Prevent ctrs not in pods from depending on pod ctrs

Containers in pods cannot depend on containers outside of the
same pod. Make the reverse true as well - containers not in pods
cannot depend on containers in pods. This greatly simplifies our
dependency handling, as we can guarantee that removing a pod will
not encounter dependency issues.

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #558
Approved by: rhatdan

1 files changed, 8 insertions, 3 deletions

diff --git a/libpod/boltdb_state_internal.go b/libpod/boltdb_state_internal.go
index 9c05dcc3a..fc175fc1f 100644
--- a/libpod/boltdb_state_internal.go
+++ b/libpod/boltdb_state_internal.go
@@ -407,11 +407,16 @@ func (s *BoltState) addContainer(ctr *Container, pod *Pod) error {
 				return errors.Wrapf(ErrNoSuchCtr, "container %s depends on container %s, but it does not exist in the DB", ctr.ID(), dependsCtr)
 			}
 
-			// If we're part of a pod, make sure the dependency is part of the same pod
+			depCtrPod := depCtrBkt.Get(podIDKey)
 			if pod != nil {
-				depCtrPod := depCtrBkt.Get(podIDKey)
+				// If we're part of a pod, make sure the dependency is part of the same pod
 				if depCtrPod == nil {
-					return errors.Wrapf(ErrInvalidArg, "container %s depends on container%s which is not in pod %s", ctr.ID(), dependsCtr, pod.ID())
+					return errors.Wrapf(ErrInvalidArg, "container %s depends on container %s which is not in pod %s", ctr.ID(), dependsCtr, pod.ID())
+				}
+			} else {
+				// If we're not part of a pod, we cannot depend on containets in a pod
+				if depCtrPod != nil {
+					return errors.Wrapf(ErrInvalidArg, "container %s depends on container %s which is in a pod - containers not in pods cannot depend on containers in pods", ctr.ID(), dependsCtr)
 				}
 			}