Skip to content

ci: confine dependencies with gomodjail (static mode) #7411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AkihiroSuda wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ci: confine dependencies with gomodjail (static mode) #7411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .github/workflows/validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,3 +109,41 @@ jobs:
working-directory: ${{ github.workspace }}/src/github.com/docker/cli
run: |
make -C ./internal/gocompat verify

# check that dependencies confined in vendor.mod cannot reach privileged
# capabilities (file, network, exec, syscall, ...), using gomodjail in
# static mode. see the comment at the top of vendor.mod.
validate-gomodjail:
runs-on: ubuntu-26.04
env:
GOMODJAIL_VERSION: v2.0.1
strategy:
fail-fast: false
matrix:
goos:
- linux
- darwin
# windows is not checked yet, as the analysis reports false
# positives inside the Go standard library on windows.
steps:
-
name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
-
name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: "1.26.9"
cache: false
-
name: Install gomodjail
run: |
go install "github.com/AkihiroSuda/gomodjail/v2/cmd/gomodjail@${GOMODJAIL_VERSION}"
-
name: Run gomodjail
env:
GOOS_TARGET: ${{ matrix.goos }}
run: |
scripts/with-go-mod.sh gomodjail analyze --goos="${GOOS_TARGET}" --goarch=amd64 ./...
72 changes: 43 additions & 29 deletions vendor.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
// gomodjail:confined
module github.com/docker/cli

// 'vendor.mod' enables use of 'go mod vendor' to managed 'vendor/' directory.
Expand All @@ -15,57 +16,57 @@ require (
dario.cat/mergo v1.0.2
github.com/containerd/errdefs v1.0.0
github.com/containerd/errdefs/pkg v0.3.0
github.com/containerd/log v0.2.0
github.com/containerd/platforms v1.0.0-rc.5
github.com/containerd/log v0.2.0 // gomodjail:unconfined
github.com/containerd/platforms v1.0.0-rc.5 // gomodjail:unconfined
Comment on lines +19 to +20

@thaJeztah thaJeztah Nov 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there ways to configure this other than through go.mod ? Also considering that (parts of?) a separate config could be more easily shared / maintained centrally.

@AkihiroSuda AkihiroSuda Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there ways to configure this other than through go.mod ?

gomodjail analyze has --policy flag, but the UX doesn't scale for dozens of deps

--policy stringToString       e.g., example.com/module=confined (overrides go.mod) (default [])

Maybe we should consider having a separate file like go.mod.policy.yaml? (or toml? hcl?)

github.com/creack/pty v1.1.24
github.com/distribution/reference v0.6.0
github.com/docker/cli-docs-tool v0.11.0
github.com/docker/distribution v2.8.3+incompatible
github.com/docker/docker-credential-helpers v0.9.12
github.com/docker/go-connections v0.8.2
github.com/docker/distribution v2.8.3+incompatible // gomodjail:unconfined
github.com/docker/docker-credential-helpers v0.9.12 // gomodjail:unconfined
github.com/docker/go-connections v0.8.2 // gomodjail:unconfined
github.com/docker/go-units v0.5.0
github.com/fvbommel/sortorder v1.2.1
github.com/go-jose/go-jose/v4 v4.1.7
github.com/go-viper/mapstructure/v2 v2.5.0
github.com/gogo/protobuf v1.3.2
github.com/google/go-cmp v0.7.0
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/google/uuid v1.6.0
github.com/google/uuid v1.6.0 // gomodjail:unconfined
github.com/mattn/go-runewidth v0.0.31
github.com/moby/go-archive v0.3.3
github.com/moby/go-archive v0.3.3 // gomodjail:unconfined
github.com/moby/moby/api v1.56.2-0.20261106011722-402d0a16f131
github.com/moby/moby/client v0.6.3-0.20261106011722-402d0a16f131
github.com/moby/moby/client v0.6.3-0.20261106011722-402d0a16f131 // gomodjail:unconfined
github.com/moby/patternmatcher v0.6.1
github.com/moby/swarmkit/v2 v2.1.3
github.com/moby/sys/atomicwriter v0.1.0
github.com/moby/sys/capability v0.5.0
github.com/moby/sys/sequential v0.7.0
github.com/moby/sys/signal v0.7.1
github.com/moby/sys/symlink v0.3.0
github.com/moby/term v0.5.2
github.com/moby/swarmkit/v2 v2.1.3 // gomodjail:unconfined
github.com/moby/sys/atomicwriter v0.1.0 // gomodjail:unconfined
github.com/moby/sys/capability v0.5.0 // gomodjail:unconfined
github.com/moby/sys/sequential v0.7.0 // gomodjail:unconfined
github.com/moby/sys/signal v0.7.1 // gomodjail:unconfined
github.com/moby/sys/symlink v0.3.0 // gomodjail:unconfined
github.com/moby/term v0.5.2 // gomodjail:unconfined
github.com/morikuni/aec v1.1.0
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.1
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
github.com/sirupsen/logrus v1.10.2
github.com/spf13/cobra v1.10.2
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // gomodjail:unconfined
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // gomodjail:unconfined
github.com/sirupsen/logrus v1.10.2 // gomodjail:unconfined
github.com/spf13/cobra v1.10.2 // gomodjail:unconfined
github.com/spf13/pflag v1.0.10
github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0
go.opentelemetry.io/otel v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0
github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346 // gomodjail:unconfined
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // gomodjail:unconfined
go.opentelemetry.io/otel v1.47.0 // gomodjail:unconfined
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.47.0 // gomodjail:unconfined
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0 // gomodjail:unconfined
go.opentelemetry.io/otel/metric v1.47.0
go.opentelemetry.io/otel/sdk v1.47.0
go.opentelemetry.io/otel/sdk/metric v1.47.0
go.opentelemetry.io/otel/sdk v1.47.0 // gomodjail:unconfined
go.opentelemetry.io/otel/sdk/metric v1.47.0 // gomodjail:unconfined
go.opentelemetry.io/otel/trace v1.47.0
go.yaml.in/yaml/v3 v3.0.6
golang.org/x/sync v0.25.0
golang.org/x/sys v0.50.0
golang.org/x/term v0.48.0
golang.org/x/sys v0.50.0 // gomodjail:unconfined
golang.org/x/term v0.48.0 // gomodjail:unconfined
golang.org/x/text v0.44.0
gotest.tools/v3 v3.5.2
gotest.tools/v3 v3.5.2 // gomodjail:unconfined
tags.cncf.io/container-device-interface v1.1.1
)

Expand All @@ -77,36 +78,49 @@ require (
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
// gomodjail:unconfined
github.com/docker/go-events v0.1.0 // indirect
Comment on lines +81 to 82

@thaJeztah thaJeztah Nov 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.. and for the indirects; this feels brittle; a comment can (and will?) be left behind, now describing the wrong dependency

@AkihiroSuda AkihiroSuda Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment could be also written as // indirect // gomodjail:unconfined but IIRC dependabot didn't work well with it.
This docker/cli repo doesn't use dependabot though.

// gomodjail:unconfined
github.com/docker/go-metrics v0.1.0 // indirect
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
github.com/felixge/httpsnoop v1.1.0 // indirect
github.com/go-logr/logr v1.4.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
// gomodjail:unconfined
github.com/gorilla/mux v1.8.1 // indirect
// gomodjail:unconfined
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/klauspost/compress v1.20.2 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
// gomodjail:unconfined
github.com/moby/sys/user v0.4.1 // indirect
// gomodjail:unconfined
github.com/moby/sys/userns v0.2.1 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
// gomodjail:unconfined
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
// gomodjail:unconfined
github.com/prometheus/common v0.62.0 // indirect
// gomodjail:unconfined
github.com/prometheus/procfs v0.15.1 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
go.etcd.io/raft/v3 v3.6.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
// gomodjail:unconfined
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
go.opentelemetry.io/otel/log v1.47.0 // indirect
// gomodjail:unconfined
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
golang.org/x/mod v0.43.0 // indirect
// gomodjail:unconfined
golang.org/x/net v0.62.0 // indirect
golang.org/x/time v0.16.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
// gomodjail:unconfined
google.golang.org/grpc v1.83.2 // indirect
google.golang.org/protobuf v1.36.12 // indirect
)
Loading