nixpkgs/pkgs/applications/virtualization/containerd/default.nix
Martin Weinelt 8884729f19
containerd: 1.4.2 -> 1.4.3
Access controls for the shim’s API socket verified that the connecting
process had an effective UID of 0, but did not otherwise restrict
access to the abstract Unix domain socket. This would allow malicious
containers running in the same network namespace as the shim, with an
effective UID of 0 but otherwise reduced privileges, to cause new
processes to be run with elevated privileges.

Fixes: CVE-2020-15257
2020-12-01 17:10:19 +01:00

55 lines
1.3 KiB
Nix

{ lib, fetchFromGitHub, buildGoPackage, btrfs-progs, go-md2man, installShellFiles, util-linux, nixosTests }:
with lib;
buildGoPackage rec {
pname = "containerd";
version = "1.4.3";
# git commit for the above version's tag
commit = "7ad184331fa3e55e52b890ea95e65ba581ae3429";
src = fetchFromGitHub {
owner = "containerd";
repo = "containerd";
rev = "v${version}";
sha256 = "09xvhjg5f8h90w1y94kqqnqzhbhd62dcdd9wb9sdqakisjk6zrl0";
};
goPackagePath = "github.com/containerd/containerd";
outputs = [ "out" "man" ];
nativeBuildInputs = [ go-md2man installShellFiles util-linux ];
buildInputs = [ btrfs-progs ];
buildFlags = [ "VERSION=v${version}" "REVISION=${commit}" ];
BUILDTAGS = []
++ optional (btrfs-progs == null) "no_btrfs";
buildPhase = ''
cd go/src/${goPackagePath}
patchShebangs .
make binaries $buildFlags
'';
installPhase = ''
for b in bin/*; do
install -Dm555 $b $out/$b
done
make man
installManPage man/*.[1-9]
'';
passthru.tests = { inherit (nixosTests) docker; };
meta = {
homepage = "https://containerd.io/";
description = "A daemon to control runC";
license = licenses.asl20;
maintainers = with maintainers; [ offline vdemeester ];
platforms = platforms.linux;
};
}