Browse code
Deprecate BridgeNfIptables and BridgeNfIp6tables fields
The netfilter module is now loaded on-demand, and no longer during daemon
startup, making these fields obsolete. These fields are now always `false`
and will be removed in the next relase.
This patch deprecates:
- the `BridgeNfIptables` field in `api/types/system.Info`
- the `BridgeNfIp6tables` field in `api/types/system.Info`
- the `BridgeNFCallIPTablesDisabled` field in `pkg/sysinfo.SysInfo`
- the `BridgeNFCallIP6TablesDisabled` field in `pkg/sysinfo.SysInfo`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn authored on 2024/12/14 23:15:33Showing 8 changed files
- api/swagger.yaml
- api/types/system/info.go
- daemon/info.go
- docs/api/v1.47.yaml
- docs/api/version-history.md
- integration-cli/requirements_unix_test.go
- pkg/sysinfo/sysinfo.go
- pkg/sysinfo/sysinfo_linux.go
| ... | ... |
@@ -5546,13 +5546,28 @@ definitions: |
| 5546 | 5546 |
type: "boolean" |
| 5547 | 5547 |
example: true |
| 5548 | 5548 |
BridgeNfIptables: |
| 5549 |
- description: "Indicates if `bridge-nf-call-iptables` is available on the host." |
|
| 5549 |
+ description: | |
|
| 5550 |
+ Indicates if `bridge-nf-call-iptables` is available on the host when |
|
| 5551 |
+ the daemon was started. |
|
| 5552 |
+ |
|
| 5553 |
+ <p><br /></p> |
|
| 5554 |
+ |
|
| 5555 |
+ > **Deprecated**: netfilter module is now loaded on-demand and no longer |
|
| 5556 |
+ > during daemon startup, making this field obsolete. This field is always |
|
| 5557 |
+ > `false` and will be removed in a API v1.49. |
|
| 5550 | 5558 |
type: "boolean" |
| 5551 |
- example: true |
|
| 5559 |
+ example: false |
|
| 5552 | 5560 |
BridgeNfIp6tables: |
| 5553 |
- description: "Indicates if `bridge-nf-call-ip6tables` is available on the host." |
|
| 5561 |
+ description: | |
|
| 5562 |
+ Indicates if `bridge-nf-call-ip6tables` is available on the host. |
|
| 5563 |
+ |
|
| 5564 |
+ <p><br /></p> |
|
| 5565 |
+ |
|
| 5566 |
+ > **Deprecated**: netfilter module is now loaded on-demand, and no longer |
|
| 5567 |
+ > during daemon startup, making this field obsolete. This field is always |
|
| 5568 |
+ > `false` and will be removed in a API v1.49. |
|
| 5554 | 5569 |
type: "boolean" |
| 5555 |
- example: true |
|
| 5570 |
+ example: false |
|
| 5556 | 5571 |
Debug: |
| 5557 | 5572 |
description: | |
| 5558 | 5573 |
Indicates if the daemon is running in debug-mode / with debug-level |
| ... | ... |
@@ -29,8 +29,8 @@ type Info struct {
|
| 29 | 29 |
CPUSet bool |
| 30 | 30 |
PidsLimit bool |
| 31 | 31 |
IPv4Forwarding bool |
| 32 |
- BridgeNfIptables bool |
|
| 33 |
- BridgeNfIP6tables bool `json:"BridgeNfIp6tables"` |
|
| 32 |
+ BridgeNfIptables bool `json:"BridgeNfIptables"` // Deprecated: netfilter module is now loaded on-demand and no longer during daemon startup, making this field obsolete. This field is always false and will be removed in the next release. |
|
| 33 |
+ BridgeNfIP6tables bool `json:"BridgeNfIp6tables"` // Deprecated: netfilter module is now loaded on-demand and no longer during daemon startup, making this field obsolete. This field is always false and will be removed in the next release. |
|
| 34 | 34 |
Debug bool |
| 35 | 35 |
NFd int |
| 36 | 36 |
OomKillDisable bool |
| ... | ... |
@@ -53,8 +53,6 @@ func (daemon *Daemon) SystemInfo(ctx context.Context) (*system.Info, error) {
|
| 53 | 53 |
ID: daemon.id, |
| 54 | 54 |
Images: daemon.imageService.CountImages(ctx), |
| 55 | 55 |
IPv4Forwarding: !sysInfo.IPv4ForwardingDisabled, |
| 56 |
- BridgeNfIptables: !sysInfo.BridgeNFCallIPTablesDisabled, |
|
| 57 |
- BridgeNfIP6tables: !sysInfo.BridgeNFCallIP6TablesDisabled, |
|
| 58 | 56 |
Name: hostName(ctx), |
| 59 | 57 |
SystemTime: time.Now().Format(time.RFC3339Nano), |
| 60 | 58 |
LoggingDriver: daemon.defaultLogConfig.Type, |
| ... | ... |
@@ -5512,7 +5512,11 @@ definitions: |
| 5512 | 5512 |
type: "boolean" |
| 5513 | 5513 |
example: true |
| 5514 | 5514 |
BridgeNfIptables: |
| 5515 |
- description: "Indicates if `bridge-nf-call-iptables` is available on the host." |
|
| 5515 |
+ description: | |
|
| 5516 |
+ Indicates if `bridge-nf-call-iptables` is available on the host when |
|
| 5517 |
+ the daemon was started. |
|
| 5518 |
+ |
|
| 5519 |
+ The `br_netfilter` |
|
| 5516 | 5520 |
type: "boolean" |
| 5517 | 5521 |
example: true |
| 5518 | 5522 |
BridgeNfIp6tables: |
| ... | ... |
@@ -22,6 +22,10 @@ keywords: "API, Docker, rcli, REST, documentation" |
| 22 | 22 |
and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig` |
| 23 | 23 |
struct in the `GET /info` response will now always be `null` and will be |
| 24 | 24 |
omitted in API v1.49. |
| 25 |
+* Deprecated: The `BridgeNfIptables` and `BridgeNfIp6tables` fields in the |
|
| 26 |
+ `GET /info` response are now always be `false` and will be omitted in API |
|
| 27 |
+ v1.49. The netfilter module is now loaded on-demand, and no longer during |
|
| 28 |
+ daemon startup, making these fields obsolete. |
|
| 25 | 29 |
* `GET /images/{name}/history` now supports a `platform` parameter (JSON
|
| 26 | 30 |
encoded OCI Platform type) that allows to specify a platform to show the |
| 27 | 31 |
history of. |
| ... | ... |
@@ -64,7 +64,8 @@ func seccompEnabled() bool {
|
| 64 | 64 |
} |
| 65 | 65 |
|
| 66 | 66 |
func bridgeNfIptables() bool {
|
| 67 |
- return !sysInfo.BridgeNFCallIPTablesDisabled |
|
| 67 |
+ content, err := os.ReadFile("/proc/sys/net/bridge/bridge-nf-call-iptables")
|
|
| 68 |
+ return err == nil && strings.TrimSpace(string(content)) == "1" |
|
| 68 | 69 |
} |
| 69 | 70 |
|
| 70 | 71 |
func unprivilegedUsernsClone() bool {
|
| ... | ... |
@@ -27,9 +27,13 @@ type SysInfo struct {
|
| 27 | 27 |
IPv4ForwardingDisabled bool |
| 28 | 28 |
|
| 29 | 29 |
// Whether bridge-nf-call-iptables is supported or not |
| 30 |
+ // |
|
| 31 |
+ // Deprecated: netfilter module is now loaded on-demand and no longer during daemon startup, making this field obsolete. This field is always false and will be removed in the next release. |
|
| 30 | 32 |
BridgeNFCallIPTablesDisabled bool |
| 31 | 33 |
|
| 32 | 34 |
// Whether bridge-nf-call-ip6tables is supported or not |
| 35 |
+ // |
|
| 36 |
+ // Deprecated: netfilter module is now loaded on-demand and no longer during daemon startup, making this field obsolete. This field is always false and will be removed in the next release. |
|
| 33 | 37 |
BridgeNFCallIP6TablesDisabled bool |
| 34 | 38 |
|
| 35 | 39 |
// Whether the cgroup has the mountpoint of "devices" or not |
| ... | ... |
@@ -267,8 +267,6 @@ func applyDevicesCgroupInfo(info *SysInfo) {
|
| 267 | 267 |
// applyNetworkingInfo adds networking information to the info. |
| 268 | 268 |
func applyNetworkingInfo(info *SysInfo) {
|
| 269 | 269 |
info.IPv4ForwardingDisabled = !readProcBool("/proc/sys/net/ipv4/ip_forward")
|
| 270 |
- info.BridgeNFCallIPTablesDisabled = !readProcBool("/proc/sys/net/bridge/bridge-nf-call-iptables")
|
|
| 271 |
- info.BridgeNFCallIP6TablesDisabled = !readProcBool("/proc/sys/net/bridge/bridge-nf-call-ip6tables")
|
|
| 272 | 270 |
} |
| 273 | 271 |
|
| 274 | 272 |
// applyAppArmorInfo adds whether AppArmor is enabled to the info. |