Affected by GO-2022-0390
and 6 other vulnerabilities
GO-2022-0390: Moby (Docker Engine) started with non-empty inheritable Linux process capabilities in github.com/docker/docker
GO-2022-0985: Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker
GO-2022-1107: Container build can leak any path on the host into the container in github.com/docker/docker
GO-2023-1699: Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
GO-2023-1700: Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker
GO-2023-1701: Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker
GO-2024-2914: Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker
NewControl - initialize project quota support.
Test to make sure that quota can be set on a test dir and find
the first project id to be used for the next container create.
Returns nil (and error) if project quota is not supported.
First get the project id of the home directory.
This test will fail if the backing fs is not xfs.
xfs_quota tool can be used to assign a project id to the driver home directory, e.g.:
In that case, the home directory project id will be used as a "start offset"
and all containers will be assigned larger project ids (e.g. >= 1000).
This is a way to prevent xfs_quota management from conflicting with docker.
Then try to create a test directory with the next project id and set a quota
on it. If that works, continue to scan existing containers to map allocated
project ids.