🚀 Sync 2026-03-20 14:18:42

dockerd/Config.in

@@ -15,6 +15,7 @@ config DOCKER_CGROUP_OPTIONS
 	select KERNEL_CGROUP_FREEZER
 	select KERNEL_NET_CLS_CGROUP
 	select KERNEL_CGROUP_NET_PRIO
+	select PACKAGE_cgroupfs-mount
 	help
 		Selects kernel options to enable CGroups V1.
 

dockerd/Makefile

@@ -1,8 +1,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dockerd
+PKG_FLAGS:=hold
 PKG_VERSION:=27.3.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
 
@@ -34,6 +35,7 @@ define Package/dockerd
   TITLE:=Docker Community Edition Daemon
   URL:=https://www.docker.com/
   DEPENDS:=$(GO_ARCH_DEPENDS) \
+    +jsonfilter \
     +ca-certificates \
     +containerd \
     +iptables \
@@ -160,10 +162,19 @@ define Package/dockerd/install
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_CONF) ./files/etc/config/dockerd $(1)/etc/config/dockerd
 
-	# Must be after systcl 11-br-netfilter.conf from kmod-br-netfilter
-	$(INSTALL_DIR) $(1)/etc/sysctl.d
-	$(INSTALL_DATA) ./files/etc/sysctl.d/sysctl-br-netfilter-ip.conf \
-		$(1)/etc/sysctl.d/12-br-netfilter-ip.conf
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/net
+	$(INSTALL_DATA) ./files/etc/hotplug.d/net/br-netfilter \
+		$(1)/etc/hotplug.d/net/10-docker-br-netfilter
+
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/etc/uci-defaults/16_docker-netifd-migrate2 \
+		$(1)/etc/uci-defaults/16_docker-netifd-migrate2
+	$(INSTALL_DATA) ./files/etc/uci-defaults/17_docker-fw4 \
+		$(1)/etc/uci-defaults/17_docker-fw4
+
+	$(INSTALL_DIR) $(1)/lib/fstab.d
+	$(INSTALL_DATA) ./files/lib/fstab.d/dockerd.sh $(1)/lib/fstab.d/dockerd.sh
+
 endef
 
 define Package/dockerd/postinst

dockerd/files/dockerd.init

@@ -3,8 +3,8 @@
 USE_PROCD=1
 START=99
 
-extra_command "uciadd" "<interface> <device> <zone> Add docker bridge configuration to network and firewall uci config"
-extra_command "ucidel" "<interface> <device> <zone> Delete docker bridge configuration from network and firewall uci config"
+extra_command "uciadd" "<ignored> <device> <zone> Add docker bridge configuration to firewall uci config"
+extra_command "ucidel" "<ignored> <device> <zone> Delete docker bridge configuration from firewall uci config"
 
 DOCKER_CONF_DIR="/tmp/dockerd"
 DOCKERD_CONF="${DOCKER_CONF_DIR}/daemon.json"
@@ -17,94 +17,85 @@ json_add_array_string() {
 	json_add_string "" "${1}"
 }
 
-find_network_device() {
-	local device="${1}"
-	local device_section=""
-
-	check_device() {
-		local cfg="${1}"
-		local device="${2}"
-
-		local type name
-		config_get type "${cfg}" type
-		config_get name "${cfg}" name
-
-		[ "${type}" = "bridge" ] && [ "${name}" = "${device}" ] \
-			&& device_section="${cfg}"
-	}
-
-	config_load network
-	config_foreach check_device device "${device}"
-
-	echo "${device_section}"
-}
-
-boot() {
-	uciadd
-	rc_procd start_service
-}
-
 uciadd() {
 	local iface="${1}"
 	local device="${2}"
 	local zone="${3}"
 
-	[ -z "${iface}" ] && {
-		iface="docker"
+	[ -z "${device}" ] && {
 		device="docker0"
 		zone="docker"
 	}
 
-	/etc/init.d/dockerd running && {
-		echo "Please stop dockerd service first"
-		exit 0
-	}
-
-	# Add network interface
-	if ! uci_quiet get network.${iface}; then
-		logger -t "dockerd-init" -p notice "Adding interface '${iface}' to network config"
-		uci_quiet add network interface
-		uci_quiet rename network.@interface[-1]="${iface}"
-		uci_quiet set network.@interface[-1].device="${device}"
-		uci_quiet set network.@interface[-1].proto="none"
-		uci_quiet set network.@interface[-1].auto="0"
-		uci_quiet commit network
-	fi
-
-	# Add docker bridge device
-	if [ "$(find_network_device "$device")" = "" ]; then
-		logger -t "dockerd-init" -p notice "Adding bridge device '${device}' to network config"
-		uci_quiet add network device
-		uci_quiet set network.@device[-1].type="bridge"
-		uci_quiet set network.@device[-1].name="${device}"
-		uci_quiet commit network
-	else
-		logger -t "dockerd-init" -p notice "Bridge device '${device}' already defined in network config"
-	fi
-
 	# Add firewall zone
 	if ! uci_quiet get firewall.${zone}; then
 		logger -t "dockerd-init" -p notice "Adding firewall zone '${zone}' to firewall config"
 		uci_quiet add firewall zone
 		uci_quiet rename firewall.@zone[-1]="${zone}"
+		uci_quiet set firewall.@zone[-1].name="${zone}"
 		uci_quiet set firewall.@zone[-1].input="ACCEPT"
 		uci_quiet set firewall.@zone[-1].output="ACCEPT"
 		uci_quiet set firewall.@zone[-1].forward="ACCEPT"
-		uci_quiet set firewall.@zone[-1].name="${zone}"
 		uci_quiet set firewall.dockerd=forwarding
 		uci_quiet set firewall.@forwarding[-1].src="${zone}"
 		uci_quiet set firewall.@forwarding[-1].dest='wan'
 		uci_quiet commit firewall
 	fi
 
-	# Add interface to firewall zone
+	# Add device to firewall zone
 	if uci_quiet get firewall.${zone}; then
-		uci_quiet del_list firewall.${zone}.network="${iface}"
-		uci_quiet add_list firewall.${zone}.network="${iface}"
+		uci_quiet del_list firewall.${zone}.device="${device}"
+		if [ docker0 = "$device" ]; then
+			uci_quiet del_list firewall.${zone}.subnet="172.16.0.0/12"
+			uci_quiet add_list firewall.${zone}.subnet="172.16.0.0/12"
+		else
+			uci_quiet add_list firewall.${zone}.device="${device}"
+		fi
 		uci_quiet commit firewall
 	fi
 
-	reload_config
+	# Add forwarding rules
+	local forwarding_section
+	check_forwarding() {
+		local cfg="${1}"
+		local srcm="${2}"
+		local destm="${3}"
+
+		local src dest
+		config_get src "${cfg}" src
+		config_get dest "${cfg}" dest
+
+		[[ "${src}" = "${srcm}" && "${dest}" = "${destm}" ]] \
+			&& forwarding_section="${cfg}"
+	}
+
+	config_load firewall
+	forwarding_section=""
+	config_foreach check_forwarding forwarding ${zone} wan
+	[[ -n "${forwarding_section}" ]] || {
+		uci_quiet set firewall.${zone}_to_wan=forwarding
+		uci_quiet set firewall.${zone}_to_wan.src=${zone}
+		uci_quiet set firewall.${zone}_to_wan.dest=wan
+	}
+
+	forwarding_section=""
+	config_foreach check_forwarding forwarding ${zone} lan
+	[[ -n "${forwarding_section}" ]] || {
+		uci_quiet set firewall.${zone}_to_lan=forwarding
+		uci_quiet set firewall.${zone}_to_lan.src=${zone}
+		uci_quiet set firewall.${zone}_to_lan.dest=lan
+	}
+
+	forwarding_section=""
+	config_foreach check_forwarding forwarding lan ${zone}
+	[[ -n "${forwarding_section}" ]] || {
+		uci_quiet set firewall.lan_to_${zone}=forwarding
+		uci_quiet set firewall.lan_to_${zone}.src=lan
+		uci_quiet set firewall.lan_to_${zone}.dest=${zone}
+	}
+	uci_quiet commit firewall
+
+	/etc/init.d/firewall reload
 }
 
 ucidel() {
@@ -112,44 +103,28 @@ ucidel() {
 	local device="${2}"
 	local zone="${3}"
 
-	[ -z "${iface}" ] && {
-		iface="docker"
+	[ -z "${device}" ] && {
 		device="docker0"
 		zone="docker"
 	}
 
-	/etc/init.d/dockerd running && {
-		echo "Please stop dockerd service first"
-		exit 0
-	}
-
-	# Remove network device
-	if uci_quiet delete network.$(find_network_device "${device}"); then
-		logger -t "dockerd-init" -p notice "Deleting bridge device '${device}' from network config"
-		uci_quiet commit network
-	fi
-
-	# Remove network interface
-	if uci_quiet get network.${iface}; then
-		logger -t "dockerd-init" -p notice "Deleting interface '${iface}' from network config"
-		uci_quiet delete network.${iface}
-		uci_quiet commit network
-	fi
-
 	# Remove interface from firewall zone
 	if uci_quiet get firewall.${zone}; then
-		logger -t "dockerd-init" -p notice "Deleting network interface '${iface}' in zone '${zone}' from firewall config"
-		uci_quiet del_list firewall.${zone}.network="${iface}"
+		logger -t "dockerd-init" -p notice "Deleting network device '${device}' in zone '${zone}' from firewall config"
+		uci_quiet del_list firewall.${zone}.device="${device}"
 		uci_quiet commit firewall
 		# Remove Firewall zone if network is empty
-		if ! uci_quiet get firewall.${zone}.network; then
+		if ! uci_quiet get firewall.${zone}.device; then
 			logger -t "dockerd-init" -p notice "Deleting firewall zone '${zone}' from firewall config"
 			uci_quiet delete firewall.${zone}
+			uci_quiet delete firewall.${zone}_to_wan
+			uci_quiet delete firewall.${zone}_to_lan
+			uci_quiet delete firewall.lan_to_${zone}
 		fi
 		uci_quiet commit firewall
 	fi
 
-	reload_config
+	/etc/init.d/firewall reload
 }
 
 process_config() {
@@ -174,7 +149,7 @@ process_config() {
 
 	config_get data_root globals data_root "/opt/docker/"
 	config_get log_level globals log_level "warn"
-	config_get_bool iptables globals iptables "1"
+	config_get_bool iptables globals iptables "0"
 	config_get_bool ip6tables globals ip6tables "0"
 
 	# Don't add these options by default
@@ -193,6 +168,7 @@ process_config() {
 	config_get https_proxy proxies https_proxy "${https_proxy}"
 	config_get no_proxy proxies no_proxy "${no_proxy}"
 	config_get storage_driver globals storage_driver ""
+	config_get max_concurrent_downloads globals max_concurrent_downloads ""
 
 	. /usr/share/libubox/jshn.sh
 	json_init
@@ -223,6 +199,14 @@ process_config() {
 		json_close_object
 	fi
 	[ -z "${storage_driver}" ] || json_add_string "storage-driver" "${storage_driver}"
+
+	[ "${max_concurrent_downloads:-0}" -eq "0" ] || json_add_int "max-concurrent-downloads" "${max_concurrent_downloads}"
+	json_add_string "log-driver" "json-file"
+	json_add_object "log-opts"
+	json_add_string "max-size" "50m"
+	json_add_string "max-file" "2"
+	json_close_object
+
 	json_dump > "${DOCKERD_CONF}"
 
 	[ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall
@@ -245,6 +229,14 @@ start_service() {
 }
 
 reload_service() {
+	if [ -f "${DOCKERD_CONF}" -a -f /etc/config/dockerd ]; then
+		local oldroot=`jsonfilter -i "${DOCKERD_CONF}" -e @[\"data-root\"]`
+		local newroot=`uci get dockerd.globals.data_root`
+		if [ "$oldroot" != "$newroot" ]; then
+			restart
+			return 0
+		fi
+	fi
 	process_config
 	procd_send_signal dockerd
 }

dockerd/files/etc/config/dockerd

@@ -10,7 +10,7 @@ config globals 'globals'
 	option data_root '/opt/docker/'
 #	option log_driver 'local'
 	option log_level 'warn'
-	option iptables '1'
+	option iptables '0'
 #	list hosts 'unix:///var/run/docker.sock'
 #	option bip '172.18.0.1/24'
 #	option fixed_cidr '172.17.0.0/16'
@@ -20,6 +20,7 @@ config globals 'globals'
 #	list dns '172.17.0.1'
 #	list registry_mirrors 'https://<my-docker-mirror-host>'
 #	list registry_mirrors 'https://hub.docker.com'
+#	option max_concurrent_downloads '2'
 
 # If your organization uses a proxy server to connect to the internet, you may need to configure the proxy.
 # See https://docs.docker.com/engine/daemon/proxy/ for more details

dockerd/files/etc/hotplug.d/net/br-netfilter

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+if [ "$ACTION" = add -a "x$DEVTYPE" = xbridge ]; then
+    if [ "$DEVICENAME" = "docker0" ] || echo "$DEVICENAME" | grep -qE '^br-[0-9a-f]{12}$'; then
+        if [ "$(uci -q get dockerd.globals.iptables)" = "1" ]; then
+            echo "1" >/sys$DEVPATH/bridge/nf_call_iptables
+        fi
+        if [ "$(uci -q get dockerd.globals.ip6tables)" = "1" ]; then
+            echo "1" >/sys$DEVPATH/bridge/nf_call_ip6tables
+        fi
+    fi
+fi

dockerd/files/etc/sysctl.d/sysctl-br-netfilter-ip.conf

@@ -1,7 +0,0 @@
-# Do not edit, changes to this file will be lost on upgrades
-# /etc/sysctl.conf can be used to customize sysctl settings
-
-# enable bridge firewalling for docker
-# net.bridge.bridge-nf-call-ip6tables=1
-# net.bridge.bridge-nf-call-iptables=1
-

dockerd/files/etc/uci-defaults/16_docker-netifd-migrate2

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+uci -q set dockerd.globals.iptables=0
+
+uci -q delete firewall.docker.network
+
+DOCKER0_DEVICE=`uci show network | grep -E "^network\\.@device\\[\\d+\\]\\.name='docker0'" | head -n1 | head -c -16`
+
+if [ -n "$DOCKER0_DEVICE" ]; then
+    uci delete "$DOCKER0_DEVICE"
+fi
+uci -q delete network.docker
+uci commit

dockerd/files/etc/uci-defaults/17_docker-fw4

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+/etc/init.d/dockerd uciadd
+
+exit 0

dockerd/files/lib/fstab.d/dockerd.sh

@@ -0,0 +1,3 @@
+if /etc/init.d/dockerd enabled && [ -f /etc/config/dockerd ]; then
+    fstab_add_essential_mountpoint "$(uci -q get dockerd.globals.data_root)"
+fi

dockerd/git-short-commit.sh

@@ -39,7 +39,7 @@ git init --quiet "${GIT_DIR}"
 
 		if git fetch --depth 1 origin "${GIT_REF}"; then
 			git checkout --detach FETCH_HEAD --
-			git rev-parse --short=7 HEAD
+			git rev-parse --short HEAD
 			break
 		fi