Consolidate security options to use = as separator.

[calavera]

All other options we have use = as separator, labels,
log configurations, graph configurations and so on.
We should be consistent and use = for the security
options too.

I change the daemon parsing to accept =. It still
supports : but it logs a warning when this separator
is used.

Let's decide if we want to do this and I'll complete it
with tests and documentation changes.

Signed-off-by: David Calavera [email protected]

[jessfraz]

LGTM

[runcom]

Design LGTM

[thaJeztah]

👍 thanks!

[thaJeztah]

Will need to search the docs to update the examples

[calavera]

@thaJeztah I think I got all of them, but please double check.

[thaJeztah]

@calavera docs look good, possibly needed;

bash completion:
https://github.com/docker/docker/blob/dd32445ecc6b706e8681dcc9d80c42c9b6cbf6cd/contrib/completion/bash/docker#L1781-L1800

tests:
https://github.com/docker/docker/blob/01f165169b6913320defdc9ce3995614e4c286d1/integration-cli/docker_cli_run_unix_test.go#L713-L933

Do we need a deprecation warning? (do we plan to deprecate the old notation?)

[vdemeester]

LGTM 🐼
@thaJeztah Given the warning I would say yes, we need a deprecation warning (https://github.com/docker/docker/pull/21232/files#diff-b56258ecab11f7b797306907327cc904R84).
@calavera a question though, shouldn't the warning be also client-side ?

[calavera]

we need a deprecation warning

agreed

shouldn't the warning be also client-side ?

we don't do any parsing client side, and we don't show other warnings like this in the client afaik, but I can add it if people want it.

[rhatdan]

The SELinux label ones have multiple ":" in them.

--security-opt label:type:container_log_t --security-opt label:level:s0:c1,c2

I guess becomes

   --security-opt label=type:container_log_t --security-opt label=level:s0:c1,c2

[calavera]

I guess becomes

   --security-opt label=type:container_log_t --security-opt label=level:s0:c1,c2

Yes

[justincormack]

We do some parsing client side, as the seccomp config file is parsed client side.

[calavera]

@justincormack yes, we use this function: https://github.com/docker/docker/pull/21232/files#diff-555969c76e0ae264bc1e3c8e880cb50cR509

[jessfraz]

LGTM

[albers]

Sorry David, this change does not work: = cannot be substituted for : here because it is in COMP_WORDBREAKS.
I will create a fix.

[albers]

note: to be accurate: : us also in $COMP_WORDBREAKS but there is speacial treatment for it in

_get_comp_words_by_ref -n : cur prev words cword

Fix created: #21584