summaryrefslogtreecommitdiff
path: root/cmd
diff options
context:
space:
mode:
Diffstat (limited to 'cmd')
-rw-r--r--cmd/podman/common/create_opts.go13
-rw-r--r--cmd/podman/containers/rm.go9
-rw-r--r--cmd/podman/containers/stats.go12
-rw-r--r--cmd/podman/diff/diff.go2
-rw-r--r--cmd/podman/images/buildx.go11
-rw-r--r--cmd/podman/images/prune.go5
-rw-r--r--cmd/podman/images/search.go30
-rw-r--r--cmd/podman/machine/list.go2
-rw-r--r--cmd/podman/networks/network.go2
-rw-r--r--cmd/podman/networks/rm.go11
-rw-r--r--cmd/podman/play/kube.go10
-rw-r--r--cmd/podman/pods/create.go2
-rw-r--r--cmd/podman/pods/rm.go13
-rw-r--r--cmd/podman/registry/remote.go8
-rw-r--r--cmd/podman/root.go2
-rw-r--r--cmd/podman/system/connection/list.go8
-rw-r--r--cmd/podman/system/dial_stdio.go145
-rw-r--r--cmd/podman/system/service.go43
-rw-r--r--cmd/podman/system/service_abi.go61
-rw-r--r--cmd/podman/volumes/rm.go13
-rw-r--r--cmd/podman/volumes/volume.go2
-rw-r--r--cmd/rootlessport/main.go353
22 files changed, 677 insertions, 80 deletions
diff --git a/cmd/podman/common/create_opts.go b/cmd/podman/common/create_opts.go
index 09ac61f2e..50d7c446d 100644
--- a/cmd/podman/common/create_opts.go
+++ b/cmd/podman/common/create_opts.go
@@ -104,15 +104,18 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
addField(&builder, "target", m.Target)
addField(&builder, "ro", strconv.FormatBool(m.ReadOnly))
addField(&builder, "consistency", string(m.Consistency))
-
// Map any specialized mount options that intersect between *Options and cli options
switch m.Type {
case mount.TypeBind:
- addField(&builder, "bind-propagation", string(m.BindOptions.Propagation))
- addField(&builder, "bind-nonrecursive", strconv.FormatBool(m.BindOptions.NonRecursive))
+ if m.BindOptions != nil {
+ addField(&builder, "bind-propagation", string(m.BindOptions.Propagation))
+ addField(&builder, "bind-nonrecursive", strconv.FormatBool(m.BindOptions.NonRecursive))
+ }
case mount.TypeTmpfs:
- addField(&builder, "tmpfs-size", strconv.FormatInt(m.TmpfsOptions.SizeBytes, 10))
- addField(&builder, "tmpfs-mode", strconv.FormatUint(uint64(m.TmpfsOptions.Mode), 10))
+ if m.TmpfsOptions != nil {
+ addField(&builder, "tmpfs-size", strconv.FormatInt(m.TmpfsOptions.SizeBytes, 10))
+ addField(&builder, "tmpfs-mode", strconv.FormatUint(uint64(m.TmpfsOptions.Mode), 10))
+ }
case mount.TypeVolume:
// All current VolumeOpts are handled above
// See vendor/github.com/containers/common/pkg/parse/parse.go:ValidateVolumeOpts()
diff --git a/cmd/podman/containers/rm.go b/cmd/podman/containers/rm.go
index abab71a79..70cb76693 100644
--- a/cmd/podman/containers/rm.go
+++ b/cmd/podman/containers/rm.go
@@ -62,6 +62,9 @@ func rmFlags(cmd *cobra.Command) {
flags.BoolVarP(&rmOptions.All, "all", "a", false, "Remove all containers")
flags.BoolVarP(&rmOptions.Ignore, "ignore", "i", false, "Ignore errors when a specified container is missing")
flags.BoolVarP(&rmOptions.Force, "force", "f", false, "Force removal of a running or unusable container. The default is false")
+ timeFlagName := "time"
+ flags.UintVarP(&stopTimeout, timeFlagName, "t", containerConfig.Engine.StopTimeout, "Seconds to wait for stop before killing the container")
+ _ = cmd.RegisterFlagCompletionFunc(timeFlagName, completion.AutocompleteNone)
flags.BoolVarP(&rmOptions.Volumes, "volumes", "v", false, "Remove anonymous volumes associated with the container")
cidfileFlagName := "cidfile"
@@ -91,6 +94,12 @@ func init() {
}
func rm(cmd *cobra.Command, args []string) error {
+ if cmd.Flag("time").Changed {
+ if !rmOptions.Force {
+ return errors.New("--force option must be specified to use the --time option")
+ }
+ rmOptions.Timeout = &stopTimeout
+ }
for _, cidFile := range cidFiles {
content, err := ioutil.ReadFile(string(cidFile))
if err != nil {
diff --git a/cmd/podman/containers/stats.go b/cmd/podman/containers/stats.go
index 11e8f6870..d21feaabc 100644
--- a/cmd/podman/containers/stats.go
+++ b/cmd/podman/containers/stats.go
@@ -11,9 +11,7 @@ import (
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/validate"
"github.com/containers/podman/v3/libpod/define"
- "github.com/containers/podman/v3/pkg/cgroups"
"github.com/containers/podman/v3/pkg/domain/entities"
- "github.com/containers/podman/v3/pkg/rootless"
"github.com/containers/podman/v3/utils"
"github.com/docker/go-units"
"github.com/pkg/errors"
@@ -113,16 +111,6 @@ func checkStatOptions(cmd *cobra.Command, args []string) error {
}
func stats(cmd *cobra.Command, args []string) error {
- if rootless.IsRootless() {
- unified, err := cgroups.IsCgroup2UnifiedMode()
- if err != nil {
- return err
- }
- if !unified {
- return errors.New("stats is not supported in rootless mode without cgroups v2")
- }
- }
-
// Convert to the entities options. We should not leak CLI-only
// options into the backend and separate concerns.
opts := entities.ContainerStatsOptions{
diff --git a/cmd/podman/diff/diff.go b/cmd/podman/diff/diff.go
index 81bbb6c43..fba4ea540 100644
--- a/cmd/podman/diff/diff.go
+++ b/cmd/podman/diff/diff.go
@@ -8,7 +8,7 @@ import (
"github.com/containers/common/pkg/report"
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/pkg/domain/entities"
- "github.com/docker/docker/pkg/archive"
+ "github.com/containers/storage/pkg/archive"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)
diff --git a/cmd/podman/images/buildx.go b/cmd/podman/images/buildx.go
index 5c8e5aaa0..2577a3a74 100644
--- a/cmd/podman/images/buildx.go
+++ b/cmd/podman/images/buildx.go
@@ -14,11 +14,12 @@ var (
// If we are adding new buildx features, we will add them by default
// to podman build.
buildxCmd = &cobra.Command{
- Use: "buildx",
- Short: "Build images",
- Long: "Build images",
- RunE: validate.SubCommandExists,
- Hidden: true,
+ Use: "buildx",
+ Aliases: []string{"builder"},
+ Short: "Build images",
+ Long: "Build images",
+ RunE: validate.SubCommandExists,
+ Hidden: true,
}
)
diff --git a/cmd/podman/images/prune.go b/cmd/podman/images/prune.go
index 6c39e5c69..fc7451c41 100644
--- a/cmd/podman/images/prune.go
+++ b/cmd/podman/images/prune.go
@@ -36,6 +36,11 @@ var (
func init() {
registry.Commands = append(registry.Commands, registry.CliCommand{
Command: pruneCmd,
+ Parent: buildxCmd,
+ })
+
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Command: pruneCmd,
Parent: imageCmd,
})
diff --git a/cmd/podman/images/search.go b/cmd/podman/images/search.go
index 11e54578a..c9a4793aa 100644
--- a/cmd/podman/images/search.go
+++ b/cmd/podman/images/search.go
@@ -3,6 +3,7 @@ package images
import (
"fmt"
"os"
+ "strings"
"github.com/containers/common/pkg/auth"
"github.com/containers/common/pkg/completion"
@@ -19,6 +20,7 @@ import (
type searchOptionsWrapper struct {
entities.ImageSearchOptions
// CLI only flags
+ Compatible bool // Docker compat
TLSVerifyCLI bool // Used to convert to an optional bool later
Format string // For go templating
}
@@ -79,7 +81,7 @@ func searchFlags(cmd *cobra.Command) {
filterFlagName := "filter"
flags.StringSliceVarP(&searchOptions.Filters, filterFlagName, "f", []string{}, "Filter output based on conditions provided (default [])")
- //TODO add custom filter function
+ // TODO add custom filter function
_ = cmd.RegisterFlagCompletionFunc(filterFlagName, completion.AutocompleteNone)
formatFlagName := "format"
@@ -90,7 +92,8 @@ func searchFlags(cmd *cobra.Command) {
flags.IntVar(&searchOptions.Limit, limitFlagName, 0, "Limit the number of results")
_ = cmd.RegisterFlagCompletionFunc(limitFlagName, completion.AutocompleteNone)
- flags.BoolVar(&searchOptions.NoTrunc, "no-trunc", false, "Do not truncate the output")
+ flags.Bool("no-trunc", true, "Do not truncate the output. Default: true")
+ flags.BoolVar(&searchOptions.Compatible, "compatible", false, "List stars, official and automated columns (Docker compatibility)")
authfileFlagName := "authfile"
flags.StringVar(&searchOptions.Authfile, authfileFlagName, auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
@@ -132,11 +135,20 @@ func imageSearch(cmd *cobra.Command, args []string) error {
if err != nil {
return err
}
-
if len(searchReport) == 0 {
return nil
}
+ noTrunc, _ := cmd.Flags().GetBool("no-trunc")
+ isJSON := report.IsJSON(searchOptions.Format)
+ for i, element := range searchReport {
+ d := strings.ReplaceAll(element.Description, "\n", " ")
+ if len(d) > 44 && !(noTrunc || isJSON) {
+ d = strings.TrimSpace(d[:44]) + "..."
+ }
+ searchReport[i].Description = d
+ }
+
hdrs := report.Headers(entities.ImageSearchReport{}, nil)
renderHeaders := true
var row string
@@ -145,18 +157,22 @@ func imageSearch(cmd *cobra.Command, args []string) error {
if len(searchOptions.Filters) != 0 {
return errors.Errorf("filters are not applicable to list tags result")
}
- if report.IsJSON(searchOptions.Format) {
+ if isJSON {
listTagsEntries := buildListTagsJSON(searchReport)
return printArbitraryJSON(listTagsEntries)
}
row = "{{.Name}}\t{{.Tag}}\n"
- case report.IsJSON(searchOptions.Format):
+ case isJSON:
return printArbitraryJSON(searchReport)
case cmd.Flags().Changed("format"):
renderHeaders = report.HasTable(searchOptions.Format)
row = report.NormalizeFormat(searchOptions.Format)
default:
- row = "{{.Index}}\t{{.Name}}\t{{.Description}}\t{{.Stars}}\t{{.Official}}\t{{.Automated}}\n"
+ row = "{{.Name}}\t{{.Description}}"
+ if searchOptions.Compatible {
+ row += "\t{{.Stars}}\t{{.Official}}\t{{.Automated}}"
+ }
+ row += "\n"
}
format := report.EnforceRange(row)
@@ -190,7 +206,7 @@ func printArbitraryJSON(v interface{}) error {
}
func buildListTagsJSON(searchReport []entities.ImageSearchReport) []listEntryTag {
- entries := []listEntryTag{}
+ entries := make([]listEntryTag, 0)
ReportLoop:
for _, report := range searchReport {
diff --git a/cmd/podman/machine/list.go b/cmd/podman/machine/list.go
index 95b7d860f..7e5459e08 100644
--- a/cmd/podman/machine/list.go
+++ b/cmd/podman/machine/list.go
@@ -188,11 +188,13 @@ func toHumanFormat(vms []*machine.ListResponse) ([]*machineReporter, error) {
response := new(machineReporter)
if vm.Name == cfg.Engine.ActiveService {
response.Name = vm.Name + "*"
+ response.Default = true
} else {
response.Name = vm.Name
}
if vm.Running {
response.LastUp = "Currently running"
+ response.Running = true
} else {
response.LastUp = units.HumanDuration(time.Since(vm.LastUp)) + " ago"
}
diff --git a/cmd/podman/networks/network.go b/cmd/podman/networks/network.go
index ec045e3cf..1070e7e82 100644
--- a/cmd/podman/networks/network.go
+++ b/cmd/podman/networks/network.go
@@ -3,6 +3,7 @@ package network
import (
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/validate"
+ "github.com/containers/podman/v3/pkg/util"
"github.com/spf13/cobra"
)
@@ -17,6 +18,7 @@ var (
Long: "Manage networks",
RunE: validate.SubCommandExists,
}
+ containerConfig = util.DefaultContainerConfig()
)
func init() {
diff --git a/cmd/podman/networks/rm.go b/cmd/podman/networks/rm.go
index 14f9869e4..5efd02933 100644
--- a/cmd/podman/networks/rm.go
+++ b/cmd/podman/networks/rm.go
@@ -4,6 +4,7 @@ import (
"fmt"
"strings"
+ "github.com/containers/common/pkg/completion"
"github.com/containers/podman/v3/cmd/podman/common"
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/utils"
@@ -26,6 +27,7 @@ var (
Args: cobra.MinimumNArgs(1),
ValidArgsFunction: common.AutocompleteNetworks,
}
+ stopTimeout uint
)
var (
@@ -34,6 +36,9 @@ var (
func networkRmFlags(flags *pflag.FlagSet) {
flags.BoolVarP(&networkRmOptions.Force, "force", "f", false, "remove any containers using network")
+ timeFlagName := "time"
+ flags.UintVarP(&stopTimeout, timeFlagName, "t", containerConfig.Engine.StopTimeout, "Seconds to wait for running containers to stop before killing the container")
+ _ = networkrmCommand.RegisterFlagCompletionFunc(timeFlagName, completion.AutocompleteNone)
}
func init() {
@@ -50,6 +55,12 @@ func networkRm(cmd *cobra.Command, args []string) error {
errs utils.OutputErrors
)
+ if cmd.Flag("time").Changed {
+ if !networkRmOptions.Force {
+ return errors.New("--force option must be specified to use the --time option")
+ }
+ networkRmOptions.Timeout = &stopTimeout
+ }
responses, err := registry.ContainerEngine().NetworkRm(registry.Context(), args, networkRmOptions)
if err != nil {
setExitCode(err)
diff --git a/cmd/podman/play/kube.go b/cmd/podman/play/kube.go
index 85e0c279c..e6869efd3 100644
--- a/cmd/podman/play/kube.go
+++ b/cmd/podman/play/kube.go
@@ -11,7 +11,9 @@ import (
"github.com/containers/podman/v3/cmd/podman/common"
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/utils"
+ "github.com/containers/podman/v3/libpod/define"
"github.com/containers/podman/v3/pkg/domain/entities"
+ "github.com/containers/podman/v3/pkg/errorhandling"
"github.com/containers/podman/v3/pkg/util"
"github.com/pkg/errors"
"github.com/spf13/cobra"
@@ -90,6 +92,9 @@ func init() {
downFlagName := "down"
flags.BoolVar(&kubeOptions.Down, downFlagName, false, "Stop pods defined in the YAML file")
+ replaceFlagName := "replace"
+ flags.BoolVar(&kubeOptions.Replace, replaceFlagName, false, "Delete and recreate pods defined in the YAML file")
+
if !registry.IsRemote() {
certDirFlagName := "cert-dir"
flags.StringVar(&kubeOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
@@ -151,6 +156,11 @@ func kube(cmd *cobra.Command, args []string) error {
if kubeOptions.Down {
return teardown(yamlfile)
}
+ if kubeOptions.Replace {
+ if err := teardown(yamlfile); err != nil && !errorhandling.Contains(err, define.ErrNoSuchPod) {
+ return err
+ }
+ }
return playkube(yamlfile)
}
diff --git a/cmd/podman/pods/create.go b/cmd/podman/pods/create.go
index d5aaf09ce..7c2c72171 100644
--- a/cmd/podman/pods/create.go
+++ b/cmd/podman/pods/create.go
@@ -132,7 +132,7 @@ func create(cmd *cobra.Command, args []string) error {
}
createOptions.Share = nil
} else {
- // reassign certain optios for lbpod api, these need to be populated in spec
+ // reassign certain options for lbpod api, these need to be populated in spec
flags := cmd.Flags()
infraOptions.Net, err = common.NetFlagsToNetOptions(nil, *flags, false)
if err != nil {
diff --git a/cmd/podman/pods/rm.go b/cmd/podman/pods/rm.go
index dc4c7eb83..d8a09d774 100644
--- a/cmd/podman/pods/rm.go
+++ b/cmd/podman/pods/rm.go
@@ -42,6 +42,7 @@ var (
podman pod rm -f 860a4b23
podman pod rm -f -a`,
}
+ stopTimeout uint
)
func init() {
@@ -59,6 +60,10 @@ func init() {
flags.StringArrayVarP(&rmOptions.PodIDFiles, podIDFileFlagName, "", nil, "Read the pod ID from the file")
_ = rmCommand.RegisterFlagCompletionFunc(podIDFileFlagName, completion.AutocompleteDefault)
+ timeFlagName := "time"
+ flags.UintVarP(&stopTimeout, timeFlagName, "t", containerConfig.Engine.StopTimeout, "Seconds to wait for pod stop before killing the container")
+ _ = rmCommand.RegisterFlagCompletionFunc(timeFlagName, completion.AutocompleteNone)
+
validate.AddLatestFlag(rmCommand, &rmOptions.Latest)
if registry.IsRemote() {
@@ -66,12 +71,18 @@ func init() {
}
}
-func rm(_ *cobra.Command, args []string) error {
+func rm(cmd *cobra.Command, args []string) error {
ids, err := specgenutil.ReadPodIDFiles(rmOptions.PodIDFiles)
if err != nil {
return err
}
args = append(args, ids...)
+ if cmd.Flag("time").Changed {
+ if !rmOptions.Force {
+ return errors.New("--force option must be specified to use the --time option")
+ }
+ rmOptions.Timeout = &stopTimeout
+ }
return removePods(args, rmOptions.PodRmOptions, true)
}
diff --git a/cmd/podman/registry/remote.go b/cmd/podman/registry/remote.go
index b5da98bd4..c78930574 100644
--- a/cmd/podman/registry/remote.go
+++ b/cmd/podman/registry/remote.go
@@ -19,11 +19,17 @@ var remoteFromCLI = struct {
// Use in init() functions as an initialization check
func IsRemote() bool {
remoteFromCLI.sync.Do(func() {
+ remote := false
+ if _, ok := os.LookupEnv("CONTAINER_HOST"); ok {
+ remote = true
+ } else if _, ok := os.LookupEnv("CONTAINER_CONNECTION"); ok {
+ remote = true
+ }
fs := pflag.NewFlagSet("remote", pflag.ContinueOnError)
fs.ParseErrorsWhitelist.UnknownFlags = true
fs.Usage = func() {}
fs.SetInterspersed(false)
- fs.BoolVarP(&remoteFromCLI.Value, "remote", "r", false, "")
+ fs.BoolVarP(&remoteFromCLI.Value, "remote", "r", remote, "")
// The shell completion logic will call a command called "__complete" or "__completeNoDesc"
// This command will always be the second argument
diff --git a/cmd/podman/root.go b/cmd/podman/root.go
index eb30f1ef6..6da34050e 100644
--- a/cmd/podman/root.go
+++ b/cmd/podman/root.go
@@ -314,7 +314,7 @@ func rootFlags(cmd *cobra.Command, opts *entities.PodmanConfig) {
lFlags.StringVar(&opts.Identity, identityFlagName, ident, "path to SSH identity file, (CONTAINER_SSHKEY)")
_ = cmd.RegisterFlagCompletionFunc(identityFlagName, completion.AutocompleteDefault)
- lFlags.BoolVarP(&opts.Remote, "remote", "r", false, "Access remote Podman service (default false)")
+ lFlags.BoolVarP(&opts.Remote, "remote", "r", registry.IsRemote(), "Access remote Podman service")
pFlags := cmd.PersistentFlags()
if registry.IsRemote() {
if err := lFlags.MarkHidden("remote"); err != nil {
diff --git a/cmd/podman/system/connection/list.go b/cmd/podman/system/connection/list.go
index de85ce3fa..a3290e3d6 100644
--- a/cmd/podman/system/connection/list.go
+++ b/cmd/podman/system/connection/list.go
@@ -44,6 +44,7 @@ func init() {
type namedDestination struct {
Name string
config.Destination
+ Default bool
}
func list(cmd *cobra.Command, _ []string) error {
@@ -60,12 +61,14 @@ func list(cmd *cobra.Command, _ []string) error {
"Identity": "Identity",
"Name": "Name",
"URI": "URI",
+ "Default": "Default",
}}
rows := make([]namedDestination, 0)
for k, v := range cfg.Engine.ServiceDestinations {
+ def := false
if k == cfg.Engine.ActiveService {
- k += "*"
+ def = true
}
r := namedDestination{
@@ -74,6 +77,7 @@ func list(cmd *cobra.Command, _ []string) error {
Identity: v.Identity,
URI: v.URI,
},
+ Default: def,
}
rows = append(rows, r)
}
@@ -82,7 +86,7 @@ func list(cmd *cobra.Command, _ []string) error {
return rows[i].Name < rows[j].Name
})
- format := "{{.Name}}\t{{.Identity}}\t{{.URI}}\n"
+ format := "{{.Name}}\t{{.URI}}\t{{.Identity}}\t{{.Default}}\n"
switch {
case report.IsJSON(cmd.Flag("format").Value.String()):
buf, err := registry.JSONLibrary().MarshalIndent(rows, "", " ")
diff --git a/cmd/podman/system/dial_stdio.go b/cmd/podman/system/dial_stdio.go
new file mode 100644
index 000000000..eae89f38e
--- /dev/null
+++ b/cmd/podman/system/dial_stdio.go
@@ -0,0 +1,145 @@
+package system
+
+import (
+ "context"
+ "io"
+ "os"
+
+ "github.com/containers/podman/v3/cmd/podman/registry"
+ "github.com/containers/podman/v3/cmd/podman/validate"
+ "github.com/containers/podman/v3/pkg/bindings"
+ "github.com/pkg/errors"
+ "github.com/sirupsen/logrus"
+ "github.com/spf13/cobra"
+)
+
+var (
+ dialStdioCommand = &cobra.Command{
+ Use: "dial-stdio",
+ Short: "Proxy the stdio stream to the daemon connection. Should not be invoked manually.",
+ Args: validate.NoArgs,
+ Hidden: true,
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return runDialStdio()
+ },
+ Example: "podman system dial-stdio",
+ }
+)
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Command: dialStdioCommand,
+ Parent: systemCmd,
+ })
+}
+
+func runDialStdio() error {
+ ctx := registry.Context()
+ cfg := registry.PodmanConfig()
+ ctx, cancel := context.WithCancel(ctx)
+ defer cancel()
+ bindCtx, err := bindings.NewConnection(ctx, cfg.URI)
+ if err != nil {
+ return errors.Wrap(err, "failed to open connection to podman")
+ }
+ conn, err := bindings.GetClient(bindCtx)
+ if err != nil {
+ return errors.Wrap(err, "failed to get connection after initialization")
+ }
+ netConn, err := conn.GetDialer(bindCtx)
+ if err != nil {
+ return errors.Wrap(err, "failed to open the raw stream connection")
+ }
+ defer netConn.Close()
+
+ var connHalfCloser halfCloser
+ switch t := netConn.(type) {
+ case halfCloser:
+ connHalfCloser = t
+ case halfReadWriteCloser:
+ connHalfCloser = &nopCloseReader{t}
+ default:
+ return errors.New("the raw stream connection does not implement halfCloser")
+ }
+
+ stdin2conn := make(chan error, 1)
+ conn2stdout := make(chan error, 1)
+ go func() {
+ stdin2conn <- copier(connHalfCloser, &halfReadCloserWrapper{os.Stdin}, "stdin to stream")
+ }()
+ go func() {
+ conn2stdout <- copier(&halfWriteCloserWrapper{os.Stdout}, connHalfCloser, "stream to stdout")
+ }()
+ select {
+ case err = <-stdin2conn:
+ if err != nil {
+ return err
+ }
+ // wait for stdout
+ err = <-conn2stdout
+ case err = <-conn2stdout:
+ // return immediately
+ }
+ return err
+}
+
+// Below portion taken from original docker CLI
+// https://github.com/docker/cli/blob/v20.10.9/cli/command/system/dial_stdio.go
+func copier(to halfWriteCloser, from halfReadCloser, debugDescription string) error {
+ defer func() {
+ if err := from.CloseRead(); err != nil {
+ logrus.Errorf("error while CloseRead (%s): %v", debugDescription, err)
+ }
+ if err := to.CloseWrite(); err != nil {
+ logrus.Errorf("error while CloseWrite (%s): %v", debugDescription, err)
+ }
+ }()
+ if _, err := io.Copy(to, from); err != nil {
+ return errors.Wrapf(err, "error while Copy (%s)", debugDescription)
+ }
+ return nil
+}
+
+type halfReadCloser interface {
+ io.Reader
+ CloseRead() error
+}
+
+type halfWriteCloser interface {
+ io.Writer
+ CloseWrite() error
+}
+
+type halfCloser interface {
+ halfReadCloser
+ halfWriteCloser
+}
+
+type halfReadWriteCloser interface {
+ io.Reader
+ halfWriteCloser
+}
+
+type nopCloseReader struct {
+ halfReadWriteCloser
+}
+
+func (x *nopCloseReader) CloseRead() error {
+ return nil
+}
+
+type halfReadCloserWrapper struct {
+ io.ReadCloser
+}
+
+func (x *halfReadCloserWrapper) CloseRead() error {
+ return x.Close()
+}
+
+type halfWriteCloserWrapper struct {
+ io.WriteCloser
+}
+
+func (x *halfWriteCloserWrapper) CloseWrite() error {
+ return x.Close()
+}
diff --git a/cmd/podman/system/service.go b/cmd/podman/system/service.go
index 99a6b1e1e..41d20d9fd 100644
--- a/cmd/podman/system/service.go
+++ b/cmd/podman/system/service.go
@@ -35,12 +35,14 @@ Enable a listening service for API access to Podman commands.
Long: srvDescription,
RunE: service,
ValidArgsFunction: common.AutocompleteDefaultOneArg,
- Example: `podman system service --time=0 unix:///tmp/podman.sock`,
+ Example: `podman system service --time=0 unix:///tmp/podman.sock
+ podman system service --time=0 tcp://localhost:8888`,
}
srvArgs = struct {
- Timeout int64
CorsHeaders string
+ PProfAddr string
+ Timeout uint
}{}
)
@@ -51,15 +53,20 @@ func init() {
})
flags := srvCmd.Flags()
-
cfg := registry.PodmanConfig()
+
timeFlagName := "time"
- flags.Int64VarP(&srvArgs.Timeout, timeFlagName, "t", int64(cfg.Engine.ServiceTimeout), "Time until the service session expires in seconds. Use 0 to disable the timeout")
+ flags.UintVarP(&srvArgs.Timeout, timeFlagName, "t", cfg.Engine.ServiceTimeout,
+ "Time until the service session expires in seconds. Use 0 to disable the timeout")
_ = srvCmd.RegisterFlagCompletionFunc(timeFlagName, completion.AutocompleteNone)
+ flags.SetNormalizeFunc(aliasTimeoutFlag)
+
flags.StringVarP(&srvArgs.CorsHeaders, "cors", "", "", "Set CORS Headers")
_ = srvCmd.RegisterFlagCompletionFunc("cors", completion.AutocompleteNone)
- flags.SetNormalizeFunc(aliasTimeoutFlag)
+ flags.StringVarP(&srvArgs.PProfAddr, "pprof-address", "", "",
+ "Binding network address for pprof profile endpoints, default: do not expose endpoints")
+ flags.MarkHidden("pprof-address")
}
func aliasTimeoutFlag(_ *pflag.FlagSet, name string) pflag.NormalizedName {
@@ -74,7 +81,7 @@ func service(cmd *cobra.Command, args []string) error {
if err != nil {
return err
}
- logrus.Infof("Using API endpoint: '%s'", apiURI)
+
// Clean up any old existing unix domain socket
if len(apiURI) > 0 {
uri, err := url.Parse(apiURI)
@@ -92,33 +99,31 @@ func service(cmd *cobra.Command, args []string) error {
}
}
- opts := entities.ServiceOptions{
- URI: apiURI,
- Command: cmd,
+ return restService(cmd.Flags(), registry.PodmanConfig(), entities.ServiceOptions{
CorsHeaders: srvArgs.CorsHeaders,
- }
-
- opts.Timeout = time.Duration(srvArgs.Timeout) * time.Second
- return restService(opts, cmd.Flags(), registry.PodmanConfig())
+ PProfAddr: srvArgs.PProfAddr,
+ Timeout: time.Duration(srvArgs.Timeout) * time.Second,
+ URI: apiURI,
+ })
}
-func resolveAPIURI(_url []string) (string, error) {
+func resolveAPIURI(uri []string) (string, error) {
// When determining _*THE*_ listening endpoint --
// 1) User input wins always
// 2) systemd socket activation
// 3) rootless honors XDG_RUNTIME_DIR
// 4) lastly adapter.DefaultAPIAddress
- if len(_url) == 0 {
+ if len(uri) == 0 {
if v, found := os.LookupEnv("PODMAN_SOCKET"); found {
- logrus.Debugf("PODMAN_SOCKET='%s' used to determine API endpoint", v)
- _url = []string{v}
+ logrus.Debugf("PODMAN_SOCKET=%q used to determine API endpoint", v)
+ uri = []string{v}
}
}
switch {
- case len(_url) > 0 && _url[0] != "":
- return _url[0], nil
+ case len(uri) > 0 && uri[0] != "":
+ return uri[0], nil
case systemd.SocketActivated():
logrus.Info("Using systemd socket activation to determine API endpoint")
return "", nil
diff --git a/cmd/podman/system/service_abi.go b/cmd/podman/system/service_abi.go
index e484db339..b9bd7538f 100644
--- a/cmd/podman/system/service_abi.go
+++ b/cmd/podman/system/service_abi.go
@@ -5,9 +5,9 @@ package system
import (
"context"
"net"
+ "net/url"
"os"
"path/filepath"
- "strings"
api "github.com/containers/podman/v3/pkg/api/server"
"github.com/containers/podman/v3/pkg/domain/entities"
@@ -20,41 +20,54 @@ import (
"golang.org/x/sys/unix"
)
-func restService(opts entities.ServiceOptions, flags *pflag.FlagSet, cfg *entities.PodmanConfig) error {
+func restService(flags *pflag.FlagSet, cfg *entities.PodmanConfig, opts entities.ServiceOptions) error {
var (
listener *net.Listener
err error
)
if opts.URI != "" {
- fields := strings.Split(opts.URI, ":")
- if len(fields) == 1 {
+ uri, err := url.Parse(opts.URI)
+ if err != nil {
return errors.Errorf("%s is an invalid socket destination", opts.URI)
}
- path := opts.URI
- if fields[0] == "unix" {
- if path, err = filepath.Abs(fields[1]); err != nil {
- return err
- }
- }
- util.SetSocketPath(path)
- if os.Getenv("LISTEN_FDS") != "" {
- // If it is activated by systemd, use the first LISTEN_FD (3)
- // instead of opening the socket file.
- f := os.NewFile(uintptr(3), "podman.sock")
- l, err := net.FileListener(f)
+
+ switch uri.Scheme {
+ case "unix":
+ path, err := filepath.Abs(uri.Path)
if err != nil {
return err
}
- listener = &l
- } else {
- network := fields[0]
- address := strings.Join(fields[1:], ":")
- l, err := net.Listen(network, address)
+ util.SetSocketPath(path)
+ if os.Getenv("LISTEN_FDS") != "" {
+ // If it is activated by systemd, use the first LISTEN_FD (3)
+ // instead of opening the socket file.
+ f := os.NewFile(uintptr(3), "podman.sock")
+ l, err := net.FileListener(f)
+ if err != nil {
+ return err
+ }
+ listener = &l
+ } else {
+ l, err := net.Listen(uri.Scheme, path)
+ if err != nil {
+ return errors.Wrapf(err, "unable to create socket")
+ }
+ listener = &l
+ }
+ case "tcp":
+ host := uri.Host
+ if host == "" {
+ // For backward compatibility, support "tcp:<host>:<port>" and "tcp://<host>:<port>"
+ host = uri.Opaque
+ }
+ l, err := net.Listen(uri.Scheme, host)
if err != nil {
- return errors.Wrapf(err, "unable to create socket")
+ return errors.Wrapf(err, "unable to create socket %v", host)
}
listener = &l
+ default:
+ logrus.Debugf("Attempting API Service endpoint scheme %q", uri.Scheme)
}
}
@@ -75,12 +88,12 @@ func restService(opts entities.ServiceOptions, flags *pflag.FlagSet, cfg *entiti
servicereaper.Start()
infra.StartWatcher(rt)
- server, err := api.NewServerWithSettings(rt, listener, api.Options{Timeout: opts.Timeout, CorsHeaders: opts.CorsHeaders})
+ server, err := api.NewServerWithSettings(rt, listener, opts)
if err != nil {
return err
}
defer func() {
- if err := server.Shutdown(); err != nil {
+ if err := server.Shutdown(true); err != nil {
logrus.Warnf("Error when stopping API service: %s", err)
}
}()
diff --git a/cmd/podman/volumes/rm.go b/cmd/podman/volumes/rm.go
index 9ba4a30a1..fd5df20b7 100644
--- a/cmd/podman/volumes/rm.go
+++ b/cmd/podman/volumes/rm.go
@@ -5,6 +5,7 @@ import (
"fmt"
"strings"
+ "github.com/containers/common/pkg/completion"
"github.com/containers/podman/v3/cmd/podman/common"
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/utils"
@@ -32,7 +33,8 @@ var (
)
var (
- rmOptions = entities.VolumeRmOptions{}
+ rmOptions = entities.VolumeRmOptions{}
+ stopTimeout uint
)
func init() {
@@ -43,6 +45,9 @@ func init() {
flags := rmCommand.Flags()
flags.BoolVarP(&rmOptions.All, "all", "a", false, "Remove all volumes")
flags.BoolVarP(&rmOptions.Force, "force", "f", false, "Remove a volume by force, even if it is being used by a container")
+ timeFlagName := "time"
+ flags.UintVarP(&stopTimeout, timeFlagName, "t", containerConfig.Engine.StopTimeout, "Seconds to wait for running containers to stop before killing the container")
+ _ = rmCommand.RegisterFlagCompletionFunc(timeFlagName, completion.AutocompleteNone)
}
func rm(cmd *cobra.Command, args []string) error {
@@ -52,6 +57,12 @@ func rm(cmd *cobra.Command, args []string) error {
if (len(args) > 0 && rmOptions.All) || (len(args) < 1 && !rmOptions.All) {
return errors.New("choose either one or more volumes or all")
}
+ if cmd.Flag("time").Changed {
+ if !rmOptions.Force {
+ return errors.New("--force option must be specified to use the --time option")
+ }
+ rmOptions.Timeout = &stopTimeout
+ }
responses, err := registry.ContainerEngine().VolumeRm(context.Background(), args, rmOptions)
if err != nil {
setExitCode(err)
diff --git a/cmd/podman/volumes/volume.go b/cmd/podman/volumes/volume.go
index f42a6d81a..2f06abd4e 100644
--- a/cmd/podman/volumes/volume.go
+++ b/cmd/podman/volumes/volume.go
@@ -3,6 +3,7 @@ package volumes
import (
"github.com/containers/podman/v3/cmd/podman/registry"
"github.com/containers/podman/v3/cmd/podman/validate"
+ "github.com/containers/podman/v3/pkg/util"
"github.com/spf13/cobra"
)
@@ -17,6 +18,7 @@ var (
Long: "Volumes are created in and can be shared between containers",
RunE: validate.SubCommandExists,
}
+ containerConfig = util.DefaultContainerConfig()
)
func init() {
diff --git a/cmd/rootlessport/main.go b/cmd/rootlessport/main.go
new file mode 100644
index 000000000..feb9f5c06
--- /dev/null
+++ b/cmd/rootlessport/main.go
@@ -0,0 +1,353 @@
+package main
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "io"
+ "io/ioutil"
+ "net"
+ "os"
+ "os/exec"
+ "path/filepath"
+
+ "github.com/containernetworking/plugins/pkg/ns"
+ "github.com/containers/podman/v3/libpod/network/types"
+ "github.com/containers/podman/v3/pkg/rootlessport"
+ "github.com/pkg/errors"
+ rkport "github.com/rootless-containers/rootlesskit/pkg/port"
+ rkbuiltin "github.com/rootless-containers/rootlesskit/pkg/port/builtin"
+ rkportutil "github.com/rootless-containers/rootlesskit/pkg/port/portutil"
+ "github.com/sirupsen/logrus"
+ "golang.org/x/sys/unix"
+)
+
+const (
+ // ReexecChildKey is used internally for the second reexec
+ ReexecChildKey = "rootlessport-child"
+ reexecChildEnvOpaque = "_CONTAINERS_ROOTLESSPORT_CHILD_OPAQUE"
+)
+
+func main() {
+ if len(os.Args) > 1 {
+ fmt.Fprintln(os.Stderr, `too many arguments, rootlessport expects a json config via STDIN`)
+ os.Exit(1)
+ }
+ var err error
+ if os.Args[0] == ReexecChildKey {
+ err = child()
+ } else {
+ err = parent()
+ }
+ if err != nil {
+ fmt.Println(err)
+ os.Exit(1)
+ }
+}
+
+func loadConfig(r io.Reader) (*rootlessport.Config, io.ReadCloser, io.WriteCloser, error) {
+ stdin, err := ioutil.ReadAll(r)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ var cfg rootlessport.Config
+ if err := json.Unmarshal(stdin, &cfg); err != nil {
+ return nil, nil, nil, err
+ }
+ if cfg.NetNSPath == "" {
+ return nil, nil, nil, errors.New("missing NetNSPath")
+ }
+ if cfg.ExitFD <= 0 {
+ return nil, nil, nil, errors.New("missing ExitFD")
+ }
+ exitFile := os.NewFile(uintptr(cfg.ExitFD), "exitfile")
+ if exitFile == nil {
+ return nil, nil, nil, errors.New("invalid ExitFD")
+ }
+ if cfg.ReadyFD <= 0 {
+ return nil, nil, nil, errors.New("missing ReadyFD")
+ }
+ readyFile := os.NewFile(uintptr(cfg.ReadyFD), "readyfile")
+ if readyFile == nil {
+ return nil, nil, nil, errors.New("invalid ReadyFD")
+ }
+ return &cfg, exitFile, readyFile, nil
+}
+
+func parent() error {
+ // load config from stdin
+ cfg, exitR, readyW, err := loadConfig(os.Stdin)
+ if err != nil {
+ return err
+ }
+
+ socketDir := filepath.Join(cfg.TmpDir, "rp")
+ err = os.MkdirAll(socketDir, 0700)
+ if err != nil {
+ return err
+ }
+
+ // create the parent driver
+ stateDir, err := ioutil.TempDir(cfg.TmpDir, "rootlessport")
+ if err != nil {
+ return err
+ }
+ defer os.RemoveAll(stateDir)
+ driver, err := rkbuiltin.NewParentDriver(&logrusWriter{prefix: "parent: "}, stateDir)
+ if err != nil {
+ return err
+ }
+ initComplete := make(chan struct{})
+ quit := make(chan struct{})
+ errCh := make(chan error)
+ // start the parent driver. initComplete will be closed when the child connected to the parent.
+ logrus.Infof("Starting parent driver")
+ go func() {
+ driverErr := driver.RunParentDriver(initComplete, quit, nil)
+ if driverErr != nil {
+ logrus.WithError(driverErr).Warn("Parent driver exited")
+ }
+ errCh <- driverErr
+ close(errCh)
+ }()
+ opaque := driver.OpaqueForChild()
+ logrus.Infof("opaque=%+v", opaque)
+ opaqueJSON, err := json.Marshal(opaque)
+ if err != nil {
+ return err
+ }
+ childQuitR, childQuitW, err := os.Pipe()
+ if err != nil {
+ return err
+ }
+ defer func() {
+ // stop the child
+ logrus.Info("Stopping child driver")
+ if err := childQuitW.Close(); err != nil {
+ logrus.WithError(err).Warn("Unable to close childQuitW")
+ }
+ }()
+
+ // reexec the child process in the child netns
+ cmd := exec.Command("/proc/self/exe")
+ cmd.Args = []string{ReexecChildKey}
+ cmd.Stdin = childQuitR
+ cmd.Stdout = &logrusWriter{prefix: "child"}
+ cmd.Stderr = cmd.Stdout
+ cmd.Env = append(os.Environ(), reexecChildEnvOpaque+"="+string(opaqueJSON))
+ childNS, err := ns.GetNS(cfg.NetNSPath)
+ if err != nil {
+ return err
+ }
+ if err := childNS.Do(func(_ ns.NetNS) error {
+ logrus.Infof("Starting child driver in child netns (%q %v)", cmd.Path, cmd.Args)
+ return cmd.Start()
+ }); err != nil {
+ return err
+ }
+
+ childErrCh := make(chan error)
+ go func() {
+ err := cmd.Wait()
+ childErrCh <- err
+ close(childErrCh)
+ }()
+
+ defer func() {
+ if err := unix.Kill(cmd.Process.Pid, unix.SIGTERM); err != nil {
+ logrus.WithError(err).Warn("Kill child process")
+ }
+ }()
+
+ logrus.Info("Waiting for initComplete")
+ // wait for the child to connect to the parent
+outer:
+ for {
+ select {
+ case <-initComplete:
+ logrus.Infof("initComplete is closed; parent and child established the communication channel")
+ break outer
+ case err := <-childErrCh:
+ if err != nil {
+ return err
+ }
+ case err := <-errCh:
+ if err != nil {
+ return err
+ }
+ }
+ }
+
+ defer func() {
+ logrus.Info("Stopping parent driver")
+ quit <- struct{}{}
+ if err := <-errCh; err != nil {
+ logrus.WithError(err).Warn("Parent driver returned error on exit")
+ }
+ }()
+
+ // let parent expose ports
+ logrus.Infof("Exposing ports %v", cfg.Mappings)
+ if err := exposePorts(driver, cfg.Mappings, cfg.ChildIP); err != nil {
+ return err
+ }
+
+ // we only need to have a socket to reload ports when we run under rootless cni
+ if cfg.RootlessCNI {
+ socketfile := filepath.Join(socketDir, cfg.ContainerID)
+ // make sure to remove the file if it exists to prevent EADDRINUSE
+ _ = os.Remove(socketfile)
+ // workaround to bypass the 108 char socket path limit
+ // open the fd and use the path to the fd as bind argument
+ fd, err := unix.Open(socketDir, unix.O_PATH, 0)
+ if err != nil {
+ return err
+ }
+ socket, err := net.ListenUnix("unixpacket", &net.UnixAddr{Name: fmt.Sprintf("/proc/self/fd/%d/%s", fd, cfg.ContainerID), Net: "unixpacket"})
+ if err != nil {
+ return err
+ }
+ err = unix.Close(fd)
+ // remove the socket file on exit
+ defer os.Remove(socketfile)
+ if err != nil {
+ logrus.Warnf("Failed to close the socketDir fd: %v", err)
+ }
+ defer socket.Close()
+ go serve(socket, driver)
+ }
+
+ logrus.Info("Ready")
+
+ // https://github.com/containers/podman/issues/11248
+ // Copy /dev/null to stdout and stderr to prevent SIGPIPE errors
+ if f, err := os.OpenFile("/dev/null", os.O_WRONLY, 0755); err == nil {
+ unix.Dup2(int(f.Fd()), 1) // nolint:errcheck
+ unix.Dup2(int(f.Fd()), 2) // nolint:errcheck
+ f.Close()
+ }
+ // write and close ReadyFD (convention is same as slirp4netns --ready-fd)
+ if _, err := readyW.Write([]byte("1")); err != nil {
+ return err
+ }
+ if err := readyW.Close(); err != nil {
+ return err
+ }
+
+ // wait for ExitFD to be closed
+ logrus.Info("Waiting for exitfd to be closed")
+ if _, err := ioutil.ReadAll(exitR); err != nil {
+ return err
+ }
+ return nil
+}
+
+func serve(listener net.Listener, pm rkport.Manager) {
+ for {
+ conn, err := listener.Accept()
+ if err != nil {
+ // we cannot log this error, stderr is already closed
+ continue
+ }
+ ctx := context.TODO()
+ err = handler(ctx, conn, pm)
+ if err != nil {
+ conn.Write([]byte(err.Error()))
+ } else {
+ conn.Write([]byte("OK"))
+ }
+ conn.Close()
+ }
+}
+
+func handler(ctx context.Context, conn io.Reader, pm rkport.Manager) error {
+ var childIP string
+ dec := json.NewDecoder(conn)
+ err := dec.Decode(&childIP)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to decode ports")
+ }
+ portStatus, err := pm.ListPorts(ctx)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to list ports")
+ }
+ for _, status := range portStatus {
+ err = pm.RemovePort(ctx, status.ID)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to remove port")
+ }
+ }
+ // add the ports with the new child IP
+ for _, status := range portStatus {
+ // set the new child IP
+ status.Spec.ChildIP = childIP
+ _, err = pm.AddPort(ctx, status.Spec)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to add port")
+ }
+ }
+ return nil
+}
+
+func exposePorts(pm rkport.Manager, portMappings []types.OCICNIPortMapping, childIP string) error {
+ ctx := context.TODO()
+ for _, i := range portMappings {
+ hostIP := i.HostIP
+ if hostIP == "" {
+ hostIP = "0.0.0.0"
+ }
+ spec := rkport.Spec{
+ Proto: i.Protocol,
+ ParentIP: hostIP,
+ ParentPort: int(i.HostPort),
+ ChildPort: int(i.ContainerPort),
+ ChildIP: childIP,
+ }
+ if err := rkportutil.ValidatePortSpec(spec, nil); err != nil {
+ return err
+ }
+ if _, err := pm.AddPort(ctx, spec); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+func child() error {
+ // load the config from the parent
+ var opaque map[string]string
+ if err := json.Unmarshal([]byte(os.Getenv(reexecChildEnvOpaque)), &opaque); err != nil {
+ return err
+ }
+
+ // start the child driver
+ quit := make(chan struct{})
+ errCh := make(chan error)
+ go func() {
+ d := rkbuiltin.NewChildDriver(os.Stderr)
+ dErr := d.RunChildDriver(opaque, quit)
+ errCh <- dErr
+ }()
+ defer func() {
+ logrus.Info("Stopping child driver")
+ quit <- struct{}{}
+ if err := <-errCh; err != nil {
+ logrus.WithError(err).Warn("Child driver returned error on exit")
+ }
+ }()
+
+ // wait for stdin to be closed
+ if _, err := ioutil.ReadAll(os.Stdin); err != nil {
+ return err
+ }
+ return nil
+}
+
+type logrusWriter struct {
+ prefix string
+}
+
+func (w *logrusWriter) Write(p []byte) (int, error) {
+ logrus.Infof("%s%s", w.prefix, string(p))
+ return len(p), nil
+}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-29 19:23:10 +0000