summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.cirrus.yml5
-rw-r--r--README.md3
-rw-r--r--cmd/podman/checkpoint.go6
-rw-r--r--cmd/podman/commands.go2
-rw-r--r--cmd/podman/create.go2
-rw-r--r--cmd/podman/exists.go9
-rw-r--r--cmd/podman/generate_kube.go2
-rw-r--r--cmd/podman/image.go6
-rw-r--r--cmd/podman/images.go7
-rw-r--r--cmd/podman/main.go2
-rw-r--r--cmd/podman/ps.go7
-rw-r--r--cmd/podman/rmi.go19
-rw-r--r--cmd/podman/trust_set_show.go4
-rw-r--r--contrib/gate/Dockerfile2
-rw-r--r--pkg/adapter/runtime.go8
-rw-r--r--pkg/adapter/runtime_remote.go12
-rw-r--r--pkg/secrets/secrets.go12
-rw-r--r--remote_client.md77
18 files changed, 142 insertions, 43 deletions
diff --git a/.cirrus.yml b/.cirrus.yml
index ad9edd404..4521866d1 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -118,6 +118,11 @@ gating_task:
- '/usr/local/bin/entrypoint.sh vendor'
- 'cd /go/src/github.com/containers/libpod && ./hack/tree_status.sh'
+ # This task builds Podman with different buildtags to ensure the build does
+ # not break.
+ build_script:
+ - '/usr/local/bin/entrypoint.sh clean podman BUILDTAGS="exclude_graphdriver_devicemapper selinux seccomp"'
+
build_each_commit_task:
diff --git a/README.md b/README.md
index 97c548ddd..636a6fa5b 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,9 @@ includes tables showing Docker commands and their Podman equivalent commands.
**[Tutorials](docs/tutorials)**
Tutorials on using Podman.
+**[Remote Client](remote_client.md)**
+A brief how-to on using the Podman remote-client.
+
**[Release Notes](RELEASE_NOTES.md)**
Release notes for recent Podman versions
diff --git a/cmd/podman/checkpoint.go b/cmd/podman/checkpoint.go
index 8c4b8ad3c..367065766 100644
--- a/cmd/podman/checkpoint.go
+++ b/cmd/podman/checkpoint.go
@@ -32,9 +32,9 @@ var (
Args: func(cmd *cobra.Command, args []string) error {
return checkAllAndLatest(cmd, args, false)
},
- Example: `podman checkpoint --keep ctrID
- podman checkpoint --all
- podman checkpoint --leave-running --latest`,
+ Example: `podman container checkpoint --keep ctrID
+ podman container checkpoint --all
+ podman container checkpoint --leave-running --latest`,
}
)
diff --git a/cmd/podman/commands.go b/cmd/podman/commands.go
index 73e02e27a..fd36e77d5 100644
--- a/cmd/podman/commands.go
+++ b/cmd/podman/commands.go
@@ -30,7 +30,6 @@ func getMainCommands() []*cobra.Command {
_rmCommand,
_runCommand,
_searchCommand,
- _signCommand,
_startCommand,
_statsCommand,
_stopCommand,
@@ -49,7 +48,6 @@ func getMainCommands() []*cobra.Command {
// Commands that the local client implements
func getImageSubCommands() []*cobra.Command {
return []*cobra.Command{
- _loadCommand,
_signCommand,
}
}
diff --git a/cmd/podman/create.go b/cmd/podman/create.go
index e8746dfa3..95cb732d9 100644
--- a/cmd/podman/create.go
+++ b/cmd/podman/create.go
@@ -67,7 +67,7 @@ func init() {
getCreateFlags(&createCommand.PodmanCommand)
flags := createCommand.Flags()
- flags.SetInterspersed(true)
+ flags.SetInterspersed(false)
}
diff --git a/cmd/podman/exists.go b/cmd/podman/exists.go
index c01a6a081..109831e74 100644
--- a/cmd/podman/exists.go
+++ b/cmd/podman/exists.go
@@ -40,7 +40,8 @@ var (
imageExistsCommand.GlobalFlags = MainGlobalOpts
return imageExistsCmd(&imageExistsCommand)
},
- Example: `podman image exists imageID`,
+ Example: `podman image exists imageID
+ podman image exists alpine || podman pull alpine`,
}
_containerExistsCommand = &cobra.Command{
@@ -53,7 +54,8 @@ var (
return containerExistsCmd(&containerExistsCommand)
},
- Example: `podman container exists containerID`,
+ Example: `podman container exists containerID
+ podman container exists myctr || podman run --name myctr [etc...]`,
}
_podExistsCommand = &cobra.Command{
@@ -65,7 +67,8 @@ var (
podExistsCommand.GlobalFlags = MainGlobalOpts
return podExistsCmd(&podExistsCommand)
},
- Example: `podman pod exists podID`,
+ Example: `podman pod exists podID
+ podman pod exists mypod || podman pod create --name mypod`,
}
)
diff --git a/cmd/podman/generate_kube.go b/cmd/podman/generate_kube.go
index 090f99495..fa2872b77 100644
--- a/cmd/podman/generate_kube.go
+++ b/cmd/podman/generate_kube.go
@@ -17,7 +17,7 @@ var (
containerKubeCommand cliconfig.GenerateKubeValues
containerKubeDescription = "Generate Kubernetes Pod YAML"
_containerKubeCommand = &cobra.Command{
- Use: "kube CONTAINER | POD",
+ Use: "kube [flags] CONTAINER | POD",
Short: "Generate Kubernetes pod YAML for a container or pod",
Long: containerKubeDescription,
RunE: func(cmd *cobra.Command, args []string) error {
diff --git a/cmd/podman/image.go b/cmd/podman/image.go
index 14053cb0d..aaa1866c4 100644
--- a/cmd/podman/image.go
+++ b/cmd/podman/image.go
@@ -14,6 +14,7 @@ var (
Long: imageDescription,
},
}
+ _imagesSubCommand = _imagesCommand
)
//imageSubCommands are implemented both in local and remote clients
@@ -21,7 +22,6 @@ var imageSubCommands = []*cobra.Command{
_buildCommand,
_historyCommand,
_imageExistsCommand,
- _imagesCommand,
_importCommand,
_inspectCommand,
_loadCommand,
@@ -37,4 +37,8 @@ func init() {
imageCommand.SetUsageTemplate(UsageTemplate())
imageCommand.AddCommand(imageSubCommands...)
imageCommand.AddCommand(getImageSubCommands()...)
+
+ _imagesSubCommand.Aliases = []string{"ls", "list"}
+ imageCommand.AddCommand(&_imagesSubCommand)
+
}
diff --git a/cmd/podman/images.go b/cmd/podman/images.go
index 6e82195a9..e6f4d9a60 100644
--- a/cmd/podman/images.go
+++ b/cmd/podman/images.go
@@ -87,8 +87,8 @@ var (
imagesCommand cliconfig.ImagesValues
imagesDescription = "lists locally stored images."
- _imagesCommand = &cobra.Command{
- Use: "images",
+ _imagesCommand = cobra.Command{
+ Use: "images [flags] [IMAGE]",
Short: "List images in local storage",
Long: imagesDescription,
RunE: func(cmd *cobra.Command, args []string) error {
@@ -103,8 +103,9 @@ var (
)
func init() {
- imagesCommand.Command = _imagesCommand
+ imagesCommand.Command = &_imagesCommand
imagesCommand.SetUsageTemplate(UsageTemplate())
+
flags := imagesCommand.Flags()
flags.BoolVarP(&imagesCommand.All, "all", "a", false, "Show all images (default hides intermediate images)")
flags.BoolVar(&imagesCommand.Digests, "digests", false, "Show digests")
diff --git a/cmd/podman/main.go b/cmd/podman/main.go
index 19bdb40d6..d36270853 100644
--- a/cmd/podman/main.go
+++ b/cmd/podman/main.go
@@ -38,7 +38,7 @@ var mainCommands = []*cobra.Command{
_buildCommand,
_exportCommand,
_historyCommand,
- _imagesCommand,
+ &_imagesCommand,
_importCommand,
_infoCommand,
_inspectCommand,
diff --git a/cmd/podman/ps.go b/cmd/podman/ps.go
index 9c165b836..3bc4f0b08 100644
--- a/cmd/podman/ps.go
+++ b/cmd/podman/ps.go
@@ -158,10 +158,9 @@ var (
psCommand cliconfig.PsValues
psDescription = "Prints out information about the containers"
_psCommand = &cobra.Command{
- Use: "list",
- Aliases: []string{"ls", "ps"},
- Short: "List containers",
- Long: psDescription,
+ Use: "ps",
+ Short: "List containers",
+ Long: psDescription,
RunE: func(cmd *cobra.Command, args []string) error {
psCommand.InputArgs = args
psCommand.GlobalFlags = MainGlobalOpts
diff --git a/cmd/podman/rmi.go b/cmd/podman/rmi.go
index 0963b1328..e5bb9b486 100644
--- a/cmd/podman/rmi.go
+++ b/cmd/podman/rmi.go
@@ -5,8 +5,6 @@ import (
"os"
"github.com/containers/libpod/cmd/podman/cliconfig"
- "github.com/containers/libpod/cmd/podman/varlink"
- "github.com/containers/libpod/libpod/image"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/storage"
"github.com/pkg/errors"
@@ -31,17 +29,6 @@ var (
}
)
-func imageNotFound(err error) bool {
- if errors.Cause(err) == image.ErrNoSuchImage {
- return true
- }
- switch err.(type) {
- case *iopodman.ImageNotFound:
- return true
- }
- return false
-}
-
func init() {
rmiCommand.Command = _rmiCommand
rmiCommand.SetUsageTemplate(UsageTemplate())
@@ -80,7 +67,7 @@ func rmiCmd(c *cliconfig.RmiValues) error {
if errors.Cause(err) == storage.ErrImageUsedByContainer {
fmt.Printf("A container associated with containers/storage, i.e. via Buildah, CRI-O, etc., may be associated with this image: %-12.12s\n", img.ID())
}
- if !imageNotFound(err) {
+ if !adapter.IsImageNotFound(err) {
failureCnt++
}
if lastError != nil {
@@ -135,7 +122,7 @@ func rmiCmd(c *cliconfig.RmiValues) error {
newImage, err := runtime.NewImageFromLocal(i)
if err != nil {
if lastError != nil {
- if !imageNotFound(lastError) {
+ if !adapter.IsImageNotFound(lastError) {
failureCnt++
}
fmt.Fprintln(os.Stderr, lastError)
@@ -147,7 +134,7 @@ func rmiCmd(c *cliconfig.RmiValues) error {
}
}
- if imageNotFound(lastError) && failureCnt == 0 {
+ if adapter.IsImageNotFound(lastError) && failureCnt == 0 {
exitCode = 1
}
diff --git a/cmd/podman/trust_set_show.go b/cmd/podman/trust_set_show.go
index 0a4783d0a..746854249 100644
--- a/cmd/podman/trust_set_show.go
+++ b/cmd/podman/trust_set_show.go
@@ -23,7 +23,7 @@ var (
showTrustCommand cliconfig.ShowTrustValues
setTrustDescription = "Set default trust policy or add a new trust policy for a registry"
_setTrustCommand = &cobra.Command{
- Use: "set",
+ Use: "set [flags] REGISTRY",
Short: "Set default trust policy or a new trust policy for a registry",
Long: setTrustDescription,
Example: "",
@@ -36,7 +36,7 @@ var (
showTrustDescription = "Display trust policy for the system"
_showTrustCommand = &cobra.Command{
- Use: "show",
+ Use: "show [flags] [REGISTRY]",
Short: "Display trust policy for the system",
Long: showTrustDescription,
RunE: func(cmd *cobra.Command, args []string) error {
diff --git a/contrib/gate/Dockerfile b/contrib/gate/Dockerfile
index f9b57a6da..4d88ae9a6 100644
--- a/contrib/gate/Dockerfile
+++ b/contrib/gate/Dockerfile
@@ -49,8 +49,6 @@ WORKDIR $GOSRC
# Install dependencies
RUN set -x && \
- go get -u github.com/mailru/easyjson/... && \
- install -D -m 755 "$GOPATH"/bin/easyjson /usr/bin/ && \
make install.tools && \
install -D -m 755 $GOSRC/contrib/gate/entrypoint.sh /usr/local/bin/ && \
rm -rf "$GOSRC"
diff --git a/pkg/adapter/runtime.go b/pkg/adapter/runtime.go
index 4f5b98dbb..8624981b1 100644
--- a/pkg/adapter/runtime.go
+++ b/pkg/adapter/runtime.go
@@ -333,3 +333,11 @@ func (r *LocalRuntime) LoadImage(ctx context.Context, name string, cli *cliconfi
}
return r.Runtime.LoadImage(ctx, name, cli.Input, writer, cli.SignaturePolicy)
}
+
+// IsImageNotFound checks if the error indicates that no image was found.
+func IsImageNotFound(err error) bool {
+ if errors.Cause(err) == image.ErrNoSuchImage {
+ return true
+ }
+ return false
+}
diff --git a/pkg/adapter/runtime_remote.go b/pkg/adapter/runtime_remote.go
index ca2fad852..29b43e9b0 100644
--- a/pkg/adapter/runtime_remote.go
+++ b/pkg/adapter/runtime_remote.go
@@ -796,3 +796,15 @@ func (r *LocalRuntime) LoadImage(ctx context.Context, name string, cli *cliconfi
}
return names, nil
}
+
+// IsImageNotFound checks if the error indicates that no image was found.
+func IsImageNotFound(err error) bool {
+ if errors.Cause(err) == image.ErrNoSuchImage {
+ return true
+ }
+ switch err.(type) {
+ case *iopodman.ImageNotFound:
+ return true
+ }
+ return false
+}
diff --git a/pkg/secrets/secrets.go b/pkg/secrets/secrets.go
index 242953609..3b64f8952 100644
--- a/pkg/secrets/secrets.go
+++ b/pkg/secrets/secrets.go
@@ -8,6 +8,7 @@ import (
"strings"
"github.com/containers/libpod/pkg/rootless"
+ "github.com/containers/storage/pkg/idtools"
rspec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
@@ -176,7 +177,7 @@ func SecretMountsWithUIDGID(mountLabel, containerWorkingDir, mountFile, mountPre
// Add FIPS mode secret if /etc/system-fips exists on the host
_, err := os.Stat("/etc/system-fips")
if err == nil {
- if err := addFIPSModeSecret(&secretMounts, containerWorkingDir); err != nil {
+ if err := addFIPSModeSecret(&secretMounts, containerWorkingDir, mountPrefix, mountLabel, uid, gid); err != nil {
logrus.Errorf("error adding FIPS mode secret to container: %v", err)
}
} else if os.IsNotExist(err) {
@@ -264,13 +265,16 @@ func addSecretsFromMountsFile(filePath, mountLabel, containerWorkingDir, mountPr
// root filesystem if /etc/system-fips exists on hosts.
// This enables the container to be FIPS compliant and run openssl in
// FIPS mode as the host is also in FIPS mode.
-func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error {
+func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir, mountPrefix, mountLabel string, uid, gid int) error {
secretsDir := "/run/secrets"
ctrDirOnHost := filepath.Join(containerWorkingDir, secretsDir)
if _, err := os.Stat(ctrDirOnHost); os.IsNotExist(err) {
- if err = os.MkdirAll(ctrDirOnHost, 0755); err != nil {
+ if err = idtools.MkdirAllAs(ctrDirOnHost, 0755, uid, gid); err != nil {
return errors.Wrapf(err, "making container directory on host failed")
}
+ if err = label.Relabel(ctrDirOnHost, mountLabel, false); err != nil {
+ return errors.Wrap(err, "error applying correct labels")
+ }
}
fipsFile := filepath.Join(ctrDirOnHost, "system-fips")
// In the event of restart, it is possible for the FIPS mode file to already exist
@@ -284,7 +288,7 @@ func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error
if !mountExists(*mounts, secretsDir) {
m := rspec.Mount{
- Source: ctrDirOnHost,
+ Source: filepath.Join(mountPrefix, secretsDir),
Destination: secretsDir,
Type: "bind",
Options: []string{"bind", "rprivate"},
diff --git a/remote_client.md b/remote_client.md
new file mode 100644
index 000000000..be5c918c8
--- /dev/null
+++ b/remote_client.md
@@ -0,0 +1,77 @@
+# Podman remote-client tutorial
+
+## What is the remote-client
+
+First and foremost, the remote-client is under heavy development. We are adding new
+commands and functions frequently. We also are working on a rootless implementation that
+does not require privileged users.
+
+The purpose of the Podman remote-client is to allow users to interact with a Podman "backend"
+while on a separate client. The command line interface of the remote client is exactly the
+same as the regular Podman commands with the exception of some flags being removed as they
+do not apply to the remote-client.
+
+## What you need
+To use the remote-client, you will need a binary for your client and a Podman "backend"; hereafter
+referred to as the Podman node. In this context, a Podman node is a Linux system with Podman
+installed on it and the varlink service activated. You will also need to be able to ssh into this
+system as a user with privileges to the varlink socket (more on this later).
+
+## Building the remote client
+At this time, the remote-client is not being packaged for any distribution. It must be built from
+source. To set up your build environment, see [Installation notes](install.md) and follow the
+section [Building from scratch](install.md#building-from-scratch). Once you can successfully
+build the regular Podman binary, you can now build the remote-client.
+```
+$ make podman-remote
+```
+Like building the regular Podman, the resulting binary will be in the *bin* directory. This is the binary
+you will run on the remote node later in the instructions.
+
+## Setting up the remote and Podman nodes
+
+To use the remote-client, you must perform some setup on both the remote and Podman nodes. In this case,
+the remote node refers to where the remote-client is being run; and the Podman node refers to where
+Podman and its storage reside.
+
+### Podman node setup
+The Podman node must have Podman (not the remote-client) installed as normal. If your system uses systemd,
+then simply start the Podman varlink socket.
+```
+$ sudo systemctl start io.podman.socket
+```
+
+If your system cannot use systemd, then you can manually establish the varlink socket with the Podman
+command:
+```
+$ sudo podman --log-level debug varlink --timeout 0 unix://run/podman/io.podman
+```
+
+### Required permissions
+For now, the remote-client requires that you be able to run a privileged Podman and have privileged ssh
+access to the remote system. This limitation is being worked on.
+
+### Remote node setup
+
+#### Initiate an ssh session to the Podman node
+To use the remote client, we must establish an ssh connection to the Podman server. We will also use
+that session to bind the remote varlink socket locally.
+
+```
+$ ssh -L 127.0.0.1:1234:/run/podman/io.podman root@remotehost
+```
+Note here we are binding the Podman socket to a local TCP socket on port 1234.
+
+#### Running the remote client
+With the ssh session established, we can now run the remote client in a different terminal window. You
+must inform Podman where to look for the bound socket you created in the previous step using an
+environment variable.
+
+```
+$ PODMAN_VARLINK_ADDRESS="tcp:127.0.0.1:1234" bin/podman-remote images
+REPOSITORY TAG IMAGE ID CREATED SIZE
+docker.io/library/ubuntu latest 47b19964fb50 2 weeks ago 90.7 MB
+docker.io/library/alpine latest caf27325b298 3 weeks ago 5.8 MB
+quay.io/cevich/gcloud_centos latest 641dad61989a 5 weeks ago 489 MB
+k8s.gcr.io/pause 3.1 da86e6ba6ca1 14 months ago 747 kB
+```
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-07 10:06:20 +0000