Merge remote-tracking branch 'origin/main' into ICU-1573

CHANGELOG.md

@@ -23,6 +23,9 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   added to roles to provide grants to users.
 * dev: Predictable IDs in `boundary dev` mode now extend to the accounts created
   in the default `password` and `oidc` auth methods.
+* mlock: Add a Docker entrypoint script and modify Dockerfiles to handle mlock
+  in a fashion similar to Vault
+  ([PR](https://github.com/hashicorp/boundary/pull/1269))
 
 ## 0.2.3 (2021/05/21)
 

ci/goinstall.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 
-VERSION="1.16.4"
+VERSION="1.16.5"
 
 [ -z "$GOROOT" ] && GOROOT="$HOME/.go"
 [ -z "$GOPATH" ] && GOPATH="$HOME/go"

docker/Dev.dockerfile

@@ -12,6 +12,6 @@ RUN chown -R boundary:boundary /boundary/
 EXPOSE 9200 9201 9202
 VOLUME /boundary/
 
-USER boundary
-ENTRYPOINT ["/bin/boundary"]
+COPY ./docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["server", "-config", "/boundary/config.hcl"]

docker/Release.dockerfile

@@ -41,6 +41,6 @@ RUN chown -R boundary:boundary /boundary/
 EXPOSE 9200 9201 9202
 VOLUME /boundary/
 
-USER boundary
-ENTRYPOINT ["/bin/boundary"]
+COPY ./docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["server", "-config", "/boundary/config.hcl"]

docker/docker-entrypoint.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/dumb-init /bin/sh
+set -e
+
+# Note above that we run dumb-init as PID 1 in order to reap zombie processes
+# as well as forward signals to all processes in its session. Normally, sh
+# wouldn't do either of these functions so we'd leak zombies as well as do
+# unclean termination of all our sub-processes.
+
+# Prevent core dumps
+ulimit -c 0
+
+# If the user is trying to run Boundary directly with some arguments, then
+# pass them to Boundary.
+if [ "${1:0:1}" = '-' ]; then
+    set -- boundary "$@"
+fi
+
+if [ "$1" = 'server' ]; then
+    shift
+    set -- boundary server \
+        "$@"
+fi
+
+# If we are running Boundary, make sure it executes as the proper user.
+if [ "$1" = 'boundary' ]; then
+    if [ -z "$SKIP_CHOWN" ]; then
+        # If the config dir is bind mounted then chown it
+        if [ "$(stat -c %u /boundary)" != "$(id -u boundary)" ]; then
+            chown -R boundary:boundary /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
+        fi
+    fi
+
+    if [ -z "$SKIP_SETCAP" ]; then
+        # Allow mlock to avoid swapping Boundary memory to disk
+        setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))
+
+        # In the case Boundary has been started in a container without IPC_LOCK privileges
+        if ! boundary -version 1>/dev/null 2>/dev/null; then
+            >&2 echo "Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
+            setcap cap_ipc_lock=-ep $(readlink -f $(which boundary))
+        fi
+    fi
+
+    if [ "$(id -u)" = '0' ]; then
+      set -- su-exec boundary "$@"
+    fi
+fi
+
+exec "$@"

internal/ui/VERSION

@@ -1,4 +1,4 @@
-685ddeac7e9905dcb98660df60b426e9a64a4460 Merge pull request #549 from hashicorp/ICU-1335-close-session-on-cancel
+40ee317f47100e0be459f9c6aee12e966efd7961 Merge pull request #588 from hashicorp/frameless-desktop-shell-on-windows-os
 # This file determines the version of the UI to embed in the boundary binary.
 # Update this file by running 'make update-ui-version' from the root of this repo.
 # Set UI_COMMITISH when running the above target to update to a specific version.

packages-oss.yml

@@ -50,8 +50,8 @@ package-aliases:
     template: >-
       boundary/{{.BUNDLE_NAME}}/{{.BUNDLE_NAME}}_{{.GOOS}}_{{.GOARCH}}.zip
 
-# golang:1.16.4-buster
-base-image: "docker.mirror.hashicorp.services/golang@sha256:f7a5c5872d4bb68e152be72e4a4bf9a142a47ec2dcbb4074798d4feb6197abd7"
+# golang:1.16.5-buster
+base-image: "docker.mirror.hashicorp.services/golang@sha256:be0e3a0f3ffa448b0bcbb9019edca692b8278407a44dc138c60e6f12f0218f87"
 
 layers:
   - name: base

website/data/alert-banner.js

@@ -1,10 +1,12 @@
 export const ALERT_BANNER_ACTIVE = true
 
+// https://github.com/hashicorp/react-components/tree/main/packages/alert-banner
 export default {
   tag: 'June 8-11',
-  text:
-    'The countdown to HashiConf Europe is on, and the full schedule is now live.',
-  linkText: 'View Schedule',
   url: 'https://hashiconf.com/europe/?utm_source=DocsBanner',
-  expirationDate: null,
+  text: 'HashiConf Europe is happening now. Join all sessions live June 8 & 9.',
+  linkText: 'Join Now',
+  // Set the `expirationDate prop with a datetime string (e.g. `2020-01-31T12:00:00-07:00`)
+  // if you'd like the component to stop showing at or after a certain date
+  expirationDate: `2021-06-12T12:00:00-07:00`,
 }

website/package-lock.json

@@ -8544,9 +8544,9 @@
       }
     },
     "lodash": {
-      "version": "4.17.20",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
-      "integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA=="
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     },
     "lodash-es": {
       "version": "4.17.21",
@@ -14733,9 +14733,9 @@
       }
     },
     "ws": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-6.2.1.tgz",
-      "integrity": "sha512-GIyAXC2cB7LjvpgMt9EKS2ldqr0MTrORaleiOno6TweZ6r3TKtoFQWay/2PceJ3RuBasOHzXNn5Lrw1X0bEjqA==",
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-6.2.2.tgz",
+      "integrity": "sha512-zmhltoSR8u1cnDsD43TX59mzoMZsLKqUweyYBAIvTngR3shc0W6aOZylZmq/7hqyVxPdi+5Ud2QInblgyE72fw==",
       "requires": {
         "async-limiter": "~1.0.0"
       }