts with
either iptables or ip6tables enabled. That automatically sets:
  net.bridge.bridge-nf-call-arptables = 1
  net.bridge.bridge-nf-call-ip6tables = 1
  net.bridge.bridge-nf-call-iptables = 1

So, when:
- docker was running happily with iptables=false, and
- no explicit ip6tables=false, and
- br_netfilter was not loaded
... the change in moby 27.0 to enable ip6tables by default, resulted
in net.bridge.bridge-nf-call-iptables being enabled.

If the host also had a firewall with default-drop on its forward
chain - that resulted in packets getting dropped between containers
on a bridge network.

So, only try to load br_netfilter when it's needed - it's only needed
to implement "--icc=false", which can only be used when iptables or
ip6tables is enabled.

Signed-off-by: Rob Murray <[email protected]>
(cherry picked from commit db25b0d)
Signed-off-by: Rob Murray <[email protected]>

…iltering

[27.x backport] Only enable bridge netfiltering when needed

…mpose

[27.x backport] Dockerfile: update buildx to v0.17.1, compose to v2.29.4

When running WSL2 with mirrored mode networking, add an iptables
rule to skip DNAT for packets arriving on interface loopback0 that
are addressed to a localhost address - they're from the Windows
host.

Signed-off-by: Rob Murray <[email protected]>
(cherry picked from commit f9c0103)
Signed-off-by: Rob Murray <[email protected]>

…pback0_workaround

[27.x backport] Do not DNAT packets from WSL2's loopback0

If any permission is set, any permission not included in the list is
implicitly set to "none".

see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

The govulncheck check need read permissions, which is not problematic
for public repositories, but may be needed when running in a private
fork (such as those used for security releases).

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 4f1d739)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

…rmissions

[27.x backport] gha: govulncheck: make sure read permissions are set