11 files changed, 376 insertions, 18 deletions
diff --git a/pkg/domain/entities/auto-update.go b/pkg/domain/entities/auto-update.go
new file mode 100644
index 000000000..aef8fc46b
--- /dev/null
+++ b/pkg/domain/entities/auto-update.go
@@ -0,0 +1,7 @@
+package entities
+
+// AutoUpdateReport contains the results from running auto-update.
+type AutoUpdateReport struct {
+	// Units - the restarted systemd units during auto-update.
+	Units []string
+}
diff --git a/pkg/domain/entities/containers.go b/pkg/domain/entities/containers.go
index 071eff2fc..e5330e1ab 100644
--- a/pkg/domain/entities/containers.go
+++ b/pkg/domain/entities/containers.go
@@ -6,11 +6,49 @@ import (
 	"os"
 	"time"
 
+	"github.com/containers/image/v5/types"
 	"github.com/containers/libpod/libpod/define"
 	"github.com/containers/libpod/pkg/specgen"
 	"github.com/cri-o/ocicni/pkg/ocicni"
 )
 
+// ContainerRunlabelOptions are the options to execute container-runlabel.
+type ContainerRunlabelOptions struct {
+	// Authfile - path to an authentication file.
+	Authfile string
+	// CertDir - path to a directory containing TLS certifications and
+	// keys.
+	CertDir string
+	// Credentials - `user:password` to use when pulling an image.
+	Credentials string
+	// Display - do not execute but print the command.
+	Display bool
+	// Replace - replace an existing container with a new one from the
+	// image.
+	Replace bool
+	// Name - use this name when executing the runlabel container.
+	Name string
+	// Optional1 - fist optional parameter for install.
+	Optional1 string
+	// Optional2 - second optional parameter for install.
+	Optional2 string
+	// Optional3 - third optional parameter for install.
+	Optional3 string
+	// Pull - pull the specified image if it's not in the local storage.
+	Pull bool
+	// Quiet - suppress output when pulling images.
+	Quiet bool
+	// SignaturePolicy - path to a signature-policy file.
+	SignaturePolicy string
+	// SkipTLSVerify - skip HTTPS and certificate verifications when
+	// contacting registries.
+	SkipTLSVerify types.OptionalBool
+}
+
+// ContainerRunlabelReport contains the results from executing container-runlabel.
+type ContainerRunlabelReport struct {
+}
+
 type WaitOptions struct {
 	Condition define.ContainerStatus
 	Interval  time.Duration
diff --git a/pkg/domain/entities/engine_container.go b/pkg/domain/entities/engine_container.go
index 1bfac4514..7c93e6802 100644
--- a/pkg/domain/entities/engine_container.go
+++ b/pkg/domain/entities/engine_container.go
@@ -10,6 +10,7 @@ import (
 )
 
 type ContainerEngine interface {
+	AutoUpdate(ctx context.Context) (*AutoUpdateReport, []error)
 	Config(ctx context.Context) (*config.Config, error)
 	ContainerAttach(ctx context.Context, nameOrId string, options AttachOptions) error
 	ContainerCheckpoint(ctx context.Context, namesOrIds []string, options CheckpointOptions) ([]*CheckpointReport, error)
@@ -34,6 +35,7 @@ type ContainerEngine interface {
 	ContainerRestore(ctx context.Context, namesOrIds []string, options RestoreOptions) ([]*RestoreReport, error)
 	ContainerRm(ctx context.Context, namesOrIds []string, options RmOptions) ([]*RmReport, error)
 	ContainerRun(ctx context.Context, opts ContainerRunOptions) (*ContainerRunReport, error)
+	ContainerRunlabel(ctx context.Context, label string, image string, args []string, opts ContainerRunlabelOptions) error
 	ContainerStart(ctx context.Context, namesOrIds []string, options ContainerStartOptions) ([]*ContainerStartReport, error)
 	ContainerStats(ctx context.Context, namesOrIds []string, options ContainerStatsOptions) error
 	ContainerStop(ctx context.Context, namesOrIds []string, options StopOptions) ([]*StopReport, error)
diff --git a/pkg/domain/infra/abi/auto-update.go b/pkg/domain/infra/abi/auto-update.go
new file mode 100644
index 000000000..aa20664b4
--- /dev/null
+++ b/pkg/domain/infra/abi/auto-update.go
@@ -0,0 +1,13 @@
+package abi
+
+import (
+	"context"
+
+	"github.com/containers/libpod/pkg/autoupdate"
+	"github.com/containers/libpod/pkg/domain/entities"
+)
+
+func (ic *ContainerEngine) AutoUpdate(ctx context.Context) (*entities.AutoUpdateReport, []error) {
+	units, failures := autoupdate.AutoUpdate(ic.Libpod)
+	return &entities.AutoUpdateReport{Units: units}, failures
+}
diff --git a/pkg/domain/infra/abi/containers_runlabel.go b/pkg/domain/infra/abi/containers_runlabel.go
new file mode 100644
index 000000000..41f4444d5
--- /dev/null
+++ b/pkg/domain/infra/abi/containers_runlabel.go
@@ -0,0 +1,280 @@
+package abi
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/containers/image/v5/types"
+	"github.com/containers/libpod/libpod/define"
+	"github.com/containers/libpod/libpod/image"
+	"github.com/containers/libpod/pkg/domain/entities"
+	envLib "github.com/containers/libpod/pkg/env"
+	"github.com/containers/libpod/pkg/util"
+	"github.com/containers/libpod/utils"
+	"github.com/google/shlex"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+func (ic *ContainerEngine) ContainerRunlabel(ctx context.Context, label string, imageRef string, args []string, options entities.ContainerRunlabelOptions) error {
+	// First, get the image and pull it if needed.
+	img, err := ic.runlabelImage(ctx, label, imageRef, options)
+	if err != nil {
+		return err
+	}
+	// Extract the runlabel from the image.
+	runlabel, err := img.GetLabel(ctx, label)
+	if err != nil {
+		return err
+	}
+
+	cmd, env, err := generateRunlabelCommand(runlabel, img, args, options)
+	if err != nil {
+		return err
+	}
+
+	stdErr := os.Stderr
+	stdOut := os.Stdout
+	stdIn := os.Stdin
+	if options.Quiet {
+		stdErr = nil
+		stdOut = nil
+		stdIn = nil
+	}
+
+	// If container already exists && --replace given -- Nuke it
+	if options.Replace {
+		for i, entry := range cmd {
+			if entry == "--name" {
+				name := cmd[i+1]
+				ctr, err := ic.Libpod.LookupContainer(name)
+				if err != nil {
+					if errors.Cause(err) != define.ErrNoSuchCtr {
+						logrus.Debugf("Error occurred searching for container %s: %s", name, err.Error())
+						return err
+					}
+				} else {
+					logrus.Debugf("Runlabel --replace option given. Container %s will be deleted. The new container will be named %s", ctr.ID(), name)
+					if err := ic.Libpod.RemoveContainer(ctx, ctr, true, false); err != nil {
+						return err
+					}
+				}
+				break
+			}
+		}
+	}
+
+	return utils.ExecCmdWithStdStreams(stdIn, stdOut, stdErr, env, cmd[0], cmd[1:]...)
+}
+
+// runlabelImage returns an image based on the specified image AND options.
+func (ic *ContainerEngine) runlabelImage(ctx context.Context, label string, imageRef string, options entities.ContainerRunlabelOptions) (*image.Image, error) {
+	// First, look up the image locally. If we get an error and requested
+	// to pull, fallthrough and pull it.
+	img, err := ic.Libpod.ImageRuntime().NewFromLocal(imageRef)
+	switch {
+	case err == nil:
+		return img, nil
+	case !options.Pull:
+		return nil, err
+	default:
+		// Fallthrough and pull!
+	}
+
+	// Parse credentials if specified.
+	var credentials *types.DockerAuthConfig
+	if options.Credentials != "" {
+		credentials, err = util.ParseRegistryCreds(options.Credentials)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Suppress pull progress bars if requested.
+	pullOutput := os.Stdout
+	if options.Quiet {
+		pullOutput = nil // c/image/copy takes care of the rest
+	}
+
+	// Pull the image.
+	dockerRegistryOptions := image.DockerRegistryOptions{
+		DockerCertPath:              options.CertDir,
+		DockerInsecureSkipTLSVerify: options.SkipTLSVerify,
+		DockerRegistryCreds:         credentials,
+	}
+
+	return ic.Libpod.ImageRuntime().New(ctx, imageRef, options.SignaturePolicy, options.Authfile, pullOutput, &dockerRegistryOptions, image.SigningOptions{}, &label, util.PullImageMissing)
+}
+
+// generateRunlabelCommand generates the to-be-executed command as a string
+// slice along with a base environment.
+func generateRunlabelCommand(runlabel string, img *image.Image, args []string, options entities.ContainerRunlabelOptions) ([]string, []string, error) {
+	var (
+		err             error
+		name, imageName string
+		globalOpts      string
+		cmd, env        []string
+	)
+
+	// TODO: How do we get global opts as done in v1?
+
+	// Extract the imageName (or ID).
+	imgNames := img.Names()
+	if len(imgNames) == 0 {
+		imageName = img.ID()
+	} else {
+		imageName = imgNames[0]
+	}
+
+	// Use the user-specified name or extract one from the image.
+	if options.Name != "" {
+		name = options.Name
+	} else {
+		name, err = image.GetImageBaseName(imageName)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	// Append the user-specified arguments to the runlabel (command).
+	if len(args) > 0 {
+		runlabel = fmt.Sprintf("%s %s", runlabel, strings.Join(args, " "))
+	}
+
+	cmd, err = generateCommand(runlabel, imageName, name, globalOpts)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	env = generateRunEnvironment(name, imageName, options)
+	env = append(env, "PODMAN_RUNLABEL_NESTED=1")
+	envmap, err := envLib.ParseSlice(env)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	envmapper := func(k string) string {
+		switch k {
+		case "OPT1":
+			return envmap["OPT1"]
+		case "OPT2":
+			return envmap["OPT2"]
+		case "OPT3":
+			return envmap["OPT3"]
+		case "PWD":
+			// I would prefer to use os.getenv but it appears PWD is not in the os env list.
+			d, err := os.Getwd()
+			if err != nil {
+				logrus.Error("unable to determine current working directory")
+				return ""
+			}
+			return d
+		}
+		return ""
+	}
+	newS := os.Expand(strings.Join(cmd, " "), envmapper)
+	cmd, err = shlex.Split(newS)
+	if err != nil {
+		return nil, nil, err
+	}
+	return cmd, env, nil
+}
+
+// generateCommand takes a label (string) and converts it to an executable command
+func generateCommand(command, imageName, name, globalOpts string) ([]string, error) {
+	var (
+		newCommand []string
+	)
+	if name == "" {
+		name = imageName
+	}
+
+	cmd, err := shlex.Split(command)
+	if err != nil {
+		return nil, err
+	}
+
+	prog, err := substituteCommand(cmd[0])
+	if err != nil {
+		return nil, err
+	}
+	newCommand = append(newCommand, prog)
+
+	for _, arg := range cmd[1:] {
+		var newArg string
+		switch arg {
+		case "IMAGE":
+			newArg = imageName
+		case "$IMAGE":
+			newArg = imageName
+		case "IMAGE=IMAGE":
+			newArg = fmt.Sprintf("IMAGE=%s", imageName)
+		case "IMAGE=$IMAGE":
+			newArg = fmt.Sprintf("IMAGE=%s", imageName)
+		case "NAME":
+			newArg = name
+		case "NAME=NAME":
+			newArg = fmt.Sprintf("NAME=%s", name)
+		case "NAME=$NAME":
+			newArg = fmt.Sprintf("NAME=%s", name)
+		case "$NAME":
+			newArg = name
+		case "$GLOBAL_OPTS":
+			newArg = globalOpts
+		default:
+			newArg = arg
+		}
+		newCommand = append(newCommand, newArg)
+	}
+	return newCommand, nil
+}
+
+// GenerateRunEnvironment merges the current environment variables with optional
+// environment variables provided by the user
+func generateRunEnvironment(name, imageName string, options entities.ContainerRunlabelOptions) []string {
+	newEnv := os.Environ()
+	if options.Optional1 != "" {
+		newEnv = append(newEnv, fmt.Sprintf("OPT1=%s", options.Optional1))
+	}
+	if options.Optional2 != "" {
+		newEnv = append(newEnv, fmt.Sprintf("OPT2=%s", options.Optional2))
+	}
+	if options.Optional3 != "" {
+		newEnv = append(newEnv, fmt.Sprintf("OPT3=%s", options.Optional3))
+	}
+	return newEnv
+}
+
+func substituteCommand(cmd string) (string, error) {
+	var (
+		newCommand string
+	)
+
+	// Replace cmd with "/proc/self/exe" if "podman" or "docker" is being
+	// used. If "/usr/bin/docker" is provided, we also sub in podman.
+	// Otherwise, leave the command unchanged.
+	if cmd == "podman" || filepath.Base(cmd) == "docker" {
+		newCommand = "/proc/self/exe"
+	} else {
+		newCommand = cmd
+	}
+
+	// If cmd is an absolute or relative path, check if the file exists.
+	// Throw an error if it doesn't exist.
+	if strings.Contains(newCommand, "/") || strings.HasPrefix(newCommand, ".") {
+		res, err := filepath.Abs(newCommand)
+		if err != nil {
+			return "", err
+		}
+		if _, err := os.Stat(res); !os.IsNotExist(err) {
+			return res, nil
+		} else if err != nil {
+			return "", err
+		}
+	}
+
+	return newCommand, nil
+}
diff --git a/pkg/domain/infra/tunnel/auto-update.go b/pkg/domain/infra/tunnel/auto-update.go
new file mode 100644
index 000000000..fac033050
--- /dev/null
+++ b/pkg/domain/infra/tunnel/auto-update.go
@@ -0,0 +1,12 @@
+package tunnel
+
+import (
+	"context"
+
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/pkg/errors"
+)
+
+func (ic *ContainerEngine) AutoUpdate(ctx context.Context) (*entities.AutoUpdateReport, []error) {
+	return nil, []error{errors.New("not implemented")}
+}
diff --git a/pkg/domain/infra/tunnel/containers.go b/pkg/domain/infra/tunnel/containers.go
index 227b660f7..49a3069d6 100644
--- a/pkg/domain/infra/tunnel/containers.go
+++ b/pkg/domain/infra/tunnel/containers.go
@@ -14,6 +14,10 @@ import (
 	"github.com/pkg/errors"
 )
 
+func (ic *ContainerEngine) ContainerRunlabel(ctx context.Context, label string, image string, args []string, options entities.ContainerRunlabelOptions) error {
+	return errors.New("not implemented")
+}
+
 func (ic *ContainerEngine) ContainerExists(ctx context.Context, nameOrId string) (*entities.BoolReport, error) {
 	exists, err := containers.Exists(ic.ClientCxt, nameOrId)
 	return &entities.BoolReport{Value: exists}, err
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 92a2b4d35..e4bd2991a 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -9,6 +9,7 @@ import (
 	envLib "github.com/containers/libpod/pkg/env"
 	"github.com/containers/libpod/pkg/signal"
 	"github.com/containers/libpod/pkg/specgen"
+	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
@@ -48,24 +49,28 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		s.StopSignal = &sig
 	}
 
+	rtc, err := r.GetConfig()
+	if err != nil {
+		return err
+	}
+	// Get Default Environment
+	defaultEnvs, err := envLib.ParseSlice(rtc.Containers.Env)
+	if err != nil {
+		return errors.Wrap(err, "Env fields in containers.conf failed to parse")
+	}
+
 	// Image envs from the image if they don't exist
-	// already
-	env, err := newImage.Env(ctx)
+	// already, overriding the default environments
+	imageEnvs, err := newImage.Env(ctx)
 	if err != nil {
 		return err
 	}
 
-	if len(env) > 0 {
-		envs, err := envLib.ParseSlice(env)
-		if err != nil {
-			return err
-		}
-		for k, v := range envs {
-			if _, exists := s.Env[k]; !exists {
-				s.Env[v] = k
-			}
-		}
+	envs, err := envLib.ParseSlice(imageEnvs)
+	if err != nil {
+		return errors.Wrap(err, "Env fields from image failed to parse")
 	}
+	s.Env = envLib.Join(envLib.Join(defaultEnvs, envs), s.Env)
 
 	labels, err := newImage.Labels(ctx)
 	if err != nil {
diff --git a/pkg/specgen/pod_validate.go b/pkg/specgen/pod_validate.go
index 98d59549e..08f1c0300 100644
--- a/pkg/specgen/pod_validate.go
+++ b/pkg/specgen/pod_validate.go
@@ -33,7 +33,7 @@ func (p *PodSpecGenerator) Validate() error {
 	}
 
 	// PodNetworkConfig
-	if err := p.NetNS.validate(); err != nil {
+	if err := validateNetNS(&p.NetNS); err != nil {
 		return err
 	}
 	if p.NoInfra {
@@ -85,10 +85,6 @@ func (p *PodSpecGenerator) Validate() error {
 		return exclusivePodOptions("NoManageHosts", "HostAdd")
 	}
 
-	if err := p.NetNS.validate(); err != nil {
-		return err
-	}
-
 	// Set Defaults
 	if p.NetNS.Value == "" {
 		if rootless.IsRootless() {
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
index 682f3f215..11976233a 100644
--- a/pkg/specgen/podspecgen.go
+++ b/pkg/specgen/podspecgen.go
@@ -54,7 +54,7 @@ type PodNetworkConfig struct {
 	// namespace. This network will, by default, be shared with all
 	// containers in the pod.
 	// Cannot be set to FromContainer and FromPod.
-	// Setting this to anything except "" conflicts with NoInfra=true.
+	// Setting this to anything except default conflicts with NoInfra=true.
 	// Defaults to Bridge as root and Slirp as rootless.
 	// Mandatory.
 	NetNS Namespace `json:"netns,omitempty"`
diff --git a/pkg/specgen/specgen.go b/pkg/specgen/specgen.go
index 4ad6dd6fb..bb01a5d14 100644
--- a/pkg/specgen/specgen.go
+++ b/pkg/specgen/specgen.go
@@ -47,6 +47,7 @@ type ContainerBasicConfig struct {
 	// Optional.
 	Env map[string]string `json:"env,omitempty"`
 	// Terminal is whether the container will create a PTY.
+	// Optional.
 	Terminal bool `json:"terminal,omitempty"`
 	// Stdin is whether the container will keep its STDIN open.
 	Stdin bool `json:"stdin,omitempty"`