summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/api/handlers/compat/images.go14
-rw-r--r--pkg/api/handlers/compat/volumes.go23
-rw-r--r--pkg/api/server/register_volumes.go4
-rw-r--r--pkg/bindings/network/network.go2
-rw-r--r--pkg/domain/entities/images.go7
-rw-r--r--pkg/domain/entities/pods.go1
-rw-r--r--pkg/domain/infra/abi/images.go2
-rw-r--r--pkg/domain/infra/abi/network.go15
-rw-r--r--pkg/domain/infra/tunnel/network.go11
-rw-r--r--pkg/specgen/generate/pod_create.go3
-rw-r--r--pkg/specgen/generate/security.go46
-rw-r--r--pkg/specgen/pod_validate.go4
-rw-r--r--pkg/specgen/podspecgen.go3
13 files changed, 120 insertions, 15 deletions
diff --git a/pkg/api/handlers/compat/images.go b/pkg/api/handlers/compat/images.go
index c1ba9ca66..0900d1793 100644
--- a/pkg/api/handlers/compat/images.go
+++ b/pkg/api/handlers/compat/images.go
@@ -10,6 +10,7 @@ import (
"strings"
"github.com/containers/buildah"
+ "github.com/containers/common/pkg/config"
"github.com/containers/image/v5/manifest"
"github.com/containers/podman/v2/libpod"
image2 "github.com/containers/podman/v2/libpod/image"
@@ -17,7 +18,6 @@ import (
"github.com/containers/podman/v2/pkg/api/handlers/utils"
"github.com/containers/podman/v2/pkg/auth"
"github.com/containers/podman/v2/pkg/domain/entities"
- "github.com/containers/podman/v2/pkg/util"
"github.com/docker/docker/api/types"
"github.com/gorilla/schema"
"github.com/pkg/errors"
@@ -268,6 +268,16 @@ func CreateImageFromImage(w http.ResponseWriter, r *http.Request) {
if sys := runtime.SystemContext(); sys != nil {
registryOpts.DockerCertPath = sys.DockerCertPath
}
+ rtc, err := runtime.GetConfig()
+ if err != nil {
+ utils.Error(w, "Something went wrong.", http.StatusInternalServerError, errors.Wrap(err, "Decode()"))
+ return
+ }
+ pullPolicy, err := config.ValidatePullPolicy(rtc.Engine.PullPolicy)
+ if err != nil {
+ utils.Error(w, "Something went wrong.", http.StatusInternalServerError, errors.Wrap(err, "Decode()"))
+ return
+ }
img, err := runtime.ImageRuntime().New(r.Context(),
fromImage,
"", // signature policy
@@ -276,7 +286,7 @@ func CreateImageFromImage(w http.ResponseWriter, r *http.Request) {
&registryOpts,
image2.SigningOptions{},
nil, // label
- util.PullImageMissing,
+ pullPolicy,
)
if err != nil {
utils.Error(w, "Something went wrong.", http.StatusInternalServerError, err)
diff --git a/pkg/api/handlers/compat/volumes.go b/pkg/api/handlers/compat/volumes.go
index 976c52acb..a45509fdb 100644
--- a/pkg/api/handlers/compat/volumes.go
+++ b/pkg/api/handlers/compat/volumes.go
@@ -93,6 +93,29 @@ func CreateVolume(w http.ResponseWriter, r *http.Request) {
return
}
+ // See if the volume exists already
+ existingVolume, err := runtime.GetVolume(input.Name)
+ if err != nil && errors.Cause(err) != define.ErrNoSuchVolume {
+ utils.InternalServerError(w, err)
+ return
+ }
+
+ // if using the compat layer and the volume already exists, we
+ // must return a 201 with the same information as create
+ if existingVolume != nil && !utils.IsLibpodRequest(r) {
+ response := docker_api_types.Volume{
+ CreatedAt: existingVolume.CreatedTime().Format(time.RFC3339),
+ Driver: existingVolume.Driver(),
+ Labels: existingVolume.Labels(),
+ Mountpoint: existingVolume.MountPoint(),
+ Name: existingVolume.Name(),
+ Options: existingVolume.Options(),
+ Scope: existingVolume.Scope(),
+ }
+ utils.WriteResponse(w, http.StatusCreated, response)
+ return
+ }
+
if len(input.Name) > 0 {
volumeOptions = append(volumeOptions, libpod.WithVolumeName(input.Name))
}
diff --git a/pkg/api/server/register_volumes.go b/pkg/api/server/register_volumes.go
index 22488b158..aa0f67604 100644
--- a/pkg/api/server/register_volumes.go
+++ b/pkg/api/server/register_volumes.go
@@ -154,7 +154,9 @@ func (s *APIServer) registerVolumeHandlers(r *mux.Router) error {
// parameters:
// - in: body
// name: create
- // description: attributes for creating a container
+ // description: |
+ // attributes for creating a container.
+ // Note: If a volume by the same name exists, a 201 response with that volume's information will be generated.
// schema:
// $ref: "#/definitions/DockerVolumeCreate"
// produces:
diff --git a/pkg/bindings/network/network.go b/pkg/bindings/network/network.go
index d8dc7e352..151d15d3e 100644
--- a/pkg/bindings/network/network.go
+++ b/pkg/bindings/network/network.go
@@ -60,7 +60,7 @@ func Remove(ctx context.Context, nameOrID string, force *bool) ([]*entities.Netw
}
params := url.Values{}
if force != nil {
- params.Set("size", strconv.FormatBool(*force))
+ params.Set("force", strconv.FormatBool(*force))
}
response, err := conn.DoRequest(nil, http.MethodDelete, "/networks/%s", params, nil, nameOrID)
if err != nil {
diff --git a/pkg/domain/entities/images.go b/pkg/domain/entities/images.go
index cad6693fa..ac81c282d 100644
--- a/pkg/domain/entities/images.go
+++ b/pkg/domain/entities/images.go
@@ -3,6 +3,7 @@ package entities
import (
"time"
+ "github.com/containers/common/pkg/config"
"github.com/containers/image/v5/manifest"
"github.com/containers/image/v5/types"
"github.com/containers/podman/v2/pkg/inspect"
@@ -119,8 +120,8 @@ type ImageHistoryReport struct {
// ImagePullOptions are the arguments for pulling images.
type ImagePullOptions struct {
- // AllTags can be specified to pull all tags of the spiecifed image. Note
- // that this only works if the specified image does not include a tag.
+ // AllTags can be specified to pull all tags of an image. Note
+ // that this only works if the image does not include a tag.
AllTags bool
// Authfile is the path to the authentication file. Ignored for remote
// calls.
@@ -146,6 +147,8 @@ type ImagePullOptions struct {
SignaturePolicy string
// SkipTLSVerify to skip HTTPS and certificate verification.
SkipTLSVerify types.OptionalBool
+ // PullPolicy whether to pull new image
+ PullPolicy config.PullPolicy
}
// ImagePullReport is the response from pulling one or more images.
diff --git a/pkg/domain/entities/pods.go b/pkg/domain/entities/pods.go
index 7b38dbd87..426419833 100644
--- a/pkg/domain/entities/pods.go
+++ b/pkg/domain/entities/pods.go
@@ -142,6 +142,7 @@ func (p PodCreateOptions) ToPodSpecGen(s *specgen.PodSpecGenerator) {
s.StaticMAC = p.Net.StaticMAC
s.PortMappings = p.Net.PublishPorts
s.CNINetworks = p.Net.CNINetworks
+ s.NetworkOptions = p.Net.NetworkOptions
if p.Net.UseImageResolvConf {
s.NoManageResolvConf = true
}
diff --git a/pkg/domain/infra/abi/images.go b/pkg/domain/infra/abi/images.go
index 25c0c184f..d56dc7d94 100644
--- a/pkg/domain/infra/abi/images.go
+++ b/pkg/domain/infra/abi/images.go
@@ -255,7 +255,7 @@ func pull(ctx context.Context, runtime *image.Runtime, rawImage string, options
}
if !options.AllTags {
- newImage, err := runtime.New(ctx, rawImage, options.SignaturePolicy, options.Authfile, writer, &dockerRegistryOptions, image.SigningOptions{}, label, util.PullImageAlways)
+ newImage, err := runtime.New(ctx, rawImage, options.SignaturePolicy, options.Authfile, writer, &dockerRegistryOptions, image.SigningOptions{}, label, options.PullPolicy)
if err != nil {
return nil, err
}
diff --git a/pkg/domain/infra/abi/network.go b/pkg/domain/infra/abi/network.go
index 807e4b272..053be6528 100644
--- a/pkg/domain/infra/abi/network.go
+++ b/pkg/domain/infra/abi/network.go
@@ -82,12 +82,21 @@ func (ic *ContainerEngine) NetworkRm(ctx context.Context, namesOrIds []string, o
// We need to iterate containers looking to see if they belong to the given network
for _, c := range containers {
if util.StringInSlice(name, c.Config().Networks) {
- // if user passes force, we nuke containers
+ // if user passes force, we nuke containers and pods
if !options.Force {
// Without the force option, we return an error
- return reports, errors.Errorf("%q has associated containers with it. Use -f to forcibly delete containers", name)
+ return reports, errors.Errorf("%q has associated containers with it. Use -f to forcibly delete containers and pods", name)
}
- if err := ic.Libpod.RemoveContainer(ctx, c, true, true); err != nil {
+ if c.IsInfra() {
+ // if we have a infra container we need to remove the pod
+ pod, err := ic.Libpod.GetPod(c.PodID())
+ if err != nil {
+ return reports, err
+ }
+ if err := ic.Libpod.RemovePod(ctx, pod, true, true); err != nil {
+ return reports, err
+ }
+ } else if err := ic.Libpod.RemoveContainer(ctx, c, true, true); err != nil {
return reports, err
}
}
diff --git a/pkg/domain/infra/tunnel/network.go b/pkg/domain/infra/tunnel/network.go
index 074425087..d155fdd9e 100644
--- a/pkg/domain/infra/tunnel/network.go
+++ b/pkg/domain/infra/tunnel/network.go
@@ -26,11 +26,16 @@ func (ic *ContainerEngine) NetworkInspect(ctx context.Context, namesOrIds []stri
func (ic *ContainerEngine) NetworkRm(ctx context.Context, namesOrIds []string, options entities.NetworkRmOptions) ([]*entities.NetworkRmReport, error) {
reports := make([]*entities.NetworkRmReport, 0, len(namesOrIds))
for _, name := range namesOrIds {
- report, err := network.Remove(ic.ClientCxt, name, &options.Force)
+ response, err := network.Remove(ic.ClientCxt, name, &options.Force)
if err != nil {
- report[0].Err = err
+ report := &entities.NetworkRmReport{
+ Name: name,
+ Err: err,
+ }
+ reports = append(reports, report)
+ } else {
+ reports = append(reports, response...)
}
- reports = append(reports, report...)
}
return reports, nil
}
diff --git a/pkg/specgen/generate/pod_create.go b/pkg/specgen/generate/pod_create.go
index 101201252..43caf0fe9 100644
--- a/pkg/specgen/generate/pod_create.go
+++ b/pkg/specgen/generate/pod_create.go
@@ -99,6 +99,9 @@ func createPodOptions(p *specgen.PodSpecGenerator, rt *libpod.Runtime) ([]libpod
case specgen.Host:
logrus.Debugf("Pod will use host networking")
options = append(options, libpod.WithPodHostNetwork())
+ case specgen.Slirp:
+ logrus.Debugf("Pod will use slirp4netns")
+ options = append(options, libpod.WithPodSlirp4netns(p.NetworkOptions))
default:
return nil, errors.Errorf("pods presently do not support network mode %s", p.NetNS.NSMode)
}
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index 87e8029a7..7c818cf62 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -7,6 +7,7 @@ import (
"github.com/containers/common/pkg/capabilities"
"github.com/containers/common/pkg/config"
"github.com/containers/podman/v2/libpod"
+ "github.com/containers/podman/v2/libpod/define"
"github.com/containers/podman/v2/libpod/image"
"github.com/containers/podman/v2/pkg/specgen"
"github.com/containers/podman/v2/pkg/util"
@@ -167,7 +168,52 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
}
g.SetRootReadonly(s.ReadOnlyFilesystem)
+
+ // Add default sysctls
+ defaultSysctls, err := util.ValidateSysctls(rtc.Sysctls())
+ if err != nil {
+ return err
+ }
+ for sysctlKey, sysctlVal := range defaultSysctls {
+
+ // Ignore mqueue sysctls if --ipc=host
+ if s.IpcNS.IsHost() && strings.HasPrefix(sysctlKey, "fs.mqueue.") {
+ logrus.Infof("Sysctl %s=%s ignored in containers.conf, since IPC Namespace set to host", sysctlKey, sysctlVal)
+
+ continue
+ }
+
+ // Ignore net sysctls if --net=host
+ if s.NetNS.IsHost() && strings.HasPrefix(sysctlKey, "net.") {
+ logrus.Infof("Sysctl %s=%s ignored in containers.conf, since Network Namespace set to host", sysctlKey, sysctlVal)
+ continue
+ }
+
+ // Ignore uts sysctls if --uts=host
+ if s.UtsNS.IsHost() && (strings.HasPrefix(sysctlKey, "kernel.domainname") || strings.HasPrefix(sysctlKey, "kernel.hostname")) {
+ logrus.Infof("Sysctl %s=%s ignored in containers.conf, since UTS Namespace set to host", sysctlKey, sysctlVal)
+ continue
+ }
+
+ g.AddLinuxSysctl(sysctlKey, sysctlVal)
+ }
+
for sysctlKey, sysctlVal := range s.Sysctl {
+
+ if s.IpcNS.IsHost() && strings.HasPrefix(sysctlKey, "fs.mqueue.") {
+ return errors.Wrapf(define.ErrInvalidArg, "sysctl %s=%s can't be set since IPC Namespace set to host", sysctlKey, sysctlVal)
+ }
+
+ // Ignore net sysctls if --net=host
+ if s.NetNS.IsHost() && strings.HasPrefix(sysctlKey, "net.") {
+ return errors.Wrapf(define.ErrInvalidArg, "sysctl %s=%s can't be set since Host Namespace set to host", sysctlKey, sysctlVal)
+ }
+
+ // Ignore uts sysctls if --uts=host
+ if s.UtsNS.IsHost() && (strings.HasPrefix(sysctlKey, "kernel.domainname") || strings.HasPrefix(sysctlKey, "kernel.hostname")) {
+ return errors.Wrapf(define.ErrInvalidArg, "sysctl %s=%s can't be set since UTS Namespace set to host", sysctlKey, sysctlVal)
+ }
+
g.AddLinuxSysctl(sysctlKey, sysctlVal)
}
diff --git a/pkg/specgen/pod_validate.go b/pkg/specgen/pod_validate.go
index 907c0bb69..a6c61a203 100644
--- a/pkg/specgen/pod_validate.go
+++ b/pkg/specgen/pod_validate.go
@@ -72,9 +72,9 @@ func (p *PodSpecGenerator) Validate() error {
return exclusivePodOptions("NoInfra", "NoManageResolvConf")
}
}
- if p.NetNS.NSMode != "" && p.NetNS.NSMode != Bridge && p.NetNS.NSMode != Default {
+ if p.NetNS.NSMode != "" && p.NetNS.NSMode != Bridge && p.NetNS.NSMode != Slirp && p.NetNS.NSMode != Default {
if len(p.PortMappings) > 0 {
- return errors.New("PortMappings can only be used with Bridge mode networking")
+ return errors.New("PortMappings can only be used with Bridge or slirp4netns networking")
}
if len(p.CNINetworks) > 0 {
return errors.New("CNINetworks can only be used with Bridge mode networking")
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
index 3c32ec365..7d771f5bb 100644
--- a/pkg/specgen/podspecgen.go
+++ b/pkg/specgen/podspecgen.go
@@ -134,6 +134,9 @@ type PodNetworkConfig struct {
// Conflicts with NoInfra=true and NoManageHosts.
// Optional.
HostAdd []string `json:"hostadd,omitempty"`
+ // NetworkOptions are additional options for each network
+ // Optional.
+ NetworkOptions map[string][]string `json:"network_options,omitempty"`
}
// PodCgroupConfig contains configuration options about a pod's cgroups.
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-25 18:26:28 +0000