Update the compose cli plugin used in the dev-container

full diff: docker/cli@v2.27.1...v2.28.1

Signed-off-by: Paweł Gronowski <[email protected]>
(cherry picked from commit 790035f)
Signed-off-by: Paweł Gronowski <[email protected]>

Update the Docker CLI used in the dev-container

full diff: docker/cli@v26.1.0...v27.0.2

Signed-off-by: Paweł Gronowski <[email protected]>
(cherry picked from commit 3928165)
Signed-off-by: Paweł Gronowski <[email protected]>

[27.0 backport] Dockerfile: update compose to v2.28.1, update cli to v27.0.2

Since 838047a, the overlayWhiteoutConverter
is supported with userns enabled, so we no longer need this check.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit af85e47)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

This function was discarding EPERM errors if it detected that userns was
enabled; move such checks to the caller-site, so that they can decide
how to handle the error (which, in case of userns may be to log and ignore).

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 379ce56)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

createTarFile accepts a opts (TarOptions) argument to specify whether
userns is enabled; whe should consider always detecting locally, but
at least make sure we're consistently working with the same value within
this function.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 969993a)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Commits b2fd67d (and the follow-up commit
f6b8025) updated doesSupportNativeDiff to
detect whether the host can support native overlay diffing with userns
enabled.

As a result, [useNaiveDiff] would now return "false" in cases where it
previously would return "true" (and thus skip). However, [overlay2],
unlike [fuse-overlay] did not take user namespaces into account, when
using the native differ, and it therefore did not set the InUserNS option
in TarOptions.

As a result pkg/archive.createTarFile would attempt tocreate [device-nodes]
through [handleTarTypeBlockCharFifo] which would fail, but the resulting
error `EPERM` would be discarded, and `createTarFile` would not return
early, therefor attempting to [os.LChown] the missing file, ultimately
resulting in an error:

    failed to Lchown "/dev/console" for UID 0, GID 0: lchown /dev/console: no such file or directory

This patch fixes the missing option in overlay.

[useNaiveDiff]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/overlay2/overlay.go#L248-L256
[overlay2]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/overlay2/overlay.go#L684-L689
[fuse-overlay]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go#L456-L462
[device-nodes]: https://github.com/moby/moby/blob/ff1e2c0de72a1bbbe4cdbe1558da57d327899df5/pkg/archive/archive.go#L713-L720
[handleTarTypeBlockCharFifo]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/pkg/archive/archive_unix.go#L110-L114
[os.LChown]: https://github.com/moby/moby/blob/ff1e2c0de72a1bbbe4cdbe1558da57d327899df5/pkg/archive/archive.go#L762-L773

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 6521057)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

https://goreportcard.com/report/github.com/docker/docker

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 6ada1cf)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

Keep allocated subnets in-order, so that they're not mistakenly
reallocated due to a gap in the list where misplaced subnets should
have been.

Introduced in 9d288b5.

The iterator over allocated subnets was incremented too early, this
change moves it past three clauses in addrSpace.allocatePredefinedPool().
The three new unit tests correspond to a separate failure caused by
incrementing before each of them.

(cherry picked from commit 4de54ee)
Signed-off-by: Rob Murray <[email protected]>

…ping_subnets

[27.0 backport] Fix duplicate subnet allocations

Regression introduced in 01eecb6.

A port mapping from a specific IPv6 host address can be used
by a container on an IPv4-only network, docker-proxy makes the
connection.

Signed-off-by: Rob Murray <[email protected]>
(cherry picked from commit dfbcddb)
Signed-off-by: Sebastiaan van Stijn <[email protected]>

[27.0 backport] fix some gofmt issues reported by goreportcard

[27.0 backport] daemon/graphdriver/overlay2: set TarOptions.InUserNS for native differ (fix "failed to Lchown "/dev/console")

…ific_ipv6_portmap_proxy_to_ipv4

[27.0 backport] Fix incorrect validation of port mapping