4 files changed, 36 insertions, 11 deletions
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index f0d52d0c3..06ffa3df6 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -86,6 +86,15 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 
 	s.Env = envLib.Join(envLib.Join(defaultEnvs, envs), s.Env)
 
+	// Ensure that default environment variables are populated.
+	// Container must have PATH and TERM set, even if nothing else set them.
+	baseEnv := envLib.DefaultEnvVariables()
+	for k, v := range baseEnv {
+		if _, ok := s.Env[k]; !ok {
+			s.Env[k] = v
+		}
+	}
+
 	// Labels and Annotations
 	annotations := make(map[string]string)
 	if newImage != nil {
@@ -135,15 +144,18 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 	s.Annotations = annotations
 
 	// workdir
-	if newImage != nil {
-		workingDir, err := newImage.WorkingDir(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if len(s.WorkDir) < 1 && len(workingDir) > 1 {
+	if s.WorkDir == "" {
+		if newImage != nil {
+			workingDir, err := newImage.WorkingDir(ctx)
+			if err != nil {
+				return nil, err
+			}
 			s.WorkDir = workingDir
 		}
 	}
+	if s.WorkDir == "" {
+		s.WorkDir = "/"
+	}
 
 	if len(s.SeccompProfilePath) < 1 {
 		p, err := libpod.DefaultSeccompPath()
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index be1e3b48e..6c0a702d6 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -153,13 +153,19 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
 		}
 
 		if len(command) > 0 {
-			if command[0] == "/usr/sbin/init" || command[0] == "/sbin/init" || (filepath.Base(command[0]) == "systemd") {
+			useSystemdCommands := map[string]bool{
+				"/sbin/init":           true,
+				"/usr/sbin/init":       true,
+				"/usr/local/sbin/init": true,
+			}
+			if useSystemdCommands[command[0]] || (filepath.Base(command[0]) == "systemd") {
 				useSystemd = true
 			}
 		}
 	default:
 		return nil, errors.Wrapf(err, "invalid value %q systemd option requires 'true, false, always'", s.Systemd)
 	}
+	logrus.Debugf("using systemd mode: %t", useSystemd)
 	if useSystemd {
 		// is StopSignal was not set by the user then set it to systemd
 		// expected StopSigal
@@ -209,6 +215,11 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
 	if s.Entrypoint != nil {
 		options = append(options, libpod.WithEntrypoint(s.Entrypoint))
 	}
+	// If the user did not set an workdir but the image did, ensure it is
+	// created.
+	if s.WorkDir == "" && img != nil {
+		options = append(options, libpod.WithCreateWorkingDir())
+	}
 	if s.StopSignal != nil {
 		options = append(options, libpod.WithStopSignal(*s.StopSignal))
 	}
diff --git a/pkg/specgen/generate/oci.go b/pkg/specgen/generate/oci.go
index f279aac1c..aefc7204c 100644
--- a/pkg/specgen/generate/oci.go
+++ b/pkg/specgen/generate/oci.go
@@ -96,8 +96,10 @@ func makeCommand(ctx context.Context, s *specgen.SpecGenerator, img *image.Image
 
 	finalCommand = append(finalCommand, entrypoint...)
 
+	// Only use image command if the user did not manually set an
+	// entrypoint.
 	command := s.Command
-	if command == nil && img != nil {
+	if command == nil && img != nil && s.Entrypoint == nil {
 		newCmd, err := img.Cmd(ctx)
 		if err != nil {
 			return nil, err
@@ -258,7 +260,6 @@ func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runt
 	for key, val := range s.Annotations {
 		g.AddAnnotation(key, val)
 	}
-	g.AddProcessEnv("container", "podman")
 
 	g.Config.Linux.Resources = s.ResourceLimits
 
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index fcd1622f9..840dcb72d 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -158,8 +158,9 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
 		configSpec.Linux.Seccomp = seccompConfig
 	}
 
-	// Clear default Seccomp profile from Generator for privileged containers
-	if s.SeccompProfilePath == "unconfined" || s.Privileged {
+	// Clear default Seccomp profile from Generator for unconfined containers
+	// and privileged containers which do not specify a seccomp profile.
+	if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
 		configSpec.Linux.Seccomp = nil
 	}