2 files changed, 62 insertions, 12 deletions
diff --git a/cmd/podman/shared/container.go b/cmd/podman/shared/container.go
index f49943477..4f2002992 100644
--- a/cmd/podman/shared/container.go
+++ b/cmd/podman/shared/container.go
@@ -17,6 +17,7 @@ import (
 	"github.com/containers/libpod/libpod"
 	"github.com/containers/libpod/libpod/define"
 	"github.com/containers/libpod/libpod/image"
+	"github.com/containers/libpod/pkg/timetype"
 	"github.com/containers/libpod/pkg/util"
 	"github.com/cri-o/ocicni/pkg/ocicni"
 	"github.com/docker/go-units"
@@ -195,6 +196,8 @@ func NewBatchContainer(ctr *libpod.Container, opts PsOptions) (PsContainerOutput
 		status = "Paused"
 	case define.ContainerStateCreated.String(), define.ContainerStateConfigured.String():
 		status = "Created"
+	case define.ContainerStateRemoving.String():
+		status = "Removing"
 	default:
 		status = "Error"
 	}
@@ -272,7 +275,8 @@ func worker(wg *sync.WaitGroup, jobs <-chan workerInput, results chan<- PsContai
 	}
 }
 
-func generateContainerFilterFuncs(filter, filterValue string, r *libpod.Runtime) (func(container *libpod.Container) bool, error) {
+// GenerateContainerFilterFuncs return ContainerFilter functions based of filter.
+func GenerateContainerFilterFuncs(filter, filterValue string, r *libpod.Runtime) (func(container *libpod.Container) bool, error) {
 	switch filter {
 	case "id":
 		return func(c *libpod.Container) bool {
@@ -394,6 +398,22 @@ func generateContainerFilterFuncs(filter, filterValue string, r *libpod.Runtime)
 			}
 			return hcStatus == filterValue
 		}, nil
+	case "until":
+		ts, err := timetype.GetTimestamp(filterValue, time.Now())
+		if err != nil {
+			return nil, err
+		}
+		seconds, nanoseconds, err := timetype.ParseTimestamps(ts, 0)
+		if err != nil {
+			return nil, err
+		}
+		until := time.Unix(seconds, nanoseconds)
+		return func(c *libpod.Container) bool {
+			if !until.IsZero() && c.CreatedTime().After((until)) {
+				return true
+			}
+			return false
+		}, nil
 	}
 	return nil, errors.Errorf("%s is an invalid filter", filter)
 }
@@ -411,7 +431,7 @@ func GetPsContainerOutput(r *libpod.Runtime, opts PsOptions, filters []string, m
 			if len(filterSplit) < 2 {
 				return nil, errors.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 			}
-			generatedFunc, err := generateContainerFilterFuncs(filterSplit[0], filterSplit[1], r)
+			generatedFunc, err := GenerateContainerFilterFuncs(filterSplit[0], filterSplit[1], r)
 			if err != nil {
 				return nil, errors.Wrapf(err, "invalid filter")
 			}
diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go
index 2fcec6deb..bb4e9cd12 100644
--- a/cmd/podman/shared/create.go
+++ b/cmd/podman/shared/create.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	goruntime "runtime"
 	"strconv"
 	"strings"
 	"syscall"
@@ -88,9 +89,11 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 			return nil, nil, err
 		}
 
+		overrideOS := c.String("override-os")
+		overrideArch := c.String("override-arch")
 		dockerRegistryOptions := image.DockerRegistryOptions{
-			OSChoice:           c.String("override-os"),
-			ArchitectureChoice: c.String("override-arch"),
+			OSChoice:           overrideOS,
+			ArchitectureChoice: overrideArch,
 		}
 
 		newImage, err := runtime.ImageRuntime().New(ctx, name, rtc.SignaturePolicyPath, c.String("authfile"), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType)
@@ -101,6 +104,15 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 		if err != nil {
 			return nil, nil, err
 		}
+
+		if overrideOS == "" && data.Os != goruntime.GOOS {
+			return nil, nil, errors.Errorf("incompatible image OS %q on %q host", data.Os, goruntime.GOOS)
+		}
+
+		if overrideArch == "" && data.Architecture != goruntime.GOARCH {
+			return nil, nil, errors.Errorf("incompatible image architecture %q on %q host", data.Architecture, goruntime.GOARCH)
+		}
+
 		names := newImage.Names()
 		if len(names) > 0 {
 			imageName = names[0]
@@ -214,24 +226,24 @@ func configureEntrypoint(c *GenericCLIResults, data *inspect.ImageData) []string
 	return entrypoint
 }
 
-func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[string]string, podName string) (map[string]string, error) {
+func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[string]string, podName string) (map[string]string, string, error) {
 	pod, err := runtime.LookupPod(podName)
 	if err != nil {
-		return namespaces, err
+		return namespaces, "", err
 	}
 	podInfraID, err := pod.InfraContainerID()
 	if err != nil {
-		return namespaces, err
+		return namespaces, "", err
 	}
 	hasUserns := false
 	if podInfraID != "" {
 		podCtr, err := runtime.GetContainer(podInfraID)
 		if err != nil {
-			return namespaces, err
+			return namespaces, "", err
 		}
 		mappings, err := podCtr.IDMappings()
 		if err != nil {
-			return namespaces, err
+			return namespaces, "", err
 		}
 		hasUserns = len(mappings.UIDMap) > 0
 	}
@@ -251,7 +263,7 @@ func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[
 	if (namespaces["uts"] == cc.Pod) || (!c.IsSet("uts") && pod.SharesUTS()) {
 		namespaces["uts"] = fmt.Sprintf("container:%s", podInfraID)
 	}
-	return namespaces, nil
+	return namespaces, podInfraID, nil
 }
 
 // Parses CLI options related to container creation into a config which can be
@@ -359,6 +371,10 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 	if len(podName) < 1 && c.IsSet("pod") {
 		return nil, errors.Errorf("new pod name must be at least one character")
 	}
+
+	// If we are adding a container to a pod, we would like to add an annotation for the infra ID
+	// so kata containers can share VMs inside the pod
+	var podInfraID string
 	if c.IsSet("pod") {
 		if strings.HasPrefix(originalPodName, "new:") {
 			// pod does not exist; lets make it
@@ -387,7 +403,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 			// The container now cannot have port bindings; so we reset the map
 			portBindings = make(map[nat.Port][]nat.PortBinding)
 		}
-		namespaces, err = configurePod(c, runtime, namespaces, podName)
+		namespaces, podInfraID, err = configurePod(c, runtime, namespaces, podName)
 		if err != nil {
 			return nil, err
 		}
@@ -485,12 +501,26 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 
 	// ANNOTATIONS
 	annotations := make(map[string]string)
+
 	// First, add our default annotations
-	annotations[ann.ContainerType] = "sandbox"
 	annotations[ann.TTY] = "false"
 	if tty {
 		annotations[ann.TTY] = "true"
 	}
+
+	// in the event this container is in a pod, and the pod has an infra container
+	// we will want to configure it as a type "container" instead defaulting to
+	// the behavior of a "sandbox" container
+	// In Kata containers:
+	// - "sandbox" is the annotation that denotes the container should use its own
+	//   VM, which is the default behavior
+	// - "container" denotes the container should join the VM of the SandboxID
+	//   (the infra container)
+	if podInfraID != "" {
+		annotations[ann.SandboxID] = podInfraID
+		annotations[ann.ContainerType] = ann.ContainerTypeContainer
+	}
+
 	if data != nil {
 		// Next, add annotations from the image
 		for key, value := range data.Annotations {