Update

Author: nfnty

docker/docker/PKGBUILD

@@ -2,7 +2,7 @@
 # Maintainer: Morten Linderud <foxboron@archlinux.org>
 
 pkgname=docker
-pkgver=20.10.12
+pkgver=20.10.17
 pkgrel=1
 epoch=1
 pkgdesc='Pack, ship and run any application as a lightweight container'
@@ -17,9 +17,9 @@ optdepends=('btrfs-progs: btrfs backend support'
             'docker-scan: vulnerability scanner')
 # https://github.com/moby/moby/tree/v20.10.0/hack/dockerfile/install
 _TINI_COMMIT=de40ad007797e0dcd8b7126f27bb87401d224240
-_LIBNETWORK_COMMIT=64b7a4574d1426139437d20e81c0b6d391130ec8
+_LIBNETWORK_COMMIT=f6ccccb1c082a432c2a5814aaedaca56af33d9ea
 # TODO: Split into `docker-buildx` and make it a dependency
-_BUILDX_COMMIT=05846896d149da05f3d6fd1e7770da187b52a247
+_BUILDX_COMMIT=6224def4dd2c3d347eee19db595348c50d7cb491
 source=("git+https://github.com/docker/cli.git#tag=v$pkgver"
         "git+https://github.com/moby/moby.git#tag=v$pkgver"
         "git+https://github.com/docker/libnetwork.git#commit=$_LIBNETWORK_COMMIT"
@@ -66,7 +66,8 @@ build() {
   done
   local _commit _pkgbuild _dockerfile
   err=0
-  for _commit in LIBNETWORK TINI; do
+  # FIXME: Do not check TINI anymore, use tag instead of commit
+  for _commit in LIBNETWORK; do
     _pkgbuild=_${_commit}_COMMIT
     _dockerfile=${_commit}_COMMIT
     if [[ ${!_pkgbuild} != ${!_dockerfile} ]]; then

docker/docker/capabilities.patch

@@ -1,17 +1,27 @@
 diff --git a/oci/oci.go b/oci/oci.go
-index 6c84ba3488..d931f92d27 100644
+index 60227c2680..2727ed38ce 100644
 --- a/oci/oci.go
 +++ b/oci/oci.go
-@@ -18,12 +18,6 @@ func SetCapabilities(s *specs.Spec, caplist []string) error {
- 	s.Process.Capabilities.Bounding = caplist
- 	s.Process.Capabilities.Permitted = caplist
- 	s.Process.Capabilities.Inheritable = caplist
--	// setUser has already been executed here
--	// if non root drop capabilities in the way execve does
--	if s.Process.User.UID != 0 {
--		s.Process.Capabilities.Effective = []string{}
--		s.Process.Capabilities.Permitted = []string{}
--	}
+@@ -20,18 +20,10 @@ var deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\
+ // All capabilities are added if privileged is true.
+ func SetCapabilities(s *specs.Spec, caplist []string) error {
+ 	// setUser has already been executed here
+-	if s.Process.User.UID == 0 {
+-		s.Process.Capabilities = &specs.LinuxCapabilities{
+-			Effective: caplist,
+-			Bounding:  caplist,
+-			Permitted: caplist,
+-		}
+-	} else {
+-		// Do not set Effective and Permitted capabilities for non-root users,
+-		// to match what execve does.
+-		s.Process.Capabilities = &specs.LinuxCapabilities{
+-			Bounding: caplist,
+-		}
++	s.Process.Capabilities = &specs.LinuxCapabilities{
++		Effective: caplist,
++		Bounding:  caplist,
++		Permitted: caplist,
+ 	}
  	return nil
  }
-