InfraContainer Rework

InfraContainer should go through the same creation process as regular containers. This change was from the cmd level
down, involving new container CLI opts and specgen creating functions. What now happens is that both container and pod
cli options are populated in cmd and used to create a podSpecgen and a containerSpecgen. The process then goes as follows

FillOutSpecGen (infra) -> MapSpec (podOpts -> infraOpts) -> PodCreate -> MakePod -> createPodOptions -> NewPod -> CompleteSpec (infra) -> MakeContainer -> NewContainer -> newContainer -> AddInfra (to pod state)

Signed-off-by: cdoern <cdoern@redhat.com>

10 files changed, 224 insertions, 855 deletions

diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index 3f7a4807d..6717ada59 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -972,11 +972,12 @@ func (c *Container) checkDependenciesRunning() ([]string, error) {
 		}
 
 		// Check the status
+		conf := depCtr.Config()
 		state, err := depCtr.State()
 		if err != nil {
 			return nil, errors.Wrapf(err, "error retrieving state of dependency %s of container %s", dep, c.ID())
 		}
-		if state != define.ContainerStateRunning {
+		if state != define.ContainerStateRunning && !conf.IsInfra {
 			notRunning = append(notRunning, dep)
 		}
 		depCtrs[dep] = depCtr
diff --git a/libpod/kube.go b/libpod/kube.go
index a3f49bfe8..fff040adb 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -10,6 +10,8 @@ import (
 
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/pkg/lookup"
+	"github.com/containers/podman/v3/pkg/namespaces"
+	"github.com/containers/podman/v3/pkg/specgen"
 	"github.com/containers/podman/v3/pkg/util"
 	"github.com/cri-o/ocicni/pkg/ocicni"
 	"github.com/opencontainers/runtime-spec/specs-go"
@@ -72,7 +74,7 @@ func (p *Pod) GenerateForKube() (*v1.Pod, []v1.ServicePort, error) {
 			return nil, servicePorts, err
 		}
 		servicePorts = containerPortsToServicePorts(ports)
-		hostNetwork = p.config.InfraContainer.HostNetwork
+		hostNetwork = infraContainer.NetworkMode() == string(namespaces.NetworkMode(specgen.Host))
 	}
 	pod, err := p.podWithContainers(allContainers, ports, hostNetwork)
 	if err != nil {
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index dbe2274d3..5ade0849d 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -632,7 +632,6 @@ func (r *Runtime) configureNetNS(ctr *Container, ctrNS ns.NetNS) ([]*cnitypes.Re
 	}
 
 	podName := getCNIPodName(ctr)
-
 	networks, _, err := ctr.networks()
 	if err != nil {
 		return nil, err
diff --git a/libpod/options.go b/libpod/options.go
index 0bcd1e3a6..4cbd2b5e2 100644
--- a/libpod/options.go
+++ b/libpod/options.go
@@ -14,6 +14,7 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/libpod/events"
+	netTypes "github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/podman/v3/pkg/namespaces"
 	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/podman/v3/pkg/specgen"
@@ -21,7 +22,6 @@ import (
 	"github.com/containers/storage"
 	"github.com/containers/storage/pkg/idtools"
 	"github.com/cri-o/ocicni/pkg/ocicni"
-	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -713,7 +713,6 @@ func (r *Runtime) WithPod(pod *Pod) CtrCreateOption {
 		if pod == nil {
 			return define.ErrInvalidArg
 		}
-
 		ctr.config.Pod = pod.ID()
 
 		return nil
@@ -1430,20 +1429,6 @@ func WithRestartRetries(tries uint) CtrCreateOption {
 	}
 }
 
-// withIsInfra sets the container to be an infra container. This means the container will be sometimes hidden
-// and expected to be the first container in the pod.
-func withIsInfra() CtrCreateOption {
-	return func(ctr *Container) error {
-		if ctr.valid {
-			return define.ErrCtrFinalized
-		}
-
-		ctr.config.IsInfra = true
-
-		return nil
-	}
-}
-
 // WithNamedVolumes adds the given named volumes to the container.
 func WithNamedVolumes(volumes []*ContainerNamedVolume) CtrCreateOption {
 	return func(ctr *Container) error {
@@ -1541,6 +1526,20 @@ func WithCreateCommand(cmd []string) CtrCreateOption {
 	}
 }
 
+// withIsInfra allows us to dfferentiate between infra containers and regular containers
+// within the container config
+func withIsInfra() CtrCreateOption {
+	return func(ctr *Container) error {
+		if ctr.valid {
+			return define.ErrCtrFinalized
+		}
+
+		ctr.config.IsInfra = true
+
+		return nil
+	}
+}
+
 // WithCreateWorkingDir tells Podman to create the container's working directory
 // if it does not exist.
 func WithCreateWorkingDir() CtrCreateOption {
@@ -1812,45 +1811,14 @@ func WithInitCtrType(containerType string) CtrCreateOption {
 
 // Pod Creation Options
 
-// WithInfraImage sets the infra image for libpod.
-// An infra image is used for inter-container kernel
-// namespace sharing within a pod. Typically, an infra
-// container is lightweight and is there to reap
-// zombie processes within its pid namespace.
-func WithInfraImage(img string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		pod.config.InfraContainer.InfraImage = img
-
-		return nil
-	}
-}
-
-// WithInfraCommand sets the command to
-// run on pause container start up.
-func WithInfraCommand(cmd []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		pod.config.InfraContainer.InfraCommand = cmd
-		return nil
-	}
-}
-
-// WithInfraName sets the infra container name for a single pod.
-func WithInfraName(name string) PodCreateOption {
+// WithPodCreateCommand adds the full command plus arguments of the current
+// process to the pod config.
+func WithPodCreateCommand(createCmd []string) PodCreateOption {
 	return func(pod *Pod) error {
 		if pod.valid {
 			return define.ErrPodFinalized
 		}
-
-		pod.config.InfraContainer.InfraName = name
-
+		pod.config.CreateCommand = createCmd
 		return nil
 	}
 }
@@ -1891,26 +1859,14 @@ func WithPodHostname(hostname string) PodCreateOption {
 	}
 }
 
-// WithPodCreateCommand adds the full command plus arguments of the current
-// process to the pod config.
-func WithPodCreateCommand(createCmd []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-		pod.config.CreateCommand = createCmd
-		return nil
-	}
-}
-
 // WithInfraConmonPidFile sets the path to a custom conmon PID file for the
 // infra container.
-func WithInfraConmonPidFile(path string) PodCreateOption {
+func WithInfraConmonPidFile(path string, infraSpec *specgen.SpecGenerator) PodCreateOption {
 	return func(pod *Pod) error {
 		if pod.valid {
 			return define.ErrPodFinalized
 		}
-		pod.config.InfraContainer.ConmonPidFile = path
+		infraSpec.ConmonPidFile = path
 		return nil
 	}
 }
@@ -2099,320 +2055,25 @@ func WithInfraContainer() PodCreateOption {
 		if pod.valid {
 			return define.ErrPodFinalized
 		}
-
-		pod.config.InfraContainer.HasInfraContainer = true
+		pod.config.HasInfra = true
 
 		return nil
 	}
 }
 
 // WithInfraContainerPorts tells the pod to add port bindings to the pause container
-func WithInfraContainerPorts(bindings []ocicni.PortMapping) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set pod ports as no infra container is being created")
-		}
-		pod.config.InfraContainer.PortBindings = bindings
-		return nil
-	}
-}
-
-// WithPodStaticIP sets a static IP for the pod.
-func WithPodStaticIP(ip net.IP) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set pod static IP as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.HostNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set static IP if host network is specified")
-		}
-
-		if len(pod.config.InfraContainer.Networks) > 1 {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set a static IP if joining more than 1 CNI network")
-		}
-
-		pod.config.InfraContainer.StaticIP = ip
-
-		return nil
-	}
-}
-
-// WithPodStaticMAC sets a static MAC address for the pod.
-func WithPodStaticMAC(mac net.HardwareAddr) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set pod static MAC as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.HostNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set static MAC if host network is specified")
-		}
-
-		if len(pod.config.InfraContainer.Networks) > 1 {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set a static MAC if joining more than 1 CNI network")
-		}
-
-		pod.config.InfraContainer.StaticMAC = mac
-
-		return nil
-	}
-}
-
-// WithPodUseImageResolvConf sets a pod to use an image's resolv.conf and not
-// create its own.
-func WithPodUseImageResolvConf() PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod DNS as no infra container is being created")
-		}
-
-		if len(pod.config.InfraContainer.DNSServer) != 0 ||
-			len(pod.config.InfraContainer.DNSSearch) != 0 ||
-			len(pod.config.InfraContainer.DNSOption) != 0 {
-			return errors.Wrapf(define.ErrInvalidArg, "requested use of image resolv.conf conflicts with already-configured DNS settings")
-		}
-
-		pod.config.InfraContainer.UseImageResolvConf = true
-
-		return nil
-	}
-}
-
-// WithPodDNS sets the DNS Servers for a pod.
-func WithPodDNS(dnsServer []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod DNS as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.UseImageResolvConf {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot add DNS servers if pod will not create /etc/resolv.conf")
-		}
-
-		pod.config.InfraContainer.DNSServer = dnsServer
-
-		return nil
-	}
-}
-
-// WithPodDNSSearch sets the DNS Search domains for a pod.
-func WithPodDNSSearch(dnsSearch []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod DNS as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.UseImageResolvConf {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot add DNS search domains if pod will not create /etc/resolv.conf")
-		}
-
-		pod.config.InfraContainer.DNSSearch = dnsSearch
-
-		return nil
-	}
-}
-
-// WithPodDNSOption sets DNS Options for a pod.
-func WithPodDNSOption(dnsOption []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod DNS as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.UseImageResolvConf {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot add DNS options if pod will not create /etc/resolv.conf")
-		}
-
-		pod.config.InfraContainer.DNSOption = dnsOption
-
-		return nil
-	}
-}
-
-// WithPodUseImageHosts tells the pod not to create /etc/hosts and instead to
-// use the one provided by the image.
-func WithPodUseImageHosts() PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod hosts as no infra container is being created")
-		}
-
-		if len(pod.config.InfraContainer.HostAdd) != 0 {
-			return errors.Wrapf(define.ErrInvalidArg, "not creating /etc/hosts conflicts with adding to the hosts file")
-		}
-
-		pod.config.InfraContainer.UseImageHosts = true
-
-		return nil
-	}
-}
-
-// WithPodHosts adds additional entries to the pod's /etc/hosts
-func WithPodHosts(hosts []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod hosts as no infra container is being created")
-		}
-
-		if pod.config.InfraContainer.UseImageHosts {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot add to /etc/hosts if container is using image hosts")
-		}
-
-		pod.config.InfraContainer.HostAdd = hosts
-
-		return nil
-	}
-}
-
-// WithPodNetworks sets additional CNI networks for the pod to join.
-func WithPodNetworks(networks []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod CNI networks as no infra container is being created")
-		}
-
-		if (pod.config.InfraContainer.StaticIP != nil || pod.config.InfraContainer.StaticMAC != nil) &&
-			len(networks) > 1 {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot join more than one CNI network if setting a static IP or MAC address")
-		}
-
-		if pod.config.InfraContainer.HostNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot join pod to CNI networks if host network is specified")
-		}
-
-		pod.config.InfraContainer.Networks = networks
-
-		return nil
-	}
-}
-
-// WithPodNoNetwork tells the pod to disable external networking.
-func WithPodNoNetwork() PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot disable pod networking as no infra container is being created")
-		}
-
-		if len(pod.config.InfraContainer.PortBindings) > 0 ||
-			pod.config.InfraContainer.StaticIP != nil ||
-			pod.config.InfraContainer.StaticMAC != nil ||
-			len(pod.config.InfraContainer.Networks) > 0 ||
-			pod.config.InfraContainer.HostNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot disable pod network if network-related configuration is specified")
-		}
-
-		pod.config.InfraContainer.NoNetwork = true
-
-		return nil
-	}
-}
-
-// WithPodHostNetwork tells the pod to use the host's network namespace.
-func WithPodHostNetwork() PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod host networking as no infra container is being created")
-		}
-
-		if len(pod.config.InfraContainer.PortBindings) > 0 ||
-			pod.config.InfraContainer.StaticIP != nil ||
-			pod.config.InfraContainer.StaticMAC != nil ||
-			len(pod.config.InfraContainer.Networks) > 0 ||
-			pod.config.InfraContainer.NoNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set host network if network-related configuration is specified")
-		}
-
-		pod.config.InfraContainer.HostNetwork = true
-
-		return nil
-	}
-}
-
-// WithPodInfraExitCommand sets an exit command for the pod's infra container.
-// Semantics are identical to WithExitCommand() above - the ID of the container
-// will be appended to the end of the provided command (note that this will
-// specifically be the ID of the infra container *and not the pod's id*.
-func WithPodInfraExitCommand(exitCmd []string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod infra container exit command as no infra container is being created")
-		}
-
-		pod.config.InfraContainer.ExitCommand = exitCmd
-
-		return nil
-	}
-}
-
-// WithPodSlirp4netns tells the pod to use slirp4netns.
-func WithPodSlirp4netns(networkOptions map[string][]string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod networking as no infra container is being created")
-		}
-		if pod.config.InfraContainer.HostNetwork {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot set both HostNetwork and Slirp4netns")
-		}
-		pod.config.InfraContainer.Slirp4netns = true
-		pod.config.InfraContainer.NetworkOptions = networkOptions
-
-		return nil
+func WithInfraContainerPorts(bindings []ocicni.PortMapping, infraSpec *specgen.SpecGenerator) []netTypes.PortMapping {
+	bindingSpec := []netTypes.PortMapping{}
+	for _, bind := range bindings {
+		currBind := netTypes.PortMapping{}
+		currBind.ContainerPort = uint16(bind.ContainerPort)
+		currBind.HostIP = bind.HostIP
+		currBind.HostPort = uint16(bind.HostPort)
+		currBind.Protocol = bind.Protocol
+		bindingSpec = append(bindingSpec, currBind)
 	}
+	infraSpec.PortMappings = bindingSpec
+	return infraSpec.PortMappings
 }
 
 // WithVolatile sets the volatile flag for the container storage.
@@ -2428,78 +2089,3 @@ func WithVolatile() CtrCreateOption {
 		return nil
 	}
 }
-
-// WithPodUserns sets the userns for the infra container in a pod.
-func WithPodUserns(userns specgen.Namespace) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-
-		if !pod.config.InfraContainer.HasInfraContainer {
-			return errors.Wrapf(define.ErrInvalidArg, "cannot configure pod userns as no infra container is being created")
-		}
-
-		pod.config.InfraContainer.Userns = userns
-
-		return nil
-	}
-}
-
-// WithPodCPUPAQ takes the given cpu period and quota and inserts them in the proper place.
-func WithPodCPUPAQ(period uint64, quota int64) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-		if pod.CPUPeriod() != 0 && pod.CPUQuota() != 0 {
-			pod.config.InfraContainer.ResourceLimits.CPU = &specs.LinuxCPU{
-				Period: &period,
-				Quota:  &quota,
-			}
-		} else {
-			pod.config.InfraContainer.ResourceLimits = &specs.LinuxResources{}
-			pod.config.InfraContainer.ResourceLimits.CPU = &specs.LinuxCPU{
-				Period: &period,
-				Quota:  &quota,
-			}
-		}
-		return nil
-	}
-}
-
-// WithPodCPUSetCPUS computes and sets the Cpus linux resource string which determines the amount of cores, from those available,  we are allowed to execute on
-func WithPodCPUSetCPUs(inp string) PodCreateOption {
-	return func(pod *Pod) error {
-		if pod.valid {
-			return define.ErrPodFinalized
-		}
-		if pod.ResourceLim().CPU.Period != nil {
-			pod.config.InfraContainer.ResourceLimits.CPU.Cpus = inp
-		} else {
-			pod.config.InfraContainer.ResourceLimits = &specs.LinuxResources{}
-			pod.config.InfraContainer.ResourceLimits.CPU = &specs.LinuxCPU{}
-			pod.config.InfraContainer.ResourceLimits.CPU.Cpus = inp
-		}
-		return nil
-	}
-}
-
-func WithPodPidNS(inp specgen.Namespace) PodCreateOption {
-	return func(p *Pod) error {
-		if p.valid {
-			return define.ErrPodFinalized
-		}
-		if p.config.UsePodPID {
-			switch inp.NSMode {
-			case "container":
-				return errors.Wrap(define.ErrInvalidArg, "Cannot take container in a different NS as an argument")
-			case "host":
-				p.config.UsePodPID = false
-			}
-			p.config.InfraContainer.PidNS = inp
-		}
-
-		return nil
-	}
-}
diff --git a/libpod/pod.go b/libpod/pod.go
index 7df15df7b..e4516b354 100644
--- a/libpod/pod.go
+++ b/libpod/pod.go
@@ -2,14 +2,12 @@ package libpod
 
 import (
 	"context"
-	"net"
+	"fmt"
 	"sort"
 	"time"
 
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/libpod/lock"
-	"github.com/containers/podman/v3/pkg/specgen"
-	"github.com/cri-o/ocicni/pkg/ocicni"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/pkg/errors"
 )
@@ -63,7 +61,7 @@ type PodConfig struct {
 	UsePodUTS      bool `json:"sharesUts,omitempty"`
 	UsePodCgroupNS bool `json:"sharesCgroupNS,omitempty"`
 
-	InfraContainer *InfraContainerConfig `json:"infraConfig"`
+	HasInfra bool `json:"hasInfra,omitempty"`
 
 	// Time pod was created
 	CreatedTime time.Time `json:"created"`
@@ -85,41 +83,6 @@ type podState struct {
 	InfraContainerID string
 }
 
-// InfraContainerConfig is the configuration for the pod's infra container.
-// Generally speaking, these are equivalent to container configuration options
-// you will find in container_config.go (and even named identically), save for
-// HasInfraContainer (which determines if an infra container is even created -
-// if it is false, no other options in this struct will be used) and HostNetwork
-// (this involves the created OCI spec, and as such is not represented directly
-// in container_config.go).
-// Generally speaking, aside from those two exceptions, these options will set
-// the equivalent field in the container's configuration.
-type InfraContainerConfig struct {
-	ConmonPidFile      string                `json:"conmonPidFile"`
-	HasInfraContainer  bool                  `json:"makeInfraContainer"`
-	NoNetwork          bool                  `json:"noNetwork,omitempty"`
-	HostNetwork        bool                  `json:"infraHostNetwork,omitempty"`
-	PidNS              specgen.Namespace     `json:"infraPid,omitempty"`
-	PortBindings       []ocicni.PortMapping  `json:"infraPortBindings"`
-	StaticIP           net.IP                `json:"staticIP,omitempty"`
-	StaticMAC          net.HardwareAddr      `json:"staticMAC,omitempty"`
-	UseImageResolvConf bool                  `json:"useImageResolvConf,omitempty"`
-	DNSServer          []string              `json:"dnsServer,omitempty"`
-	DNSSearch          []string              `json:"dnsSearch,omitempty"`
-	DNSOption          []string              `json:"dnsOption,omitempty"`
-	UseImageHosts      bool                  `json:"useImageHosts,omitempty"`
-	HostAdd            []string              `json:"hostsAdd,omitempty"`
-	Networks           []string              `json:"networks,omitempty"`
-	ExitCommand        []string              `json:"exitCommand,omitempty"`
-	InfraImage         string                `json:"infraImage,omitempty"`
-	InfraCommand       []string              `json:"infraCommand,omitempty"`
-	InfraName          string                `json:"infraName,omitempty"`
-	Slirp4netns        bool                  `json:"slirp4netns,omitempty"`
-	NetworkOptions     map[string][]string   `json:"network_options,omitempty"`
-	ResourceLimits     *specs.LinuxResources `json:"resource_limits,omitempty"`
-	Userns             specgen.Namespace     `json:"userns,omitempty"`
-}
-
 // ID retrieves the pod's ID
 func (p *Pod) ID() string {
 	return p.config.ID
@@ -139,45 +102,104 @@ func (p *Pod) Namespace() string {
 // ResourceLim returns the cpuset resource limits for the pod
 func (p *Pod) ResourceLim() *specs.LinuxResources {
 	resCopy := &specs.LinuxResources{}
-	if err := JSONDeepCopy(p.config.InfraContainer.ResourceLimits, resCopy); err != nil {
+	empty := &specs.LinuxResources{
+		CPU: &specs.LinuxCPU{},
+	}
+	infra, err := p.runtime.GetContainer(p.state.InfraContainerID)
+	if err != nil {
+		return empty
+	}
+	conf := infra.config.Spec
+	if err != nil {
+		return empty
+	}
+	if conf.Linux == nil || conf.Linux.Resources == nil {
+		return empty
+	}
+	if err = JSONDeepCopy(conf.Linux.Resources, resCopy); err != nil {
 		return nil
 	}
-	if resCopy != nil && resCopy.CPU != nil {
+	if resCopy.CPU != nil {
 		return resCopy
 	}
-	empty := &specs.LinuxResources{
-		CPU: &specs.LinuxCPU{},
-	}
+
 	return empty
 }
 
 // CPUPeriod returns the pod CPU period
 func (p *Pod) CPUPeriod() uint64 {
-	resCopy := &specs.LinuxResources{}
-	if err := JSONDeepCopy(p.config.InfraContainer.ResourceLimits, resCopy); err != nil {
+	if p.state.InfraContainerID == "" {
 		return 0
 	}
-	if resCopy != nil && resCopy.CPU != nil && resCopy.CPU.Period != nil {
-		return *resCopy.CPU.Period
+	infra, err := p.runtime.GetContainer(p.state.InfraContainerID)
+	if err != nil {
+		return 0
+	}
+	conf := infra.config.Spec
+	if conf != nil && conf.Linux != nil && conf.Linux.Resources != nil && conf.Linux.Resources.CPU != nil && conf.Linux.Resources.CPU.Period != nil {
+		return *conf.Linux.Resources.CPU.Period
 	}
 	return 0
 }
 
 // CPUQuota returns the pod CPU quota
 func (p *Pod) CPUQuota() int64 {
-	resCopy := &specs.LinuxResources{}
-	if err := JSONDeepCopy(p.config.InfraContainer.ResourceLimits, resCopy); err != nil {
+	if p.state.InfraContainerID == "" {
+		return 0
+	}
+	infra, err := p.runtime.GetContainer(p.state.InfraContainerID)
+	if err != nil {
 		return 0
 	}
-	if resCopy != nil && resCopy.CPU != nil && resCopy.CPU.Quota != nil {
-		return *resCopy.CPU.Quota
+	conf := infra.config.Spec
+	if conf != nil && conf.Linux != nil && conf.Linux.Resources != nil && conf.Linux.Resources.CPU != nil && conf.Linux.Resources.CPU.Quota != nil {
+		return *conf.Linux.Resources.CPU.Quota
 	}
 	return 0
 }
 
 // PidMode returns the PID mode given by the user ex: pod, private...
 func (p *Pod) PidMode() string {
-	return string(p.config.InfraContainer.PidNS.NSMode)
+	infra, err := p.runtime.GetContainer(p.state.InfraContainerID)
+	if err != nil {
+		return ""
+	}
+	conf := infra.Config()
+	ctrSpec := conf.Spec
+	if ctrSpec != nil && ctrSpec.Linux != nil {
+		for _, ns := range ctrSpec.Linux.Namespaces {
+			if ns.Type == specs.PIDNamespace {
+				if ns.Path != "" {
+					return fmt.Sprintf("ns:%s", ns.Path)
+				}
+				return "private"
+			}
+		}
+		return "host"
+	}
+	return ""
+}
+
+// PidMode returns the PID mode given by the user ex: pod, private...
+func (p *Pod) UserNSMode() string {
+	infra, err := p.infraContainer()
+	if err != nil {
+		return ""
+	}
+	conf := infra.Config()
+	ctrSpec := conf.Spec
+	if ctrSpec != nil && ctrSpec.Linux != nil {
+		for _, ns := range ctrSpec.Linux.Namespaces {
+			if ns.Type == specs.UserNamespace {
+				if ns.Path != "" {
+					return fmt.Sprintf("ns:%s", ns.Path)
+				}
+				return "private"
+			}
+		}
+		return "host"
+	}
+	return ""
 }
 
 // Labels returns the pod's labels
@@ -263,20 +285,24 @@ func (p *Pod) CgroupPath() (string, error) {
 	if p.state.CgroupPath != "" {
 		return p.state.CgroupPath, nil
 	}
-	if !p.HasInfraContainer() {
+	if p.state.InfraContainerID == "" {
 		return "", errors.Wrap(define.ErrNoSuchCtr, "pod has no infra container")
 	}
 
-	id := p.state.InfraContainerID
+	id, err := p.infraContainerID()
+	if err != nil {
+		return "", err
+	}
 
 	if id != "" {
-		ctr, err := p.runtime.state.Container(id)
+		ctr, err := p.infraContainer()
 		if err != nil {
 			return "", errors.Wrapf(err, "could not get infra")
 		}
 		if ctr != nil {
-			ctr.Start(context.Background(), false)
+			ctr.Start(context.Background(), true)
 			cgroupPath, err := ctr.CGroupPath()
+			fmt.Println(cgroupPath)
 			if err != nil {
 				return "", errors.Wrapf(err, "could not get container cgroup")
 			}
@@ -325,7 +351,7 @@ func (p *Pod) allContainers() ([]*Container, error) {
 
 // HasInfraContainer returns whether the pod will create an infra container
 func (p *Pod) HasInfraContainer() bool {
-	return p.config.InfraContainer.HasInfraContainer
+	return p.config.HasInfra
 }
 
 // SharesNamespaces checks if the pod has any kernel namespaces set as shared. An infra container will not be
@@ -350,19 +376,26 @@ func (p *Pod) InfraContainerID() (string, error) {
 	return p.infraContainerID()
 }
 
-// InfraContainer returns the infra container.
-func (p *Pod) InfraContainer() (*Container, error) {
-	if !p.HasInfraContainer() {
-		return nil, errors.Wrap(define.ErrNoSuchCtr, "pod has no infra container")
-	}
-	id, err := p.InfraContainerID()
+// infraContainer is the unlocked versio of InfraContainer which returns the infra container
+func (p *Pod) infraContainer() (*Container, error) {
+	id, err := p.infraContainerID()
 	if err != nil {
 		return nil, err
 	}
+	if id == "" {
+		return nil, errors.Wrap(define.ErrNoSuchCtr, "pod has no infra container")
+	}
 
 	return p.runtime.state.Container(id)
 }
 
+// InfraContainer returns the infra container.
+func (p *Pod) InfraContainer() (*Container, error) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+	return p.infraContainer()
+}
+
 // TODO add pod batching
 // Lock pod to avoid lock contention
 // Store and lock all containers (no RemoveContainer in batch guarantees cache will not become stale)
@@ -412,13 +445,7 @@ func (p *Pod) ProcessLabel() (string, error) {
 	if !p.HasInfraContainer() {
 		return "", nil
 	}
-
-	id, err := p.InfraContainerID()
-	if err != nil {
-		return "", err
-	}
-
-	ctr, err := p.runtime.state.Container(id)
+	ctr, err := p.infraContainer()
 	if err != nil {
 		return "", err
 	}
diff --git a/libpod/pod_api.go b/libpod/pod_api.go
index 53fb9538f..5f4d983b9 100644
--- a/libpod/pod_api.go
+++ b/libpod/pod_api.go
@@ -582,41 +582,46 @@ func (p *Pod) Inspect() (*define.InspectPodData, error) {
 	// Infra config contains detailed information on the pod's infra
 	// container.
 	var infraConfig *define.InspectPodInfraConfig
-	if p.config.InfraContainer != nil && p.config.InfraContainer.HasInfraContainer {
+	if p.state.InfraContainerID != "" {
+		infra, err := p.runtime.GetContainer(p.state.InfraContainerID)
+		if err != nil {
+			return nil, err
+		}
 		infraConfig = new(define.InspectPodInfraConfig)
-		infraConfig.HostNetwork = p.config.InfraContainer.HostNetwork
-		infraConfig.StaticIP = p.config.InfraContainer.StaticIP
-		infraConfig.StaticMAC = p.config.InfraContainer.StaticMAC.String()
-		infraConfig.NoManageResolvConf = p.config.InfraContainer.UseImageResolvConf
-		infraConfig.NoManageHosts = p.config.InfraContainer.UseImageHosts
+		infraConfig.HostNetwork = !infra.Config().ContainerNetworkConfig.UseImageHosts
+		infraConfig.StaticIP = infra.Config().ContainerNetworkConfig.StaticIP
+		infraConfig.NoManageResolvConf = infra.Config().UseImageResolvConf
+		infraConfig.NoManageHosts = infra.Config().UseImageHosts
 		infraConfig.CPUPeriod = p.CPUPeriod()
 		infraConfig.CPUQuota = p.CPUQuota()
 		infraConfig.CPUSetCPUs = p.ResourceLim().CPU.Cpus
 		infraConfig.PidNS = p.PidMode()
-		infraConfig.UserNS = p.config.InfraContainer.Userns.String()
+		infraConfig.UserNS = p.UserNSMode()
 
-		if len(p.config.InfraContainer.DNSServer) > 0 {
-			infraConfig.DNSServer = make([]string, 0, len(p.config.InfraContainer.DNSServer))
-			infraConfig.DNSServer = append(infraConfig.DNSServer, p.config.InfraContainer.DNSServer...)
+		if len(infra.Config().ContainerNetworkConfig.DNSServer) > 0 {
+			infraConfig.DNSServer = make([]string, 0, len(infra.Config().ContainerNetworkConfig.DNSServer))
+			for _, entry := range infra.Config().ContainerNetworkConfig.DNSServer {
+				infraConfig.DNSServer = append(infraConfig.DNSServer, entry.String())
+			}
 		}
-		if len(p.config.InfraContainer.DNSSearch) > 0 {
-			infraConfig.DNSSearch = make([]string, 0, len(p.config.InfraContainer.DNSSearch))
-			infraConfig.DNSSearch = append(infraConfig.DNSSearch, p.config.InfraContainer.DNSSearch...)
+		if len(infra.Config().ContainerNetworkConfig.DNSSearch) > 0 {
+			infraConfig.DNSSearch = make([]string, 0, len(infra.Config().ContainerNetworkConfig.DNSSearch))
+			infraConfig.DNSSearch = append(infraConfig.DNSSearch, infra.Config().ContainerNetworkConfig.DNSSearch...)
 		}
-		if len(p.config.InfraContainer.DNSOption) > 0 {
-			infraConfig.DNSOption = make([]string, 0, len(p.config.InfraContainer.DNSOption))
-			infraConfig.DNSOption = append(infraConfig.DNSOption, p.config.InfraContainer.DNSOption...)
+		if len(infra.Config().ContainerNetworkConfig.DNSOption) > 0 {
+			infraConfig.DNSOption = make([]string, 0, len(infra.Config().ContainerNetworkConfig.DNSOption))
+			infraConfig.DNSOption = append(infraConfig.DNSOption, infra.Config().ContainerNetworkConfig.DNSOption...)
 		}
-		if len(p.config.InfraContainer.HostAdd) > 0 {
-			infraConfig.HostAdd = make([]string, 0, len(p.config.InfraContainer.HostAdd))
-			infraConfig.HostAdd = append(infraConfig.HostAdd, p.config.InfraContainer.HostAdd...)
+		if len(infra.Config().HostAdd) > 0 {
+			infraConfig.HostAdd = make([]string, 0, len(infra.Config().HostAdd))
+			infraConfig.HostAdd = append(infraConfig.HostAdd, infra.Config().HostAdd...)
 		}
-		if len(p.config.InfraContainer.Networks) > 0 {
-			infraConfig.Networks = make([]string, 0, len(p.config.InfraContainer.Networks))
-			infraConfig.Networks = append(infraConfig.Networks, p.config.InfraContainer.Networks...)
+		if len(infra.Config().ContainerNetworkConfig.Networks) > 0 {
+			infraConfig.Networks = make([]string, 0, len(infra.Config().ContainerNetworkConfig.Networks))
+			infraConfig.Networks = append(infraConfig.Networks, infra.Config().ContainerNetworkConfig.Networks...)
 		}
-		infraConfig.NetworkOptions = p.config.InfraContainer.NetworkOptions
-		infraConfig.PortBindings = makeInspectPortBindings(p.config.InfraContainer.PortBindings, nil)
+		infraConfig.NetworkOptions = infra.Config().ContainerNetworkConfig.NetworkOptions
+		infraConfig.PortBindings = makeInspectPortBindings(infra.Config().ContainerNetworkConfig.PortMappings, nil)
 	}
 
 	inspectData := define.InspectPodData{
diff --git a/libpod/pod_internal.go b/libpod/pod_internal.go
index e81bd7b16..079b631a0 100644
--- a/libpod/pod_internal.go
+++ b/libpod/pod_internal.go
@@ -20,7 +20,7 @@ func newPod(runtime *Runtime) *Pod {
 	pod.config.ID = stringid.GenerateNonCryptoID()
 	pod.config.Labels = make(map[string]string)
 	pod.config.CreatedTime = time.Now()
-	pod.config.InfraContainer = new(InfraContainerConfig)
+	//	pod.config.InfraContainer = new(ContainerConfig)
 	pod.state = new(podState)
 	pod.runtime = runtime
 
diff --git a/libpod/runtime_ctr.go b/libpod/runtime_ctr.go
index 52072b0f3..7d3891f6e 100644
--- a/libpod/runtime_ctr.go
+++ b/libpod/runtime_ctr.go
@@ -17,6 +17,7 @@ import (
 	"github.com/containers/podman/v3/pkg/cgroups"
 	"github.com/containers/podman/v3/pkg/domain/entities/reports"
 	"github.com/containers/podman/v3/pkg/rootless"
+	"github.com/containers/podman/v3/pkg/specgen"
 	"github.com/containers/storage"
 	"github.com/containers/storage/pkg/stringid"
 	"github.com/docker/go-units"
@@ -38,12 +39,15 @@ type CtrCreateOption func(*Container) error
 type ContainerFilter func(*Container) bool
 
 // NewContainer creates a new container from a given OCI config.
-func (r *Runtime) NewContainer(ctx context.Context, rSpec *spec.Spec, options ...CtrCreateOption) (*Container, error) {
+func (r *Runtime) NewContainer(ctx context.Context, rSpec *spec.Spec, spec *specgen.SpecGenerator, infra bool, options ...CtrCreateOption) (*Container, error) {
 	r.lock.Lock()
 	defer r.lock.Unlock()
 	if !r.valid {
 		return nil, define.ErrRuntimeStopped
 	}
+	if infra {
+		options = append(options, withIsInfra())
+	}
 	return r.newContainer(ctx, rSpec, options...)
 }
 
@@ -172,6 +176,7 @@ func (r *Runtime) initContainerVariables(rSpec *spec.Spec, config *ContainerConf
 		}
 		ctr.config.ShmSize = size
 		ctr.config.StopSignal = 15
+
 		ctr.config.StopTimeout = r.config.Engine.StopTimeout
 	} else {
 		// This is a restore from an imported checkpoint
@@ -211,7 +216,11 @@ func (r *Runtime) initContainerVariables(rSpec *spec.Spec, config *ContainerConf
 }
 
 func (r *Runtime) newContainer(ctx context.Context, rSpec *spec.Spec, options ...CtrCreateOption) (*Container, error) {
-	ctr, err := r.initContainerVariables(rSpec, nil)
+	var ctr *Container
+	var err error
+
+	ctr, err = r.initContainerVariables(rSpec, nil)
+
 	if err != nil {
 		return nil, errors.Wrapf(err, "error initializing container variables")
 	}
@@ -230,7 +239,9 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
 	if err := ctr.validate(); err != nil {
 		return nil, err
 	}
-
+	if ctr.config.IsInfra {
+		ctr.config.StopTimeout = 10
+	}
 	// normalize the networks to names
 	// ocicni only knows about cni names so we have to make
 	// sure we do not use ids internally
@@ -327,7 +338,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
 		switch r.config.Engine.CgroupManager {
 		case config.CgroupfsCgroupsManager:
 			if ctr.config.CgroupParent == "" {
-				if pod != nil && pod.config.UsePodCgroup {
+				if pod != nil && pod.config.UsePodCgroup && !ctr.IsInfra() {
 					podCgroup, err := pod.CgroupPath()
 					if err != nil {
 						return nil, errors.Wrapf(err, "error retrieving pod %s cgroup", pod.ID())
@@ -348,7 +359,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
 		case config.SystemdCgroupsManager:
 			if ctr.config.CgroupParent == "" {
 				switch {
-				case pod != nil && pod.config.UsePodCgroup:
+				case pod != nil && pod.config.UsePodCgroup && !ctr.IsInfra():
 					podCgroup, err := pod.CgroupPath()
 					if err != nil {
 						return nil, errors.Wrapf(err, "error retrieving pod %s cgroup", pod.ID())
@@ -833,7 +844,10 @@ func (r *Runtime) evictContainer(ctx context.Context, idOrName string, removeVol
 			return id, err
 		}
 
-		infraID := pod.state.InfraContainerID
+		infraID, err := pod.infraContainerID()
+		if err != nil {
+			return "", err
+		}
 		if c.ID() == infraID {
 			return id, errors.Errorf("container %s is the infra container of pod %s and cannot be removed without removing the pod", c.ID(), pod.ID())
 		}
diff --git a/libpod/runtime_pod_infra_linux.go b/libpod/runtime_pod_infra_linux.go
deleted file mode 100644
index 9236fb1f5..000000000
--- a/libpod/runtime_pod_infra_linux.go
+++ /dev/null
@@ -1,284 +0,0 @@
-// +build linux
-
-package libpod
-
-import (
-	"context"
-	"strings"
-
-	"github.com/containers/common/pkg/config"
-	"github.com/containers/podman/v3/libpod/define"
-	"github.com/containers/podman/v3/pkg/namespaces"
-	"github.com/containers/podman/v3/pkg/rootless"
-	"github.com/containers/podman/v3/pkg/specgen"
-	"github.com/containers/podman/v3/pkg/util"
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
-	spec "github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/opencontainers/runtime-tools/generate"
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
-)
-
-const (
-	// IDTruncLength is the length of the pod's id that will be used to make the
-	// infra container name
-	IDTruncLength = 12
-)
-
-func (r *Runtime) makeInfraContainer(ctx context.Context, p *Pod, imgName, rawImageName, imgID string, config *v1.ImageConfig) (*Container, error) {
-	// Set up generator for infra container defaults
-	g, err := generate.New("linux")
-	if err != nil {
-		return nil, err
-	}
-
-	// Set Pod hostname
-	g.Config.Hostname = p.config.Hostname
-
-	var options []CtrCreateOption
-
-	// Command: If user-specified, use that preferentially.
-	// If not set and the config file is set, fall back to that.
-	var infraCtrCommand []string
-	if p.config.InfraContainer.InfraCommand != nil {
-		logrus.Debugf("User-specified infra container entrypoint %v", p.config.InfraContainer.InfraCommand)
-		infraCtrCommand = p.config.InfraContainer.InfraCommand
-	} else if r.config.Engine.InfraCommand != "" {
-		logrus.Debugf("Config-specified infra container entrypoint %s", r.config.Engine.InfraCommand)
-		infraCtrCommand = []string{r.config.Engine.InfraCommand}
-	}
-	// Only if set by the user or containers.conf, we set entrypoint for the
-	// infra container.
-	// This is only used by commit, so it shouldn't matter... But someone
-	// may eventually want to commit an infra container?
-	// TODO: Should we actually do this if set by containers.conf?
-	if infraCtrCommand != nil {
-		// Need to duplicate the array - we are going to add Cmd later
-		// so the current array will be changed.
-		newArr := make([]string, 0, len(infraCtrCommand))
-		newArr = append(newArr, infraCtrCommand...)
-		options = append(options, WithEntrypoint(newArr))
-	}
-
-	isRootless := rootless.IsRootless()
-
-	// I've seen circumstances where config is being passed as nil.
-	// Let's err on the side of safety and make sure it's safe to use.
-	if config != nil {
-		if infraCtrCommand == nil {
-			// If we have no entrypoint and command from the image,
-			// we can't go on - the infra container has no command.
-			if len(config.Entrypoint) == 0 && len(config.Cmd) == 0 {
-				return nil, errors.Errorf("infra container has no command")
-			}
-			if len(config.Entrypoint) > 0 {
-				infraCtrCommand = config.Entrypoint
-			} else {
-				// Use the Docker default "/bin/sh -c"
-				// entrypoint, as we're overriding command.
-				// If an image doesn't want this, it can
-				// override entrypoint too.
-				infraCtrCommand = []string{"/bin/sh", "-c"}
-			}
-		}
-		if len(config.Cmd) > 0 {
-			infraCtrCommand = append(infraCtrCommand, config.Cmd...)
-		}
-
-		if len(config.Env) > 0 {
-			for _, nameValPair := range config.Env {
-				nameValSlice := strings.Split(nameValPair, "=")
-				if len(nameValSlice) < 2 {
-					return nil, errors.Errorf("Invalid environment variable structure in pause image")
-				}
-				g.AddProcessEnv(nameValSlice[0], nameValSlice[1])
-			}
-		}
-
-		switch {
-		case p.config.InfraContainer.HostNetwork:
-			if err := g.RemoveLinuxNamespace(string(spec.NetworkNamespace)); err != nil {
-				return nil, errors.Wrapf(err, "error removing network namespace from pod %s infra container", p.ID())
-			}
-		case p.config.InfraContainer.NoNetwork:
-			// Do nothing - we have a network namespace by default,
-			// but should not configure slirp.
-		default:
-			// Since user namespace sharing is not implemented, we only need to check if it's rootless
-			netmode := "bridge"
-			if p.config.InfraContainer.Slirp4netns {
-				netmode = "slirp4netns"
-				if len(p.config.InfraContainer.NetworkOptions) != 0 {
-					options = append(options, WithNetworkOptions(p.config.InfraContainer.NetworkOptions))
-				}
-			}
-			// FIXME allow pods to have exposed ports
-			options = append(options, WithNetNS(p.config.InfraContainer.PortBindings, nil, !p.config.InfraContainer.Userns.IsHost(), netmode, p.config.InfraContainer.Networks))
-		}
-
-		// For each option in InfraContainerConfig - if set, pass into
-		// the infra container we're creating with the appropriate
-		// With... option.
-		if p.config.InfraContainer.StaticIP != nil {
-			options = append(options, WithStaticIP(p.config.InfraContainer.StaticIP))
-		}
-		if p.config.InfraContainer.StaticMAC != nil {
-			options = append(options, WithStaticMAC(p.config.InfraContainer.StaticMAC))
-		}
-		if p.config.InfraContainer.UseImageResolvConf {
-			options = append(options, WithUseImageResolvConf())
-		}
-		if len(p.config.InfraContainer.DNSServer) > 0 {
-			options = append(options, WithDNS(p.config.InfraContainer.DNSServer))
-		}
-		if len(p.config.InfraContainer.DNSSearch) > 0 {
-			options = append(options, WithDNSSearch(p.config.InfraContainer.DNSSearch))
-		}
-		if len(p.config.InfraContainer.DNSOption) > 0 {
-			options = append(options, WithDNSOption(p.config.InfraContainer.DNSOption))
-		}
-		if p.config.InfraContainer.UseImageHosts {
-			options = append(options, WithUseImageHosts())
-		}
-		if len(p.config.InfraContainer.HostAdd) > 0 {
-			options = append(options, WithHosts(p.config.InfraContainer.HostAdd))
-		}
-		if len(p.config.InfraContainer.ExitCommand) > 0 {
-			options = append(options, WithExitCommand(p.config.InfraContainer.ExitCommand))
-		}
-
-		if p.config.UsePodPID && p.config.InfraContainer.PidNS.NSMode != "host" {
-			g.AddOrReplaceLinuxNamespace(string(spec.LinuxNamespaceType("pid")), p.config.InfraContainer.PidNS.Value)
-		} else if p.config.InfraContainer.PidNS.NSMode == "host" {
-			newNS := []spec.LinuxNamespace{}
-			for _, entry := range g.Config.Linux.Namespaces {
-				if entry.Type != spec.LinuxNamespaceType("pid") {
-					newNS = append(newNS, entry)
-				}
-			}
-			g.Config.Linux.Namespaces = newNS
-		}
-	}
-
-	for _, ctl := range r.config.Containers.DefaultSysctls {
-		sysctl := strings.SplitN(ctl, "=", 2)
-		if len(sysctl) < 2 {
-			return nil, errors.Errorf("invalid default sysctl %s", ctl)
-		}
-
-		// Ignore net sysctls if --net=host
-		if p.config.InfraContainer.HostNetwork && strings.HasPrefix(sysctl[0], "net.") {
-			logrus.Infof("Sysctl %s=%s ignored in containers.conf, since Network Namespace set to host", sysctl[0], sysctl[1])
-			continue
-		}
-
-		g.AddLinuxSysctl(sysctl[0], sysctl[1])
-	}
-
-	g.SetRootReadonly(true)
-	g.SetProcessArgs(infraCtrCommand)
-
-	logrus.Debugf("Using %q as infra container command", infraCtrCommand)
-
-	mapopt, err := util.ParseIDMapping(namespaces.UsernsMode(p.config.InfraContainer.Userns.String()), []string{}, []string{}, "", "")
-	if err != nil {
-		return nil, err
-	}
-	user, err := specgen.SetupUserNS(mapopt, p.config.InfraContainer.Userns, &g)
-	if err != nil {
-		return nil, err
-	}
-	if user != "" {
-		options = append(options, WithUser(user))
-	}
-
-	g.RemoveMount("/dev/shm")
-	if isRootless {
-		g.RemoveMount("/dev/pts")
-		devPts := spec.Mount{
-			Destination: "/dev/pts",
-			Type:        "devpts",
-			Source:      "devpts",
-			Options:     []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
-		}
-		g.AddMount(devPts)
-	}
-
-	// Add default sysctls from containers.conf
-	defaultSysctls, err := util.ValidateSysctls(r.config.Sysctls())
-	if err != nil {
-		return nil, err
-	}
-	for sysctlKey, sysctlVal := range defaultSysctls {
-		// Ignore mqueue sysctls if not sharing IPC
-		if !p.config.UsePodIPC && strings.HasPrefix(sysctlKey, "fs.mqueue.") {
-			logrus.Infof("Sysctl %s=%s ignored in containers.conf, since IPC Namespace for pod is unused", sysctlKey, sysctlVal)
-			continue
-		}
-
-		// Ignore net sysctls if host network or not sharing network
-		if (p.config.InfraContainer.HostNetwork || !p.config.UsePodNet) && strings.HasPrefix(sysctlKey, "net.") {
-			logrus.Infof("Sysctl %s=%s ignored in containers.conf, since Network Namespace for pod is unused", sysctlKey, sysctlVal)
-			continue
-		}
-
-		// Ignore uts sysctls if not sharing UTS
-		if !p.config.UsePodUTS && (strings.HasPrefix(sysctlKey, "kernel.domainname") || strings.HasPrefix(sysctlKey, "kernel.hostname")) {
-			logrus.Infof("Sysctl %s=%s ignored in containers.conf, since UTS Namespace for pod is unused", sysctlKey, sysctlVal)
-			continue
-		}
-		g.AddLinuxSysctl(sysctlKey, sysctlVal)
-	}
-
-	containerName := p.config.InfraContainer.InfraName
-	if containerName == "" {
-		containerName = p.ID()[:IDTruncLength] + "-infra"
-	}
-	logrus.Infof("Infra container name %s", containerName)
-	options = append(options, r.WithPod(p))
-	options = append(options, WithRootFSFromImage(imgID, imgName, rawImageName))
-	options = append(options, WithName(containerName))
-	options = append(options, withIsInfra())
-	options = append(options, WithIDMappings(*mapopt))
-	if len(p.config.InfraContainer.ConmonPidFile) > 0 {
-		options = append(options, WithConmonPidFile(p.config.InfraContainer.ConmonPidFile))
-	}
-	newRes := new(spec.LinuxResources)
-	newRes.CPU = new(spec.LinuxCPU)
-	newRes.CPU = p.ResourceLim().CPU
-	g.Config.Linux.Resources.CPU = newRes.CPU
-
-	return r.newContainer(ctx, g.Config, options...)
-}
-
-// createInfraContainer wrap creates an infra container for a pod.
-// An infra container becomes the basis for kernel namespace sharing between
-// containers in the pod.
-func (r *Runtime) createInfraContainer(ctx context.Context, p *Pod) (*Container, error) {
-	if !r.valid {
-		return nil, define.ErrRuntimeStopped
-	}
-	imageName := p.config.InfraContainer.InfraImage
-	if imageName == "" {
-		imageName = r.config.Engine.InfraImage
-	}
-
-	pulledImages, err := r.LibimageRuntime().Pull(ctx, imageName, config.PullPolicyMissing, nil)
-	if err != nil {
-		return nil, errors.Wrap(err, "error pulling infra-container image")
-	}
-
-	newImage := pulledImages[0]
-	data, err := newImage.Inspect(ctx, false)
-	if err != nil {
-		return nil, err
-	}
-
-	imageName = "none"
-	if len(newImage.Names()) > 0 {
-		imageName = newImage.Names()[0]
-	}
-	imageID := data.ID
-
-	return r.makeInfraContainer(ctx, p, imageName, r.config.Engine.InfraImage, imageID, data.Config)
-}
diff --git a/libpod/runtime_pod_linux.go b/libpod/runtime_pod_linux.go
index fce3f38a7..7571fdfff 100644
--- a/libpod/runtime_pod_linux.go
+++ b/libpod/runtime_pod_linux.go
@@ -14,13 +14,14 @@ import (
 	"github.com/containers/podman/v3/libpod/events"
 	"github.com/containers/podman/v3/pkg/cgroups"
 	"github.com/containers/podman/v3/pkg/rootless"
+	"github.com/containers/podman/v3/pkg/specgen"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
 // NewPod makes a new, empty pod
-func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (_ *Pod, deferredErr error) {
+func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, options ...PodCreateOption) (_ *Pod, deferredErr error) {
 	r.lock.Lock()
 	defer r.lock.Unlock()
 
@@ -50,8 +51,8 @@ func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (_ *Po
 		pod.config.Name = name
 	}
 
-	if pod.config.Hostname == "" {
-		pod.config.Hostname = pod.config.Name
+	if p.InfraContainerSpec != nil && p.InfraContainerSpec.Hostname == "" {
+		p.InfraContainerSpec.Hostname = pod.config.Name
 	}
 
 	// Allocate a lock for the pod
@@ -88,6 +89,9 @@ func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (_ *Po
 			// launch should do it for us
 			if pod.config.UsePodCgroup {
 				pod.state.CgroupPath = filepath.Join(pod.config.CgroupParent, pod.ID())
+				if p.InfraContainerSpec != nil {
+					p.InfraContainerSpec.CgroupParent = pod.state.CgroupPath
+				}
 			}
 		}
 	case config.SystemdCgroupsManager:
@@ -108,6 +112,9 @@ func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (_ *Po
 				return nil, errors.Wrapf(err, "unable to create pod cgroup for pod %s", pod.ID())
 			}
 			pod.state.CgroupPath = cgroupPath
+			if p.InfraContainerSpec != nil {
+				p.InfraContainerSpec.CgroupParent = pod.state.CgroupPath
+			}
 		}
 	default:
 		return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
@@ -127,28 +134,40 @@ func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (_ *Po
 	if err := r.state.AddPod(pod); err != nil {
 		return nil, errors.Wrapf(err, "error adding pod to state")
 	}
-	defer func() {
-		if deferredErr != nil {
-			if err := r.removePod(ctx, pod, true, true); err != nil {
-				logrus.Errorf("Error removing pod after pause container creation failure: %v", err)
-			}
-		}
-	}()
+	return pod, nil
+}
 
-	if pod.HasInfraContainer() {
-		ctr, err := r.createInfraContainer(ctx, pod)
-		if err != nil {
-			return nil, errors.Wrapf(err, "error adding Infra Container")
-		}
-		pod.state.InfraContainerID = ctr.ID()
-		if err := pod.save(); err != nil {
-			return nil, err
-		}
+// AddInfra adds the created infra container to the pod state
+func (r *Runtime) AddInfra(ctx context.Context, pod *Pod, infraCtr *Container) (*Pod, error) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+
+	if !r.valid {
+		return nil, define.ErrRuntimeStopped
+	}
+	pod.state.InfraContainerID = infraCtr.ID()
+	if err := pod.save(); err != nil {
+		return nil, err
 	}
 	pod.newPodEvent(events.Create)
 	return pod, nil
 }
 
+// SavePod is a helper function to save the pod state from outside of libpod
+func (r *Runtime) SavePod(pod *Pod) error {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+	if err := pod.save(); err != nil {
+		return err
+	}
+	pod.newPodEvent(events.Create)
+	return nil
+}
+
 func (r *Runtime) removePod(ctx context.Context, p *Pod, removeCtrs, force bool) error {
 	if err := p.updatePod(); err != nil {
 		return err