From 8073db15be2aa3898d5ae902509fa04a42b56872 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 19 Oct 2026 17:36:41 +0900 Subject: [PATCH] ci: confine dependencies with gomodjail (static mode) Mark all the modules in vendor.mod as confined by default with gomodjail, and run `gomodjail analyze` (static mode) in CI to verify that confined modules cannot reach privileged capabilities such as file, network, exec, syscall, etc. Modules that already need such capabilities are annotated as "gomodjail:unconfined". Newly added dependencies are confined by default, so an update that newly gains a privileged capability fails the check and gets more review. https://github.com/AkihiroSuda/gomodjail Assisted-by: Claude Opus 5.5 (1M context) Signed-off-by: Akihiro Suda --- .github/workflows/validate.yml | 38 ++++++++++++++++++ vendor.mod | 72 ++++++++++++++++++++-------------- 2 files changed, 81 insertions(+), 29 deletions(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 1396c8d7b0aa..aac181cb8337 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -109,3 +109,41 @@ jobs: working-directory: ${{ github.workspace }}/src/github.com/docker/cli run: | make -C ./internal/gocompat verify + + # check that dependencies confined in vendor.mod cannot reach privileged + # capabilities (file, network, exec, syscall, ...), using gomodjail in + # static mode. see the comment at the top of vendor.mod. + validate-gomodjail: + runs-on: ubuntu-26.04 + env: + GOMODJAIL_VERSION: v2.0.1 + strategy: + fail-fast: false + matrix: + goos: + - linux + - darwin + # windows is not checked yet, as the analysis reports false + # positives inside the Go standard library on windows. + steps: + - + name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - + name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: "1.26.9" + cache: false + - + name: Install gomodjail + run: | + go install "github.com/AkihiroSuda/gomodjail/v2/cmd/gomodjail@${GOMODJAIL_VERSION}" + - + name: Run gomodjail + env: + GOOS_TARGET: ${{ matrix.goos }} + run: | + scripts/with-go-mod.sh gomodjail analyze --goos="${GOOS_TARGET}" --goarch=amd64 ./... diff --git a/vendor.mod b/vendor.mod index 9b14b2e61eb9..1b3815af1b35 100644 --- a/vendor.mod +++ b/vendor.mod @@ -1,3 +1,4 @@ +// gomodjail:confined module github.com/docker/cli // 'vendor.mod' enables use of 'go mod vendor' to managed 'vendor/' directory. @@ -15,14 +16,14 @@ require ( dario.cat/mergo v1.0.2 github.com/containerd/errdefs v1.0.0 github.com/containerd/errdefs/pkg v0.3.0 - github.com/containerd/log v0.2.0 - github.com/containerd/platforms v1.0.0-rc.5 + github.com/containerd/log v0.2.0 // gomodjail:unconfined + github.com/containerd/platforms v1.0.0-rc.5 // gomodjail:unconfined github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli-docs-tool v0.11.0 - github.com/docker/distribution v2.8.3+incompatible - github.com/docker/docker-credential-helpers v0.9.9 - github.com/docker/go-connections v0.8.2 + github.com/docker/distribution v2.8.3+incompatible // gomodjail:unconfined + github.com/docker/docker-credential-helpers v0.9.9 // gomodjail:unconfined + github.com/docker/go-connections v0.8.2 // gomodjail:unconfined github.com/docker/go-units v0.5.0 github.com/fvbommel/sortorder v1.2.0 github.com/go-jose/go-jose/v4 v4.1.5 @@ -30,42 +31,42 @@ require ( github.com/gogo/protobuf v1.3.2 github.com/google/go-cmp v0.7.0 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 - github.com/google/uuid v1.6.0 + github.com/google/uuid v1.6.0 // gomodjail:unconfined github.com/mattn/go-runewidth v0.0.31 - github.com/moby/go-archive v0.3.3 + github.com/moby/go-archive v0.3.3 // gomodjail:unconfined github.com/moby/moby/api v1.56.1 - github.com/moby/moby/client v0.6.2 + github.com/moby/moby/client v0.6.2 // gomodjail:unconfined github.com/moby/patternmatcher v0.6.1 - github.com/moby/swarmkit/v2 v2.1.2 - github.com/moby/sys/atomicwriter v0.1.0 - github.com/moby/sys/capability v0.4.0 - github.com/moby/sys/sequential v0.7.0 - github.com/moby/sys/signal v0.7.1 - github.com/moby/sys/symlink v0.3.0 - github.com/moby/term v0.5.2 + github.com/moby/swarmkit/v2 v2.1.2 // gomodjail:unconfined + github.com/moby/sys/atomicwriter v0.1.0 // gomodjail:unconfined + github.com/moby/sys/capability v0.4.0 // gomodjail:unconfined + github.com/moby/sys/sequential v0.7.0 // gomodjail:unconfined + github.com/moby/sys/signal v0.7.1 // gomodjail:unconfined + github.com/moby/sys/symlink v0.3.0 // gomodjail:unconfined + github.com/moby/term v0.5.2 // gomodjail:unconfined github.com/morikuni/aec v1.1.0 github.com/opencontainers/go-digest v1.0.0 github.com/opencontainers/image-spec v1.1.1 - github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c - github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 - github.com/sirupsen/logrus v1.10.2 - github.com/spf13/cobra v1.10.2 + github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // gomodjail:unconfined + github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // gomodjail:unconfined + github.com/sirupsen/logrus v1.10.2 // gomodjail:unconfined + github.com/spf13/cobra v1.10.2 // gomodjail:unconfined github.com/spf13/pflag v1.0.10 - github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 - go.opentelemetry.io/otel v1.46.0 - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 + github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346 // gomodjail:unconfined + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // gomodjail:unconfined + go.opentelemetry.io/otel v1.46.0 // gomodjail:unconfined + go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 // gomodjail:unconfined + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // gomodjail:unconfined go.opentelemetry.io/otel/metric v1.46.0 - go.opentelemetry.io/otel/sdk v1.46.0 - go.opentelemetry.io/otel/sdk/metric v1.46.0 + go.opentelemetry.io/otel/sdk v1.46.0 // gomodjail:unconfined + go.opentelemetry.io/otel/sdk/metric v1.46.0 // gomodjail:unconfined go.opentelemetry.io/otel/trace v1.46.0 go.yaml.in/yaml/v3 v3.0.5 golang.org/x/sync v0.23.0 - golang.org/x/sys v0.48.0 - golang.org/x/term v0.46.0 + golang.org/x/sys v0.48.0 // gomodjail:unconfined + golang.org/x/term v0.46.0 // gomodjail:unconfined golang.org/x/text v0.42.0 - gotest.tools/v3 v3.5.2 + gotest.tools/v3 v3.5.2 // gomodjail:unconfined tags.cncf.io/container-device-interface v1.1.1 ) @@ -77,35 +78,48 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect + // gomodjail:unconfined github.com/docker/go-events v0.1.0 // indirect + // gomodjail:unconfined github.com/docker/go-metrics v0.1.0 // indirect github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect github.com/felixge/httpsnoop v1.1.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/golang/protobuf v1.5.4 // indirect + // gomodjail:unconfined github.com/gorilla/mux v1.8.1 // indirect + // gomodjail:unconfined github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/klauspost/compress v1.20.1 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect + // gomodjail:unconfined github.com/moby/sys/user v0.4.1 // indirect + // gomodjail:unconfined github.com/moby/sys/userns v0.2.1 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect + // gomodjail:unconfined github.com/prometheus/client_golang v1.22.0 // indirect github.com/prometheus/client_model v0.6.1 // indirect + // gomodjail:unconfined github.com/prometheus/common v0.62.0 // indirect + // gomodjail:unconfined github.com/prometheus/procfs v0.15.1 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect go.etcd.io/raft/v3 v3.6.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect + // gomodjail:unconfined go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect + // gomodjail:unconfined go.opentelemetry.io/proto/otlp v1.11.0 // indirect golang.org/x/mod v0.41.0 // indirect + // gomodjail:unconfined golang.org/x/net v0.60.0 // indirect golang.org/x/time v0.16.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect + // gomodjail:unconfined google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12 // indirect )