From 612793826485a232a6d6fb9d416e1be6b1fc0a9b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 3 Aug 2026 12:20:49 +0200 Subject: [PATCH] vendor: github.com/docker/cli v29.7.1 Signed-off-by: Sebastiaan van Stijn --- .../cli/docs/extend/plugins_authorization.md | 21 +++++++++++-------- _vendor/modules.txt | 2 +- go.mod | 2 +- go.sum | 2 ++ 4 files changed, 16 insertions(+), 11 deletions(-) diff --git a/_vendor/github.com/docker/cli/docs/extend/plugins_authorization.md b/_vendor/github.com/docker/cli/docs/extend/plugins_authorization.md index 8c84d6e384..605fac16fa 100644 --- a/_vendor/github.com/docker/cli/docs/extend/plugins_authorization.md +++ b/_vendor/github.com/docker/cli/docs/extend/plugins_authorization.md @@ -95,6 +95,18 @@ The Engine's authorization middleware fails closed: when a plugin returns an err the request is denied and the error is surfaced to the client. Plugins should also fail closed: if the plugin cannot confidently evaluate a request, it should return an error or `Allow: false`. +> [!WARNING] +> Because the plugin receives the [**raw** request body](#authzpluginauthzreq) from the daemon, it must +> apply the same decoding semantics as the daemon to be sure it evaluates the request the daemon will +> act on. The daemon decodes JSON with Go's [`encoding/json.Unmarshal`](https://pkg.go.dev/encoding/json#Unmarshal). +> +> The same requirement applies to the response body. Plugins that depend on `ResponseBody` +> inspection for redaction or content-filtering should restrict their policies to endpoints +> whose response is produced as a single write (typical of REST-style API responses). For +> commands whose responses are streamed or are likely to exceed the [buffer](#response-body-size-and-partial-buffering) through multiple +> writes, do not rely on `ResponseBody` for security-relevant decisions; perform the filtering +> in a separate layer in front of the daemon. + ### Response body size and partial buffering The internal buffer that holds the response body between the daemon's HTTP @@ -111,15 +123,6 @@ is the practical effect of this 64 KiB threshold combined with the is immediately drained to the client and is therefore no longer available for plugin inspection by the time the handler returns. -> [!NOTE] -> Plugins that depend on `ResponseBody` inspection for redaction or -> content-filtering should restrict their policies to endpoints whose -> response is produced as a single write (typical of REST-style API -> responses). For commands whose responses are streamed or are likely to -> exceed the buffer through multiple writes, do not rely on `ResponseBody` -> for security-relevant decisions; perform the filtering in a separate -> layer in front of the daemon. - During request/response processing, some authorization flows might need to do additional queries to the Docker daemon. To complete such flows, plugins can call the daemon API similar to a regular user. To enable these diff --git a/_vendor/modules.txt b/_vendor/modules.txt index 8ae6b7d2dc..ead1f6377d 100644 --- a/_vendor/modules.txt +++ b/_vendor/modules.txt @@ -1,7 +1,7 @@ # github.com/moby/moby/api v1.55.0 # github.com/moby/buildkit v0.32.0 # github.com/docker/buildx v0.36.0 -# github.com/docker/cli v29.6.2+incompatible +# github.com/docker/cli v29.7.1+incompatible # github.com/docker/compose/v5 v5.3.0 # github.com/docker/model-runner v1.1.36 # github.com/docker/docker-agent v1.110.0 diff --git a/go.mod b/go.mod index abcf04f18e..fc94d934ac 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ go 1.26.5 // Make sure to add an entry in the "tools" section when adding a new repository. require ( github.com/docker/buildx v0.36.0 - github.com/docker/cli v29.6.2+incompatible + github.com/docker/cli v29.7.1+incompatible github.com/docker/compose/v5 v5.3.0 github.com/docker/docker-agent v1.110.0 github.com/docker/model-runner v1.1.36 diff --git a/go.sum b/go.sum index 44ffa33f5c..09182a2899 100644 --- a/go.sum +++ b/go.sum @@ -114,6 +114,8 @@ github.com/docker/cli v29.6.1+incompatible h1:oO7F4nn3Ovr/5TlfTUWFbMwBSS/B7Xs6Ep github.com/docker/cli v29.6.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.7.1+incompatible h1:ILZpP6B7fedIr6ANy824QkDp1WMJuouIq0O2SrBkB2w= +github.com/docker/cli v29.7.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/compose/v5 v5.0.0 h1:J2uMCzJ/5xLcoIVVXvMmPe6HBzVQpmJThKa7Qk7Xldc= github.com/docker/compose/v5 v5.0.0/go.mod h1:BurapGv8zmYnsbSmlpCz5EU2Pi3YFV/PjeUnoFpcw64= github.com/docker/compose/v5 v5.0.1 h1:5yCjDJbwUqcuI+6WNFHNWz2/3vyBDsNnfe8LlFjyxEc=