From 0f0137a7dbb9f7f8d7336c4b85a6a21d928b3bdf Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Mon, 7 Jun 2021 19:23:21 -0500 Subject: [PATCH 1/6] Update to Go 1.16.5 (#1288) --- ci/goinstall.sh | 2 +- packages-oss.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ci/goinstall.sh b/ci/goinstall.sh index 289b945f9..79e1c01f0 100755 --- a/ci/goinstall.sh +++ b/ci/goinstall.sh @@ -1,7 +1,7 @@ #!/bin/bash set -e -VERSION="1.16.4" +VERSION="1.16.5" [ -z "$GOROOT" ] && GOROOT="$HOME/.go" [ -z "$GOPATH" ] && GOPATH="$HOME/go" diff --git a/packages-oss.yml b/packages-oss.yml index 370652e1e..307769886 100644 --- a/packages-oss.yml +++ b/packages-oss.yml @@ -50,8 +50,8 @@ package-aliases: template: >- boundary/{{.BUNDLE_NAME}}/{{.BUNDLE_NAME}}_{{.GOOS}}_{{.GOARCH}}.zip -# golang:1.16.4-buster -base-image: "docker.mirror.hashicorp.services/golang@sha256:f7a5c5872d4bb68e152be72e4a4bf9a142a47ec2dcbb4074798d4feb6197abd7" +# golang:1.16.5-buster +base-image: "docker.mirror.hashicorp.services/golang@sha256:be0e3a0f3ffa448b0bcbb9019edca692b8278407a44dc138c60e6f12f0218f87" layers: - name: base From cc843dd796f4e1fa24f0e81792bed98fe73edbca Mon Sep 17 00:00:00 2001 From: Joe Thompson Date: Mon, 7 Jun 2021 23:42:28 -0400 Subject: [PATCH 2/6] Add a Docker entrypoint script and modify Dockerfiles to mimic Vault, to enable mlock inside Docker containers (#1269) * Add a Docker entrypoint script and modify Dockerfiles to enable mlock --- CHANGELOG.md | 5 ++++ docker/Dev.dockerfile | 4 +-- docker/Release.dockerfile | 4 +-- docker/docker-entrypoint.sh | 49 +++++++++++++++++++++++++++++++++++++ 4 files changed, 58 insertions(+), 4 deletions(-) create mode 100755 docker/docker-entrypoint.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 1204778de..bb2048c1b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. ## Next +### New and Improved + +* mlock: Add a Docker entrypoint script and modify Dockerfiles to mimic Vault + ([PR](https://github.com/hashicorp/boundary/pull/1269)) + ## 0.2.3 (2021/05/21) ### Deprecations/Changes diff --git a/docker/Dev.dockerfile b/docker/Dev.dockerfile index f44593e96..633dafe9b 100644 --- a/docker/Dev.dockerfile +++ b/docker/Dev.dockerfile @@ -12,6 +12,6 @@ RUN chown -R boundary:boundary /boundary/ EXPOSE 9200 9201 9202 VOLUME /boundary/ -USER boundary -ENTRYPOINT ["/bin/boundary"] +COPY ./docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh +ENTRYPOINT ["docker-entrypoint.sh"] CMD ["server", "-config", "/boundary/config.hcl"] diff --git a/docker/Release.dockerfile b/docker/Release.dockerfile index d4ed7127e..80b96f5d2 100644 --- a/docker/Release.dockerfile +++ b/docker/Release.dockerfile @@ -41,6 +41,6 @@ RUN chown -R boundary:boundary /boundary/ EXPOSE 9200 9201 9202 VOLUME /boundary/ -USER boundary -ENTRYPOINT ["/bin/boundary"] +COPY ./docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh +ENTRYPOINT ["docker-entrypoint.sh"] CMD ["server", "-config", "/boundary/config.hcl"] diff --git a/docker/docker-entrypoint.sh b/docker/docker-entrypoint.sh new file mode 100755 index 000000000..994b1d809 --- /dev/null +++ b/docker/docker-entrypoint.sh @@ -0,0 +1,49 @@ +#!/usr/bin/dumb-init /bin/sh +set -e + +# Note above that we run dumb-init as PID 1 in order to reap zombie processes +# as well as forward signals to all processes in its session. Normally, sh +# wouldn't do either of these functions so we'd leak zombies as well as do +# unclean termination of all our sub-processes. + +# Prevent core dumps +ulimit -c 0 + +# If the user is trying to run Boundary directly with some arguments, then +# pass them to Boundary. +if [ "${1:0:1}" = '-' ]; then + set -- boundary "$@" +fi + +if [ "$1" = 'server' ]; then + shift + set -- boundary server \ + "$@" +fi + +# If we are running Boundary, make sure it executes as the proper user. +if [ "$1" = 'boundary' ]; then + if [ -z "$SKIP_CHOWN" ]; then + # If the config dir is bind mounted then chown it + if [ "$(stat -c %u /boundary)" != "$(id -u boundary)" ]; then + chown -R boundary:boundary /boundary || echo "Could not chown /boundary (may not have appropriate permissions)" + fi + fi + + if [ -z "$SKIP_SETCAP" ]; then + # Allow mlock to avoid swapping Boundary memory to disk + setcap cap_ipc_lock=+ep $(readlink -f $(which boundary)) + + # In the case Boundary has been started in a container without IPC_LOCK privileges + if ! boundary -version 1>/dev/null 2>/dev/null; then + >&2 echo "Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK" + setcap cap_ipc_lock=-ep $(readlink -f $(which boundary)) + fi + fi + + if [ "$(id -u)" = '0' ]; then + set -- su-exec boundary "$@" + fi +fi + +exec "$@" From 002f165552bbbb6c9e259ad62bead2b64d6c3425 Mon Sep 17 00:00:00 2001 From: Kendall Strautman <36613477+kendallstrautman@users.noreply.github.com> Date: Mon, 7 Jun 2021 20:44:03 -0700 Subject: [PATCH 3/6] =?UTF-8?q?chore:=20updates=20alert-banner=20=E2=80=94?= =?UTF-8?q?=20hashiconf=20=20(#1264)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: updates alert-banner — hashiconf eu --- website/data/alert-banner.js | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/website/data/alert-banner.js b/website/data/alert-banner.js index da923312d..2a166ab93 100644 --- a/website/data/alert-banner.js +++ b/website/data/alert-banner.js @@ -1,10 +1,12 @@ export const ALERT_BANNER_ACTIVE = true +// https://github.com/hashicorp/react-components/tree/main/packages/alert-banner export default { tag: 'June 8-11', - text: - 'The countdown to HashiConf Europe is on, and the full schedule is now live.', - linkText: 'View Schedule', url: 'https://hashiconf.com/europe/?utm_source=DocsBanner', - expirationDate: null, + text: 'HashiConf Europe is happening now. Join all sessions live June 8 & 9.', + linkText: 'Join Now', + // Set the `expirationDate prop with a datetime string (e.g. `2020-01-31T12:00:00-07:00`) + // if you'd like the component to stop showing at or after a certain date + expirationDate: `2021-06-12T12:00:00-07:00`, } From d2da59b68dd7be21996aab32717909bd0ca474d0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Jun 2021 05:46:03 -0700 Subject: [PATCH 4/6] Bump ws from 6.2.1 to 6.2.2 in /website (#1283) Bumps [ws](https://github.com/websockets/ws) from 6.2.1 to 6.2.2. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/commits) --- updated-dependencies: - dependency-name: ws dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- website/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/package-lock.json b/website/package-lock.json index 3de60b467..55ba89bb5 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -14733,9 +14733,9 @@ } }, "ws": { - "version": "6.2.1", - "resolved": "https://registry.npmjs.org/ws/-/ws-6.2.1.tgz", - "integrity": "sha512-GIyAXC2cB7LjvpgMt9EKS2ldqr0MTrORaleiOno6TweZ6r3TKtoFQWay/2PceJ3RuBasOHzXNn5Lrw1X0bEjqA==", + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/ws/-/ws-6.2.2.tgz", + "integrity": "sha512-zmhltoSR8u1cnDsD43TX59mzoMZsLKqUweyYBAIvTngR3shc0W6aOZylZmq/7hqyVxPdi+5Ud2QInblgyE72fw==", "requires": { "async-limiter": "~1.0.0" } From 566fd3312eaa458950229dc652ad4300841f0f30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Jun 2021 05:47:18 -0700 Subject: [PATCH 5/6] Bump lodash from 4.17.20 to 4.17.21 in /website (#1206) Bumps [lodash](https://github.com/lodash/lodash) from 4.17.20 to 4.17.21. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.20...4.17.21) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- website/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/package-lock.json b/website/package-lock.json index 55ba89bb5..a3e975584 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -8544,9 +8544,9 @@ } }, "lodash": { - "version": "4.17.20", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz", - "integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==" + "version": "4.17.21", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", + "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==" }, "lodash-es": { "version": "4.17.21", From 5c5678cd395a6a8b32da662823b0647255c6a157 Mon Sep 17 00:00:00 2001 From: Randall Morey Date: Tue, 8 Jun 2021 12:33:31 -0400 Subject: [PATCH 6/6] chore: bump UI version to include OIDC CRUD (#1280) * chore: bump UI version to include OIDC CRUD * chore: bump ui version again --- internal/ui/VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/ui/VERSION b/internal/ui/VERSION index 23f7f31a6..a0270fb29 100644 --- a/internal/ui/VERSION +++ b/internal/ui/VERSION @@ -1,4 +1,4 @@ -685ddeac7e9905dcb98660df60b426e9a64a4460 Merge pull request #549 from hashicorp/ICU-1335-close-session-on-cancel +40ee317f47100e0be459f9c6aee12e966efd7961 Merge pull request #588 from hashicorp/frameless-desktop-shell-on-windows-os # This file determines the version of the UI to embed in the boundary binary. # Update this file by running 'make update-ui-version' from the root of this repo. # Set UI_COMMITISH when running the above target to update to a specific version.