Previously it was difficult to debug which Docker credentials were
loaded and why if `DOCKER_AUTH_CONFIG` were specified.

This commit adds a debug message that shows which auth sources loaded
from which config. For example:

```
Loaded Docker credentials, source = "$DOCKER_AUTH_CONFIG", hostnames = [public.ecr.aws 312968203986.dkr.ecr.us-west-2.amazonaws.com], error = <nil>  job=4000 project=2 runner=fz-mj8s9
Loaded Docker credentials, source = "/Users/stanhu/.docker/config.json", hostnames = [dev.gitlab.org:5005 registry.gitlab.com], error = <nil>  job=4000 project=2 runner=fz-mj8s9
Loaded Docker credentials, source = "job payload (GitLab Registry)", hostnames = [gitlab.example.com:5050 registry.gitlab.example.com:443], error = <nil>  job=4000 project=2 runner=fz-mj8s9
Authenticating with credentials from $DOCKER_AUTH_CONFIG  job=4000 project=2 runner=fz-mj8s9
```

Changelog: added

Hide docker executor init behind a feature flag

Closes #37011 and #37003

See merge request gitlab-org/gitlab-runner!4488



Merged-by: Axel von Bertoldi <avonbertoldi@gitlab.com>
Approved-by: Fiona Neill <fneill@gitlab.com>
Approved-by: Romuald Atchadé <ratchade@gitlab.com>
Reviewed-by: Romuald Atchadé <ratchade@gitlab.com>

Over in
!4446, we,
among other things, added use of the `Init` option when creating
containers in the docker executor. We did this for all containers,
unconditionally. This was the wrong choice. It should have:
- been done only for service and build images. The helper image doesn't
  need this.
- been hidden behind a feature flag. Turns our there are a number of
  conditions where making tini-init PID 1 breaks things.

This will run `/sbin/docker-init -- sh` as PID 1, which will correctly
propagate SIGTERM (and other signals) to child process. Note that if any
of the child processes are shells, signal propagation will effectively
stop at that process since shells have the prickly property of
swallowing signals. All this to say this running the container with a
proper init system is not enough to guarantee graceful shutdown of the
container. We'll fox that later.

Muhammed Ali authored 2 years ago and Axel von Bertoldi committed 1 year ago

Allows users to specify a specific image platform to pull, that may be
different to the workers architecture.

see #28653 and #27919

This is the minimum set of mocks required (i.e. actually used by tests).

I've added the directive directly above the interface that needs to be
mocked. Another alternative is to put the directive in the test file
that uses the mock, but there are cases where a mock is used in more
than one file, and other where the mock is used outside of the package
in which the corresponding interface is defined, both of which made
things more awkward than the approach taken here.

The linter was emitting warnings about this, and would likely eventually
outright fail, so we may as well fix it before that happens.

I'm not sure why we have both the new `//go:build ...` and the old
`// +build ...` build directives, but the latter seem superfluous now.

Looks like the new version of mockery creates mocks for "function
types", whereas the previous version we used did not. Alas, there is no
runtime flag to skip creation of mocks for function types.

I'm commiting them here to make progress, but we can also keep track of
them and delete/ignore them.

Run `make mocks` to regenerate all mocks. Running this actually
generates net-new mocks and causes a test compilation failure, but we'll
address those later. This commit ONLY regenerates and updates
already-tracked mocks.

This commit replaces `ioutil.TempDir` with `t.TempDir` in tests. The
directory created by `t.TempDir` is automatically removed when the test
and all its subtests complete.

Prior to this commit, temporary directory created using `ioutil.TempDir`
needs to be removed manually by calling `os.RemoveAll`, which is omitted
in some tests. The error handling boilerplate e.g.
	defer func() {
		if err := os.RemoveAll(dir); err != nil {
			t.Fatal(err)
		}
	}
is also tedious, but `t.TempDir` handles this for us nicely.

Reference: https://pkg.go.dev/testing#T.TempDir


Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>

Aaron Friel authored 3 years ago and Arran Walker committed 3 years ago

We use ContainerStop to first send SIGTERM and then SIGKILL on error.

What:
Update to the latest version of `github.com/docker/cli`. The only usage
that we have for `github.com/docker/cli` is for
[`helpers/docker/auth`](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/master/helpers/docker/auth/auth.go).

Changes:
We are using it for `github.com/docker/cli/cli/config/configfile` which
the struct hasn't changed much (check the diff in the vendor directory)
and `github.com/docker/cli/cli/config/credentials` which also didn't
change.

The biggest change is that `github.com/docker/cli` start using its own
[AuthConfig](https://github.com/docker/cli/blob/d26bdfd4ea235a4e94c5fc907215b197280f80c0/cli/config/types/authconfig.go)
struct instead of the one from
[`github.com/moby/moby`](https://github.com/moby/moby/blob/76f4bbd0a894a325e93fec177b6f2b6e8cea5b20/api/types/auth.go)
and they are identical structs. This requires us to change the import
type from `github.com/docker/docker/api/types` to
`github.com/docker/cli/cli/config/types`. This was done by Docker in
https://github.com/docker/cli/commit/27b2797f7deb3ca5b7f80371d825113deb1faca1
to remove the dependecy from `github.com/moby/moby`.

Why:
This is part of the ongoing effort to support GPUs in GitLab Docker
executor which requires us to parse the gpu string, and we need to
update this library so we get access to
[opts/gpus](https://github.com/docker/cli/blob/master/opts/gpus.go) as
discussed inhttps://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/1955#note_495010465

reference !1955

Release notes:
https://docs.docker.com/engine/release-notes/#20102

Fix ContainerCreate API call for update

This uses a nil platform.Platform, but we may want to consider
sending a proper value.

Through `DOCKER_AUTH_CONFIG`

`client.NewClient` has been deprecated
https://github.com/docker/engine/blob/18.06/client/client.go#L286-L296
and removed in later versions for the library.

Pedro Pombeiro authored 4 years ago and Steve Xuereb - Out of Office Back 2025-04-21 committed 4 years ago

Instead of following the redirect we will send an error back to the
user.