Fix an issue where docker build would fail when using --add-host=host.docker.internal:host-gateway
with BuildKit enabled moby/moby#44650.
Revert seccomp: block socket calls to AF_VSOCK in default profile moby/moby#44712.
This change, while favorable from a security standpoint, caused a change
in behavior for some use-cases. As such, we are reverting it to ensure
stability and compatibility for the affected users.

However, users of AF_VSOCK in containers should recognize that this
(special) address family is not currently namespaced in any version of
the Linux kernel, and may result in unexpected behavior, like containers
communicating directly with host hypervisors.

Future releases, will filter AF_VSOCK. Users who need to allow containers
to communicate over the unnamespaced AF_VSOCK will need to turn off seccomp
confinement or set a custom seccomp profile.

Packaging Updates

Update Docker Compose to v2.15.1.
Update Docker Buildx to v0.10.0.
Update containerd (containerd.io package) to v1.6.15.
Update the package versioning format for docker-compose-cli to allow distro version updates docker/docker-ce-packaging#822.
Update Go runtime to 1.18.10.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | require | patch | `v20.10.22+incompatible` -> `v20.10.23` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the logs for more information. --- ### Release Notes <details> <summary>docker/docker</summary> ### [`v20.10.23`](https://github.com/moby/moby/releases/tag/v20.10.23) [Compare Source](https://github.com/docker/docker/compare/v20.10.22...v20.10.23) ##### Bug fixes and enhancements - Fix an issue where `docker build` would fail when using `--add-host=host.docker.internal:host-gateway` with BuildKit enabled [moby/moby#44650](https://github.com/moby/moby/pull/44650). - Revert seccomp: block socket calls to `AF_VSOCK` in default profile [moby/moby#44712](https://github.com/moby/moby/pull/44712). This change, while favorable from a security standpoint, caused a change in behavior for some use-cases. As such, we are reverting it to ensure stability and compatibility for the affected users. However, users of `AF_VSOCK` in containers should recognize that this (special) address family is not currently namespaced in any version of the Linux kernel, and may result in unexpected behavior, like containers communicating directly with host hypervisors. Future releases, will filter `AF_VSOCK`. Users who need to allow containers to communicate over the unnamespaced `AF_VSOCK` will need to turn off seccomp confinement or set a custom seccomp profile. ##### Packaging Updates - Update Docker Compose to [v2.15.1](https://github.com/docker/compose/releases/tag/v2.15.1). - Update Docker Buildx to [v0.10.0](https://github.com/docker/buildx/releases/tag/v0.10.0). - Update containerd (`containerd.io` package) to [v1.6.15](https://github.com/containerd/containerd/releases/tag/v1.6.15). - Update the package versioning format for `docker-compose-cli` to allow distro version updates [docker/docker-ce-packaging#822](https://github.com/docker/docker-ce-packaging/pull/822). - Update Go runtime to [1.18.10](https://go.dev/doc/devel/release#go1.18.minor). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2023-01-21 01:19:17 +00:00