summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--libpod/networking_linux.go90
-rw-r--r--pkg/machine/config.go3
-rw-r--r--pkg/machine/ignition.go28
-rw-r--r--pkg/machine/qemu/config.go7
-rw-r--r--pkg/machine/qemu/machine.go49
-rw-r--r--pkg/machine/qemu/options_darwin_arm64.go1
-rw-r--r--test/e2e/build/Containerfile.with-multiple-secret (renamed from test/e2e/build/Dockerfile.with-multiple-secret)0
-rw-r--r--test/e2e/build/Containerfile.with-secret (renamed from test/e2e/build/Dockerfile.with-secret)0
-rw-r--r--test/e2e/build/Dockerfile.test-cp-root-dir2
-rw-r--r--test/e2e/build/secret-verify-leak/Containerfile.with-secret-verify-leak (renamed from test/e2e/build/Dockerfile.with-secret-verify-leak)0
-rw-r--r--test/e2e/build_test.go6
-rw-r--r--test/e2e/run_networking_test.go155
-rw-r--r--test/e2e/system_service_test.go2
13 files changed, 324 insertions, 19 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index 29b9941fe..7fd80927b 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -30,6 +30,7 @@ import (
"github.com/containers/podman/v4/pkg/util"
"github.com/containers/podman/v4/utils"
"github.com/containers/storage/pkg/lockfile"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@@ -990,8 +991,20 @@ func (c *Container) getContainerNetworkInfo() (*define.InspectNetworkSettings, e
return nil, err
}
- // We can't do more if the network is down.
if c.state.NetNS == nil {
+ if networkNSPath := c.joinedNetworkNSPath(); networkNSPath != "" {
+ if result, err := c.inspectJoinedNetworkNS(networkNSPath); err == nil {
+ if basicConfig, err := resultToBasicNetworkConfig(result); err == nil {
+ // fallback to dummy configuration
+ settings.InspectBasicNetworkConfig = basicConfig
+ return settings, nil
+ }
+ }
+ // do not propagate error inspecting a joined network ns
+ logrus.Errorf("Error inspecting network namespace: %s of container %s: %v", networkNSPath, c.ID(), err)
+ }
+ // We can't do more if the network is down.
+
// We still want to make dummy configurations for each CNI net
// the container joined.
if len(networks) > 0 {
@@ -1065,11 +1078,84 @@ func (c *Container) getContainerNetworkInfo() (*define.InspectNetworkSettings, e
return settings, nil
}
+func (c *Container) joinedNetworkNSPath() string {
+ for _, namespace := range c.config.Spec.Linux.Namespaces {
+ if namespace.Type == spec.NetworkNamespace {
+ return namespace.Path
+ }
+ }
+ return ""
+}
+
+func (c *Container) inspectJoinedNetworkNS(networkns string) (q types.StatusBlock, retErr error) {
+ var result types.StatusBlock
+ err := ns.WithNetNSPath(networkns, func(_ ns.NetNS) error {
+ ifaces, err := net.Interfaces()
+ if err != nil {
+ return err
+ }
+ routes, err := netlink.RouteList(nil, netlink.FAMILY_ALL)
+ if err != nil {
+ return err
+ }
+ var gateway net.IP
+ for _, route := range routes {
+ // default gateway
+ if route.Dst == nil {
+ gateway = route.Gw
+ }
+ }
+ result.Interfaces = make(map[string]types.NetInterface)
+ for _, iface := range ifaces {
+ if iface.Flags&net.FlagLoopback != 0 {
+ continue
+ }
+ addrs, err := iface.Addrs()
+ if err != nil {
+ continue
+ }
+ if len(addrs) == 0 {
+ continue
+ }
+ subnets := make([]types.NetAddress, 0, len(addrs))
+ for _, address := range addrs {
+ if ipnet, ok := address.(*net.IPNet); ok {
+ if ipnet.IP.IsLinkLocalMulticast() || ipnet.IP.IsLinkLocalUnicast() {
+ continue
+ }
+ subnet := types.NetAddress{
+ IPNet: types.IPNet{
+ IPNet: *ipnet,
+ },
+ }
+ if ipnet.Contains(gateway) {
+ subnet.Gateway = gateway
+ }
+ subnets = append(subnets, subnet)
+ }
+ }
+ result.Interfaces[iface.Name] = types.NetInterface{
+ Subnets: subnets,
+ MacAddress: types.HardwareAddr(iface.HardwareAddr),
+ }
+ }
+ return nil
+ })
+ return result, err
+}
+
// resultToBasicNetworkConfig produces an InspectBasicNetworkConfig from a CNI
// result
func resultToBasicNetworkConfig(result types.StatusBlock) (define.InspectBasicNetworkConfig, error) {
config := define.InspectBasicNetworkConfig{}
- for _, netInt := range result.Interfaces {
+ interfaceNames := make([]string, len(result.Interfaces))
+ for interfaceName := range result.Interfaces {
+ interfaceNames = append(interfaceNames, interfaceName)
+ }
+ // ensure consistent inspect results by sorting
+ sort.Strings(interfaceNames)
+ for _, interfaceName := range interfaceNames {
+ netInt := result.Interfaces[interfaceName]
for _, netAddress := range netInt.Subnets {
size, _ := netAddress.IPNet.Mask.Size()
if netAddress.IPNet.IP.To4() != nil {
diff --git a/pkg/machine/config.go b/pkg/machine/config.go
index efb1eda15..b3b105150 100644
--- a/pkg/machine/config.go
+++ b/pkg/machine/config.go
@@ -1,3 +1,4 @@
+//go:build amd64 || arm64
// +build amd64 arm64
package machine
@@ -28,6 +29,8 @@ type InitOptions struct {
Username string
ReExec bool
Rootful bool
+ // The numberical userid of the user that called machine
+ UID string
}
type QemuMachineStatus = string
diff --git a/pkg/machine/ignition.go b/pkg/machine/ignition.go
index 47b1836f0..b2dabb689 100644
--- a/pkg/machine/ignition.go
+++ b/pkg/machine/ignition.go
@@ -51,6 +51,7 @@ type DynamicIgnition struct {
Name string
Key string
TimeZone string
+ UID int
VMName string
WritePath string
}
@@ -63,12 +64,13 @@ func NewIgnitionFile(ign DynamicIgnition) error {
ignVersion := Ignition{
Version: "3.2.0",
}
-
ignPassword := Passwd{
Users: []PasswdUser{
{
Name: ign.Name,
SSHAuthorizedKeys: []SSHAuthorizedKey{SSHAuthorizedKey(ign.Key)},
+ // Set the UID of the core user inside the machine
+ UID: intToPtr(ign.UID),
},
{
Name: "root",
@@ -289,9 +291,7 @@ func getDirs(usrName string) []Directory {
}
func getFiles(usrName string) []File {
- var (
- files []File
- )
+ files := make([]File, 0)
lingerExample := `[Unit]
Description=A systemd user unit demo
@@ -310,6 +310,7 @@ machine_enabled=true
delegateConf := `[Service]
Delegate=memory pids cpu io
`
+ subUID := `%s:100000:1000000`
// Add a fake systemd service to get the user socket rolling
files = append(files, File{
@@ -344,6 +345,25 @@ Delegate=memory pids cpu io
},
})
+ // Setup /etc/subuid and /etc/subgid
+ for _, sub := range []string{"/etc/subuid", "/etc/subgid"} {
+ files = append(files, File{
+ Node: Node{
+ Group: getNodeGrp("root"),
+ Path: sub,
+ User: getNodeUsr("root"),
+ Overwrite: boolToPtr(true),
+ },
+ FileEmbedded1: FileEmbedded1{
+ Append: nil,
+ Contents: Resource{
+ Source: encodeDataURLPtr(fmt.Sprintf(subUID, usrName)),
+ },
+ Mode: intToPtr(0744),
+ },
+ })
+ }
+
// Set delegate.conf so cpu,io subsystem is delegated to non-root users as well for cgroupv2
// by default
files = append(files, File{
diff --git a/pkg/machine/qemu/config.go b/pkg/machine/qemu/config.go
index c619b7dd4..b39334be0 100644
--- a/pkg/machine/qemu/config.go
+++ b/pkg/machine/qemu/config.go
@@ -1,8 +1,11 @@
+//go:build (amd64 && !windows) || (arm64 && !windows)
// +build amd64,!windows arm64,!windows
package qemu
-import "time"
+import (
+ "time"
+)
type Provider struct{}
@@ -35,6 +38,8 @@ type MachineVM struct {
RemoteUsername string
// Whether this machine should run in a rootful or rootless manner
Rootful bool
+ // UID is the numerical id of the user that called machine
+ UID int
}
type Mount struct {
diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
index 8b567fb26..43a79dae8 100644
--- a/pkg/machine/qemu/machine.go
+++ b/pkg/machine/qemu/machine.go
@@ -88,11 +88,16 @@ func (p *Provider) NewMachine(opts machine.InitOptions) (machine.VM, error) {
vm.Memory = opts.Memory
vm.DiskSize = opts.DiskSize
- // Look up the executable
- execPath, err := exec.LookPath(QemuCommand)
+ // Find the qemu executable
+ cfg, err := config.Default()
if err != nil {
return nil, err
}
+ execPath, err := cfg.FindHelperBinary(QemuCommand, true)
+ if err != nil {
+ return nil, err
+ }
+
cmd := append([]string{execPath})
// Add memory
cmd = append(cmd, []string{"-m", strconv.Itoa(int(vm.Memory))}...)
@@ -245,12 +250,13 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
}
}
v.Mounts = mounts
+ v.UID = os.Getuid()
// Add location of bootable image
v.CmdLine = append(v.CmdLine, "-drive", "if=virtio,file="+v.ImagePath)
// This kind of stinks but no other way around this r/n
if len(opts.IgnitionPath) < 1 {
- uri := machine.SSHRemoteConnection.MakeSSHURL("localhost", "/run/user/1000/podman/podman.sock", strconv.Itoa(v.Port), v.RemoteUsername)
+ uri := machine.SSHRemoteConnection.MakeSSHURL("localhost", fmt.Sprintf("/run/user/%d/podman/podman.sock", v.UID), strconv.Itoa(v.Port), v.RemoteUsername)
uriRoot := machine.SSHRemoteConnection.MakeSSHURL("localhost", "/run/podman/podman.sock", strconv.Itoa(v.Port), "root")
identity := filepath.Join(sshDir, v.Name)
@@ -296,7 +302,16 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
// only if the virtualdisk size is less than
// the given disk size
if opts.DiskSize<<(10*3) > originalDiskSize {
- resize := exec.Command("qemu-img", []string{"resize", v.ImagePath, strconv.Itoa(int(opts.DiskSize)) + "G"}...)
+ // Find the qemu executable
+ cfg, err := config.Default()
+ if err != nil {
+ return false, err
+ }
+ resizePath, err := cfg.FindHelperBinary("qemu-img", true)
+ if err != nil {
+ return false, err
+ }
+ resize := exec.Command(resizePath, []string{"resize", v.ImagePath, strconv.Itoa(int(opts.DiskSize)) + "G"}...)
resize.Stdout = os.Stdout
resize.Stderr = os.Stderr
if err := resize.Run(); err != nil {
@@ -319,6 +334,7 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
VMName: v.Name,
TimeZone: opts.TimeZone,
WritePath: v.IgnitionFilePath,
+ UID: v.UID,
}
err = machine.NewIgnitionFile(ign)
return err == nil, err
@@ -459,7 +475,17 @@ func (v *MachineVM) Start(name string, _ machine.StartOptions) error {
for _, mount := range v.Mounts {
fmt.Printf("Mounting volume... %s:%s\n", mount.Source, mount.Target)
// create mountpoint directory if it doesn't exist
- err = v.SSH(name, machine.SSHOptions{Args: []string{"-q", "--", "sudo", "mkdir", "-p", mount.Target}})
+ // because / is immutable, we have to monkey around with permissions
+ // if we dont mount in /home or /mnt
+ args := []string{"-q", "--"}
+ if !strings.HasPrefix(mount.Target, "/home") || !strings.HasPrefix(mount.Target, "/mnt") {
+ args = append(args, "sudo", "chattr", "-i", "/", ";")
+ }
+ args = append(args, "sudo", "mkdir", "-p", mount.Target)
+ if !strings.HasPrefix(mount.Target, "/home") || !strings.HasPrefix(mount.Target, "/mnt") {
+ args = append(args, ";", "sudo", "chattr", "+i", "/", ";")
+ }
+ err = v.SSH(name, machine.SSHOptions{Args: args})
if err != nil {
return err
}
@@ -795,7 +821,16 @@ func (v *MachineVM) SSH(name string, opts machine.SSHOptions) error {
// executes qemu-image info to get the virtual disk size
// of the diskimage
func getDiskSize(path string) (uint64, error) {
- diskInfo := exec.Command("qemu-img", "info", "--output", "json", path)
+ // Find the qemu executable
+ cfg, err := config.Default()
+ if err != nil {
+ return 0, err
+ }
+ qemuPathDir, err := cfg.FindHelperBinary("qemu-img", true)
+ if err != nil {
+ return 0, err
+ }
+ diskInfo := exec.Command(qemuPathDir, "info", "--output", "json", path)
stdout, err := diskInfo.StdoutPipe()
if err != nil {
return 0, err
@@ -957,7 +992,7 @@ func (v *MachineVM) setupAPIForwarding(cmd []string) ([]string, string, apiForwa
return cmd, "", noForwarding
}
- destSock := "/run/user/1000/podman/podman.sock"
+ destSock := fmt.Sprintf("/run/user/%d/podman/podman.sock", v.UID)
forwardUser := "core"
if v.Rootful {
diff --git a/pkg/machine/qemu/options_darwin_arm64.go b/pkg/machine/qemu/options_darwin_arm64.go
index 727a275d2..5b6cdc86d 100644
--- a/pkg/machine/qemu/options_darwin_arm64.go
+++ b/pkg/machine/qemu/options_darwin_arm64.go
@@ -45,6 +45,7 @@ func getOvmfDir(imagePath, vmName string) string {
*/
func getEdk2CodeFd(name string) string {
dirs := []string{
+ "/opt/homebrew/opt/podman/libexec/share/qemu",
"/usr/local/share/qemu",
"/opt/homebrew/share/qemu",
}
diff --git a/test/e2e/build/Dockerfile.with-multiple-secret b/test/e2e/build/Containerfile.with-multiple-secret
index f3478914f..f3478914f 100644
--- a/test/e2e/build/Dockerfile.with-multiple-secret
+++ b/test/e2e/build/Containerfile.with-multiple-secret
diff --git a/test/e2e/build/Dockerfile.with-secret b/test/e2e/build/Containerfile.with-secret
index 920663a92..920663a92 100644
--- a/test/e2e/build/Dockerfile.with-secret
+++ b/test/e2e/build/Containerfile.with-secret
diff --git a/test/e2e/build/Dockerfile.test-cp-root-dir b/test/e2e/build/Dockerfile.test-cp-root-dir
deleted file mode 100644
index 9f7de7c32..000000000
--- a/test/e2e/build/Dockerfile.test-cp-root-dir
+++ /dev/null
@@ -1,2 +0,0 @@
-FROM scratch
-COPY Dockerfile.test-cp-root-dir /
diff --git a/test/e2e/build/Dockerfile.with-secret-verify-leak b/test/e2e/build/secret-verify-leak/Containerfile.with-secret-verify-leak
index 0957ac6a6..0957ac6a6 100644
--- a/test/e2e/build/Dockerfile.with-secret-verify-leak
+++ b/test/e2e/build/secret-verify-leak/Containerfile.with-secret-verify-leak
diff --git a/test/e2e/build_test.go b/test/e2e/build_test.go
index 14fa12fa2..c5903f037 100644
--- a/test/e2e/build_test.go
+++ b/test/e2e/build_test.go
@@ -60,7 +60,7 @@ var _ = Describe("Podman build", func() {
})
It("podman build with a secret from file", func() {
- session := podmanTest.Podman([]string{"build", "-f", "build/Dockerfile.with-secret", "-t", "secret-test", "--secret", "id=mysecret,src=build/secret.txt", "build/"})
+ session := podmanTest.Podman([]string{"build", "-f", "build/Containerfile.with-secret", "-t", "secret-test", "--secret", "id=mysecret,src=build/secret.txt", "build/"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
@@ -71,7 +71,7 @@ var _ = Describe("Podman build", func() {
})
It("podman build with multiple secrets from files", func() {
- session := podmanTest.Podman([]string{"build", "-f", "build/Dockerfile.with-multiple-secret", "-t", "multiple-secret-test", "--secret", "id=mysecret,src=build/secret.txt", "--secret", "id=mysecret2,src=build/anothersecret.txt", "build/"})
+ session := podmanTest.Podman([]string{"build", "-f", "build/Containerfile.with-multiple-secret", "-t", "multiple-secret-test", "--secret", "id=mysecret,src=build/secret.txt", "--secret", "id=mysecret2,src=build/anothersecret.txt", "build/"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
@@ -83,7 +83,7 @@ var _ = Describe("Podman build", func() {
})
It("podman build with a secret from file and verify if secret file is not leaked into image", func() {
- session := podmanTest.Podman([]string{"build", "-f", "build/Dockerfile.with-secret-verify-leak", "-t", "secret-test-leak", "--secret", "id=mysecret,src=build/secret.txt", "build/"})
+ session := podmanTest.Podman([]string{"build", "-f", "build/secret-verify-leak/Containerfile.with-secret-verify-leak", "-t", "secret-test-leak", "--secret", "id=mysecret,src=build/secret.txt", "build/"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go
index aa1887f84..2202cadd8 100644
--- a/test/e2e/run_networking_test.go
+++ b/test/e2e/run_networking_test.go
@@ -2,15 +2,19 @@ package integration
import (
"fmt"
+ "net"
"os"
"strings"
+ "syscall"
+ "github.com/containernetworking/plugins/pkg/ns"
. "github.com/containers/podman/v4/test/utils"
"github.com/containers/storage/pkg/stringid"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
. "github.com/onsi/gomega/gexec"
"github.com/uber/jaeger-client-go/utils"
+ "github.com/vishvananda/netlink"
)
var _ = Describe("Podman run networking", func() {
@@ -694,6 +698,157 @@ EXPOSE 2004-2005/tcp`, ALPINE)
Expect(session.OutputToString()).To(ContainSubstring("11.11.11.11"))
})
+ addAddr := func(cidr string, containerInterface netlink.Link) error {
+ _, ipnet, err := net.ParseCIDR(cidr)
+ Expect(err).To(BeNil())
+ addr := &netlink.Addr{IPNet: ipnet, Label: ""}
+ if err := netlink.AddrAdd(containerInterface, addr); err != nil && err != syscall.EEXIST {
+ return err
+ }
+ return nil
+ }
+
+ loopbackup := func() {
+ lo, err := netlink.LinkByName("lo")
+ Expect(err).To(BeNil())
+ err = netlink.LinkSetUp(lo)
+ Expect(err).To(BeNil())
+ }
+
+ linkup := func(name string, mac string, addresses []string) {
+ linkAttr := netlink.NewLinkAttrs()
+ linkAttr.Name = name
+ m, err := net.ParseMAC(mac)
+ Expect(err).To(BeNil())
+ linkAttr.HardwareAddr = net.HardwareAddr(m)
+ eth := &netlink.Dummy{LinkAttrs: linkAttr}
+ err = netlink.LinkAdd(eth)
+ Expect(err).To(BeNil())
+ err = netlink.LinkSetUp(eth)
+ Expect(err).To(BeNil())
+ for _, address := range addresses {
+ err := addAddr(address, eth)
+ Expect(err).To(BeNil())
+ }
+ }
+
+ routeAdd := func(gateway string) {
+ gw := net.ParseIP(gateway)
+ route := &netlink.Route{Dst: nil, Gw: gw}
+ netlink.RouteAdd(route)
+ }
+
+ setupNetworkNs := func(networkNSName string) {
+ ns.WithNetNSPath("/run/netns/"+networkNSName, func(_ ns.NetNS) error {
+ loopbackup()
+ linkup("eth0", "46:7f:45:6e:4f:c8", []string{"10.25.40.0/24", "fd04:3e42:4a4e:3381::/64"})
+ linkup("eth1", "56:6e:35:5d:3e:a8", []string{"10.88.0.0/16"})
+
+ routeAdd("10.25.40.0")
+ return nil
+ })
+ }
+
+ checkNetworkNsInspect := func(name string) {
+ inspectOut := podmanTest.InspectContainer(name)
+ Expect(inspectOut[0].NetworkSettings.IPAddress).To(Equal("10.25.40.0"))
+ Expect(inspectOut[0].NetworkSettings.IPPrefixLen).To(Equal(24))
+ Expect(len(inspectOut[0].NetworkSettings.SecondaryIPAddresses)).To(Equal(1))
+ Expect(inspectOut[0].NetworkSettings.SecondaryIPAddresses[0].Addr).To(Equal("10.88.0.0"))
+ Expect(inspectOut[0].NetworkSettings.SecondaryIPAddresses[0].PrefixLength).To(Equal(16))
+ Expect(inspectOut[0].NetworkSettings.GlobalIPv6Address).To(Equal("fd04:3e42:4a4e:3381::"))
+ Expect(inspectOut[0].NetworkSettings.GlobalIPv6PrefixLen).To(Equal(64))
+ Expect(len(inspectOut[0].NetworkSettings.SecondaryIPv6Addresses)).To(Equal(0))
+ Expect(inspectOut[0].NetworkSettings.MacAddress).To(Equal("46:7f:45:6e:4f:c8"))
+ Expect(len(inspectOut[0].NetworkSettings.AdditionalMacAddresses)).To(Equal(1))
+ Expect(inspectOut[0].NetworkSettings.AdditionalMacAddresses[0]).To(Equal("56:6e:35:5d:3e:a8"))
+ Expect(inspectOut[0].NetworkSettings.Gateway).To(Equal("10.25.40.0"))
+
+ }
+
+ It("podman run newtork inspect fails gracefully on non-reachable network ns", func() {
+ SkipIfRootless("ip netns is not supported for rootless users")
+
+ networkNSName := RandomString(12)
+ addNamedNetwork := SystemExec("ip", []string{"netns", "add", networkNSName})
+ Expect(addNamedNetwork).Should(Exit(0))
+
+ setupNetworkNs(networkNSName)
+
+ name := RandomString(12)
+ session := podmanTest.Podman([]string{"run", "-d", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE, "top"})
+ session.WaitWithDefaultTimeout()
+
+ // delete the named network ns before inspect
+ delNetworkNamespace := SystemExec("ip", []string{"netns", "delete", networkNSName})
+ Expect(delNetworkNamespace).Should(Exit(0))
+
+ inspectOut := podmanTest.InspectContainer(name)
+ Expect(inspectOut[0].NetworkSettings.IPAddress).To(Equal(""))
+ Expect(len(inspectOut[0].NetworkSettings.Networks)).To(Equal(0))
+ })
+
+ It("podman inspect can handle joined network ns with multiple interfaces", func() {
+ SkipIfRootless("ip netns is not supported for rootless users")
+
+ networkNSName := RandomString(12)
+ addNamedNetwork := SystemExec("ip", []string{"netns", "add", networkNSName})
+ Expect(addNamedNetwork).Should(Exit(0))
+ defer func() {
+ delNetworkNamespace := SystemExec("ip", []string{"netns", "delete", networkNSName})
+ Expect(delNetworkNamespace).Should(Exit(0))
+ }()
+ setupNetworkNs(networkNSName)
+
+ name := RandomString(12)
+ session := podmanTest.Podman([]string{"run", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE})
+ session.WaitWithDefaultTimeout()
+
+ session = podmanTest.Podman([]string{"container", "rm", name})
+ session.WaitWithDefaultTimeout()
+
+ // no network teardown should touch joined network ns interfaces
+ session = podmanTest.Podman([]string{"run", "-d", "--replace", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE, "top"})
+ session.WaitWithDefaultTimeout()
+
+ checkNetworkNsInspect(name)
+ })
+
+ It("podman do not tamper with joined network ns interfaces", func() {
+ SkipIfRootless("ip netns is not supported for rootless users")
+
+ networkNSName := RandomString(12)
+ addNamedNetwork := SystemExec("ip", []string{"netns", "add", networkNSName})
+ Expect(addNamedNetwork).Should(Exit(0))
+ defer func() {
+ delNetworkNamespace := SystemExec("ip", []string{"netns", "delete", networkNSName})
+ Expect(delNetworkNamespace).Should(Exit(0))
+ }()
+
+ setupNetworkNs(networkNSName)
+
+ name := RandomString(12)
+ session := podmanTest.Podman([]string{"run", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE})
+ session.WaitWithDefaultTimeout()
+
+ checkNetworkNsInspect(name)
+
+ name = RandomString(12)
+ session = podmanTest.Podman([]string{"run", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE})
+ session.WaitWithDefaultTimeout()
+
+ checkNetworkNsInspect(name)
+
+ // delete container, the network inspect should not change
+ session = podmanTest.Podman([]string{"container", "rm", name})
+ session.WaitWithDefaultTimeout()
+
+ session = podmanTest.Podman([]string{"run", "-d", "--replace", "--name", name, "--net", "ns:/run/netns/" + networkNSName, ALPINE, "top"})
+ session.WaitWithDefaultTimeout()
+
+ checkNetworkNsInspect(name)
+ })
+
It("podman run network in bogus user created network namespace", func() {
session := podmanTest.Podman([]string{"run", "-dt", "--net", "ns:/run/netns/xxy", ALPINE, "wget", "www.podman.io"})
session.Wait(90)
diff --git a/test/e2e/system_service_test.go b/test/e2e/system_service_test.go
index dcf5e03b2..2bc7756d6 100644
--- a/test/e2e/system_service_test.go
+++ b/test/e2e/system_service_test.go
@@ -58,6 +58,7 @@ var _ = Describe("podman system service", func() {
const magicComment = "pprof service listening on"
It("are available", func() {
+ Skip("FIXME: Test is too flaky (#12624)")
SkipIfRemote("service subcommand not supported remotely")
address := url.URL{
@@ -97,6 +98,7 @@ var _ = Describe("podman system service", func() {
})
It("are not available", func() {
+ Skip("FIXME: Test is too flaky (#12624)")
SkipIfRemote("service subcommand not supported remotely")
address := url.URL{
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-15 03:33:58 +0000