Nalin Dahyabhai

RUN-1933: test unprivileged builds

20

Test builds where we set BUILD_PRIVILEGED=false in the environment to ask the build controller to ask nodes to run builds with fewer privileges. Verify that builds run with lower privileges...

dockerclient quietly ignores the --chmod flag for ADD/COPY

3

We extended the parser to recognize it and add a field to `Copy` structs, but didn't teach `dockerclient` to either use the value or produce an error when people attempted...

WIP: commit: optionally create layers for ADD/COPY/RUN/WORKDIR

21

#### What type of PR is this? /kind bug #### What this PR does / why we need it: In multi-layer mode, only add layers when ADD, COPY, RUN, or...

tar.Reader(): add NextHeader()

2

Add a `NextHeader()` method to `tar.Reader` that can reuse a passed-in `Header` structure. When looping through a lengthy archive, calling `Next()` for each entry can end up allocating a _lot_...

archive parsing: use strings.Trim...Func() instead of strings.Trim()

4

When trimming string values as part of parsing them, use the `string.Trim()` variants that take a callback function instead of a string of characters to trim, so that they won't...

WIP: make it so that journald logs are ascribed to containers

11

Looking for feedback on this. Currently, when we log container output to the journal, _dockerd_ is doing the work of forwarding each piece of output to _journald_. For every piece...

If libkrun-sev is installed, but /dev/sev doesn't exist, rootless krun fails

4

If libkrun-sev is installed, but there is no `/dev/sev`, rootless krun will attempt to bind mount a `/dev/sev` that doesn't exist into containers, even for containers which aren't using SEV....

Remove hard-coded default for RHS

11

Don't fall back to using a default LHS or RHS when the configuration file can't be read. Original report from https://bugzilla.redhat.com/show_bug.cgi?id=1332493

A couple of potential security bugs

2

Hi, I got a couple of bug reports today that affect the client library. [#1332508](https://bugzilla.redhat.com/show_bug.cgi?id=1332508) is largely about checks that we have around getenv() no longer being sufficient, and [#1332493](https://bugzilla.redhat.com/show_bug.cgi?id=1332493)...

libimage.Image.matchesPlatform() is sometimes wrong

13

matchesPlatform() inspects images to retrieve their OS/Architecture/Variant values and, after canonicalization, compares the values it finds to passed-in values. Images don't always have this information, so it can be wrong,...