Merge pull request #8400 from rhatdan/varlink

Remove varlink support from podman

1 files changed, 0 insertions, 1155 deletions

diff --git a/pkg/varlinkapi/create.go b/pkg/varlinkapi/create.go
deleted file mode 100644
index e9309a2d4..000000000
--- a/pkg/varlinkapi/create.go
+++ /dev/null
@@ -1,1155 +0,0 @@
-package varlinkapi
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	goruntime "runtime"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/containers/common/pkg/sysinfo"
-	"github.com/containers/image/v5/manifest"
-	"github.com/containers/podman/v2/cmd/podman/parse"
-	"github.com/containers/podman/v2/libpod"
-	"github.com/containers/podman/v2/libpod/define"
-	"github.com/containers/podman/v2/libpod/image"
-	ann "github.com/containers/podman/v2/pkg/annotations"
-	"github.com/containers/podman/v2/pkg/autoupdate"
-	"github.com/containers/podman/v2/pkg/cgroups"
-	envLib "github.com/containers/podman/v2/pkg/env"
-	"github.com/containers/podman/v2/pkg/errorhandling"
-	"github.com/containers/podman/v2/pkg/inspect"
-	ns "github.com/containers/podman/v2/pkg/namespaces"
-	"github.com/containers/podman/v2/pkg/rootless"
-	"github.com/containers/podman/v2/pkg/seccomp"
-	cc "github.com/containers/podman/v2/pkg/spec"
-	systemdGen "github.com/containers/podman/v2/pkg/systemd/generate"
-	"github.com/containers/podman/v2/pkg/util"
-	"github.com/docker/go-connections/nat"
-	"github.com/docker/go-units"
-	"github.com/opentracing/opentracing-go"
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
-)
-
-var DefaultKernelNamespaces = "cgroup,ipc,net,uts"
-
-func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime) (*libpod.Container, *cc.CreateConfig, error) {
-	var (
-		healthCheck *manifest.Schema2HealthConfig
-		err         error
-		cidFile     *os.File
-	)
-	if c.Bool("trace") {
-		span, _ := opentracing.StartSpanFromContext(ctx, "createContainer")
-		defer span.Finish()
-	}
-	if c.Bool("rm") && c.String("restart") != "" && c.String("restart") != "no" {
-		return nil, nil, errors.Errorf("the --rm option conflicts with --restart")
-	}
-
-	rtc, err := runtime.GetConfig()
-	if err != nil {
-		return nil, nil, err
-	}
-	rootfs := ""
-	if c.Bool("rootfs") {
-		rootfs = c.InputArgs[0]
-	}
-
-	if c.IsSet("cidfile") {
-		cidFile, err = util.OpenExclusiveFile(c.String("cidfile"))
-		if err != nil && os.IsExist(err) {
-			return nil, nil, errors.Errorf("container id file exists. Ensure another container is not using it or delete %s", c.String("cidfile"))
-		}
-		if err != nil {
-			return nil, nil, errors.Errorf("error opening cidfile %s", c.String("cidfile"))
-		}
-		defer errorhandling.CloseQuiet(cidFile)
-		defer errorhandling.SyncQuiet(cidFile)
-	}
-
-	imageName := ""
-	rawImageName := ""
-	var imageData *inspect.ImageData = nil
-
-	// Set the storage if there is no rootfs specified
-	if rootfs == "" {
-		var writer io.Writer
-		if !c.Bool("quiet") {
-			writer = os.Stderr
-		}
-
-		if len(c.InputArgs) != 0 {
-			rawImageName = c.InputArgs[0]
-		} else {
-			return nil, nil, errors.Errorf("error, image name not provided")
-		}
-
-		pullType, err := util.ValidatePullType(c.String("pull"))
-		if err != nil {
-			return nil, nil, err
-		}
-
-		overrideOS := c.String("override-os")
-		overrideArch := c.String("override-arch")
-		dockerRegistryOptions := image.DockerRegistryOptions{
-			OSChoice:           overrideOS,
-			ArchitectureChoice: overrideArch,
-		}
-
-		newImage, err := runtime.ImageRuntime().New(ctx, rawImageName, rtc.Engine.SignaturePolicyPath, c.String("authfile"), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType)
-		if err != nil {
-			return nil, nil, err
-		}
-		imageData, err = newImage.InspectNoSize(ctx)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		if overrideOS == "" && imageData.Os != goruntime.GOOS {
-			logrus.Infof("Using %q (OS) image on %q host", imageData.Os, goruntime.GOOS)
-		}
-
-		if overrideArch == "" && imageData.Architecture != goruntime.GOARCH {
-			logrus.Infof("Using %q (architecture) on %q host", imageData.Architecture, goruntime.GOARCH)
-		}
-
-		names := newImage.Names()
-		if len(names) > 0 {
-			imageName = names[0]
-		} else {
-			imageName = newImage.ID()
-		}
-
-		// if the user disabled the healthcheck with "none" or the no-healthcheck
-		// options is provided, we skip adding it
-		healthCheckCommandInput := c.String("healthcheck-command")
-
-		// the user didn't disable the healthcheck but did pass in a healthcheck command
-		// now we need to make a healthcheck from the commandline input
-		if healthCheckCommandInput != "none" && !c.Bool("no-healthcheck") {
-			if len(healthCheckCommandInput) > 0 {
-				healthCheck, err = makeHealthCheckFromCli(c)
-				if err != nil {
-					return nil, nil, errors.Wrapf(err, "unable to create healthcheck")
-				}
-			} else {
-				// the user did not disable the health check and did not pass in a healthcheck
-				// command as input.  so now we add healthcheck if it exists AND is correct mediatype
-				_, mediaType, err := newImage.Manifest(ctx)
-				if err != nil {
-					return nil, nil, errors.Wrapf(err, "unable to determine mediatype of image %s", newImage.ID())
-				}
-				if mediaType == manifest.DockerV2Schema2MediaType {
-					healthCheck, err = newImage.GetHealthCheck(ctx)
-					if err != nil {
-						return nil, nil, errors.Wrapf(err, "unable to get healthcheck for %s", c.InputArgs[0])
-					}
-
-					if healthCheck != nil {
-						hcCommand := healthCheck.Test
-						if len(hcCommand) < 1 || hcCommand[0] == "" || hcCommand[0] == "NONE" {
-							// disable health check
-							healthCheck = nil
-						} else {
-							// apply defaults if image doesn't override them
-							if healthCheck.Interval == 0 {
-								healthCheck.Interval = 30 * time.Second
-							}
-							if healthCheck.Timeout == 0 {
-								healthCheck.Timeout = 30 * time.Second
-							}
-							/* Docker default is 0s, so the following would be a no-op
-							if healthCheck.StartPeriod == 0 {
-								healthCheck.StartPeriod = 0 * time.Second
-							}
-							*/
-							if healthCheck.Retries == 0 {
-								healthCheck.Retries = 3
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	createConfig, err := ParseCreateOpts(ctx, c, runtime, imageName, rawImageName, imageData)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// (VR): Ideally we perform the checks _before_ pulling the image but that
-	// would require some bigger code refactoring of `ParseCreateOpts` and the
-	// logic here.  But as the creation code will be consolidated in the future
-	// and given auto updates are experimental, we can live with that for now.
-	// In the end, the user may only need to correct the policy or the raw image
-	// name.
-	autoUpdatePolicy, autoUpdatePolicySpecified := createConfig.Labels[autoupdate.Label]
-	if autoUpdatePolicySpecified {
-		if _, err := autoupdate.LookupPolicy(autoUpdatePolicy); err != nil {
-			return nil, nil, err
-		}
-		// Now we need to make sure we're having a fully-qualified image reference.
-		if rootfs != "" {
-			return nil, nil, errors.Errorf("auto updates do not work with --rootfs")
-		}
-		// Make sure the input image is a docker.
-		if err := autoupdate.ValidateImageReference(rawImageName); err != nil {
-			return nil, nil, err
-		}
-	}
-
-	// Because parseCreateOpts does derive anything from the image, we add health check
-	// at this point. The rest is done by WithOptions.
-	createConfig.HealthCheck = healthCheck
-
-	// TODO: Should be able to return this from ParseCreateOpts
-	var pod *libpod.Pod
-	if createConfig.Pod != "" {
-		pod, err = runtime.LookupPod(createConfig.Pod)
-		if err != nil {
-			return nil, nil, errors.Wrapf(err, "error looking up pod to join")
-		}
-	}
-
-	ctr, err := CreateContainerFromCreateConfig(ctx, runtime, createConfig, pod)
-	if err != nil {
-		return nil, nil, err
-	}
-	if cidFile != nil {
-		_, err = cidFile.WriteString(ctr.ID())
-		if err != nil {
-			logrus.Error(err)
-		}
-
-	}
-
-	logrus.Debugf("New container created %q", ctr.ID())
-	return ctr, createConfig, nil
-}
-
-func configureEntrypoint(c *GenericCLIResults, data *inspect.ImageData) []string {
-	entrypoint := []string{}
-	if c.IsSet("entrypoint") {
-		// Force entrypoint to ""
-		if c.String("entrypoint") == "" {
-			return entrypoint
-		}
-		// Check if entrypoint specified is json
-		if err := json.Unmarshal([]byte(c.String("entrypoint")), &entrypoint); err == nil {
-			return entrypoint
-		}
-		// Return entrypoint as a single command
-		return []string{c.String("entrypoint")}
-	}
-	if data != nil {
-		return data.Config.Entrypoint
-	}
-	return entrypoint
-}
-
-func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[string]string, podName string) (map[string]string, string, error) {
-	pod, err := runtime.LookupPod(podName)
-	if err != nil {
-		return namespaces, "", err
-	}
-	podInfraID, err := pod.InfraContainerID()
-	if err != nil {
-		return namespaces, "", err
-	}
-	hasUserns := false
-	if podInfraID != "" {
-		podCtr, err := runtime.GetContainer(podInfraID)
-		if err != nil {
-			return namespaces, "", err
-		}
-		mappings, err := podCtr.IDMappings()
-		if err != nil {
-			return namespaces, "", err
-		}
-		hasUserns = len(mappings.UIDMap) > 0
-	}
-
-	if (namespaces["pid"] == cc.Pod) || (!c.IsSet("pid") && pod.SharesPID()) {
-		namespaces["pid"] = fmt.Sprintf("container:%s", podInfraID)
-	}
-	if (namespaces["net"] == cc.Pod) || (!c.IsSet("net") && !c.IsSet("network") && pod.SharesNet()) {
-		namespaces["net"] = fmt.Sprintf("container:%s", podInfraID)
-	}
-	if hasUserns && (namespaces["user"] == cc.Pod) || (!c.IsSet("user") && pod.SharesUser()) {
-		namespaces["user"] = fmt.Sprintf("container:%s", podInfraID)
-	}
-	if (namespaces["ipc"] == cc.Pod) || (!c.IsSet("ipc") && pod.SharesIPC()) {
-		namespaces["ipc"] = fmt.Sprintf("container:%s", podInfraID)
-	}
-	if (namespaces["uts"] == cc.Pod) || (!c.IsSet("uts") && pod.SharesUTS()) {
-		namespaces["uts"] = fmt.Sprintf("container:%s", podInfraID)
-	}
-	return namespaces, podInfraID, nil
-}
-
-// Parses CLI options related to container creation into a config which can be
-// parsed into an OCI runtime spec
-func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime, imageName string, rawImageName string, data *inspect.ImageData) (*cc.CreateConfig, error) {
-	var (
-		inputCommand, command                                    []string
-		memoryLimit, memoryReservation, memorySwap, memoryKernel int64
-		blkioWeight                                              uint16
-		namespaces                                               map[string]string
-	)
-
-	idmappings, err := util.ParseIDMapping(ns.UsernsMode(c.String("userns")), c.StringSlice("uidmap"), c.StringSlice("gidmap"), c.String("subuidname"), c.String("subgidname"))
-	if err != nil {
-		return nil, err
-	}
-
-	imageID := ""
-
-	inputCommand = c.InputArgs[1:]
-	if data != nil {
-		imageID = data.ID
-	}
-
-	rootfs := ""
-	if c.Bool("rootfs") {
-		rootfs = c.InputArgs[0]
-	}
-
-	if c.String("memory") != "" {
-		memoryLimit, err = units.RAMInBytes(c.String("memory"))
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid value for memory")
-		}
-	}
-	if c.String("memory-reservation") != "" {
-		memoryReservation, err = units.RAMInBytes(c.String("memory-reservation"))
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid value for memory-reservation")
-		}
-	}
-	if c.String("memory-swap") != "" {
-		if c.String("memory-swap") == "-1" {
-			memorySwap = -1
-		} else {
-			memorySwap, err = units.RAMInBytes(c.String("memory-swap"))
-			if err != nil {
-				return nil, errors.Wrapf(err, "invalid value for memory-swap")
-			}
-		}
-	}
-	if c.String("kernel-memory") != "" {
-		memoryKernel, err = units.RAMInBytes(c.String("kernel-memory"))
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid value for kernel-memory")
-		}
-	}
-	if c.String("blkio-weight") != "" {
-		u, err := strconv.ParseUint(c.String("blkio-weight"), 10, 16)
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid value for blkio-weight")
-		}
-		blkioWeight = uint16(u)
-	}
-
-	tty := c.Bool("tty")
-
-	if c.Changed("cpu-period") && c.Changed("cpus") {
-		return nil, errors.Errorf("--cpu-period and --cpus cannot be set together")
-	}
-	if c.Changed("cpu-quota") && c.Changed("cpus") {
-		return nil, errors.Errorf("--cpu-quota and --cpus cannot be set together")
-	}
-
-	if c.Bool("no-hosts") && c.Changed("add-host") {
-		return nil, errors.Errorf("--no-hosts and --add-host cannot be set together")
-	}
-
-	// EXPOSED PORTS
-	var portBindings map[nat.Port][]nat.PortBinding
-	if data != nil {
-		portBindings, err = cc.ExposedPorts(c.StringSlice("expose"), c.StringSlice("publish"), c.Bool("publish-all"), data.Config.ExposedPorts)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// Kernel Namespaces
-	// TODO Fix handling of namespace from pod
-	// Instead of integrating here, should be done in libpod
-	// However, that also involves setting up security opts
-	// when the pod's namespace is integrated
-	namespaces = map[string]string{
-		"cgroup": c.String("cgroupns"),
-		"pid":    c.String("pid"),
-		"net":    c.String("network"),
-		"ipc":    c.String("ipc"),
-		"user":   c.String("userns"),
-		"uts":    c.String("uts"),
-	}
-
-	originalPodName := c.String("pod")
-	podName := strings.Replace(originalPodName, "new:", "", 1)
-	// after we strip out :new, make sure there is something left for a pod name
-	if len(podName) < 1 && c.IsSet("pod") {
-		return nil, errors.Errorf("new pod name must be at least one character")
-	}
-
-	// If we are adding a container to a pod, we would like to add an annotation for the infra ID
-	// so kata containers can share VMs inside the pod
-	var podInfraID string
-	if c.IsSet("pod") {
-		if strings.HasPrefix(originalPodName, "new:") {
-			// pod does not exist; lets make it
-			var podOptions []libpod.PodCreateOption
-			podOptions = append(podOptions, libpod.WithPodName(podName), libpod.WithInfraContainer(), libpod.WithPodCgroups())
-			if len(portBindings) > 0 {
-				ociPortBindings, err := cc.NatToOCIPortBindings(portBindings)
-				if err != nil {
-					return nil, err
-				}
-				podOptions = append(podOptions, libpod.WithInfraContainerPorts(ociPortBindings))
-			}
-
-			podNsOptions, err := GetNamespaceOptions(strings.Split(DefaultKernelNamespaces, ","))
-			if err != nil {
-				return nil, err
-			}
-			podOptions = append(podOptions, podNsOptions...)
-			// make pod
-			pod, err := runtime.NewPod(ctx, podOptions...)
-			if err != nil {
-				return nil, err
-			}
-			logrus.Debugf("pod %s created by new container request", pod.ID())
-
-			// The container now cannot have port bindings; so we reset the map
-			portBindings = make(map[nat.Port][]nat.PortBinding)
-		}
-		namespaces, podInfraID, err = configurePod(c, runtime, namespaces, podName)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	pidMode := ns.PidMode(namespaces["pid"])
-	if !cc.Valid(string(pidMode), pidMode) {
-		return nil, errors.Errorf("--pid %q is not valid", c.String("pid"))
-	}
-
-	usernsMode := ns.UsernsMode(namespaces["user"])
-	if !cc.Valid(string(usernsMode), usernsMode) {
-		return nil, errors.Errorf("--userns %q is not valid", namespaces["user"])
-	}
-
-	utsMode := ns.UTSMode(namespaces["uts"])
-	if !cc.Valid(string(utsMode), utsMode) {
-		return nil, errors.Errorf("--uts %q is not valid", namespaces["uts"])
-	}
-
-	cgroupMode := ns.CgroupMode(namespaces["cgroup"])
-	if !cgroupMode.Valid() {
-		return nil, errors.Errorf("--cgroup %q is not valid", namespaces["cgroup"])
-	}
-
-	ipcMode := ns.IpcMode(namespaces["ipc"])
-	if !cc.Valid(string(ipcMode), ipcMode) {
-		return nil, errors.Errorf("--ipc %q is not valid", ipcMode)
-	}
-
-	// Make sure if network is set to container namespace, port binding is not also being asked for
-	netMode := ns.NetworkMode(namespaces["net"])
-	if netMode.IsContainer() {
-		if len(portBindings) > 0 {
-			return nil, errors.Errorf("cannot set port bindings on an existing container network namespace")
-		}
-	}
-
-	// USER
-	user := c.String("user")
-	if user == "" {
-		switch {
-		case usernsMode.IsKeepID():
-			user = fmt.Sprintf("%d:%d", rootless.GetRootlessUID(), rootless.GetRootlessGID())
-		case data == nil:
-			user = "0"
-		default:
-			user = data.Config.User
-		}
-	}
-
-	// STOP SIGNAL
-	stopSignal := syscall.SIGTERM
-	signalString := ""
-	if data != nil {
-		signalString = data.Config.StopSignal
-	}
-	if c.IsSet("stop-signal") {
-		signalString = c.String("stop-signal")
-	}
-	if signalString != "" {
-		stopSignal, err = util.ParseSignal(signalString)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// ENVIRONMENT VARIABLES
-	//
-	// Precedence order (higher index wins):
-	//  1) env-host, 2) image data, 3) env-file, 4) env
-	env := map[string]string{
-		"container": "podman",
-	}
-
-	// First transform the os env into a map. We need it for the labels later in
-	// any case.
-	osEnv, err := envLib.ParseSlice(os.Environ())
-	if err != nil {
-		return nil, errors.Wrap(err, "error parsing host environment variables")
-	}
-
-	// Start with env-host
-
-	if c.Bool("env-host") {
-		env = envLib.Join(env, osEnv)
-	}
-
-	// Image data overrides any previous variables
-	if data != nil {
-		configEnv, err := envLib.ParseSlice(data.Config.Env)
-		if err != nil {
-			return nil, errors.Wrap(err, "error passing image environment variables")
-		}
-		env = envLib.Join(env, configEnv)
-	}
-
-	// env-file overrides any previous variables
-	if c.IsSet("env-file") {
-		for _, f := range c.StringSlice("env-file") {
-			fileEnv, err := envLib.ParseFile(f)
-			if err != nil {
-				return nil, err
-			}
-			// File env is overridden by env.
-			env = envLib.Join(env, fileEnv)
-		}
-	}
-
-	if c.IsSet("env") {
-		// env overrides any previous variables
-		cmdlineEnv := c.StringSlice("env")
-		if len(cmdlineEnv) > 0 {
-			parsedEnv, err := envLib.ParseSlice(cmdlineEnv)
-			if err != nil {
-				return nil, err
-			}
-			env = envLib.Join(env, parsedEnv)
-		}
-	}
-
-	// LABEL VARIABLES
-	labels, err := parse.GetAllLabels(c.StringSlice("label-file"), c.StringArray("label"))
-	if err != nil {
-		return nil, errors.Wrapf(err, "unable to process labels")
-	}
-	if data != nil {
-		for key, val := range data.Config.Labels {
-			if _, ok := labels[key]; !ok {
-				labels[key] = val
-			}
-		}
-	}
-
-	if systemdUnit, exists := osEnv[systemdGen.EnvVariable]; exists {
-		labels[systemdGen.EnvVariable] = systemdUnit
-	}
-
-	// ANNOTATIONS
-	annotations := make(map[string]string)
-
-	// First, add our default annotations
-	annotations[ann.TTY] = "false"
-	if tty {
-		annotations[ann.TTY] = "true"
-	}
-
-	// in the event this container is in a pod, and the pod has an infra container
-	// we will want to configure it as a type "container" instead defaulting to
-	// the behavior of a "sandbox" container
-	// In Kata containers:
-	// - "sandbox" is the annotation that denotes the container should use its own
-	//   VM, which is the default behavior
-	// - "container" denotes the container should join the VM of the SandboxID
-	//   (the infra container)
-	if podInfraID != "" {
-		annotations[ann.SandboxID] = podInfraID
-		annotations[ann.ContainerType] = ann.ContainerTypeContainer
-	}
-
-	if data != nil {
-		// Next, add annotations from the image
-		for key, value := range data.Annotations {
-			annotations[key] = value
-		}
-	}
-	// Last, add user annotations
-	for _, annotation := range c.StringSlice("annotation") {
-		splitAnnotation := strings.SplitN(annotation, "=", 2)
-		if len(splitAnnotation) < 2 {
-			return nil, errors.Errorf("Annotations must be formatted KEY=VALUE")
-		}
-		annotations[splitAnnotation[0]] = splitAnnotation[1]
-	}
-
-	// WORKING DIRECTORY
-	workDir := "/"
-	if c.IsSet("workdir") {
-		workDir = c.String("workdir")
-	} else if data != nil && data.Config.WorkingDir != "" {
-		workDir = data.Config.WorkingDir
-	}
-
-	userCommand := []string{}
-	entrypoint := configureEntrypoint(c, data)
-	// Build the command
-	// If we have an entry point, it goes first
-	if len(entrypoint) > 0 {
-		command = entrypoint
-	}
-	if len(inputCommand) > 0 {
-		// User command overrides data CMD
-		command = append(command, inputCommand...)
-		userCommand = append(userCommand, inputCommand...)
-	} else if data != nil && len(data.Config.Cmd) > 0 && !c.IsSet("entrypoint") {
-		// If not user command, add CMD
-		command = append(command, data.Config.Cmd...)
-		userCommand = append(userCommand, data.Config.Cmd...)
-	}
-
-	if data != nil && len(command) == 0 {
-		return nil, errors.Errorf("No command specified on command line or as CMD or ENTRYPOINT in this image")
-	}
-
-	// SHM Size
-	shmSize, err := units.FromHumanSize(c.String("shm-size"))
-	if err != nil {
-		return nil, errors.Wrapf(err, "unable to translate --shm-size")
-	}
-
-	if c.IsSet("add-host") {
-		// Verify the additional hosts are in correct format
-		for _, host := range c.StringSlice("add-host") {
-			if _, err := parse.ValidateExtraHost(host); err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	var (
-		dnsSearches []string
-		dnsServers  []string
-		dnsOptions  []string
-	)
-	if c.Changed("dns-search") {
-		dnsSearches = c.StringSlice("dns-search")
-		// Check for explicit dns-search domain of ''
-		if len(dnsSearches) == 0 {
-			return nil, errors.Errorf("'' is not a valid domain")
-		}
-		// Validate domains are good
-		for _, dom := range dnsSearches {
-			if dom == "." {
-				if len(dnsSearches) > 1 {
-					return nil, errors.Errorf("cannot pass additional search domains when also specifying '.'")
-				}
-				continue
-			}
-			if _, err := parse.ValidateDomain(dom); err != nil {
-				return nil, err
-			}
-		}
-	}
-	if c.IsSet("dns") {
-		dnsServers = append(dnsServers, c.StringSlice("dns")...)
-	}
-	if c.IsSet("dns-opt") {
-		dnsOptions = c.StringSlice("dns-opt")
-	}
-
-	var ImageVolumes map[string]struct{}
-	if data != nil && c.String("image-volume") != "ignore" {
-		ImageVolumes = data.Config.Volumes
-	}
-
-	var imageVolType = map[string]string{
-		"bind":   "",
-		"tmpfs":  "",
-		"ignore": "",
-	}
-	if _, ok := imageVolType[c.String("image-volume")]; !ok {
-		return nil, errors.Errorf("invalid image-volume type %q. Pick one of bind, tmpfs, or ignore", c.String("image-volume"))
-	}
-
-	systemd := c.String("systemd") == "always"
-	if !systemd && command != nil {
-		x, err := strconv.ParseBool(c.String("systemd"))
-		if err != nil {
-			return nil, errors.Wrapf(err, "cannot parse bool %s", c.String("systemd"))
-		}
-		useSystemdCommands := map[string]bool{
-			"/sbin/init":           true,
-			"/usr/sbin/init":       true,
-			"/usr/local/sbin/init": true,
-		}
-		if x && (useSystemdCommands[command[0]] || (filepath.Base(command[0]) == "systemd")) {
-			systemd = true
-		}
-	}
-	if systemd {
-		if signalString == "" {
-			stopSignal, err = util.ParseSignal("RTMIN+3")
-			if err != nil {
-				return nil, errors.Wrapf(err, "error parsing systemd signal")
-			}
-		}
-	}
-	// This is done because cobra cannot have two aliased flags. So we have to check
-	// both
-	memorySwappiness := c.Int64("memory-swappiness")
-
-	logDriver := define.KubernetesLogging
-	if c.Changed("log-driver") {
-		logDriver = c.String("log-driver")
-	}
-
-	pidsLimit := c.Int64("pids-limit")
-	if c.String("cgroups") == "disabled" && !c.Changed("pids-limit") {
-		pidsLimit = -1
-	}
-
-	pid := &cc.PidConfig{
-		PidMode: pidMode,
-	}
-	ipc := &cc.IpcConfig{
-		IpcMode: ipcMode,
-	}
-
-	cgroup := &cc.CgroupConfig{
-		Cgroups:      c.String("cgroups"),
-		Cgroupns:     c.String("cgroupns"),
-		CgroupParent: c.String("cgroup-parent"),
-		CgroupMode:   cgroupMode,
-	}
-
-	userns := &cc.UserConfig{
-		GroupAdd:   c.StringSlice("group-add"),
-		IDMappings: idmappings,
-		UsernsMode: usernsMode,
-		User:       user,
-	}
-
-	uts := &cc.UtsConfig{
-		UtsMode:  utsMode,
-		NoHosts:  c.Bool("no-hosts"),
-		HostAdd:  c.StringSlice("add-host"),
-		Hostname: c.String("hostname"),
-	}
-	net := &cc.NetworkConfig{
-		DNSOpt:       dnsOptions,
-		DNSSearch:    dnsSearches,
-		DNSServers:   dnsServers,
-		HTTPProxy:    c.Bool("http-proxy"),
-		MacAddress:   c.String("mac-address"),
-		Network:      c.String("network"),
-		NetMode:      netMode,
-		IPAddress:    c.String("ip"),
-		Publish:      c.StringSlice("publish"),
-		PublishAll:   c.Bool("publish-all"),
-		PortBindings: portBindings,
-	}
-
-	sysctl := map[string]string{}
-	if c.Changed("sysctl") {
-		sysctl, err = util.ValidateSysctls(c.StringSlice("sysctl"))
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid value for sysctl")
-		}
-	}
-
-	secConfig := &cc.SecurityConfig{
-		CapAdd:         c.StringSlice("cap-add"),
-		CapDrop:        c.StringSlice("cap-drop"),
-		Privileged:     c.Bool("privileged"),
-		ReadOnlyRootfs: c.Bool("read-only"),
-		ReadOnlyTmpfs:  c.Bool("read-only-tmpfs"),
-		Sysctl:         sysctl,
-	}
-
-	var securityOpt []string
-	if c.Changed("security-opt") {
-		securityOpt = c.StringArray("security-opt")
-	}
-	if err := secConfig.SetSecurityOpts(runtime, securityOpt); err != nil {
-		return nil, err
-	}
-
-	// SECCOMP
-	if data != nil {
-		if value, exists := labels[seccomp.ContainerImageLabel]; exists {
-			secConfig.SeccompProfileFromImage = value
-		}
-	}
-	if policy, err := seccomp.LookupPolicy(c.String("seccomp-policy")); err != nil {
-		return nil, err
-	} else {
-		secConfig.SeccompPolicy = policy
-	}
-	rtc, err := runtime.GetConfig()
-	if err != nil {
-		return nil, err
-	}
-	volumes := rtc.Containers.Volumes
-	if c.Changed("volume") {
-		volumes = append(volumes, c.StringSlice("volume")...)
-	}
-
-	devices := rtc.Containers.Devices
-	if c.Changed("device") {
-		devices = append(devices, c.StringSlice("device")...)
-	}
-
-	config := &cc.CreateConfig{
-		Annotations:       annotations,
-		BuiltinImgVolumes: ImageVolumes,
-		ConmonPidFile:     c.String("conmon-pidfile"),
-		ImageVolumeType:   c.String("image-volume"),
-		CidFile:           c.String("cidfile"),
-		Command:           command,
-		UserCommand:       userCommand,
-		Detach:            c.Bool("detach"),
-		Devices:           devices,
-		Entrypoint:        entrypoint,
-		Env:               env,
-		// ExposedPorts:   ports,
-		Init:         c.Bool("init"),
-		InitPath:     c.String("init-path"),
-		Image:        imageName,
-		RawImageName: rawImageName,
-		ImageID:      imageID,
-		Interactive:  c.Bool("interactive"),
-		// IP6Address:     c.String("ipv6"), // Not implemented yet - needs CNI support for static v6
-		Labels: labels,
-		// LinkLocalIP:    c.StringSlice("link-local-ip"), // Not implemented yet
-		LogDriver:    logDriver,
-		LogDriverOpt: c.StringSlice("log-opt"),
-		Name:         c.String("name"),
-		// NetworkAlias:   c.StringSlice("network-alias"), // Not implemented - does this make sense in Podman?
-		Pod:   podName,
-		Quiet: c.Bool("quiet"),
-		Resources: cc.CreateResourceConfig{
-			BlkioWeight:       blkioWeight,
-			BlkioWeightDevice: c.StringSlice("blkio-weight-device"),
-			CPUShares:         c.Uint64("cpu-shares"),
-			CPUPeriod:         c.Uint64("cpu-period"),
-			CPUsetCPUs:        c.String("cpuset-cpus"),
-			CPUsetMems:        c.String("cpuset-mems"),
-			CPUQuota:          c.Int64("cpu-quota"),
-			CPURtPeriod:       c.Uint64("cpu-rt-period"),
-			CPURtRuntime:      c.Int64("cpu-rt-runtime"),
-			CPUs:              c.Float64("cpus"),
-			DeviceCgroupRules: c.StringSlice("device-cgroup-rule"),
-			DeviceReadBps:     c.StringSlice("device-read-bps"),
-			DeviceReadIOps:    c.StringSlice("device-read-iops"),
-			DeviceWriteBps:    c.StringSlice("device-write-bps"),
-			DeviceWriteIOps:   c.StringSlice("device-write-iops"),
-			DisableOomKiller:  c.Bool("oom-kill-disable"),
-			ShmSize:           shmSize,
-			Memory:            memoryLimit,
-			MemoryReservation: memoryReservation,
-			MemorySwap:        memorySwap,
-			MemorySwappiness:  int(memorySwappiness),
-			KernelMemory:      memoryKernel,
-			OomScoreAdj:       c.Int("oom-score-adj"),
-			PidsLimit:         pidsLimit,
-			Ulimit:            c.StringSlice("ulimit"),
-		},
-		RestartPolicy: c.String("restart"),
-		Rm:            c.Bool("rm"),
-		Security:      *secConfig,
-		StopSignal:    stopSignal,
-		StopTimeout:   c.Uint("stop-timeout"),
-		Systemd:       systemd,
-		Tmpfs:         c.StringArray("tmpfs"),
-		Tty:           tty,
-		MountsFlag:    c.StringArray("mount"),
-		Volumes:       volumes,
-		WorkDir:       workDir,
-		Rootfs:        rootfs,
-		VolumesFrom:   c.StringSlice("volumes-from"),
-		Syslog:        c.Bool("syslog"),
-
-		Pid:     *pid,
-		Ipc:     *ipc,
-		Cgroup:  *cgroup,
-		User:    *userns,
-		Uts:     *uts,
-		Network: *net,
-	}
-
-	warnings, err := verifyContainerResources(config, false)
-	if err != nil {
-		return nil, err
-	}
-	for _, warning := range warnings {
-		fmt.Fprintln(os.Stderr, warning)
-	}
-	return config, nil
-}
-
-func CreateContainerFromCreateConfig(ctx context.Context, r *libpod.Runtime, createConfig *cc.CreateConfig, pod *libpod.Pod) (*libpod.Container, error) {
-	runtimeSpec, options, err := createConfig.MakeContainerConfig(r, pod)
-	if err != nil {
-		return nil, err
-	}
-
-	ctr, err := r.NewContainer(ctx, runtimeSpec, options...)
-	if err != nil {
-		return nil, err
-	}
-	return ctr, nil
-}
-
-func makeHealthCheckFromCli(c *GenericCLIResults) (*manifest.Schema2HealthConfig, error) {
-	inCommand := c.String("healthcheck-command")
-	inInterval := c.String("healthcheck-interval")
-	inRetries := c.Uint("healthcheck-retries")
-	inTimeout := c.String("healthcheck-timeout")
-	inStartPeriod := c.String("healthcheck-start-period")
-
-	// Every healthcheck requires a command
-	if len(inCommand) == 0 {
-		return nil, errors.New("Must define a healthcheck command for all healthchecks")
-	}
-
-	// first try to parse option value as JSON array of strings...
-	cmd := []string{}
-	err := json.Unmarshal([]byte(inCommand), &cmd)
-	if err != nil {
-		// ...otherwise pass it to "/bin/sh -c" inside the container
-		cmd = []string{"CMD-SHELL", inCommand}
-	}
-	hc := manifest.Schema2HealthConfig{
-		Test: cmd,
-	}
-
-	if inInterval == "disable" {
-		inInterval = "0"
-	}
-	intervalDuration, err := time.ParseDuration(inInterval)
-	if err != nil {
-		return nil, errors.Wrapf(err, "invalid healthcheck-interval %s ", inInterval)
-	}
-
-	hc.Interval = intervalDuration
-
-	if inRetries < 1 {
-		return nil, errors.New("healthcheck-retries must be greater than 0.")
-	}
-	hc.Retries = int(inRetries)
-	timeoutDuration, err := time.ParseDuration(inTimeout)
-	if err != nil {
-		return nil, errors.Wrapf(err, "invalid healthcheck-timeout %s", inTimeout)
-	}
-	if timeoutDuration < time.Duration(1) {
-		return nil, errors.New("healthcheck-timeout must be at least 1 second")
-	}
-	hc.Timeout = timeoutDuration
-
-	startPeriodDuration, err := time.ParseDuration(inStartPeriod)
-	if err != nil {
-		return nil, errors.Wrapf(err, "invalid healthcheck-start-period %s", inStartPeriod)
-	}
-	if startPeriodDuration < time.Duration(0) {
-		return nil, errors.New("healthcheck-start-period must be 0 seconds or greater")
-	}
-	hc.StartPeriod = startPeriodDuration
-
-	return &hc, nil
-}
-
-// GetNamespaceOptions transforms a slice of kernel namespaces
-// into a slice of pod create options. Currently, not all
-// kernel namespaces are supported, and they will be returned in an error
-func GetNamespaceOptions(ns []string) ([]libpod.PodCreateOption, error) {
-	var options []libpod.PodCreateOption
-	var erroredOptions []libpod.PodCreateOption
-	for _, toShare := range ns {
-		switch toShare {
-		case "cgroup":
-			options = append(options, libpod.WithPodCgroups())
-		case "net":
-			options = append(options, libpod.WithPodNet())
-		case "mnt":
-			return erroredOptions, errors.Errorf("Mount sharing functionality not supported on pod level")
-		case "pid":
-			options = append(options, libpod.WithPodPID())
-		case "user":
-			return erroredOptions, errors.Errorf("User sharing functionality not supported on pod level")
-		case "ipc":
-			options = append(options, libpod.WithPodIPC())
-		case "uts":
-			options = append(options, libpod.WithPodUTS())
-		case "":
-		case "none":
-			return erroredOptions, nil
-		default:
-			return erroredOptions, errors.Errorf("Invalid kernel namespace to share: %s. Options are: net, pid, ipc, uts or none", toShare)
-		}
-	}
-	return options, nil
-}
-
-func addWarning(warnings []string, msg string) []string {
-	logrus.Warn(msg)
-	return append(warnings, msg)
-}
-
-func verifyContainerResources(config *cc.CreateConfig, update bool) ([]string, error) {
-	warnings := []string{}
-
-	cgroup2, err := cgroups.IsCgroup2UnifiedMode()
-	if err != nil || cgroup2 {
-		return warnings, err
-	}
-
-	sysInfo := sysinfo.New(true)
-
-	// memory subsystem checks and adjustments
-	if config.Resources.Memory > 0 && !sysInfo.MemoryLimit {
-		warnings = addWarning(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
-		config.Resources.Memory = 0
-		config.Resources.MemorySwap = -1
-	}
-	if config.Resources.Memory > 0 && config.Resources.MemorySwap != -1 && !sysInfo.SwapLimit {
-		warnings = addWarning(warnings, "Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.")
-		config.Resources.MemorySwap = -1
-	}
-	if config.Resources.Memory > 0 && config.Resources.MemorySwap > 0 && config.Resources.MemorySwap < config.Resources.Memory {
-		return warnings, fmt.Errorf("minimum memoryswap limit should be larger than memory limit, see usage")
-	}
-	if config.Resources.Memory == 0 && config.Resources.MemorySwap > 0 && !update {
-		return warnings, fmt.Errorf("you should always set the memory limit when using memoryswap limit, see usage")
-	}
-	if config.Resources.MemorySwappiness != -1 {
-		if !sysInfo.MemorySwappiness {
-			msg := "Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded."
-			warnings = addWarning(warnings, msg)
-			config.Resources.MemorySwappiness = -1
-		} else {
-			swappiness := config.Resources.MemorySwappiness
-			if swappiness < -1 || swappiness > 100 {
-				return warnings, fmt.Errorf("invalid value: %v, valid memory swappiness range is 0-100", swappiness)
-			}
-		}
-	}
-	if config.Resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
-		warnings = addWarning(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
-		config.Resources.MemoryReservation = 0
-	}
-	if config.Resources.Memory > 0 && config.Resources.MemoryReservation > 0 && config.Resources.Memory < config.Resources.MemoryReservation {
-		return warnings, fmt.Errorf("minimum memory limit cannot be less than memory reservation limit, see usage")
-	}
-	if config.Resources.KernelMemory > 0 && !sysInfo.KernelMemory {
-		warnings = addWarning(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
-		config.Resources.KernelMemory = 0
-	}
-	if config.Resources.DisableOomKiller && !sysInfo.OomKillDisable {
-		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
-		// warning the caller if they already wanted the feature to be off
-		warnings = addWarning(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
-		config.Resources.DisableOomKiller = false
-	}
-
-	if config.Resources.PidsLimit != 0 && !sysInfo.PidsLimit {
-		warnings = addWarning(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
-		config.Resources.PidsLimit = 0
-	}
-
-	if config.Resources.CPUShares > 0 && !sysInfo.CPUShares {
-		warnings = addWarning(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
-		config.Resources.CPUShares = 0
-	}
-	if config.Resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
-		warnings = addWarning(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
-		config.Resources.CPUPeriod = 0
-	}
-	if config.Resources.CPUPeriod != 0 && (config.Resources.CPUPeriod < 1000 || config.Resources.CPUPeriod > 1000000) {
-		return warnings, fmt.Errorf("CPU cfs period cannot be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")
-	}
-	if config.Resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
-		warnings = addWarning(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
-		config.Resources.CPUQuota = 0
-	}
-	if config.Resources.CPUQuota > 0 && config.Resources.CPUQuota < 1000 {
-		return warnings, fmt.Errorf("CPU cfs quota cannot be less than 1ms (i.e. 1000)")
-	}
-	// cpuset subsystem checks and adjustments
-	if (config.Resources.CPUsetCPUs != "" || config.Resources.CPUsetMems != "") && !sysInfo.Cpuset {
-		warnings = addWarning(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. CPUset discarded.")
-		config.Resources.CPUsetCPUs = ""
-		config.Resources.CPUsetMems = ""
-	}
-	cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(config.Resources.CPUsetCPUs)
-	if err != nil {
-		return warnings, fmt.Errorf("invalid value %s for cpuset cpus", config.Resources.CPUsetCPUs)
-	}
-	if !cpusAvailable {
-		return warnings, fmt.Errorf("requested CPUs are not available - requested %s, available: %s", config.Resources.CPUsetCPUs, sysInfo.Cpus)
-	}
-	memsAvailable, err := sysInfo.IsCpusetMemsAvailable(config.Resources.CPUsetMems)
-	if err != nil {
-		return warnings, fmt.Errorf("invalid value %s for cpuset mems", config.Resources.CPUsetMems)
-	}
-	if !memsAvailable {
-		return warnings, fmt.Errorf("requested memory nodes are not available - requested %s, available: %s", config.Resources.CPUsetMems, sysInfo.Mems)
-	}
-
-	// blkio subsystem checks and adjustments
-	if config.Resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
-		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
-		config.Resources.BlkioWeight = 0
-	}
-	if config.Resources.BlkioWeight > 0 && (config.Resources.BlkioWeight < 10 || config.Resources.BlkioWeight > 1000) {
-		return warnings, fmt.Errorf("range of blkio weight is from 10 to 1000")
-	}
-	if len(config.Resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
-		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
-		config.Resources.BlkioWeightDevice = []string{}
-	}
-	if len(config.Resources.DeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
-		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded")
-		config.Resources.DeviceReadBps = []string{}
-	}
-	if len(config.Resources.DeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
-		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
-		config.Resources.DeviceWriteBps = []string{}
-	}
-	if len(config.Resources.DeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
-		warnings = addWarning(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
-		config.Resources.DeviceReadIOps = []string{}
-	}
-	if len(config.Resources.DeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
-		warnings = addWarning(warnings, "Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
-		config.Resources.DeviceWriteIOps = []string{}
-	}
-
-	return warnings, nil
-}