summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cmd/podman/containers/prune.go5
-rw-r--r--cmd/podman/pods/prune.go5
-rw-r--r--docs/tutorials/rootless_tutorial.md2
-rw-r--r--libpod/container_internal_linux.go3
-rw-r--r--test/e2e/run_security_labels.go4
-rw-r--r--test/e2e/run_test.go6
-rw-r--r--test/system/020-tag.bats19
7 files changed, 33 insertions, 11 deletions
diff --git a/cmd/podman/containers/prune.go b/cmd/podman/containers/prune.go
index 90dea2b45..cfe6765ac 100644
--- a/cmd/podman/containers/prune.go
+++ b/cmd/podman/containers/prune.go
@@ -10,6 +10,7 @@ import (
"github.com/containers/podman/v2/cmd/podman/registry"
"github.com/containers/podman/v2/cmd/podman/utils"
+ "github.com/containers/podman/v2/cmd/podman/validate"
"github.com/containers/podman/v2/pkg/domain/entities"
"github.com/pkg/errors"
"github.com/spf13/cobra"
@@ -25,6 +26,7 @@ var (
Long: pruneDescription,
RunE: prune,
Example: `podman container prune`,
+ Args: validate.NoArgs,
}
force bool
filter = []string{}
@@ -45,9 +47,6 @@ func prune(cmd *cobra.Command, args []string) error {
var (
pruneOptions = entities.ContainerPruneOptions{}
)
- if len(args) > 0 {
- return errors.Errorf("`%s` takes no arguments", cmd.CommandPath())
- }
if !force {
reader := bufio.NewReader(os.Stdin)
fmt.Println("WARNING! This will remove all non running containers.")
diff --git a/cmd/podman/pods/prune.go b/cmd/podman/pods/prune.go
index a7347ede5..f13d95ae9 100644
--- a/cmd/podman/pods/prune.go
+++ b/cmd/podman/pods/prune.go
@@ -9,6 +9,7 @@ import (
"github.com/containers/podman/v2/cmd/podman/registry"
"github.com/containers/podman/v2/cmd/podman/utils"
+ "github.com/containers/podman/v2/cmd/podman/validate"
"github.com/containers/podman/v2/pkg/domain/entities"
"github.com/pkg/errors"
"github.com/spf13/cobra"
@@ -23,6 +24,7 @@ var (
pruneCommand = &cobra.Command{
Use: "prune [flags]",
+ Args: validate.NoArgs,
Short: "Remove all stopped pods and their containers",
Long: pruneDescription,
RunE: prune,
@@ -41,9 +43,6 @@ func init() {
}
func prune(cmd *cobra.Command, args []string) error {
- if len(args) > 0 {
- return errors.Errorf("`%s` takes no arguments", cmd.CommandPath())
- }
if !pruneOptions.Force {
reader := bufio.NewReader(os.Stdin)
fmt.Println("WARNING! This will remove all stopped/exited pods..")
diff --git a/docs/tutorials/rootless_tutorial.md b/docs/tutorials/rootless_tutorial.md
index 6b83f18d9..3b9cbd2d0 100644
--- a/docs/tutorials/rootless_tutorial.md
+++ b/docs/tutorials/rootless_tutorial.md
@@ -95,7 +95,7 @@ If this is required, the administrator must verify that the UID of the user is p
To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`.
-To make the change persistent, the administrator will need to add a file in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`.
+To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container.
## User Actions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index dde7cafb1..eba732d2a 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -415,8 +415,9 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
}
// Look up and add groups the user belongs to, if a group wasn't directly specified
- if !rootless.IsRootless() && !strings.Contains(c.config.User, ":") {
+ if !strings.Contains(c.config.User, ":") {
for _, gid := range execUser.Sgids {
+ // FIXME: We need to add a flag to containers.conf to not add these for HPC Users.
g.AddProcessAdditionalGid(uint32(gid))
}
}
diff --git a/test/e2e/run_security_labels.go b/test/e2e/run_security_labels.go
index 7c8597866..2a0b0467d 100644
--- a/test/e2e/run_security_labels.go
+++ b/test/e2e/run_security_labels.go
@@ -130,7 +130,7 @@ var _ = Describe("Podman generate kube", func() {
SkipIfRemote("runlabel not supported on podman-remote")
PodmanDockerfile := `
FROM alpine:latest
-LABEL io.containers.capabilities=chown,mknod`
+LABEL io.containers.capabilities=chown,kill`
image := "podman-caps:podman"
podmanTest.BuildImage(PodmanDockerfile, image, "false")
@@ -145,7 +145,7 @@ LABEL io.containers.capabilities=chown,mknod`
ctr := inspect.InspectContainerToJSON()
caps := strings.Join(ctr[0].EffectiveCaps, ",")
- Expect(caps).To(Equal("CAP_CHOWN,CAP_MKNOD"))
+ Expect(caps).To(Equal("CAP_CHOWN,CAP_KILL"))
})
})
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 2d4f3a42d..292df529c 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -261,6 +261,8 @@ var _ = Describe("Podman run", func() {
})
It("podman run user capabilities test", func() {
+ // We need to ignore the containers.conf on the test distribution for this test
+ os.Setenv("CONTAINERS_CONF", "/dev/null")
session := podmanTest.Podman([]string{"run", "--rm", "--user", "bin", ALPINE, "grep", "CapBnd", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
@@ -293,6 +295,8 @@ var _ = Describe("Podman run", func() {
})
It("podman run user capabilities test with image", func() {
+ // We need to ignore the containers.conf on the test distribution for this test
+ os.Setenv("CONTAINERS_CONF", "/dev/null")
SkipIfRemote("FIXME This should work on podman-remote")
dockerfile := `FROM busybox
USER bin`
@@ -1134,7 +1138,7 @@ USER mail`
It("podman run --device-cgroup-rule", func() {
SkipIfRootless("rootless users are not allowed to mknod")
deviceCgroupRule := "c 42:* rwm"
- session := podmanTest.Podman([]string{"run", "--name", "test", "-d", "--device-cgroup-rule", deviceCgroupRule, ALPINE, "top"})
+ session := podmanTest.Podman([]string{"run", "--cap-add", "mknod", "--name", "test", "-d", "--device-cgroup-rule", deviceCgroupRule, ALPINE, "top"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
session = podmanTest.Podman([]string{"exec", "test", "mknod", "newDev", "c", "42", "1"})
diff --git a/test/system/020-tag.bats b/test/system/020-tag.bats
index 7593ad68f..1f5eede39 100644
--- a/test/system/020-tag.bats
+++ b/test/system/020-tag.bats
@@ -32,4 +32,23 @@ function _tag_and_check() {
is "$output" "Error: \"registry.com/foo:bar\": no such tag"
}
+@test "podman untag all" {
+ # First get the image ID
+ run_podman inspect --format '{{.ID}}' $IMAGE
+ iid=$output
+
+ # Add a couple of tags
+ run_podman tag $IMAGE registry.com/1:latest registry.com/2:latest registry.com/3:latest
+
+ # Untag with arguments to for all tags to be removed
+ run_podman untag $iid
+
+ # Now make sure all tags are removed
+ run_podman image inspect $iid --format "{{.RepoTags}}"
+ is "$output" "\[\]" "untag by ID leaves empty set of tags"
+
+ # Restore image
+ run_podman tag $iid $IMAGE
+}
+
# vim: filetype=sh
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-17 05:13:59 +0000