Skip to content

Commit 1f4e37c

Browse files
cypharcyphar
committed
*: switch to -buildmode=pie
Go has supported PIC builds for a while now, and given the security benefits of using PIC binaries we should really enable them. There also appears to be some indication that non-PIC builds have been interacting oddly on ppc64le (the linker cannot load some shared libraries), and using PIC builds appears to solve this problem. Signed-off-by: Aleksa Sarai <asarai@suse.de>
1 parent 97be2a0 commit 1f4e37c

File tree

10 files changed

+33
-28
lines changed

10 files changed

+33
-28
lines changed

‎Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,10 @@ RUN set -x \
114114
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
115115
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
116116
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
117-
go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
117+
go build -buildmode=pie -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
118118
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \
119119
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
120-
go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
120+
go build -buildmode=pie -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
121121
&& rm -rf "$GOPATH"
122122

123123
# Install notary and notary-server
@@ -127,9 +127,9 @@ RUN set -x \
127127
&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \
128128
&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \
129129
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
130-
go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
130+
go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
131131
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
132-
go build -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
132+
go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
133133
&& rm -rf "$GOPATH"
134134

135135
# Get the "docker-py" source so we can run their integration tests

‎Dockerfile.aarch64‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ RUN set -x \
8989
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
9090
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
9191
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
92-
go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
92+
go build -buildmode=pie -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
9393
&& rm -rf "$GOPATH"
9494

9595
# Install notary and notary-server
@@ -99,9 +99,9 @@ RUN set -x \
9999
&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \
100100
&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \
101101
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
102-
go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
102+
go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
103103
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
104-
go build -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
104+
go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
105105
&& rm -rf "$GOPATH"
106106

107107
# Get the "docker-py" source so we can run their integration tests

‎Dockerfile.armhf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,10 +84,10 @@ RUN set -x \
8484
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
8585
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
8686
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
87-
go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
87+
go build -buildmode=pie -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
8888
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \
8989
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
90-
go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
90+
go build -buildmode=pie -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
9191
&& rm -rf "$GOPATH"
9292

9393
# Install notary and notary-server
@@ -97,9 +97,9 @@ RUN set -x \
9797
&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \
9898
&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \
9999
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
100-
go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
100+
go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
101101
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
102-
go build -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
102+
go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
103103
&& rm -rf "$GOPATH"
104104

105105
# Get the "docker-py" source so we can run their integration tests

‎Dockerfile.e2e‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ ENV DOCKER_GITCOMMIT=$DOCKER_GITCOMMIT
3131
ADD . .
3232

3333
# Build DockerSuite.TestBuild* dependency
34-
RUN CGO_ENABLED=0 go build -o /output/httpserver github.com/docker/docker/contrib/httpserver
34+
RUN CGO_ENABLED=0 go build -buildmode=pie -o /output/httpserver github.com/docker/docker/contrib/httpserver
3535

3636
# Build the integration tests and copy the resulting binaries to /output/tests
3737
RUN hack/make.sh build-integration-test-binary

‎Dockerfile.ppc64le‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,10 @@ RUN set -x \
8282
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
8383
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
8484
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
85-
go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
85+
go build -buildmode=pie -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
8686
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \
8787
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
88-
go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
88+
go build -buildmode=pie -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
8989
&& rm -rf "$GOPATH"
9090

9191
# Install notary and notary-server
@@ -95,9 +95,9 @@ RUN set -x \
9595
&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \
9696
&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \
9797
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
98-
go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
98+
go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
9999
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
100-
go build -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
100+
go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
101101
&& rm -rf "$GOPATH"
102102

103103
# Get the "docker-py" source so we can run their integration tests

‎Dockerfile.s390x‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,10 @@ RUN set -x \
7676
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
7777
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
7878
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
79-
go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
79+
go build -buildmode=pie -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
8080
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \
8181
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
82-
go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
82+
go build -buildmode=pie -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
8383
&& rm -rf "$GOPATH"
8484

8585
# Install notary and notary-server
@@ -89,9 +89,9 @@ RUN set -x \
8989
&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \
9090
&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \
9191
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
92-
go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
92+
go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \
9393
&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \
94-
go build -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
94+
go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \
9595
&& rm -rf "$GOPATH"
9696

9797
# Get the "docker-py" source so we can run their integration tests

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ swagger-docs: ## preview the API documentation
188188

189189
build-integration-cli-on-swarm: build ## build images and binary for running integration-cli on Swarm in parallel
190190
@echo "Building hack/integration-cli-on-swarm (if build fails, please refer to hack/integration-cli-on-swarm/README.md)"
191-
go build -o ./hack/integration-cli-on-swarm/integration-cli-on-swarm ./hack/integration-cli-on-swarm/host
191+
go build -buildmode=pie -o ./hack/integration-cli-on-swarm/integration-cli-on-swarm ./hack/integration-cli-on-swarm/host
192192
@echo "Building $(INTEGRATION_CLI_MASTER_IMAGE)"
193193
docker build -t $(INTEGRATION_CLI_MASTER_IMAGE) hack/integration-cli-on-swarm/agent
194194
# For worker, we don't use `docker build` so as to enable DOCKER_INCREMENTAL_BINARY and so on
@@ -198,6 +198,6 @@ build-integration-cli-on-swarm: build ## build images and binary for running int
198198
# For avoiding bakings DOCKER_GRAPHDRIVER and so on to image, we cannot use $(DOCKER_ENVS) here
199199
docker run -t -d --name $(tmp) -e DOCKER_GITCOMMIT -e BUILDFLAGS -e DOCKER_INCREMENTAL_BINARY --privileged $(DOCKER_MOUNT_PKGCACHE) $(DOCKER_IMAGE) top
200200
docker exec $(tmp) hack/make.sh build-integration-test-binary dynbinary
201-
docker exec $(tmp) go build -o /worker github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker
201+
docker exec $(tmp) go build -buildmode=pie -o /worker github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker
202202
docker commit -c 'ENTRYPOINT ["/worker"]' $(tmp) $(INTEGRATION_CLI_WORKER_IMAGE)
203203
docker rm -f $(tmp)

‎hack/dockerfile/install-binaries.sh‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ install_proxy() {
6060
git clone https://github.com/docker/libnetwork.git "$GOPATH/src/github.com/docker/libnetwork"
6161
cd "$GOPATH/src/github.com/docker/libnetwork"
6262
git checkout -q "$LIBNETWORK_COMMIT"
63-
go build -ldflags="$PROXY_LDFLAGS" -o /usr/local/bin/docker-proxy github.com/docker/libnetwork/cmd/proxy
63+
go build -buildmode=pie -ldflags="$PROXY_LDFLAGS" -o /usr/local/bin/docker-proxy github.com/docker/libnetwork/cmd/proxy
6464
}
6565

6666
install_dockercli() {
@@ -89,15 +89,15 @@ build_dockercli() {
8989
git checkout -q "v$DOCKERCLI_VERSION"
9090
mkdir -p "$GOPATH/src/github.com/docker"
9191
mv components/cli "$GOPATH/src/github.com/docker/cli"
92-
go build -o /usr/local/bin/docker github.com/docker/cli/cmd/docker
92+
go build -buildmode=pie -o /usr/local/bin/docker github.com/docker/cli/cmd/docker
9393
}
9494

9595
install_gometalinter() {
9696
echo "Installing gometalinter version $GOMETALINTER_COMMIT"
9797
go get -d github.com/alecthomas/gometalinter
9898
cd "$GOPATH/src/github.com/alecthomas/gometalinter"
9999
git checkout -q "$GOMETALINTER_COMMIT"
100-
go build -o /usr/local/bin/gometalinter github.com/alecthomas/gometalinter
100+
go build -buildmode=pie -o /usr/local/bin/gometalinter github.com/alecthomas/gometalinter
101101
GOBIN=/usr/local/bin gometalinter --install
102102
}
103103

@@ -108,7 +108,7 @@ do
108108
echo "Install tomlv version $TOMLV_COMMIT"
109109
git clone https://github.com/BurntSushi/toml.git "$GOPATH/src/github.com/BurntSushi/toml"
110110
cd "$GOPATH/src/github.com/BurntSushi/toml" && git checkout -q "$TOMLV_COMMIT"
111-
go build -v -o /usr/local/bin/tomlv github.com/BurntSushi/toml/cmd/tomlv
111+
go build -buildmode=pie -v -o /usr/local/bin/tomlv github.com/BurntSushi/toml/cmd/tomlv
112112
;;
113113

114114
runc)
@@ -157,7 +157,7 @@ do
157157
git clone https://github.com/LK4D4/vndr.git "$GOPATH/src/github.com/LK4D4/vndr"
158158
cd "$GOPATH/src/github.com/LK4D4/vndr"
159159
git checkout -q "$VNDR_COMMIT"
160-
go build -v -o /usr/local/bin/vndr .
160+
go build -buildmode=pie -v -o /usr/local/bin/vndr .
161161
;;
162162

163163
dockercli)

‎hack/integration-cli-on-swarm/agent/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22
# Please refer to the top-level Makefile for the worker image.
33
FROM golang:1.7
44
ADD . /go/src/github.com/docker/docker/hack/integration-cli-on-swarm/agent
5-
RUN go build -o /master github.com/docker/docker/hack/integration-cli-on-swarm/agent/master
5+
RUN go build -buildmode=pie -o /master github.com/docker/docker/hack/integration-cli-on-swarm/agent/master
66
ENTRYPOINT ["/master"]

‎hack/make/.binary‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARC
5050
esac
5151
fi
5252

53+
# -buildmode=pie is not supported on Windows.
54+
if [ "$(go env GOOS)" != "windows" ]; then
55+
BUILDFLAGS+=( "-buildmode=pie" )
56+
fi
57+
5358
echo "Building: $DEST/$BINARY_FULLNAME"
5459
go build \
5560
-o "$DEST/$BINARY_FULLNAME" \

0 commit comments

Comments
 (0)