4 files changed, 75 insertions, 20 deletions

diff --git a/pkg/adapter/client.go b/pkg/adapter/client.go
index f672a92a6..01914834f 100644
--- a/pkg/adapter/client.go
+++ b/pkg/adapter/client.go
@@ -10,44 +10,56 @@ import (
 	"github.com/varlink/go/varlink"
 )
 
-type VarlinkConnectionInfo struct {
-	RemoteUserName string
-	RemoteHost     string
-	VarlinkAddress string
-}
-
-// Connect provides a varlink connection
-func (r RemoteRuntime) Connect() (*varlink.Connection, error) {
-	var (
-		err        error
-		connection *varlink.Connection
-	)
+var remoteEndpoint *Endpoint
 
-	logLevel := r.cmd.LogLevel
+func (r RemoteRuntime) RemoteEndpoint() (remoteEndpoint *Endpoint, err error) {
+	if remoteEndpoint == nil {
+		remoteEndpoint = &Endpoint{Unknown, ""}
+	} else {
+		return remoteEndpoint, nil
+	}
 
 	// I'm leaving this here for now as a document of the birdge format.  It can be removed later once the bridge
 	// function is more flushed out.
-	//bridge := `ssh -T root@192.168.122.1 "/usr/bin/varlink -A '/usr/bin/podman varlink \$VARLINK_ADDRESS' bridge"`
+	// bridge := `ssh -T root@192.168.122.1 "/usr/bin/varlink -A '/usr/bin/podman varlink \$VARLINK_ADDRESS' bridge"`
 	if len(r.cmd.RemoteHost) > 0 {
 		// The user has provided a remote host endpoint
 		if len(r.cmd.RemoteUserName) < 1 {
 			return nil, errors.New("you must provide a username when providing a remote host name")
 		}
-		bridge := fmt.Sprintf(`ssh -T %s@%s /usr/bin/varlink -A \'/usr/bin/podman --log-level=%s varlink \\\$VARLINK_ADDRESS\' bridge`, r.cmd.RemoteUserName, r.cmd.RemoteHost, logLevel)
-		connection, err = varlink.NewBridge(bridge)
+		remoteEndpoint.Type = BridgeConnection
+		remoteEndpoint.Connection = fmt.Sprintf(
+			`ssh -T %s@%s /usr/bin/varlink -A \'/usr/bin/podman --log-level=%s varlink \\\$VARLINK_ADDRESS\' bridge`,
+			r.cmd.RemoteUserName, r.cmd.RemoteHost, r.cmd.LogLevel)
+
 	} else if bridge := os.Getenv("PODMAN_VARLINK_BRIDGE"); bridge != "" {
-		connection, err = varlink.NewBridge(bridge)
+		remoteEndpoint.Type = BridgeConnection
+		remoteEndpoint.Connection = bridge
 	} else {
 		address := os.Getenv("PODMAN_VARLINK_ADDRESS")
 		if address == "" {
 			address = DefaultAddress
 		}
-		connection, err = varlink.NewConnection(address)
+		remoteEndpoint.Type = DirectConnection
+		remoteEndpoint.Connection = address
 	}
+	return
+}
+
+// Connect provides a varlink connection
+func (r RemoteRuntime) Connect() (*varlink.Connection, error) {
+	ep, err := r.RemoteEndpoint()
 	if err != nil {
 		return nil, err
 	}
-	return connection, nil
+
+	switch ep.Type {
+	case DirectConnection:
+		return varlink.NewConnection(ep.Connection)
+	case BridgeConnection:
+		return varlink.NewBridge(ep.Connection)
+	}
+	return nil, errors.New(fmt.Sprintf("Unable to determine type of varlink connection: %s", ep.Connection))
 }
 
 // RefreshConnection is used to replace the current r.Conn after things like
diff --git a/pkg/adapter/client_config.go b/pkg/adapter/client_config.go
index d165ef1cc..3559b16e3 100644
--- a/pkg/adapter/client_config.go
+++ b/pkg/adapter/client_config.go
@@ -2,3 +2,35 @@ package adapter
 
 // DefaultAddress is the default address of the varlink socket
 const DefaultAddress = "unix:/run/podman/io.podman"
+
+// EndpointType declares the type of server connection
+type EndpointType int
+
+// Enum of connection types
+const (
+	Unknown          = iota - 1 // Unknown connection type
+	BridgeConnection            // BridgeConnection proxy connection via ssh
+	DirectConnection            // DirectConnection socket connection to server
+)
+
+// String prints ASCII string for EndpointType
+func (e EndpointType) String() string {
+	// declare an array of strings
+	// ... operator counts how many
+	// items in the array (7)
+	names := [...]string{
+		"BridgeConnection",
+		"DirectConnection",
+	}
+
+	if e < BridgeConnection || e > DirectConnection {
+		return "Unknown"
+	}
+	return names[e]
+}
+
+// Endpoint type and connection string to use
+type Endpoint struct {
+	Type       EndpointType
+	Connection string
+}
diff --git a/pkg/adapter/runtime.go b/pkg/adapter/runtime.go
index 21613c425..37ee1b737 100644
--- a/pkg/adapter/runtime.go
+++ b/pkg/adapter/runtime.go
@@ -398,3 +398,8 @@ func (r *LocalRuntime) GetPodsByStatus(statuses []string) ([]*libpod.Pod, error)
 func (r *LocalRuntime) GetVersion() (libpod.Version, error) {
 	return libpod.GetVersion()
 }
+
+// RemoteEndpoint resolve interface requirement
+func (r *LocalRuntime) RemoteEndpoint() (*Endpoint, error) {
+	return nil, errors.New("RemoteEndpoint() not implemented for local connection")
+}
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index c2c5e0900..0d953ff6f 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -268,7 +268,9 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
 	// SECURITY OPTS
 	g.SetProcessNoNewPrivileges(config.NoNewPrivs)
 
-	g.SetProcessApparmorProfile(config.ApparmorProfile)
+	if !config.Privileged {
+		g.SetProcessApparmorProfile(config.ApparmorProfile)
+	}
 
 	blockAccessToKernelFilesystems(config, &g)
 
@@ -355,6 +357,10 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
 		if addedResources && !cgroup2 {
 			return nil, errors.New("invalid configuration, cannot set resources with rootless containers not using cgroups v2 unified mode")
 		}
+		if !cgroup2 {
+			// Force the resources block to be empty instead of having default values.
+			configSpec.Linux.Resources = &spec.LinuxResources{}
+		}
 	}
 
 	// Make sure that the bind mounts keep options like nosuid, noexec, nodev.