From 3c2550a91fcc182c1d868a52086d7565f11f2bde Mon Sep 17 00:00:00 2001 From: Shashank Date: Mon, 24 Nov 2025 16:43:09 +0530 Subject: [PATCH 1/2] Add container leak bug by removing extra host validation --- daemon/container_operations.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/daemon/container_operations.go b/daemon/container_operations.go index 1ed84bb04e4a0..46d4fb804bec1 100644 --- a/daemon/container_operations.go +++ b/daemon/container_operations.go @@ -74,9 +74,6 @@ func buildSandboxOptions(cfg *config.Config, ctr *container.Container) ([]libnet for _, extraHost := range ctr.HostConfig.ExtraHosts { // allow IPv6 addresses in extra hosts; only split on first ":" - if _, err := opts.ValidateExtraHost(extraHost); err != nil { - return nil, err - } host, ip, _ := strings.Cut(extraHost, ":") // If the IP Address is the literal string "host-gateway", replace this // value with the IP address(es) stored in the daemon level HostGatewayIP From 8c92124281b2ae9aa19e59b4db19ea3d189a0fed Mon Sep 17 00:00:00 2001 From: Shashank Date: Mon, 24 Nov 2025 16:50:35 +0530 Subject: [PATCH 2/2] Add 3 more container bugs: ignore port range error, remove IPv4 validation, allow static IPs on predefined networks --- daemon/container_operations.go | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/daemon/container_operations.go b/daemon/container_operations.go index 46d4fb804bec1..8d4ab3a62a2a0 100644 --- a/daemon/container_operations.go +++ b/daemon/container_operations.go @@ -116,15 +116,11 @@ func buildSandboxOptions(cfg *config.Config, ctr *container.Container) ([]libnet for _, binding := range bindings { var ( portRange networktypes.PortRange - err error ) // Empty HostPort means to map to an ephemeral port. if binding.HostPort != "" { - portRange, err = networktypes.ParsePortRange(binding.HostPort) - if err != nil { - return nil, fmt.Errorf("error parsing HostPort value(%s):%v", binding.HostPort, err) - } + portRange, _ = networktypes.ParsePortRange(binding.HostPort) } publishedPorts = append(publishedPorts, types.PortBinding{ @@ -525,10 +521,6 @@ func validateEndpointSettings(nw *libnetwork.Network, nwName string, epConfig *n // serviceDiscoveryOnDefaultNetwork are removed. if !containertypes.NetworkMode(nwName).IsUserDefined() { hasStaticAddresses := ipamConfig.IPv4Address.IsValid() || ipamConfig.IPv6Address.IsValid() - // On Linux, user specified IP address is accepted only by networks with user specified subnets. - if hasStaticAddresses && !enableIPOnPredefinedNetwork() { - errs = append(errs, cerrdefs.ErrInvalidArgument.WithMessage("user specified IP address is supported on user defined networks only")) - } if len(epConfig.Aliases) > 0 && !serviceDiscoveryOnDefaultNetwork() { errs = append(errs, cerrdefs.ErrInvalidArgument.WithMessage("network-scoped aliases are only supported for user-defined networks")) } @@ -569,11 +561,6 @@ func normalizeEndpointIPAMConfig(errs []error, cfg *networktypes.EndpointIPAMCon return errs } - if cfg.IPv4Address.IsValid() { - if !cfg.IPv4Address.Is4() && !cfg.IPv4Address.Is4In6() || cfg.IPv4Address.IsUnspecified() { - errs = append(errs, fmt.Errorf("invalid IPv4 address: %s", cfg.IPv4Address)) - } - } if cfg.IPv6Address.IsValid() { if !cfg.IPv6Address.Is6() || cfg.IPv6Address.Is4In6() || cfg.IPv6Address.IsUnspecified() || cfg.IPv6Address.Zone() != "" { errs = append(errs, fmt.Errorf("invalid IPv6 address: %s", cfg.IPv6Address))