summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/domain/infra/abi/images.go30
-rw-r--r--pkg/domain/infra/abi/network.go4
-rw-r--r--pkg/domain/infra/abi/play.go3
-rw-r--r--pkg/domain/infra/abi/secrets.go12
-rw-r--r--pkg/specgen/generate/container_create.go19
-rw-r--r--pkg/specgen/specgen.go9
6 files changed, 41 insertions, 36 deletions
diff --git a/pkg/domain/infra/abi/images.go b/pkg/domain/infra/abi/images.go
index 0364b00a3..79e815490 100644
--- a/pkg/domain/infra/abi/images.go
+++ b/pkg/domain/infra/abi/images.go
@@ -40,25 +40,13 @@ func (ir *ImageEngine) Exists(_ context.Context, nameOrID string) (*entities.Boo
}
func (ir *ImageEngine) Prune(ctx context.Context, opts entities.ImagePruneOptions) ([]*reports.PruneReport, error) {
- // NOTE: the terms "dangling" and "intermediate" are not used
- // consistently across our code base. In libimage, "dangling" means
- // that an image has no tags. "intermediate" means that an image is
- // dangling and that no other image depends on it (i.e., has no
- // children).
- //
- // While pruning usually refers to "dangling" images, it has always
- // removed "intermediate" ones.
- defaultOptions := &libimage.RemoveImagesOptions{
- Filters: append(opts.Filter, "intermediate=true", "containers=false", "readonly=false"),
+ pruneOptions := &libimage.RemoveImagesOptions{
+ Filters: append(opts.Filter, "containers=false", "readonly=false"),
WithSize: true,
}
- // `image prune --all` means to *also* remove images which are not in
- // use by any container. Since image filters are chained, we need to
- // do two look ups since the default ones are a subset of all.
- unusedOptions := &libimage.RemoveImagesOptions{
- Filters: append(opts.Filter, "containers=false", "readonly=false"),
- WithSize: true,
+ if !opts.All {
+ pruneOptions.Filters = append(pruneOptions.Filters, "dangling=true")
}
var pruneReports []*reports.PruneReport
@@ -66,16 +54,12 @@ func (ir *ImageEngine) Prune(ctx context.Context, opts entities.ImagePruneOption
// Now prune all images until we converge.
numPreviouslyRemovedImages := 1
for {
- removedDefault, rmErrors := ir.Libpod.LibimageRuntime().RemoveImages(ctx, nil, defaultOptions)
- if rmErrors != nil {
- return nil, errorhandling.JoinErrors(rmErrors)
- }
- removedUnused, rmErrors := ir.Libpod.LibimageRuntime().RemoveImages(ctx, nil, unusedOptions)
+ removedImages, rmErrors := ir.Libpod.LibimageRuntime().RemoveImages(ctx, nil, pruneOptions)
if rmErrors != nil {
return nil, errorhandling.JoinErrors(rmErrors)
}
- for _, rmReport := range append(removedDefault, removedUnused...) {
+ for _, rmReport := range removedImages {
r := *rmReport
pruneReports = append(pruneReports, &reports.PruneReport{
Id: r.ID,
@@ -83,7 +67,7 @@ func (ir *ImageEngine) Prune(ctx context.Context, opts entities.ImagePruneOption
})
}
- numRemovedImages := len(removedDefault) + len(removedUnused)
+ numRemovedImages := len(removedImages)
if numRemovedImages+numPreviouslyRemovedImages == 0 {
break
}
diff --git a/pkg/domain/infra/abi/network.go b/pkg/domain/infra/abi/network.go
index 1a833332c..33ab280e5 100644
--- a/pkg/domain/infra/abi/network.go
+++ b/pkg/domain/infra/abi/network.go
@@ -71,7 +71,9 @@ func (ic *ContainerEngine) NetworkReload(ctx context.Context, names []string, op
report := new(entities.NetworkReloadReport)
report.Id = ctr.ID()
report.Err = ctr.ReloadNetwork()
- if options.All && errors.Cause(report.Err) == define.ErrCtrStateInvalid {
+ // ignore errors for invalid ctr state and network mode when --all is used
+ if options.All && (errors.Cause(report.Err) == define.ErrCtrStateInvalid ||
+ errors.Cause(report.Err) == define.ErrNetworkModeInvalid) {
continue
}
reports = append(reports, report)
diff --git a/pkg/domain/infra/abi/play.go b/pkg/domain/infra/abi/play.go
index a94c5f5c5..0ac9b5d8d 100644
--- a/pkg/domain/infra/abi/play.go
+++ b/pkg/domain/infra/abi/play.go
@@ -12,7 +12,6 @@ import (
"github.com/containers/common/libimage"
"github.com/containers/common/pkg/config"
- "github.com/containers/common/pkg/secrets"
"github.com/containers/image/v5/types"
"github.com/containers/podman/v3/libpod"
"github.com/containers/podman/v3/libpod/define"
@@ -161,7 +160,7 @@ func (ic *ContainerEngine) playKubePod(ctx context.Context, podName string, podY
)
// Create the secret manager before hand
- secretsManager, err := secrets.NewManager(ic.Libpod.GetSecretsStorageDir())
+ secretsManager, err := ic.Libpod.SecretsManager()
if err != nil {
return nil, err
}
diff --git a/pkg/domain/infra/abi/secrets.go b/pkg/domain/infra/abi/secrets.go
index 764f4a9dc..1e1cbc70f 100644
--- a/pkg/domain/infra/abi/secrets.go
+++ b/pkg/domain/infra/abi/secrets.go
@@ -6,7 +6,6 @@ import (
"io/ioutil"
"path/filepath"
- "github.com/containers/common/pkg/secrets"
"github.com/containers/podman/v3/pkg/domain/entities"
"github.com/pkg/errors"
)
@@ -14,7 +13,7 @@ import (
func (ic *ContainerEngine) SecretCreate(ctx context.Context, name string, reader io.Reader, options entities.SecretCreateOptions) (*entities.SecretCreateReport, error) {
data, _ := ioutil.ReadAll(reader)
secretsPath := ic.Libpod.GetSecretsStorageDir()
- manager, err := secrets.NewManager(secretsPath)
+ manager, err := ic.Libpod.SecretsManager()
if err != nil {
return nil, err
}
@@ -36,8 +35,7 @@ func (ic *ContainerEngine) SecretCreate(ctx context.Context, name string, reader
}
func (ic *ContainerEngine) SecretInspect(ctx context.Context, nameOrIDs []string) ([]*entities.SecretInfoReport, []error, error) {
- secretsPath := ic.Libpod.GetSecretsStorageDir()
- manager, err := secrets.NewManager(secretsPath)
+ manager, err := ic.Libpod.SecretsManager()
if err != nil {
return nil, nil, err
}
@@ -71,8 +69,7 @@ func (ic *ContainerEngine) SecretInspect(ctx context.Context, nameOrIDs []string
}
func (ic *ContainerEngine) SecretList(ctx context.Context) ([]*entities.SecretInfoReport, error) {
- secretsPath := ic.Libpod.GetSecretsStorageDir()
- manager, err := secrets.NewManager(secretsPath)
+ manager, err := ic.Libpod.SecretsManager()
if err != nil {
return nil, err
}
@@ -105,8 +102,7 @@ func (ic *ContainerEngine) SecretRm(ctx context.Context, nameOrIDs []string, opt
toRemove []string
reports = []*entities.SecretRmReport{}
)
- secretsPath := ic.Libpod.GetSecretsStorageDir()
- manager, err := secrets.NewManager(secretsPath)
+ manager, err := ic.Libpod.SecretsManager()
if err != nil {
return nil, err
}
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 7682367b7..a0f5cc7e6 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -400,7 +400,24 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
}
if len(s.Secrets) != 0 {
- options = append(options, libpod.WithSecrets(s.Secrets))
+ manager, err := rt.SecretsManager()
+ if err != nil {
+ return nil, err
+ }
+ var secrs []*libpod.ContainerSecret
+ for _, s := range s.Secrets {
+ secr, err := manager.Lookup(s.Source)
+ if err != nil {
+ return nil, err
+ }
+ secrs = append(secrs, &libpod.ContainerSecret{
+ Secret: secr,
+ UID: s.UID,
+ GID: s.GID,
+ Mode: s.Mode,
+ })
+ }
+ options = append(options, libpod.WithSecrets(secrs))
}
if len(s.EnvSecrets) != 0 {
diff --git a/pkg/specgen/specgen.go b/pkg/specgen/specgen.go
index 2e01d1535..2815bdebb 100644
--- a/pkg/specgen/specgen.go
+++ b/pkg/specgen/specgen.go
@@ -258,7 +258,7 @@ type ContainerStorageConfig struct {
RootfsPropagation string `json:"rootfs_propagation,omitempty"`
// Secrets are the secrets that will be added to the container
// Optional.
- Secrets []string `json:"secrets,omitempty"`
+ Secrets []Secret `json:"secrets,omitempty"`
// Volatile specifies whether the container storage can be optimized
// at the cost of not syncing all the dirty files in memory.
Volatile bool `json:"volatile,omitempty"`
@@ -521,6 +521,13 @@ type PortMapping struct {
Protocol string `json:"protocol,omitempty"`
}
+type Secret struct {
+ Source string
+ UID uint32
+ GID uint32
+ Mode uint32
+}
+
var (
// ErrNoStaticIPRootless is used when a rootless user requests to assign a static IP address
// to a pod or container
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-29 14:01:38 +0000