Merge pull request #12525 from mheon/bump_343

Backports for and bump to v3.4.3

10 files changed, 212 insertions, 12 deletions

diff --git a/test/apiv2/10-images.at b/test/apiv2/10-images.at
index d3fde9f9d..ec32ffb59 100644
--- a/test/apiv2/10-images.at
+++ b/test/apiv2/10-images.at
@@ -10,6 +10,13 @@ t GET libpod/images/json 200 \
   .[0].Id~[0-9a-f]\\{64\\}
 iid=$(jq -r '.[0].Id' <<<"$output")
 
+# Create an empty manifest and make sure it is not listed
+# in the compat endpoint.
+t GET images/json 200 length=1
+podman manifest create foo
+t GET images/json 200 length=1
+t GET libpod/images/json 200 length=2
+
 t GET libpod/images/$iid/exists                     204
 t GET libpod/images/$PODMAN_TEST_IMAGE_NAME/exists  204
 t GET libpod/images/${iid}abcdef/exists  404 \
diff --git a/test/e2e/config/containers-netns2.conf b/test/e2e/config/containers-netns2.conf
new file mode 100644
index 000000000..1ffd100f5
--- /dev/null
+++ b/test/e2e/config/containers-netns2.conf
@@ -0,0 +1,3 @@
+[containers]
+
+netns = "bridge"
diff --git a/test/e2e/play_kube_test.go b/test/e2e/play_kube_test.go
index f38350413..c9899c0bc 100644
--- a/test/e2e/play_kube_test.go
+++ b/test/e2e/play_kube_test.go
@@ -2759,6 +2759,34 @@ invalid kube kind
 		Expect(exists).To(Exit(0))
 	})
 
+	It("podman play kube use network mode from config", func() {
+		confPath, err := filepath.Abs("config/containers-netns2.conf")
+		Expect(err).ToNot(HaveOccurred())
+		os.Setenv("CONTAINERS_CONF", confPath)
+		defer os.Unsetenv("CONTAINERS_CONF")
+		if IsRemote() {
+			podmanTest.RestartRemoteService()
+		}
+
+		pod := getPod()
+		err = generateKubeYaml("pod", pod, kubeYaml)
+		Expect(err).To(BeNil())
+
+		kube := podmanTest.Podman([]string{"play", "kube", kubeYaml})
+		kube.WaitWithDefaultTimeout()
+		Expect(kube).Should(Exit(0))
+
+		podInspect := podmanTest.Podman([]string{"pod", "inspect", pod.Name, "--format", "{{.InfraContainerID}}"})
+		podInspect.WaitWithDefaultTimeout()
+		Expect(podInspect).To(Exit(0))
+		infraID := podInspect.OutputToString()
+
+		inspect := podmanTest.Podman([]string{"inspect", "--format", "{{.HostConfig.NetworkMode}}", infraID})
+		inspect.WaitWithDefaultTimeout()
+		Expect(inspect).To(Exit(0))
+		Expect(inspect.OutputToString()).To(Equal("bridge"))
+	})
+
 	Describe("verify environment variables", func() {
 		var maxLength int
 		BeforeEach(func() {
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index a5a0aad8b..e21b1dcf3 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -1670,6 +1670,50 @@ WORKDIR /madethis`, BB)
 
 	})
 
+	It("podman run --secret source=mysecret,type=mount with target", func() {
+		secretsString := "somesecretdata"
+		secretFilePath := filepath.Join(podmanTest.TempDir, "secret")
+		err := ioutil.WriteFile(secretFilePath, []byte(secretsString), 0755)
+		Expect(err).To(BeNil())
+
+		session := podmanTest.Podman([]string{"secret", "create", "mysecret_target", secretFilePath})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+
+		session = podmanTest.Podman([]string{"run", "--secret", "source=mysecret_target,type=mount,target=hello", "--name", "secr_target", ALPINE, "cat", "/run/secrets/hello"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.OutputToString()).To(Equal(secretsString))
+
+		session = podmanTest.Podman([]string{"inspect", "secr_target", "--format", " {{(index .Config.Secrets 0).Name}}"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.OutputToString()).To(ContainSubstring("mysecret_target"))
+
+	})
+
+	It("podman run --secret source=mysecret,type=mount with target at /tmp", func() {
+		secretsString := "somesecretdata"
+		secretFilePath := filepath.Join(podmanTest.TempDir, "secret")
+		err := ioutil.WriteFile(secretFilePath, []byte(secretsString), 0755)
+		Expect(err).To(BeNil())
+
+		session := podmanTest.Podman([]string{"secret", "create", "mysecret_target2", secretFilePath})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+
+		session = podmanTest.Podman([]string{"run", "--secret", "source=mysecret_target2,type=mount,target=/tmp/hello", "--name", "secr_target2", ALPINE, "cat", "/tmp/hello"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.OutputToString()).To(Equal(secretsString))
+
+		session = podmanTest.Podman([]string{"inspect", "secr_target2", "--format", " {{(index .Config.Secrets 0).Name}}"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.OutputToString()).To(ContainSubstring("mysecret_target2"))
+
+	})
+
 	It("podman run --secret source=mysecret,type=env", func() {
 		secretsString := "somesecretdata"
 		secretFilePath := filepath.Join(podmanTest.TempDir, "secret")
@@ -1695,10 +1739,6 @@ WORKDIR /madethis`, BB)
 		session := podmanTest.Podman([]string{"secret", "create", "mysecret", secretFilePath})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
-		// target with mount type should fail
-		session = podmanTest.Podman([]string{"run", "--secret", "source=mysecret,type=mount,target=anotherplace", "--name", "secr", ALPINE, "cat", "/run/secrets/mysecret"})
-		session.WaitWithDefaultTimeout()
-		Expect(session).To(ExitWithError())
 
 		session = podmanTest.Podman([]string{"run", "--secret", "source=mysecret,type=env,target=anotherplace", "--name", "secr", ALPINE, "printenv", "anotherplace"})
 		session.WaitWithDefaultTimeout()
diff --git a/test/e2e/systemd_test.go b/test/e2e/systemd_test.go
index 7212f8843..bb2cd11f2 100644
--- a/test/e2e/systemd_test.go
+++ b/test/e2e/systemd_test.go
@@ -109,6 +109,11 @@ WantedBy=default.target
 		stats := podmanTest.Podman([]string{"stats", "--no-stream", ctrName})
 		stats.WaitWithDefaultTimeout()
 		Expect(stats).Should(Exit(0))
+
+		cgroupPath := podmanTest.Podman([]string{"inspect", "--format='{{.State.CgroupPath}}'", ctrName})
+		cgroupPath.WaitWithDefaultTimeout()
+		Expect(cgroupPath).Should(Exit(0))
+		Expect(result.OutputToString()).To(Not(ContainSubstring("init.scope")))
 	})
 
 	It("podman create container with systemd entrypoint triggers systemd mode", func() {
diff --git a/test/e2e/top_test.go b/test/e2e/top_test.go
index 93c4f3f12..1a71ebf33 100644
--- a/test/e2e/top_test.go
+++ b/test/e2e/top_test.go
@@ -101,6 +101,11 @@ var _ = Describe("Podman top", func() {
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
 		Expect(len(result.OutputToStringArray())).To(BeNumerically(">", 1))
+
+		result = podmanTest.Podman([]string{"top", session.OutputToString(), "ax -o args"})
+		result.WaitWithDefaultTimeout()
+		Expect(result).Should(Exit(0))
+		Expect(result.OutputToStringArray()).To(Equal([]string{"COMMAND", "top -d 2"}))
 	})
 
 	It("podman top with comma-separated options", func() {
diff --git a/test/python/docker/compat/test_containers.py b/test/python/docker/compat/test_containers.py
index 1ad1e7f15..d14c09fc1 100644
--- a/test/python/docker/compat/test_containers.py
+++ b/test/python/docker/compat/test_containers.py
@@ -3,11 +3,13 @@ import subprocess
 import sys
 import time
 import unittest
-from typing import IO, Optional
+from typing import IO, Optional, List
 
 from docker import DockerClient, errors
 from docker.models.containers import Container
 from docker.models.images import Image
+from docker.models.volumes import Volume
+from docker.types import Mount
 
 from test.python.docker import Podman
 from test.python.docker.compat import common, constant
@@ -207,9 +209,14 @@ class TestContainers(unittest.TestCase):
 
     def test_copy_to_container(self):
         ctr: Optional[Container] = None
+        vol: Optional[Volume] = None
         try:
             test_file_content = b"Hello World!"
-            ctr = self.client.containers.create(image="alpine", detach=True, command="top")
+            vol = self.client.volumes.create("test-volume")
+            ctr = self.client.containers.create(image="alpine",
+                                                detach=True,
+                                                command="top",
+                                                volumes=["test-volume:/test-volume-read-only:ro"])
             ctr.start()
 
             buff: IO[bytes] = io.BytesIO()
@@ -234,10 +241,16 @@ class TestContainers(unittest.TestCase):
             ret, out = ctr.exec_run(["cat", "/tmp/a.txt"])
             self.assertEqual(ret, 0)
             self.assertEqual(out.rstrip(), test_file_content, "Content of copied file")
+
+            buff.seek(0)
+            with self.assertRaises(errors.APIError):
+                ctr.put_archive("/test-volume-read-only/", buff)
         finally:
             if ctr is not None:
                 ctr.stop()
                 ctr.remove()
+            if vol is not None:
+                vol.remove(force=True)
 
     def test_mount_preexisting_dir(self):
         dockerfile = (B'FROM quay.io/libpod/alpine:latest\n'
@@ -251,3 +264,39 @@ class TestContainers(unittest.TestCase):
         ctr.start()
         ret, out = ctr.exec_run(["stat", "-c", "%u:%g", "/workspace"])
         self.assertEqual(out.rstrip(), b'1042:1043', "UID/GID set in dockerfile")
+
+
+    def test_non_existant_workdir(self):
+        dockerfile = (B'FROM quay.io/libpod/alpine:latest\n'
+                      B'USER root\n'
+                      B'WORKDIR /workspace/scratch\n'
+                      B'RUN touch test')
+        img: Image
+        img, out = self.client.images.build(fileobj=io.BytesIO(dockerfile))
+        ctr: Container = self.client.containers.create(image=img.id, detach=True, command="top",
+                                                       volumes=["test_non_existant_workdir:/workspace"])
+        ctr.start()
+        ret, out = ctr.exec_run(["stat", "/workspace/scratch/test"])
+        self.assertEqual(ret, 0, "Working directory created if it doesn't exist")
+
+    def test_mount_rw_by_default(self):
+        ctr: Optional[Container] = None
+        vol: Optional[Volume] = None
+        try:
+            vol = self.client.volumes.create("test-volume")
+            ctr = self.client.containers.create(image="alpine",
+                                                detach=True,
+                                                command="top",
+                                                mounts=[Mount(target="/vol-mnt",
+                                                              source="test-volume",
+                                                              type='volume',
+                                                              read_only=False)])
+            ctr_inspect = self.client.api.inspect_container(ctr.id)
+            binds: List[str] = ctr_inspect["HostConfig"]["Binds"]
+            self.assertEqual(len(binds), 1)
+            self.assertEqual(binds[0], 'test-volume:/vol-mnt:rw,rprivate,nosuid,nodev,rbind')
+        finally:
+            if ctr is not None:
+                ctr.remove()
+            if vol is not None:
+                vol.remove(force=True)
diff --git a/test/system/035-logs.bats b/test/system/035-logs.bats
index 76ce12b81..d9ec8423b 100644
--- a/test/system/035-logs.bats
+++ b/test/system/035-logs.bats
@@ -30,6 +30,17 @@ load helpers
     run_podman rm $cid
 }
 
+function _additional_events_backend() {
+    local driver=$1
+    # Since PR#10431, 'logs -f' with journald driver is only supported with journald events backend.
+    if [[ $driver = "journald" ]]; then
+        run_podman info --format '{{.Host.EventLogger}}' >/dev/null
+        if [[ $output != "journald" ]]; then
+            echo "--events-backend journald"
+        fi
+    fi
+}
+
 function _log_test_multi() {
     local driver=$1
 
@@ -42,10 +53,12 @@ function _log_test_multi() {
         etc='.*'
     fi
 
+    local events_backend=$(_additional_events_backend $driver)
+
     # Simple helper to make the container starts, below, easier to read
     local -a cid
     doit() {
-        run_podman run --log-driver=$driver --rm -d --name "$1" $IMAGE sh -c "$2";
+        run_podman ${events_backend} run --log-driver=$driver --rm -d --name "$1" $IMAGE sh -c "$2";
         cid+=($(echo "${output:0:12}"))
     }
 
@@ -57,7 +70,7 @@ function _log_test_multi() {
     doit c1         "echo a;sleep 10;echo d;sleep 3"
     doit c2 "sleep 1;echo b;sleep  2;echo c;sleep 3"
 
-    run_podman logs -f c1 c2
+    run_podman ${events_backend} logs -f c1 c2
     is "$output" \
        "${cid[0]} a$etc
 ${cid[1]} b$etc
@@ -76,6 +89,27 @@ ${cid[0]} d"   "Sequential output from logs"
     _log_test_multi journald
 }
 
+function _log_test_restarted() {
+    run_podman run --log-driver=$1 --name logtest $IMAGE sh -c 'start=0; if test -s log; then start=`tail -n 1 log`; fi; seq `expr $start + 1` `expr $start + 10` | tee -a log'
+    run_podman start -a logtest
+    logfile=$(mktemp -p ${PODMAN_TMPDIR} logfileXXXXXXXX)
+    $PODMAN $_PODMAN_TEST_OPTS logs -f logtest > $logfile
+    expected=$(mktemp -p ${PODMAN_TMPDIR} expectedXXXXXXXX)
+    seq 1 20  > $expected
+    diff -u ${expected} ${logfile}
+}
+
+@test "podman logs restarted - k8s-file" {
+    _log_test_restarted k8s-file
+}
+
+@test "podman logs restarted journald" {
+    # We can't use journald on RHEL as rootless: rhbz#1895105
+    skip_if_journald_unavailable
+
+    _log_test_restarted journald
+}
+
 @test "podman logs - journald log driver requires journald events backend" {
     skip_if_remote "remote does not support --events-backend"
     # We can't use journald on RHEL as rootless: rhbz#1895105
@@ -187,15 +221,20 @@ function _log_test_follow() {
     contentA=$(random_string)
     contentB=$(random_string)
     contentC=$(random_string)
+    local events_backend=$(_additional_events_backend $driver)
+
+    if [[ -n "${events_backend}" ]]; then
+        skip_if_remote "remote does not support --events-backend"
+    fi
 
     # Note: it seems we need at least three log lines to hit #11461.
-    run_podman run --log-driver=$driver --name $cname $IMAGE sh -c "echo $contentA; echo $contentB; echo $contentC"
-    run_podman logs -f $cname
+    run_podman ${events_backend} run --log-driver=$driver --name $cname $IMAGE sh -c "echo $contentA; echo $contentB; echo $contentC"
+    run_podman ${events_backend} logs -f $cname
     is "$output" "$contentA
 $contentB
 $contentC" "logs -f on exitted container works"
 
-    run_podman rm -f $cname
+    run_podman ${events_backend} rm -f $cname
 }
 
 @test "podman logs - --follow k8s-file" {
diff --git a/test/system/090-events.bats b/test/system/090-events.bats
index 22edaeee9..f8a7a87c8 100644
--- a/test/system/090-events.bats
+++ b/test/system/090-events.bats
@@ -85,6 +85,17 @@ function _events_disjunctive_filters() {
     _events_disjunctive_filters --events-backend=journald
 }
 
+@test "events with file backend and journald logdriver with --follow failure" {
+    skip_if_remote "remote does not support --events-backend"
+    skip_if_journald_unavailable "system does not support journald events"
+    run_podman --events-backend=file run --log-driver=journald --name=test $IMAGE echo hi
+    is "$output" "hi" "Should support events-backend=file"
+
+    run_podman 125 --events-backend=file logs --follow test
+    is "$output" "Error: using --follow with the journald --log-driver but without the journald --events-backend (file) is not supported" "Should fail with reasonable error message when events-backend and events-logger do not match"
+
+}
+
 @test "events with disjunctive filters - default" {
     _events_disjunctive_filters ""
 }
diff --git a/test/system/130-kill.bats b/test/system/130-kill.bats
index d85f0a6a9..1ff3a7b61 100644
--- a/test/system/130-kill.bats
+++ b/test/system/130-kill.bats
@@ -6,9 +6,22 @@
 load helpers
 
 @test "podman kill - test signal handling in containers" {
+
+    # Prepare for 'logs -f'
+    run_podman info --format '{{.Host.LogDriver}}'
+    log_driver=$output
+    run_podman info --format '{{.Host.EventLogger}}'
+    event_logger=$output
+    opt_log_driver=
+    if [ $log_driver = "journald" ] && [ $event_logger != "journald" ]; then
+        # Since PR#10431, 'logs -f' with journald driver is only supported with journald events backend.
+        # Set '--log driver' temporally because remote doesn't support '--events-backend'.
+        opt_log_driver="--log-driver k8s-file"
+    fi
+
     # Start a container that will handle all signals by emitting 'got: N'
     local -a signals=(1 2 3 4 5 6 8 10 12 13 14 15 16 20 21 22 23 24 25 26 64)
-    run_podman run -d $IMAGE sh -c \
+    run_podman run -d ${opt_log_driver} $IMAGE sh -c \
         "for i in ${signals[*]}; do trap \"echo got: \$i\" \$i; done;
         echo READY;
         while ! test -e /stop; do sleep 0.05; done;