diff options
60 files changed, 461 insertions, 92 deletions
@@ -149,7 +149,7 @@ err_if_empty = $(if $(strip $($(1))),$(strip $($(1))),$(error Required variable # Podman does not work w/o CGO_ENABLED, except in some very specific cases CGO_ENABLED ?= 1 -# Default to the native OS type and archetecture unless otherwise specified +# Default to the native OS type and architecture unless otherwise specified GOOS ?= $(shell $(GO) env GOOS) ifeq ($(call err_if_empty,GOOS),windows) BINSFX := .exe @@ -255,7 +255,7 @@ test/goecho/goecho: .gopathok $(wildcard test/goecho/*.go) .PHONY: codespell codespell: - codespell -S bin,vendor,.git,go.sum,changelog.txt,.cirrus.yml,"RELEASE_NOTES.md,*.xz,*.gz,*.tar,*.tgz,bin2img,*ico,*.png,*.1,*.5,copyimg,*.orig,apidoc.go" -L uint,iff,od,seeked,splitted,marge,ERRO,hist -w + codespell -S bin,vendor,.git,go.sum,changelog.txt,.cirrus.yml,"RELEASE_NOTES.md,*.xz,*.gz,*.tar,*.tgz,bin2img,*ico,*.png,*.1,*.5,copyimg,*.orig,apidoc.go" -L uint,iff,od,seeked,splitted,marge,ERRO,hist,ether -w .PHONY: validate validate: gofmt lint .gitvalidation validate.completions man-page-check swagger-check tests-included diff --git a/RELEASE_PROCESS.md b/RELEASE_PROCESS.md index 52c08c3f2..e063fa617 100644 --- a/RELEASE_PROCESS.md +++ b/RELEASE_PROCESS.md @@ -196,7 +196,7 @@ spelled with complete minutiae. 1. Merge the PR (or ask someone else to review and merge, to be safer). 1. **Note:** This is the last point where any test-failures can be addressed by code changes. After pushing the new version-tag upstream, no further - changes can be made to the code without lots of unpleasent efforts. Please + changes can be made to the code without lots of unpleasant efforts. Please seek assistance if needed, before proceeding. 1. Assuming the "Bump to ..." PR merged successfully, and you're **really** diff --git a/cmd/podman/common/completion.go b/cmd/podman/common/completion.go index 6086df297..4aca79770 100644 --- a/cmd/podman/common/completion.go +++ b/cmd/podman/common/completion.go @@ -4,6 +4,7 @@ import ( "bufio" "fmt" "os" + "reflect" "strings" "github.com/containers/common/pkg/config" @@ -891,10 +892,85 @@ func AutocompleteNetworkFlag(cmd *cobra.Command, args []string, toComplete strin return append(networks, suggestions...), dir } -// AutocompleteJSONFormat - Autocomplete format flag option. -// -> "json" -func AutocompleteJSONFormat(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) { - return []string{"json"}, cobra.ShellCompDirectiveNoFileComp +// AutocompleteFormat - Autocomplete json or a given struct to use for a go template. +// The input can be nil, In this case only json will be autocompleted. +// This function will only work for structs other types are not supported. +// When "{{." is typed the field and method names of the given struct will be completed. +// This also works recursive for nested structs. +func AutocompleteFormat(o interface{}) func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) { + // this function provides shell completion for go templates + return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) { + // autocomplete json when nothing or json is typed + if strings.HasPrefix("json", toComplete) { + return []string{"json"}, cobra.ShellCompDirectiveNoFileComp + } + // no input struct we cannot provide completion return nothing + if o == nil { + return nil, cobra.ShellCompDirectiveNoFileComp + } + + // toComplete could look like this: {{ .Config }} {{ .Field.F + // 1. split the template variable delimiter + vars := strings.Split(toComplete, "{{") + if len(vars) == 1 { + // no variables return no completion + return nil, cobra.ShellCompDirectiveNoFileComp + } + // clean the spaces from the last var + field := strings.Split(vars[len(vars)-1], " ") + // split this into it struct field names + fields := strings.Split(field[len(field)-1], ".") + f := reflect.ValueOf(o) + for i := 1; i < len(fields); i++ { + if f.Kind() == reflect.Ptr { + f = f.Elem() + } + + // // the only supported type is struct + if f.Kind() != reflect.Struct { + return nil, cobra.ShellCompDirectiveNoFileComp + } + + // last field get all names to suggest + if i == len(fields)-1 { + suggestions := []string{} + for j := 0; j < f.NumField(); j++ { + fname := f.Type().Field(j).Name + suffix := "}}" + kind := f.Type().Field(j).Type.Kind() + if kind == reflect.Ptr { + // make sure to read the actual type when it is a pointer + kind = f.Type().Field(j).Type.Elem().Kind() + } + // when we have a nested struct do not append braces instead append a dot + if kind == reflect.Struct { + suffix = "." + } + if strings.HasPrefix(fname, fields[i]) { + // add field name with closing braces + suggestions = append(suggestions, fname+suffix) + } + } + + for j := 0; j < f.NumMethod(); j++ { + fname := f.Type().Method(j).Name + if strings.HasPrefix(fname, fields[i]) { + // add method name with closing braces + suggestions = append(suggestions, fname+"}}") + } + } + + // add the current toComplete value in front so that the shell can complete this correctly + toCompArr := strings.Split(toComplete, ".") + toCompArr[len(toCompArr)-1] = "" + toComplete = strings.Join(toCompArr, ".") + return prefixSlice(toComplete, suggestions), cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp + } + // set the next struct field + f = f.FieldByName(fields[i]) + } + return nil, cobra.ShellCompDirectiveNoFileComp + } } // AutocompleteEventFilter - Autocomplete event filter flag options. diff --git a/cmd/podman/common/completion_test.go b/cmd/podman/common/completion_test.go new file mode 100644 index 000000000..5bd627b85 --- /dev/null +++ b/cmd/podman/common/completion_test.go @@ -0,0 +1,142 @@ +package common_test + +import ( + "testing" + + "github.com/containers/podman/v3/cmd/podman/common" + "github.com/spf13/cobra" + "github.com/stretchr/testify/assert" +) + +type Car struct { + Brand string + Stats struct { + HP *int + Displacement int + } + Extras map[string]string +} + +func (c Car) Type() string { + return "" +} + +func (c Car) Color() string { + return "" +} + +func TestAutocompleteFormat(t *testing.T) { + testStruct := struct { + Name string + Age int + Car *Car + }{} + + testStruct.Car = &Car{} + testStruct.Car.Extras = map[string]string{"test": "1"} + + tests := []struct { + name string + toComplete string + expected []string + }{ + { + "empty completion", + "", + []string{"json"}, + }, + { + "json completion", + "json", + []string{"json"}, + }, + { + "invalid completion", + "blahblah", + nil, + }, + { + "invalid completion", + "{{", + nil, + }, + { + "invalid completion", + "{{ ", + nil, + }, + { + "invalid completion", + "{{ ..", + nil, + }, + { + "fist level struct field name", + "{{.", + []string{"{{.Name}}", "{{.Age}}", "{{.Car."}, + }, + { + "fist level struct field name", + "{{ .", + []string{"{{ .Name}}", "{{ .Age}}", "{{ .Car."}, + }, + { + "fist level struct field name", + "{{ .N", + []string{"{{ .Name}}"}, + }, + { + "second level struct field name", + "{{ .Car.", + []string{"{{ .Car.Brand}}", "{{ .Car.Stats.", "{{ .Car.Extras}}", "{{ .Car.Color}}", "{{ .Car.Type}}"}, + }, + { + "second level struct field name", + "{{ .Car.B", + []string{"{{ .Car.Brand}}"}, + }, + { + "three level struct field name", + "{{ .Car.Stats.", + []string{"{{ .Car.Stats.HP}}", "{{ .Car.Stats.Displacement}}"}, + }, + { + "three level struct field name", + "{{ .Car.Stats.D", + []string{"{{ .Car.Stats.Displacement}}"}, + }, + { + "second level struct field name", + "{{ .Car.B", + []string{"{{ .Car.Brand}}"}, + }, + { + "invalid field name", + "{{ .Ca.B", + nil, + }, + { + "map key names don't work", + "{{ .Car.Extras.", + nil, + }, + { + "two variables struct field name", + "{{ .Car.Brand }} {{ .Car.", + []string{"{{ .Car.Brand }} {{ .Car.Brand}}", "{{ .Car.Brand }} {{ .Car.Stats.", "{{ .Car.Brand }} {{ .Car.Extras}}", + "{{ .Car.Brand }} {{ .Car.Color}}", "{{ .Car.Brand }} {{ .Car.Type}}"}, + }, + { + "only dot without variable", + ".", + nil, + }, + } + + for _, test := range tests { + completion, directive := common.AutocompleteFormat(testStruct)(nil, nil, test.toComplete) + // directive should always be greater than ShellCompDirectiveNoFileComp + assert.GreaterOrEqual(t, directive, cobra.ShellCompDirectiveNoFileComp, "unexpected ShellCompDirective") + assert.Equal(t, test.expected, completion, test.name) + } +} diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go index da391d30d..d496ae308 100644 --- a/cmd/podman/common/create.go +++ b/cmd/podman/common/create.go @@ -277,7 +277,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *ContainerCLIOpts) { createFlags.StringSliceVar( &cf.GroupAdd, groupAddFlagName, []string{}, - "Add additional groups to join", + "Add additional groups to the primary container process. 'keep-groups' allows container processes to use suplementary groups.", ) _ = cmd.RegisterFlagCompletionFunc(groupAddFlagName, completion.AutocompleteNone) diff --git a/cmd/podman/common/create_opts.go b/cmd/podman/common/create_opts.go index 040dc6570..983b9e5ca 100644 --- a/cmd/podman/common/create_opts.go +++ b/cmd/podman/common/create_opts.go @@ -252,21 +252,24 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, cgroup return nil, nil, err } - netNS := specgen.Namespace{ - NSMode: nsmode.NSMode, - Value: nsmode.Value, + var netOpts map[string][]string + parts := strings.SplitN(string(cc.HostConfig.NetworkMode), ":", 2) + if len(parts) > 1 { + netOpts = make(map[string][]string) + netOpts[parts[0]] = strings.Split(parts[1], ",") } // network // Note: we cannot emulate compat exactly here. we only allow specifics of networks to be // defined when there is only one network. netInfo := entities.NetOptions{ - AddHosts: cc.HostConfig.ExtraHosts, - DNSOptions: cc.HostConfig.DNSOptions, - DNSSearch: cc.HostConfig.DNSSearch, - DNSServers: dns, - Network: netNS, - PublishPorts: specPorts, + AddHosts: cc.HostConfig.ExtraHosts, + DNSOptions: cc.HostConfig.DNSOptions, + DNSSearch: cc.HostConfig.DNSSearch, + DNSServers: dns, + Network: nsmode, + PublishPorts: specPorts, + NetworkOptions: netOpts, } // network names diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go index 507e9c221..3f495e19b 100644 --- a/cmd/podman/containers/create.go +++ b/cmd/podman/containers/create.go @@ -193,6 +193,25 @@ func createInit(c *cobra.Command) error { val := c.Flag("entrypoint").Value.String() cliVals.Entrypoint = &val } + + if c.Flags().Changed("group-add") { + groups := []string{} + for _, g := range cliVals.GroupAdd { + if g == "keep-groups" { + if len(cliVals.GroupAdd) > 1 { + return errors.New("the '--group-add keep-groups' option is not allowed with any other --group-add options") + } + if registry.IsRemote() { + return errors.New("the '--group-add keep-groups' option is not supported in remote mode") + } + cliVals.Annotation = append(cliVals.Annotation, "run.oci.keep_original_groups=1") + } else { + groups = append(groups, g) + } + } + cliVals.GroupAdd = groups + } + if c.Flags().Changed("pids-limit") { val := c.Flag("pids-limit").Value.String() pidsLimit, err := strconv.ParseInt(val, 10, 32) diff --git a/cmd/podman/containers/diff.go b/cmd/podman/containers/diff.go index f6f262066..799d01127 100644 --- a/cmd/podman/containers/diff.go +++ b/cmd/podman/containers/diff.go @@ -39,7 +39,7 @@ func init() { formatFlagName := "format" flags.StringVar(&diffOpts.Format, formatFlagName, "", "Change the output format") - _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) validate.AddLatestFlag(diffCmd, &diffOpts.Latest) } diff --git a/cmd/podman/containers/inspect.go b/cmd/podman/containers/inspect.go index e7921fc39..eb29b7285 100644 --- a/cmd/podman/containers/inspect.go +++ b/cmd/podman/containers/inspect.go @@ -5,6 +5,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/inspect" "github.com/containers/podman/v3/cmd/podman/registry" "github.com/containers/podman/v3/cmd/podman/validate" + "github.com/containers/podman/v3/libpod/define" "github.com/containers/podman/v3/pkg/domain/entities" "github.com/spf13/cobra" ) @@ -35,7 +36,12 @@ func init() { formatFlagName := "format" flags.StringVarP(&inspectOpts.Format, formatFlagName, "f", "json", "Format the output to a Go template or json") - _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.InspectContainerData{ + State: &define.InspectContainerState{}, + NetworkSettings: &define.InspectNetworkSettings{}, + Config: &define.InspectContainerConfig{}, + HostConfig: &define.InspectContainerHostConfig{}, + })) validate.AddLatestFlag(inspectCmd, &inspectOpts.Latest) } diff --git a/cmd/podman/containers/mount.go b/cmd/podman/containers/mount.go index 7853bfae6..fd5a279d2 100644 --- a/cmd/podman/containers/mount.go +++ b/cmd/podman/containers/mount.go @@ -61,7 +61,7 @@ func mountFlags(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&mountOpts.Format, formatFlagName, "", "Print the mounted containers in specified format (json)") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) flags.BoolVar(&mountOpts.NoTruncate, "notruncate", false, "Do not truncate output") } diff --git a/cmd/podman/containers/ps.go b/cmd/podman/containers/ps.go index 97451eb46..3c0162676 100644 --- a/cmd/podman/containers/ps.go +++ b/cmd/podman/containers/ps.go @@ -87,7 +87,7 @@ func listFlagSet(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&listOpts.Format, formatFlagName, "", "Pretty-print containers to JSON or using a Go template") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.ListContainer{})) lastFlagName := "last" flags.IntVarP(&listOpts.Last, lastFlagName, "n", -1, "Print the n last created containers (all states)") diff --git a/cmd/podman/containers/stats.go b/cmd/podman/containers/stats.go index 4c31896be..7160f1ba8 100644 --- a/cmd/podman/containers/stats.go +++ b/cmd/podman/containers/stats.go @@ -71,7 +71,7 @@ func statFlags(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&statsOptions.Format, formatFlagName, "", "Pretty-print container statistics to JSON or using a Go template") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.ContainerStats{})) flags.BoolVar(&statsOptions.NoReset, "no-reset", false, "Disable resetting the screen between intervals") flags.BoolVar(&statsOptions.NoStream, "no-stream", false, "Disable streaming stats and only pull the first result, default setting is false") diff --git a/cmd/podman/diff.go b/cmd/podman/diff.go index 4862d31b5..ae7d6c4bc 100644 --- a/cmd/podman/diff.go +++ b/cmd/podman/diff.go @@ -43,7 +43,7 @@ func init() { formatFlagName := "format" flags.StringVar(&diffOpts.Format, formatFlagName, "", "Change the output format") - _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) validate.AddLatestFlag(diffCmd, &diffOpts.Latest) } diff --git a/cmd/podman/generate/systemd.go b/cmd/podman/generate/systemd.go index 693506725..72b2e6335 100644 --- a/cmd/podman/generate/systemd.go +++ b/cmd/podman/generate/systemd.go @@ -72,7 +72,7 @@ func init() { formatFlagName := "format" flags.StringVar(&format, formatFlagName, "", "Print the created units in specified format (json)") - _ = systemdCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = systemdCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) flags.SetNormalizeFunc(utils.AliasFlags) } diff --git a/cmd/podman/images/diff.go b/cmd/podman/images/diff.go index 36b0d4e7a..7f4c3e83d 100644 --- a/cmd/podman/images/diff.go +++ b/cmd/podman/images/diff.go @@ -41,7 +41,7 @@ func diffFlags(flags *pflag.FlagSet) { formatFlagName := "format" flags.StringVar(&diffOpts.Format, formatFlagName, "", "Change the output format") - _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = diffCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) } func diff(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/images/history.go b/cmd/podman/images/history.go index eaf56651f..16be0bb19 100644 --- a/cmd/podman/images/history.go +++ b/cmd/podman/images/history.go @@ -74,7 +74,7 @@ func historyFlags(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&opts.format, formatFlagName, "", "Change the output to JSON or a Go template") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.ImageHistoryLayer{})) flags.BoolVarP(&opts.human, "human", "H", true, "Display sizes and dates in human readable format") flags.BoolVar(&opts.noTrunc, "no-trunc", false, "Do not truncate the output") diff --git a/cmd/podman/images/inspect.go b/cmd/podman/images/inspect.go index fb96286fa..ac3becaa6 100644 --- a/cmd/podman/images/inspect.go +++ b/cmd/podman/images/inspect.go @@ -5,6 +5,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/inspect" "github.com/containers/podman/v3/cmd/podman/registry" "github.com/containers/podman/v3/pkg/domain/entities" + inspectTypes "github.com/containers/podman/v3/pkg/inspect" "github.com/spf13/cobra" ) @@ -34,7 +35,7 @@ func init() { formatFlagName := "format" flags.StringVarP(&inspectOpts.Format, formatFlagName, "f", "json", "Format the output to a Go template or json") - _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(inspectTypes.ImageData{})) } func inspectExec(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/images/list.go b/cmd/podman/images/list.go index 7a9a8a804..132af858b 100644 --- a/cmd/podman/images/list.go +++ b/cmd/podman/images/list.go @@ -83,7 +83,7 @@ func imageListFlagSet(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&listFlag.format, formatFlagName, "", "Change the output format to JSON or a Go template") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.ImageSummary{})) flags.BoolVar(&listFlag.digests, "digests", false, "Show digests") flags.BoolVarP(&listFlag.noHeading, "noheading", "n", false, "Do not print column headings") diff --git a/cmd/podman/images/mount.go b/cmd/podman/images/mount.go index 79c97006d..a098aac63 100644 --- a/cmd/podman/images/mount.go +++ b/cmd/podman/images/mount.go @@ -51,7 +51,7 @@ func mountFlags(cmd *cobra.Command) { formatFlagName := "format" flags.StringVar(&mountOpts.Format, formatFlagName, "", "Print the mounted images in specified format (json)") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) } func init() { diff --git a/cmd/podman/machine/stop.go b/cmd/podman/machine/stop.go index 4235b64f1..4307d3eeb 100644 --- a/cmd/podman/machine/stop.go +++ b/cmd/podman/machine/stop.go @@ -30,7 +30,7 @@ func init() { }) } -// TODO Name shouldnt be required, need to create a default vm +// TODO Name shouldn't be required, need to create a default vm func stop(cmd *cobra.Command, args []string) error { var ( err error diff --git a/cmd/podman/networks/inspect.go b/cmd/podman/networks/inspect.go index 953f5e6e8..a05b9026d 100644 --- a/cmd/podman/networks/inspect.go +++ b/cmd/podman/networks/inspect.go @@ -33,7 +33,7 @@ func init() { formatFlagName := "format" flags.StringVarP(&inspectOpts.Format, formatFlagName, "f", "", "Pretty-print network to JSON or using a Go template") - _ = networkinspectCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = networkinspectCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(nil)) } func networkInspect(_ *cobra.Command, args []string) error { diff --git a/cmd/podman/networks/list.go b/cmd/podman/networks/list.go index bc100da8c..e1b182cbf 100644 --- a/cmd/podman/networks/list.go +++ b/cmd/podman/networks/list.go @@ -41,7 +41,7 @@ var ( func networkListFlags(flags *pflag.FlagSet) { formatFlagName := "format" flags.StringVar(&networkListOptions.Format, formatFlagName, "", "Pretty-print networks to JSON or using a Go template") - _ = networklistCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = networklistCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(ListPrintReports{})) flags.BoolVarP(&networkListOptions.Quiet, "quiet", "q", false, "display only names") flags.BoolVar(&noTrunc, "no-trunc", false, "Do not truncate the network ID") diff --git a/cmd/podman/pods/inspect.go b/cmd/podman/pods/inspect.go index 96e007fa3..c66b81adb 100644 --- a/cmd/podman/pods/inspect.go +++ b/cmd/podman/pods/inspect.go @@ -10,6 +10,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/common" "github.com/containers/podman/v3/cmd/podman/registry" "github.com/containers/podman/v3/cmd/podman/validate" + "github.com/containers/podman/v3/libpod/define" "github.com/containers/podman/v3/pkg/domain/entities" "github.com/pkg/errors" "github.com/spf13/cobra" @@ -44,7 +45,7 @@ func init() { formatFlagName := "format" flags.StringVarP(&inspectOptions.Format, formatFlagName, "f", "json", "Format the output to a Go template or json") - _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.InspectPodData{})) validate.AddLatestFlag(inspectCmd, &inspectOptions.Latest) } diff --git a/cmd/podman/pods/ps.go b/cmd/podman/pods/ps.go index a4b6d1afa..beaeda871 100644 --- a/cmd/podman/pods/ps.go +++ b/cmd/podman/pods/ps.go @@ -61,7 +61,7 @@ func init() { formatFlagName := "format" flags.StringVar(&psInput.Format, formatFlagName, "", "Pretty-print pods to JSON or using a Go template") - _ = psCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = psCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(ListPodReporter{})) flags.Bool("noheading", false, "Do not print headers") flags.BoolVar(&psInput.Namespace, "namespace", false, "Display namespace information of the pod") diff --git a/cmd/podman/pods/stats.go b/cmd/podman/pods/stats.go index e336b864e..97147275e 100644 --- a/cmd/podman/pods/stats.go +++ b/cmd/podman/pods/stats.go @@ -58,7 +58,7 @@ func init() { formatFlagName := "format" flags.StringVar(&statsOptions.Format, formatFlagName, "", "Pretty-print container statistics to JSON or using a Go template") - _ = statsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = statsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.PodStatsReport{})) flags.BoolVar(&statsOptions.NoReset, "no-reset", false, "Disable resetting the screen when streaming") flags.BoolVar(&statsOptions.NoStream, "no-stream", false, "Disable streaming stats and only pull the first result") diff --git a/cmd/podman/secrets/inspect.go b/cmd/podman/secrets/inspect.go index 4036291ec..bcb1adb5e 100644 --- a/cmd/podman/secrets/inspect.go +++ b/cmd/podman/secrets/inspect.go @@ -40,7 +40,7 @@ func init() { flags := inspectCmd.Flags() formatFlagName := "format" flags.StringVar(&format, formatFlagName, "", "Format volume output using Go template") - _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.SecretInfoReport{})) } func inspect(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/secrets/list.go b/cmd/podman/secrets/list.go index 2006fb0ee..ba7065d61 100644 --- a/cmd/podman/secrets/list.go +++ b/cmd/podman/secrets/list.go @@ -47,7 +47,7 @@ func init() { flags := lsCmd.Flags() formatFlagName := "format" flags.StringVar(&listFlag.format, formatFlagName, "{{.ID}}\t{{.Name}}\t{{.Driver}}\t{{.CreatedAt}}\t{{.UpdatedAt}}\t\n", "Format volume output using Go template") - _ = lsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = lsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.SecretInfoReport{})) flags.BoolVar(&listFlag.noHeading, "noheading", false, "Do not print headers") } diff --git a/cmd/podman/system/events.go b/cmd/podman/system/events.go index 0f52282a9..568610bdc 100644 --- a/cmd/podman/system/events.go +++ b/cmd/podman/system/events.go @@ -52,7 +52,7 @@ func init() { formatFlagName := "format" flags.StringVar(&eventFormat, formatFlagName, "", "format the output using a Go template") - _ = eventsCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = eventsCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(events.Event{})) flags.BoolVar(&eventOptions.Stream, "stream", true, "stream new events; for testing only") diff --git a/cmd/podman/system/info.go b/cmd/podman/system/info.go index 2babd49c8..afd5b3a34 100644 --- a/cmd/podman/system/info.go +++ b/cmd/podman/system/info.go @@ -10,6 +10,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/common" "github.com/containers/podman/v3/cmd/podman/registry" "github.com/containers/podman/v3/cmd/podman/validate" + "github.com/containers/podman/v3/libpod/define" "github.com/containers/podman/v3/pkg/domain/entities" "github.com/ghodss/yaml" "github.com/spf13/cobra" @@ -68,7 +69,7 @@ func infoFlags(cmd *cobra.Command) { formatFlagName := "format" flags.StringVarP(&inFormat, formatFlagName, "f", "", "Change the output format to JSON or a Go template") - _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.Info{Host: &define.HostInfo{}, Store: &define.StoreInfo{}})) } func info(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/system/version.go b/cmd/podman/system/version.go index dfb10c080..ad9fd2a85 100644 --- a/cmd/podman/system/version.go +++ b/cmd/podman/system/version.go @@ -38,7 +38,7 @@ func init() { formatFlagName := "format" flags.StringVarP(&versionFormat, formatFlagName, "f", "", "Change the output format to JSON or a Go template") - _ = versionCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = versionCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(entities.SystemVersionReport{})) } func version(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/volumes/inspect.go b/cmd/podman/volumes/inspect.go index 91269e3d1..d52eee9f3 100644 --- a/cmd/podman/volumes/inspect.go +++ b/cmd/podman/volumes/inspect.go @@ -4,6 +4,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/common" "github.com/containers/podman/v3/cmd/podman/inspect" "github.com/containers/podman/v3/cmd/podman/registry" + "github.com/containers/podman/v3/libpod/define" "github.com/containers/podman/v3/pkg/domain/entities" "github.com/pkg/errors" "github.com/spf13/cobra" @@ -41,7 +42,7 @@ func init() { formatFlagName := "format" flags.StringVarP(&inspectOpts.Format, formatFlagName, "f", "json", "Format volume output using Go template") - _ = inspectCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = inspectCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.InspectVolumeData{})) } func volumeInspect(cmd *cobra.Command, args []string) error { diff --git a/cmd/podman/volumes/list.go b/cmd/podman/volumes/list.go index 0d764e988..f402afa94 100644 --- a/cmd/podman/volumes/list.go +++ b/cmd/podman/volumes/list.go @@ -14,6 +14,7 @@ import ( "github.com/containers/podman/v3/cmd/podman/parse" "github.com/containers/podman/v3/cmd/podman/registry" "github.com/containers/podman/v3/cmd/podman/validate" + "github.com/containers/podman/v3/libpod/define" "github.com/containers/podman/v3/pkg/domain/entities" "github.com/pkg/errors" "github.com/spf13/cobra" @@ -60,7 +61,7 @@ func init() { formatFlagName := "format" flags.StringVar(&cliOpts.Format, formatFlagName, "{{.Driver}}\t{{.Name}}\n", "Format volume output using Go template") - _ = lsCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat) + _ = lsCommand.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteFormat(define.InspectVolumeData{})) flags.Bool("noheading", false, "Do not print headers") flags.BoolVarP(&cliOpts.Quiet, "quiet", "q", false, "Print volume output in quiet mode") diff --git a/completions/powershell/podman-remote.ps1 b/completions/powershell/podman-remote.ps1 index 9cdbabc52..875684b34 100644 --- a/completions/powershell/podman-remote.ps1 +++ b/completions/powershell/podman-remote.ps1 @@ -161,7 +161,7 @@ Register-ArgumentCompleter -CommandName 'podman-remote' -ScriptBlock { $Values | ForEach-Object { - # store temporay because switch will overwrite $_ + # store temporary because switch will overwrite $_ $comp = $_ # PowerShell supports three different completion modes @@ -216,7 +216,7 @@ Register-ArgumentCompleter -CommandName 'podman-remote' -ScriptBlock { Default { # Like MenuComplete but we don't want to add a space here because # the user need to press space anyway to get the completion. - # Description will not be shown because thats not possible with TabCompleteNext + # Description will not be shown because that's not possible with TabCompleteNext [System.Management.Automation.CompletionResult]::new($($comp.Name | __podman-remote_escapeStringWithSpecialChars), "$($comp.Name)", 'ParameterValue', "$($comp.Description)") } } diff --git a/completions/powershell/podman.ps1 b/completions/powershell/podman.ps1 index 6b6f832d2..619c5beea 100644 --- a/completions/powershell/podman.ps1 +++ b/completions/powershell/podman.ps1 @@ -161,7 +161,7 @@ Register-ArgumentCompleter -CommandName 'podman' -ScriptBlock { $Values | ForEach-Object { - # store temporay because switch will overwrite $_ + # store temporary because switch will overwrite $_ $comp = $_ # PowerShell supports three different completion modes @@ -216,7 +216,7 @@ Register-ArgumentCompleter -CommandName 'podman' -ScriptBlock { Default { # Like MenuComplete but we don't want to add a space here because # the user need to press space anyway to get the completion. - # Description will not be shown because thats not possible with TabCompleteNext + # Description will not be shown because that's not possible with TabCompleteNext [System.Management.Automation.CompletionResult]::new($($comp.Name | __podman_escapeStringWithSpecialChars), "$($comp.Name)", 'ParameterValue', "$($comp.Description)") } } diff --git a/contrib/cirrus/runner.sh b/contrib/cirrus/runner.sh index b463745d1..47f3c9405 100755 --- a/contrib/cirrus/runner.sh +++ b/contrib/cirrus/runner.sh @@ -277,7 +277,7 @@ logformatter() { |& awk --file "${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/timestamp.awk" \ |& "${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/logformatter" "$output_name" else - # Assume script is run by a human, they want output immediatly + # Assume script is run by a human, they want output immediately cat - fi } diff --git a/docs/remote-docs.sh b/docs/remote-docs.sh index 2b7d73cd3..939c7264c 100755 --- a/docs/remote-docs.sh +++ b/docs/remote-docs.sh @@ -6,7 +6,7 @@ PLATFORM=$1 ## linux, windows or darwin TARGET=${2} ## where to output files SOURCES=${@:3} ## directories to find markdown files -# Overriden for testing. Native podman-remote binary expected filepaths +# Overridden for testing. Native podman-remote binary expected filepaths if [[ -z "$PODMAN" ]]; then case $(env -i HOME=$HOME PATH=$PATH go env GOOS) in windows) diff --git a/docs/source/markdown/podman-build.1.md b/docs/source/markdown/podman-build.1.md index 876bfe412..791e2d907 100644 --- a/docs/source/markdown/podman-build.1.md +++ b/docs/source/markdown/podman-build.1.md @@ -688,7 +688,7 @@ Set the architecture variant of the image to be pulled. bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman container. (This option is not available with the remote Podman client) - The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> + The `OPTIONS` are a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> * [rw|ro] * [z|Z|O] diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md index 059a09ae1..1ea9d1ea6 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -261,8 +261,8 @@ Note: if _host_device_ is a symbolic link then it will be resolved first. The container will only store the major and minor numbers of the host device. Note: if the user only has access rights via a group, accessing the device -from inside a rootless container will fail. The **crun**(1) runtime offers a -workaround for this by adding the option **\-\-annotation run.oci.keep_original_groups=1**. +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. Podman may load kernel modules required for using the specified device. The devices that podman will load modules when necessary are: @@ -361,9 +361,17 @@ GID map for the user namespace. Using this flag will run the container with user The following example maps uids 0-2000 in the container to the uids 30000-31999 on the host and gids 0-2000 in the container to the gids 30000-31999 on the host. `--gidmap=0:30000:2000` -#### **\-\-group-add**=*group* +#### **\-\-group-add**=*group|keep-groups* -Add additional groups to run as +Add additional groups to assign to primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, you cannot add any other groups +with this flag. (Not available for remote commands) #### **\-\-health-cmd**=*"command"* | *'["command", "arg1", ...]'* @@ -634,7 +642,7 @@ Valid _mode_ values are: - **none**: no networking; - **container:**_id_: reuse another container's network stack; - **host**: use the Podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure; -- _network-id_: connect to a user-defined network, multiple networks should be comma separated; +- _network-id_: connect to a user-defined network, multiple networks should be comma-separated; - **ns:**_path_: path to a network namespace to join; - **private**: create a new namespace for the container (default) - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options: @@ -861,6 +869,8 @@ Security Options - `label=filetype:TYPE` : Set the label file type for the container files - `label=disable` : Turn off label separation for the container +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + - `mask=/path/1:/path/2` : The paths to mask separated by a colon. A masked path cannot be accessed inside the container. @@ -869,13 +879,13 @@ Security Options - `seccomp=unconfined` : Turn off seccomp confinement for the container - `seccomp=profile.json` : White listed syscalls seccomp Json file to be used as a seccomp filter +- `proc-opts=OPTIONS` : Comma-separated list of options to use for the /proc mount. More details for the + possible mount options are specified in the **proc(5)** man page. + - `unmask=ALL or /path/1:/path/2` : Paths to unmask separated by a colon. If set to **ALL**, it will unmask all the paths that are masked or made read only by default. The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.** The default paths that are read only are **/proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup**. -- `proc-opts=OPTIONS` : Comma separated list of options to use for the /proc mount. More details for the - possible mount options are specified at **proc(5)** man page. - Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. #### **\-\-shm-size**=*size* @@ -1093,9 +1103,9 @@ Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, Podman bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` will mount the volume in the host to the container. If no such named volume exists, Podman will -create one. The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) +create one. The `OPTIONS` are a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) -The _options_ is a comma delimited list and can be: +The _options_ is a comma-separated list and can be: * **rw**|**ro** * **z**|**Z** @@ -1185,7 +1195,7 @@ host into the container to allow speeding up builds. Content mounted into the container is labeled with the private label. On SELinux systems, labels in the source directory must be readable by the container label. Usually containers can read/execute `container_share_t` -and can read/write `container_file_t`. If you can not change the labels on a +and can read/write `container_file_t`. If you cannot change the labels on a source volume, SELinux container separation must be disabled for the container to work. - The source directory mounted into the container with an overlay mount @@ -1245,10 +1255,14 @@ will convert /foo into a `shared` mount point. Alternatively one can directly change propagation properties of source mount. Say `/` is source mount for `/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount. +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + #### **\-\-volumes-from**[=*CONTAINER*[:*OPTIONS*]] Mount volumes from the specified container(s). Used to share volumes between -containers. The *options* is a comma delimited list with the following available elements: +containers. The *options* is a comma-separated list with the following available elements: * **rw**|**ro** * **z** @@ -1351,6 +1365,11 @@ $ podman create --name container1 -t -i fedora bash $ podman create --name container2 -t -i fedora bash $ podman create --name container3 --requires container1,container2 -t -i fedora bash $ podman start --attach container3 + +### Configure keep supplemental groups for access to volume + +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 ``` ### Rootless Containers diff --git a/docs/source/markdown/podman-pod-create.1.md b/docs/source/markdown/podman-pod-create.1.md index 9ecde1ca3..6f3d7f1ca 100644 --- a/docs/source/markdown/podman-pod-create.1.md +++ b/docs/source/markdown/podman-pod-create.1.md @@ -125,7 +125,7 @@ If another pod with the same name already exists, replace and remove it. The de #### **\-\-share**=*namespace* -A comma delimited list of kernel namespaces to share. If none or "" is specified, no namespaces will be shared. The namespaces to choose from are ipc, net, pid, uts. +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces will be shared. The namespaces to choose from are ipc, net, pid, uts. The operator can identify a pod in three ways: UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index b607a65ff..3a2651f98 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -299,8 +299,8 @@ Note: if _host_device_ is a symbolic link then it will be resolved first. The container will only store the major and minor numbers of the host device. Note: if the user only has access rights via a group, accessing the device -from inside a rootless container will fail. The **crun**(1) runtime offers a -workaround for this by adding the option **\-\-annotation run.oci.keep_original_groups=1**. +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. Podman may load kernel modules required for using the specified device. The devices that Podman will load modules when necessary are: @@ -405,9 +405,17 @@ Meaning **groupname** is initially mapped to gid **100000** which is referenced above: The group **groupname** is mapped to group **100000** of the initial namespace then the **30000**st id of this namespace (which is gid 130000 in this namespace) is mapped to container namespace group id **0**. (groupname -> 100000 / 30000 -> 0) -#### **\-\-group-add**=*group* +#### **\-\-group-add**=*group|keep-groups* -Add additional groups to run as +Add additional groups to assign to primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, you cannot add any other groups +with this flag. (Not available for remote commands) #### **\-\-health-cmd**=*"command"* | *'["command", "arg1", ...]'* @@ -670,7 +678,7 @@ Valid _mode_ values are: - **none**: no networking; - **container:**_id_: reuse another container's network stack; - **host**: use the Podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure; -- _network-id_: connect to a user-defined network, multiple networks should be comma separated; +- _network-id_: connect to a user-defined network, multiple networks should be comma-separated; - **ns:**_path_: path to a network namespace to join; - **private**: create a new namespace for the container (default) - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options: @@ -905,19 +913,27 @@ Security Options - **apparmor=unconfined** : Turn off apparmor confinement for the container - **apparmor**=_your-profile_ : Set the apparmor confinement profile for the container + - **label=user:**_USER_: Set the label user for the container processes - **label=role:**_ROLE_: Set the label role for the container processes - **label=type:**_TYPE_: Set the label process type for the container processes - **label=level:**_LEVEL_: Set the label level for the container processes - **label=filetype:**TYPE_: Set the label file type for the container files - **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + - **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + - **no-new-privileges**: Disable container processes from gaining additional privileges + - **seccomp=unconfined**: Turn off seccomp confinement for the container - **seccomp**=_profile.json_: Allowed syscall list seccomp JSON file to be used as a seccomp filter -- **proc-opts**=_OPTIONS_ : Comma separated list of options to use for the /proc mount. More details - for the possible mount options are specified at **proc(5)** man page. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + - **unmask**=_ALL_ or _/path/1:/path/2_: Paths to unmask separated by a colon. If set to **ALL**, it will unmask all the paths that are masked or made read only by default. The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**. The default paths that are read only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. @@ -1164,7 +1180,7 @@ container. Similarly, _SOURCE-VOLUME_:_/CONTAINER-DIR_ will mount the volume in the host to the container. If no such named volume exists, Podman will create one. (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) -The _options_ is a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> +The _options_ is a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> * **rw**|**ro** * **z**|**Z** @@ -1252,7 +1268,7 @@ host into the container to allow speeding up builds. Content mounted into the container is labeled with the private label. On SELinux systems, labels in the source directory must be readable by the container label. Usually containers can read/execute `container_share_t` -and can read/write `container_file_t`. If you can not change the labels on a +and can read/write `container_file_t`. If you cannot change the labels on a source volume, SELinux container separation must be disabled for the container to work. - The source directory mounted into the container with an overlay mount @@ -1314,10 +1330,14 @@ will convert /foo into a shared mount point. Alternatively, one can directly change propagation properties of source mount. Say, if _/_ is source mount for _/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + #### **\-\-volumes-from**[=*CONTAINER*[:*OPTIONS*]] Mount volumes from the specified container(s). Used to share volumes between -containers. The *options* is a comma delimited list with the following available elements: +containers. The *options* is a comma-separated list with the following available elements: * **rw**|**ro** * **z** @@ -1699,6 +1719,11 @@ Multiple containers can be required. $ podman create --name container1 -t -i fedora bash $ podman create --name container2 -t -i fedora bash $ podman run --name container3 --requires container1,container2 -t -i fedora bash + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 ``` ### Rootless Containers diff --git a/docs/source/markdown/podman-secret-create.1.md b/docs/source/markdown/podman-secret-create.1.md index ca92dd38e..f5a97a0f3 100644 --- a/docs/source/markdown/podman-secret-create.1.md +++ b/docs/source/markdown/podman-secret-create.1.md @@ -16,7 +16,7 @@ A secret is a blob of sensitive data which a container needs at runtime but should not be stored in the image or in source control, such as usernames and passwords, TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). -Secrets will not be commited to an image with `podman commit`, and will not be in the archive created by a `podman export` +Secrets will not be committed to an image with `podman commit`, and will not be in the archive created by a `podman export` ## OPTIONS diff --git a/libpod/container_internal.go b/libpod/container_internal.go index 041fa13e7..80c00a622 100644 --- a/libpod/container_internal.go +++ b/libpod/container_internal.go @@ -1313,7 +1313,7 @@ func (c *Container) stop(timeout uint) error { } // We have to check stopErr *after* we lock again - otherwise, we have a - // change of panicing on a double-unlock. Ref: GH Issue 9615 + // change of panicking on a double-unlock. Ref: GH Issue 9615 if stopErr != nil { return stopErr } @@ -1676,7 +1676,7 @@ func (c *Container) chownVolume(volumeName string) error { // TODO: For now, I've disabled chowning volumes owned by non-Podman // drivers. This may be safe, but it's really going to be a case-by-case - // thing, I think - safest to leave disabled now and reenable later if + // thing, I think - safest to leave disabled now and re-enable later if // there is a demand. if vol.state.NeedsChown && !vol.UsesVolumeDriver() { vol.state.NeedsChown = false diff --git a/libpod/define/fileinfo.go b/libpod/define/fileinfo.go index 2c7b6fe99..eec99e300 100644 --- a/libpod/define/fileinfo.go +++ b/libpod/define/fileinfo.go @@ -5,7 +5,7 @@ import ( "time" ) -// FileInfo describes the attributes of a file or diretory. +// FileInfo describes the attributes of a file or directory. type FileInfo struct { Name string `json:"name"` Size int64 `json:"size"` diff --git a/libpod/image/utils.go b/libpod/image/utils.go index 0b4264112..dfe35c017 100644 --- a/libpod/image/utils.go +++ b/libpod/image/utils.go @@ -50,7 +50,7 @@ func findImageInRepotags(search imageParts, images []*Image) (*storage.Image, er // If more then one candidate and the candidates all have same name // and only one is read/write return it. - // Othewise return error with the list of candidates + // Otherwise return error with the list of candidates if len(candidates) > 1 { var ( rwImage *Image diff --git a/libpod/shutdown/handler.go b/libpod/shutdown/handler.go index ac1d33910..848b6729a 100644 --- a/libpod/shutdown/handler.go +++ b/libpod/shutdown/handler.go @@ -18,7 +18,7 @@ var ( stopped bool sigChan chan os.Signal cancelChan chan bool - // Syncronize accesses to the map + // Synchronize accesses to the map handlerLock sync.Mutex // Definitions of all on-shutdown handlers handlers map[string]func(os.Signal) error diff --git a/pkg/api/handlers/compat/containers.go b/pkg/api/handlers/compat/containers.go index e7146a5d8..d97a4d3bd 100644 --- a/pkg/api/handlers/compat/containers.go +++ b/pkg/api/handlers/compat/containers.go @@ -26,6 +26,7 @@ import ( "github.com/docker/go-units" "github.com/gorilla/schema" "github.com/pkg/errors" + "github.com/sirupsen/logrus" ) func RemoveContainer(w http.ResponseWriter, r *http.Request) { @@ -148,14 +149,19 @@ func ListContainers(w http.ResponseWriter, r *http.Request) { containers = containers[:query.Limit] } } - var list = make([]*handlers.Container, len(containers)) - for i, ctnr := range containers { + list := make([]*handlers.Container, 0, len(containers)) + for _, ctnr := range containers { api, err := LibpodToContainer(ctnr, query.Size) if err != nil { + if errors.Cause(err) == define.ErrNoSuchCtr { + // container was removed between the initial fetch of the list and conversion + logrus.Debugf("Container %s removed between initial fetch and conversion, ignoring in output", ctnr.ID()) + continue + } utils.InternalServerError(w, err) return } - list[i] = api + list = append(list, api) } utils.WriteResponse(w, http.StatusOK, list) } diff --git a/pkg/api/handlers/utils/containers.go b/pkg/api/handlers/utils/containers.go index 91e02abf1..c4c9cc2ea 100644 --- a/pkg/api/handlers/utils/containers.go +++ b/pkg/api/handlers/utils/containers.go @@ -76,7 +76,7 @@ func WaitContainerDocker(w http.ResponseWriter, r *http.Request) { exitCode, err := waitDockerCondition(ctx, name, interval, condition) msg := "" if err != nil { - logrus.Errorf("error while waiting on condtion: %q", err) + logrus.Errorf("error while waiting on condition: %q", err) msg = err.Error() } responseData := handlers.ContainerWaitOKBody{ diff --git a/pkg/domain/infra/abi/play.go b/pkg/domain/infra/abi/play.go index 4a13a8029..6ddd4a042 100644 --- a/pkg/domain/infra/abi/play.go +++ b/pkg/domain/infra/abi/play.go @@ -428,7 +428,7 @@ func readConfigMapFromFile(r io.Reader) (v1.ConfigMap, error) { return cm, nil } -// splitMultiDocYAML reads mutiple documents in a YAML file and +// splitMultiDocYAML reads multiple documents in a YAML file and // returns them as a list. func splitMultiDocYAML(yamlContent []byte) ([][]byte, error) { var documentList [][]byte @@ -471,7 +471,7 @@ func getKubeKind(obj []byte) (string, error) { } // sortKubeKinds adds the correct creation order for the kube kinds. -// Any pod dependecy will be created first like volumes, secrets, etc. +// Any pod dependency will be created first like volumes, secrets, etc. func sortKubeKinds(documentList [][]byte) ([][]byte, error) { var sortedDocumentList [][]byte diff --git a/pkg/machine/pull.go b/pkg/machine/pull.go index 41abe6993..d9f34057f 100644 --- a/pkg/machine/pull.go +++ b/pkg/machine/pull.go @@ -170,7 +170,7 @@ func Decompress(localPath, uncompressedPath string) error { // Will error out if file without .xz already exists // Maybe extracting then renameing is a good idea here.. -// depends on xz: not pre-installed on mac, so it becomes a brew dependecy +// depends on xz: not pre-installed on mac, so it becomes a brew dependency func decompressXZ(src string, output io.Writer) error { fmt.Println("Extracting compressed file") cmd := exec.Command("xzcat", "-k", src) diff --git a/pkg/specgen/generate/kube/kube.go b/pkg/specgen/generate/kube/kube.go index 7aeec9d41..1347ed1e0 100644 --- a/pkg/specgen/generate/kube/kube.go +++ b/pkg/specgen/generate/kube/kube.go @@ -56,7 +56,7 @@ func ToPodGen(ctx context.Context, podName string, podYAML *v1.PodTemplateSpec) } p.DNSServer = servers } - // search domans + // search domains if domains := dnsConfig.Searches; len(domains) > 0 { p.DNSSearch = domains } diff --git a/pkg/systemd/generate/common_test.go b/pkg/systemd/generate/common_test.go index 30e758127..fdcc9d21b 100644 --- a/pkg/systemd/generate/common_test.go +++ b/pkg/systemd/generate/common_test.go @@ -199,8 +199,8 @@ func TestEscapeSystemdArguments(t *testing.T) { []string{"foo", `"command with backslash \\"`}, }, { - []string{"foo", `command with two backslashs \\`}, - []string{"foo", `"command with two backslashs \\\\"`}, + []string{"foo", `command with two backslashes \\`}, + []string{"foo", `"command with two backslashes \\\\"`}, }, } diff --git a/pkg/util/filters.go b/pkg/util/filters.go index 43bf646f1..e252c1ddf 100644 --- a/pkg/util/filters.go +++ b/pkg/util/filters.go @@ -94,7 +94,7 @@ func PrepareFilters(r *http.Request) (*map[string][]string, error) { return &filterMap, nil } -// MatchLabelFilters matches labels and returs true if they are valid +// MatchLabelFilters matches labels and returns true if they are valid func MatchLabelFilters(filterValues []string, labels map[string]string) bool { outer: for _, filterValue := range filterValues { diff --git a/test/apiv2/rest_api/test_rest_v2_0_0.py b/test/apiv2/rest_api/test_rest_v2_0_0.py index bf0ee0603..3b089e2f2 100644 --- a/test/apiv2/rest_api/test_rest_v2_0_0.py +++ b/test/apiv2/rest_api/test_rest_v2_0_0.py @@ -378,7 +378,7 @@ class TestApi(unittest.TestCase): self.assertEqual(r.status_code, 200, r.text) objs = json.loads(r.text) self.assertIn(type(objs), (list,)) - # There should be only one offical image + # There should be only one official image self.assertEqual(len(objs), 1) def do_search4(): diff --git a/test/compose/slirp4netns_opts/docker-compose.yml b/test/compose/slirp4netns_opts/docker-compose.yml new file mode 100644 index 000000000..dcdcae04c --- /dev/null +++ b/test/compose/slirp4netns_opts/docker-compose.yml @@ -0,0 +1,5 @@ +services: + alpine: + image: alpine + network_mode: "slirp4netns:allow_host_loopback=true" + command: sh -c "echo teststring | nc 10.0.2.2 5001" diff --git a/test/compose/slirp4netns_opts/setup.sh b/test/compose/slirp4netns_opts/setup.sh new file mode 100644 index 000000000..35bbf7c70 --- /dev/null +++ b/test/compose/slirp4netns_opts/setup.sh @@ -0,0 +1,8 @@ +# -*- bash -*- + +# create tempfile to store nc output +OUTFILE=$(mktemp) +# listen on a port, the container will try to connect to it +nc -l 5001 > $OUTFILE & + +nc_pid=$! diff --git a/test/compose/slirp4netns_opts/teardown.sh b/test/compose/slirp4netns_opts/teardown.sh new file mode 100644 index 000000000..656724363 --- /dev/null +++ b/test/compose/slirp4netns_opts/teardown.sh @@ -0,0 +1,4 @@ +# -*- bash -*- + +kill $nc_pid &> /dev/null +rm -f $OUTFILE diff --git a/test/compose/slirp4netns_opts/tests.sh b/test/compose/slirp4netns_opts/tests.sh new file mode 100644 index 000000000..1efce45c4 --- /dev/null +++ b/test/compose/slirp4netns_opts/tests.sh @@ -0,0 +1,6 @@ +# -*- bash -*- + +output="$(cat $OUTFILE)" +expected="teststring" + +is "$output" "$expected" "$testname : nc received teststring" diff --git a/test/system/050-stop.bats b/test/system/050-stop.bats index a9495e350..2ed791429 100644 --- a/test/system/050-stop.bats +++ b/test/system/050-stop.bats @@ -114,7 +114,7 @@ load helpers @test "podman stop - unlock while waiting for timeout" { # Test that the container state transitions to "stopping" and that other # commands can get the container's lock. To do that, run a container that - # ingores SIGTERM such that the Podman would wait 20 seconds for the stop + # ignores SIGTERM such that the Podman would wait 20 seconds for the stop # to finish. This gives us enough time to try some commands and inspect # the container's status. diff --git a/test/system/070-build.bats b/test/system/070-build.bats index d4017ae01..6ae78de2e 100644 --- a/test/system/070-build.bats +++ b/test/system/070-build.bats @@ -354,7 +354,7 @@ Cmd[1] | $s_echo WorkingDir | $workdir Labels.$label_name | $label_value " - # FIXME: 2021-02-24: Fixed in buildah #3036; reenable this once podman + # FIXME: 2021-02-24: Fixed in buildah #3036; re-enable this once podman # vendors in a newer buildah! # Labels.\"io.buildah.version\" | $buildah_version diff --git a/test/system/170-run-userns.bats b/test/system/170-run-userns.bats new file mode 100644 index 000000000..2dc5b078f --- /dev/null +++ b/test/system/170-run-userns.bats @@ -0,0 +1,45 @@ +#!/usr/bin/env bats -*- bats -*- +# shellcheck disable=SC2096 +# +# Tests for podman build +# + +load helpers + +@test "podman --group-add keep-groups while in a userns" { + skip_if_rootless "choot is not allowed in rootless mode" + skip_if_remote "--group-add keep-groups not supported in remote mode" + run chroot --groups 1234 / ${PODMAN} run --uidmap 0:200000:5000 --group-add keep-groups $IMAGE id + is "$output" ".*65534(nobody)" "Check group leaked into user namespace" +} + +@test "podman --group-add keep-groups while not in a userns" { + skip_if_rootless "choot is not allowed in rootless mode" + skip_if_remote "--group-add keep-groups not supported in remote mode" + run chroot --groups 1234,5678 / ${PODMAN} run --group-add keep-groups $IMAGE id + is "$output" ".*1234" "Check group leaked into container" +} + +@test "podman --group-add without keep-groups while in a userns" { + skip_if_rootless "choot is not allowed in rootless mode" + skip_if_remote "--group-add keep-groups not supported in remote mode" + run chroot --groups 1234,5678 / ${PODMAN} run --uidmap 0:200000:5000 --group-add 457 $IMAGE id + is "$output" ".*457" "Check group leaked into container" +} + +@test "podman --remote --group-add keep-groups " { + if is_remote; then + run_podman 125 run --group-add keep-groups $IMAGE id + is "$output" ".*not supported in remote mode" "Remote check --group-add keep-groups" + fi +} + +@test "podman --group-add without keep-groups " { + run_podman run --group-add 457 $IMAGE id + is "$output" ".*457" "Check group leaked into container" +} + +@test "podman --group-add keep-groups plus added groups " { + run_podman 125 run --group-add keep-groups --group-add 457 $IMAGE id + is "$output" ".*the '--group-add keep-groups' option is not allowed with any other --group-add options" "Check group leaked into container" +} |