Repository: moby/moby
File: daemon/command/daemon.go (Go)

Code before:
	conf.Labels = newLabels

	// Regardless of whether the user sets it to true or false, if they
	// specify TLSVerify at all then we need to turn on TLS
	if conf.IsValueSet(FlagTLSVerify) {
		v := true
		conf.TLS = &v
	}

	if conf.TLSVerify == nil && conf.TLS != nil {
		conf.TLSVerify = conf.TLS
	}

	err = validateCPURealtimeOptions(conf)
	if err != nil {
		return nil, err
	}

	if conf.CDISpecDirs == nil {
		// If the CDISpecDirs is not set at this stage, we set it to the default.
		conf.CDISpecDirs = append([]string(nil), cdi.DefaultSpecDirs...)
	} else if len(conf.CDISpecDirs) == 1 && conf.CDISpecDirs[0] == "" {
		// If CDISpecDirs is set to an empty string, we clear it to ensure that CDI is disabled.
		conf.CDISpecDirs = nil
	}
	// Only clear CDISpecDirs if CDI is explicitly disabled
	if val, exists := conf.Features["cdi"]; exists && !val {
		// If the CDI feature is explicitly disabled, we clear the CDISpecDirs to ensure that CDI is disabled.
		conf.CDISpecDirs = nil
	}

	if err := setPlatformOptions(conf); err != nil {
		return nil, err
	}

	return conf, nil
}

// normalizeHosts normalizes the configured config.Hosts and remove duplicates.
// It returns an error if it fails to parse a host.
func normalizeHosts(cfg *config.Config) error {
	if len(cfg.Hosts) == 0 {
		// if no hosts are configured, create a single entry slice, so that the
		// default is used.
		//
		// TODO(thaJeztah) implement a cleaner way for this; this depends on a
		//                 side-effect of how we parse empty/partial hosts.
		cfg.Hosts = make([]string, 1)
	}
	hosts := make([]string, 0, len(cfg.Hosts))
	seen := make(map[string]struct{}, len(cfg.Hosts))

Review comment (security):
Perhaps a silly question, but something I've been looking at a few times; is there any reason why we wouldn't handle XDG_xxx directories when running rootful?

I'm assuming here that when running as `root`, the `XDG_xx` directories would be owned by `root`, so if that's the case, it wouldn't risk a non-privileged user from installing CDI-related things that would be executed as `root`, but it would make the logic slightly more consistent without needing special branches for rootless / non-rootless sprinkled in various parts of the code.


Code after:
	}
	conf.Labels = newLabels

	// Regardless of whether the user sets it to true or false, if they
	// specify TLSVerify at all then we need to turn on TLS
	if conf.IsValueSet(FlagTLSVerify) {
		v := true
		conf.TLS = &v
	}

	if conf.TLSVerify == nil && conf.TLS != nil {
		conf.TLSVerify = conf.TLS
	}

	err = validateCPURealtimeOptions(conf)
	if err != nil {
		return nil, err
	}

	if conf.CDISpecDirs == nil {
		// If the CDISpecDirs is not set at this stage, we set it to the default.
		conf.CDISpecDirs = append([]string(nil), cdi.DefaultSpecDirs...)
		if rootless.RunningWithRootlessKit() {
			// In rootless mode, we add the user-specific CDI spec directory.
			xch, err := homedir.GetConfigHome()
			if err != nil {
				return nil, err
			}
			xrd, err := homedir.GetRuntimeDir()
			if err != nil {
				return nil, err
			}
			conf.CDISpecDirs = append(conf.CDISpecDirs, filepath.Join(xch, "cdi"), filepath.Join(xrd, "cdi"))
		}
	}
	// Filter out CDI spec directories that are not readable, and log appropriately
	var cdiSpecDirs []string
	for _, dir := range conf.CDISpecDirs {
		// Non-existing directories are not filtered out here, as CDI spec directories are allowed to not exist.
		if _, err := os.ReadDir(dir); err == nil || errors.Is(err, os.ErrNotExist) {
			cdiSpecDirs = append(cdiSpecDirs, dir)
		} else {
			logLevel := log.ErrorLevel
			if userns.RunningInUserNS() && errors.Is(err, os.ErrPermission) {
				logLevel = log.DebugLevel
			}
			log.L.WithField("dir", dir).WithError(err).Log(logLevel, "CDI spec directory cannot be accessed, skipping")
		}
	}
	conf.CDISpecDirs = cdiSpecDirs
	if len(conf.CDISpecDirs) == 1 && conf.CDISpecDirs[0] == "" {