|
| 1 | +// Unless explicitly stated otherwise all files in this repository are licensed |
| 2 | +// under the Apache License Version 2.0. |
| 3 | +// This product includes software developed at Datadog (https://www.datadoghq.com/). |
| 4 | +// Copyright 2016-present Datadog, Inc. |
| 5 | + |
| 6 | +//go:build docker |
| 7 | + |
| 8 | +package docker |
| 9 | + |
| 10 | +import ( |
| 11 | + "context" |
| 12 | + "encoding/json" |
| 13 | + "errors" |
| 14 | + "fmt" |
| 15 | + "net" |
| 16 | + "net/http" |
| 17 | + "path" |
| 18 | + "strings" |
| 19 | + |
| 20 | + "github.com/moby/moby/api/types/system" |
| 21 | + "github.com/moby/moby/client" |
| 22 | + |
| 23 | + "github.com/DataDog/datadog-agent/pkg/util/log" |
| 24 | +) |
| 25 | + |
| 26 | +// safeInfo returns the Docker daemon's /info response, working around daemons |
| 27 | +// that emit invalid CIDRs in DefaultAddressPools[].Base. The moby v29 SDK |
| 28 | +// decodes Base into a netip.Prefix, whose UnmarshalText is strict and rejects |
| 29 | +// such values, which would fail the entire /info JSON decode and break every |
| 30 | +// caller (init probe, hostname provider, host tags, host metadata, storage |
| 31 | +// stats). |
| 32 | +// |
| 33 | +// Strategy: try the SDK's Info() first. If it fails with the SDK's JSON-decode |
| 34 | +// wrapper, retry with a raw HTTP request that decodes into a mirror struct |
| 35 | +// where DefaultAddressPools is captured as json.RawMessage, shadowing the |
| 36 | +// strict field and letting the rest of /info parse normally. |
| 37 | +func safeInfo(ctx context.Context, cli *client.Client) (system.Info, error) { |
| 38 | + result, err := cli.Info(ctx, client.InfoOptions{}) |
| 39 | + if err == nil { |
| 40 | + return result.Info, nil |
| 41 | + } |
| 42 | + |
| 43 | + // The moby client wraps JSON-decode failures of /info with this prefix |
| 44 | + // (see github.com/moby/moby/client/system_info.go). Network, HTTP-status |
| 45 | + // and other connection errors do not, and the tolerant fallback would not |
| 46 | + // help in those cases — propagate the original error. |
| 47 | + if !strings.Contains(err.Error(), "Error reading remote info") { |
| 48 | + return system.Info{}, err |
| 49 | + } |
| 50 | + |
| 51 | + log.Debugf("Docker /info decode failed (%v); retrying with tolerant decoder", err) |
| 52 | + info, fallbackErr := tolerantInfo(ctx, cli) |
| 53 | + if fallbackErr != nil { |
| 54 | + return system.Info{}, errors.Join(err, fmt.Errorf("tolerant /info fallback: %w", fallbackErr)) |
| 55 | + } |
| 56 | + return info, nil |
| 57 | +} |
| 58 | + |
| 59 | +// tolerantInfo reissues GET /info through the moby client's dialer and decodes |
| 60 | +// the response into a struct that shadows DefaultAddressPools with a |
| 61 | +// json.RawMessage. This bypasses the strict netip.Prefix decoding of the typed |
| 62 | +// field while leaving the rest of system.Info populated. |
| 63 | +func tolerantInfo(ctx context.Context, cli *client.Client) (system.Info, error) { |
| 64 | + httpClient := &http.Client{ |
| 65 | + Transport: &http.Transport{ |
| 66 | + // One-shot client: no benefit from keep-alive, and DisableKeepAlives |
| 67 | + // ensures the dialed connection is closed when the response body |
| 68 | + // is, so the unreferenced transport does not retain FDs. |
| 69 | + DisableKeepAlives: true, |
| 70 | + DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) { |
| 71 | + return cli.Dialer()(ctx) |
| 72 | + }, |
| 73 | + }, |
| 74 | + } |
| 75 | + |
| 76 | + // The dialer takes care of reaching the daemon (unix, npipe, tcp, tcp+tls). |
| 77 | + // For TCP daemons, preserve the configured host and base path so reverse |
| 78 | + // proxies relying on Host-header or path routing reach the same backend |
| 79 | + // as the SDK does. For unix/npipe, the SDK uses DummyHost — match it. |
| 80 | + // Use the "http" scheme even for tls-fronted daemons: the dialer returns |
| 81 | + // an already-TLS-encrypted connection, and the http transport writes plain |
| 82 | + // HTTP bytes over it. |
| 83 | + reqHost := client.DummyHost |
| 84 | + basePath := "" |
| 85 | + if hostURL, err := client.ParseHostURL(cli.DaemonHost()); err == nil { |
| 86 | + if hostURL.Scheme == "tcp" { |
| 87 | + reqHost = hostURL.Host |
| 88 | + } |
| 89 | + basePath = hostURL.Path |
| 90 | + } |
| 91 | + // Match the SDK's path construction so reverse proxies routing on |
| 92 | + // /vX.Y/info don't reject the fallback (see moby client.getAPIPath). |
| 93 | + apiPath := "/info" |
| 94 | + if v := cli.ClientVersion(); v != "" { |
| 95 | + apiPath = "/v" + strings.TrimPrefix(v, "v") + apiPath |
| 96 | + } |
| 97 | + url := "http://" + reqHost + path.Join("/", basePath, apiPath) |
| 98 | + req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) |
| 99 | + if err != nil { |
| 100 | + return system.Info{}, err |
| 101 | + } |
| 102 | + |
| 103 | + resp, err := httpClient.Do(req) |
| 104 | + if err != nil { |
| 105 | + return system.Info{}, err |
| 106 | + } |
| 107 | + defer resp.Body.Close() |
| 108 | + |
| 109 | + if resp.StatusCode < 200 || resp.StatusCode >= 300 { |
| 110 | + return system.Info{}, fmt.Errorf("unexpected status %d from /info", resp.StatusCode) |
| 111 | + } |
| 112 | + |
| 113 | + // Outer DefaultAddressPools (json.RawMessage) shadows the promoted field |
| 114 | + // from the embedded system.Info: encoding/json routes the JSON value to |
| 115 | + // the less-nested field, leaving system.Info.DefaultAddressPools at its |
| 116 | + // zero value. All other fields decode through the embedded struct. |
| 117 | + var tolerant struct { |
| 118 | + system.Info |
| 119 | + DefaultAddressPools json.RawMessage `json:"DefaultAddressPools"` |
| 120 | + } |
| 121 | + if err := json.NewDecoder(resp.Body).Decode(&tolerant); err != nil { |
| 122 | + return system.Info{}, fmt.Errorf("tolerant decode of /info failed: %w", err) |
| 123 | + } |
| 124 | + return tolerant.Info, nil |
| 125 | +} |
![dd-octo-sts[bot]](https://avatars.githubusercontent.com/in/1157446?v=4&size=40){kind=avatar}
0 commit comments