ISO: Update Docker from 20.10.18 to 20.10.20

[spowelljr]

20.10.20

This release of Docker Engine contains partial mitigations for a Git vulnerability (CVE-2022-39253), and has updated handling of image:tag@digest image references.

The Git vulnerability allows a maliciously crafted Git repository, when used as a build context, to copy arbitrary filesystem paths into resulting containers/images; this can occur in both the daemon, and in API clients, depending on the versions and tools in use.

The mitigations available in this release and in other consumers of the daemon API are partial and only protect users who build a Git URL context (e.g. git+protocol://). As the vulnerability could still be exploited by manually run Git commands that interact with and check out submodules, users should immediately upgrade to a patched version of Git to protect against this vulernability. Further details are available from the GitHub blog (“Git security vulnerabilities announced”).

Client

Added a mitigation for CVE-2022-39253, when using the classic Builder with a Git URL as the build context.

Daemon

Updated handling of image:tag@digest references. When pulling an image using the image:tag@digest (“pull by digest”), image resolution happens through the content-addressable digest and the image and tag are not used. While this is expected, this could lead to confusing behavior, and could potentially be exploited through social engineering to run an image that is already present in the local image store. Docker now checks if the digest matches the repository name used to pull the image, and otherwise will produce an error.

Builder

Updated handling of image:tag@digest references. Refer to the “Daemon” section above for details.
Added a mitigation to the classic Builder and updated BuildKit to v0.8.3-31-gc0149372, for CVE-2022-39253.

Packaging

Update Docker Compose to v2.12.0.

https://docs.docker.com/engine/release-notes/#201020

20.10.19

Builder

• Fix an issue that could result in a panic during docker builder prune or docker system prune moby/moby#44122.

Daemon

• Fix a bug where using docker volume prune would remove volumes that were still in use if the daemon was running with “live restore” and was restarted moby/moby#44238.

Packaging

• Update Docker Compose to v2.11.2.
• Update Go runtime to 1.18.7, which contains fixes for CVE-2022-2879, CVE-2022-2880, and CVE-2022-41715.

https://docs.docker.com/engine/release-notes/#201019

[spowelljr]

Waiting for ISO in #15155 to be merged before building ISO

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: medyagh, spowelljr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [medyagh,spowelljr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spowelljr]

ok-to-build-iso

[minikube-bot]

Hi @spowelljr, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[spowelljr]

ok-to-build-iso

[spowelljr]

ok-to-build-iso

[minikube-bot]

Hi @spowelljr, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[spowelljr]

/ok-to-test

[minikube-pr-bot]

kvm2 driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 15159) |
+----------------+----------+---------------------+
| minikube start | 55.9s    | 55.8s               |
| enable ingress | 28.8s    | 27.6s               |
+----------------+----------+---------------------+

Times for minikube ingress: 30.7s 29.7s 26.2s 27.2s 30.2s
Times for minikube (PR 15159) ingress: 25.2s 29.2s 25.7s 29.2s 28.7s

Times for minikube start: 55.5s 56.9s 55.5s 56.1s 55.7s
Times for minikube (PR 15159) start: 55.4s 56.1s 57.6s 55.2s 54.7s

docker driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 15159) |
+----------------+----------+---------------------+
| minikube start | 27.4s    | 27.8s               |
| enable ingress | 22.3s    | 22.7s               |
+----------------+----------+---------------------+

Times for minikube ingress: 22.0s 23.5s 22.5s 22.0s 21.5s
Times for minikube (PR 15159) ingress: 22.6s 23.0s 23.0s 23.0s 22.0s

Times for minikube (PR 15159) start: 28.1s 27.7s 28.1s 27.3s 28.1s
Times for minikube start: 26.8s 26.9s 27.4s 27.6s 28.1s

docker driver with containerd runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 15159) |
+----------------+----------+---------------------+
| minikube start | 23.8s    | 26.9s               |
| enable ingress | 27.8s    | 29.0s               |
+----------------+----------+---------------------+

Times for minikube (PR 15159) start: 23.1s 26.9s 24.1s 34.6s 25.7s
Times for minikube start: 22.9s 23.6s 23.1s 26.1s 23.3s

Times for minikube (PR 15159) ingress: 37.0s 27.0s 27.0s 27.0s 27.0s
Times for minikube ingress: 31.0s 27.0s 27.0s 27.0s 27.0s

[minikube-pr-bot]

These are the flake rates of all failed tests.

Environment	Failed Tests	Flake Rate (%)
Docker_macOS	TestPause/serial/SecondStartNoReconfiguration (gopogh)	7.87 (chart)
Hyperkit_macOS	TestPause/serial/SecondStartNoReconfiguration (gopogh)	28.89 (chart)
Docker_Windows	TestFunctional/parallel/CertSync (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/CpCmd (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/FileSync (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/ImageCommands/ImageBuild (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/ImageCommands/ImageListJson (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/ImageCommands/ImageListShort (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/ImageCommands/ImageListTable (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/ImageCommands/ImageListYaml (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/NonActiveRuntimeDisabled (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/SSHCmd (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/UpdateContextCmd/no_changes (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/UpdateContextCmd/no_clusters (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/UpdateContextCmd/no_minikube_cluster (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/Version/components (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/serial/LogsCmd (gopogh)	41.79 (chart)
Docker_Windows	TestJSONOutput/start/parallel/DistinctCurrentSteps (gopogh)	41.79 (chart)
Docker_Windows	TestJSONOutput/start/parallel/IncreasingCurrentSteps (gopogh)	41.79 (chart)
Docker_Windows	TestJSONOutput/stop/parallel/DistinctCurrentSteps (gopogh)	41.79 (chart)
Docker_Windows	TestJSONOutput/stop/parallel/IncreasingCurrentSteps (gopogh)	41.79 (chart)
Docker_Windows	TestFunctional/parallel/DockerEnv/powershell (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/parallel/MySQL (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/parallel/NodeLabels (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/parallel/PersistentVolumeClaim (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/parallel/StatusCmd (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/parallel/TunnelCmd/serial/WaitService/Setup (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/serial/ComponentHealth (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/serial/ExtraConfig (gopogh)	42.54 (chart)
Docker_Windows	TestFunctional/serial/LogsFileCmd (gopogh)	42.54 (chart)
More tests...	Continued...

Too many tests failed - See test logs for more details.

To see the flake rates of all tests by environment, click here.