aboutsummaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/api/handlers/compat/containers_archive.go40
-rw-r--r--pkg/api/handlers/compat/images.go2
-rw-r--r--pkg/api/handlers/compat/images_build.go13
-rw-r--r--pkg/auth/auth.go2
-rw-r--r--pkg/bindings/containers/archive.go2
-rw-r--r--pkg/bindings/images/build.go8
-rw-r--r--pkg/bindings/play/play.go1
-rw-r--r--pkg/domain/entities/containers.go6
-rw-r--r--pkg/domain/entities/types.go7
-rw-r--r--pkg/domain/infra/abi/archive.go4
-rw-r--r--pkg/domain/infra/runtime_libpod.go4
-rw-r--r--pkg/machine/config.go27
-rw-r--r--pkg/machine/e2e/config.go8
-rw-r--r--pkg/machine/e2e/inspect_test.go2
-rw-r--r--pkg/machine/e2e/ssh_test.go7
-rw-r--r--pkg/machine/fcos.go7
-rw-r--r--pkg/machine/qemu/machine.go29
-rw-r--r--pkg/machine/wsl/machine.go8
-rw-r--r--pkg/specgen/podspecgen.go5
-rw-r--r--pkg/specgenutil/specgen.go15
-rw-r--r--pkg/util/utils.go2
21 files changed, 132 insertions, 67 deletions
diff --git a/pkg/api/handlers/compat/containers_archive.go b/pkg/api/handlers/compat/containers_archive.go
index 45b13818b..77fbbe38a 100644
--- a/pkg/api/handlers/compat/containers_archive.go
+++ b/pkg/api/handlers/compat/containers_archive.go
@@ -4,6 +4,7 @@ import (
"encoding/json"
"net/http"
"os"
+ "strings"
"github.com/containers/podman/v4/libpod"
"github.com/containers/podman/v4/libpod/define"
@@ -94,11 +95,10 @@ func handleHeadAndGet(w http.ResponseWriter, r *http.Request, decoder *schema.De
func handlePut(w http.ResponseWriter, r *http.Request, decoder *schema.Decoder, runtime *libpod.Runtime) {
query := struct {
- Path string `schema:"path"`
- Chown bool `schema:"copyUIDGID"`
- Rename string `schema:"rename"`
- // TODO handle params below
- NoOverwriteDirNonDir bool `schema:"noOverwriteDirNonDir"`
+ Path string `schema:"path"`
+ Chown bool `schema:"copyUIDGID"`
+ Rename string `schema:"rename"`
+ NoOverwriteDirNonDir bool `schema:"noOverwriteDirNonDir"`
}{
Chown: utils.IsLibpodRequest(r), // backward compatibility
}
@@ -112,7 +112,7 @@ func handlePut(w http.ResponseWriter, r *http.Request, decoder *schema.Decoder,
var rename map[string]string
if query.Rename != "" {
if err := json.Unmarshal([]byte(query.Rename), &rename); err != nil {
- utils.Error(w, http.StatusBadRequest, errors.Wrap(err, "couldn't decode the query"))
+ utils.Error(w, http.StatusBadRequest, errors.Wrap(err, "couldn't decode the query field 'rename'"))
return
}
}
@@ -120,15 +120,25 @@ func handlePut(w http.ResponseWriter, r *http.Request, decoder *schema.Decoder,
containerName := utils.GetName(r)
containerEngine := abi.ContainerEngine{Libpod: runtime}
- copyOptions := entities.CopyOptions{Chown: query.Chown, Rename: rename}
- copyFunc, err := containerEngine.ContainerCopyFromArchive(r.Context(), containerName, query.Path, r.Body, copyOptions)
- if errors.Cause(err) == define.ErrNoSuchCtr || os.IsNotExist(err) {
- // 404 is returned for an absent container and path. The
- // clients must deal with it accordingly.
- utils.Error(w, http.StatusNotFound, errors.Wrap(err, "the container doesn't exists"))
- return
- } else if err != nil {
- utils.Error(w, http.StatusInternalServerError, err)
+ copyFunc, err := containerEngine.ContainerCopyFromArchive(r.Context(), containerName, query.Path, r.Body,
+ entities.CopyOptions{
+ Chown: query.Chown,
+ NoOverwriteDirNonDir: query.NoOverwriteDirNonDir,
+ Rename: rename,
+ })
+ if err != nil {
+ switch {
+ case errors.Cause(err) == define.ErrNoSuchCtr || os.IsNotExist(err):
+ // 404 is returned for an absent container and path. The
+ // clients must deal with it accordingly.
+ utils.Error(w, http.StatusNotFound, errors.Wrap(err, "the container doesn't exists"))
+ case strings.Contains(err.Error(), "copier: put: error creating file"):
+ // Not the best test but need to break this out for compatibility
+ // See vendor/github.com/containers/buildah/copier/copier.go:1585
+ utils.Error(w, http.StatusBadRequest, err)
+ default:
+ utils.Error(w, http.StatusInternalServerError, err)
+ }
return
}
diff --git a/pkg/api/handlers/compat/images.go b/pkg/api/handlers/compat/images.go
index 8c4dea327..76a28fadf 100644
--- a/pkg/api/handlers/compat/images.go
+++ b/pkg/api/handlers/compat/images.go
@@ -460,8 +460,6 @@ func GetImages(w http.ResponseWriter, r *http.Request) {
}
func LoadImages(w http.ResponseWriter, r *http.Request) {
- // TODO this is basically wrong
- // TODO ... improve these ^ messages to something useful
decoder := r.Context().Value(api.DecoderKey).(*schema.Decoder)
runtime := r.Context().Value(api.RuntimeKey).(*libpod.Runtime)
diff --git a/pkg/api/handlers/compat/images_build.go b/pkg/api/handlers/compat/images_build.go
index 0a1bc941d..f47aa523e 100644
--- a/pkg/api/handlers/compat/images_build.go
+++ b/pkg/api/handlers/compat/images_build.go
@@ -80,6 +80,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
CgroupParent string `schema:"cgroupparent"` // nolint
Compression uint64 `schema:"compression"`
ConfigureNetwork string `schema:"networkmode"`
+ CPPFlags string `schema:"cppflags"`
CpuPeriod uint64 `schema:"cpuperiod"` // nolint
CpuQuota int64 `schema:"cpuquota"` // nolint
CpuSetCpus string `schema:"cpusetcpus"` // nolint
@@ -170,7 +171,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
// convert addcaps formats
containerFiles := []string{}
- // Tells if query paramemter `dockerfile` is set or not.
+ // Tells if query parameter `dockerfile` is set or not.
dockerFileSet := false
if utils.IsLibpodRequest(r) && query.Remote != "" {
// The context directory could be a URL. Try to handle that.
@@ -399,6 +400,15 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
}
+ // convert cppflags formats
+ var cppflags = []string{}
+ if _, found := r.URL.Query()["cppflags"]; found {
+ if err := json.Unmarshal([]byte(query.CPPFlags), &cppflags); err != nil {
+ utils.BadRequest(w, "cppflags", query.CPPFlags, err)
+ return
+ }
+ }
+
// convert nsoptions formats
nsoptions := buildah.NamespaceOptions{}
if _, found := r.URL.Query()["nsoptions"]; found {
@@ -555,6 +565,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
AddCapabilities: addCaps,
AdditionalTags: additionalTags,
Annotations: annotations,
+ CPPFlags: cppflags,
Args: buildArgs,
AllPlatforms: query.AllPlatforms,
CommonBuildOpts: &buildah.CommonBuildOptions{
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index 419225007..3a78436d7 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -245,8 +245,6 @@ func authConfigsToAuthFile(authConfigs map[string]types.DockerAuthConfig) (strin
}
authFilePath := tmpFile.Name()
- // TODO: It would be nice if c/image could dump the map at once.
- //
// Now use the c/image packages to store the credentials. It's battle
// tested, and we make sure to use the same code as the image backend.
sys := types.SystemContext{AuthFilePath: authFilePath}
diff --git a/pkg/bindings/containers/archive.go b/pkg/bindings/containers/archive.go
index 4f4b5a36a..dd489d6f1 100644
--- a/pkg/bindings/containers/archive.go
+++ b/pkg/bindings/containers/archive.go
@@ -55,8 +55,6 @@ func CopyFromArchive(ctx context.Context, nameOrID string, path string, reader i
}
// CopyFromArchiveWithOptions copy files into container
-//
-// FIXME: remove this function and make CopyFromArchive accept the option as the last parameter in podman 4.0
func CopyFromArchiveWithOptions(ctx context.Context, nameOrID string, path string, reader io.Reader, options *CopyOptions) (entities.ContainerCopyFunc, error) {
conn, err := bindings.GetClient(ctx)
if err != nil {
diff --git a/pkg/bindings/images/build.go b/pkg/bindings/images/build.go
index 51dcd2aa5..b4b7c36f6 100644
--- a/pkg/bindings/images/build.go
+++ b/pkg/bindings/images/build.go
@@ -65,6 +65,14 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
params.Set("annotations", l)
}
+ if cppflags := options.CPPFlags; len(cppflags) > 0 {
+ l, err := jsoniter.MarshalToString(cppflags)
+ if err != nil {
+ return nil, err
+ }
+ params.Set("cppflags", l)
+ }
+
if options.AllPlatforms {
params.Add("allplatforms", "1")
}
diff --git a/pkg/bindings/play/play.go b/pkg/bindings/play/play.go
index 8058a8514..0261b0250 100644
--- a/pkg/bindings/play/play.go
+++ b/pkg/bindings/play/play.go
@@ -46,7 +46,6 @@ func KubeWithBody(ctx context.Context, body io.Reader, options *KubeOptions) (*e
params.Set("start", strconv.FormatBool(options.GetStart()))
}
- // TODO: have a global system context we can pass around (1st argument)
header, err := auth.MakeXRegistryAuthHeader(&types.SystemContext{AuthFilePath: options.GetAuthfile()}, options.GetUsername(), options.GetPassword())
if err != nil {
return nil, err
diff --git a/pkg/domain/entities/containers.go b/pkg/domain/entities/containers.go
index 1db8b9951..37711ca58 100644
--- a/pkg/domain/entities/containers.go
+++ b/pkg/domain/entities/containers.go
@@ -47,8 +47,7 @@ type ContainerRunlabelOptions struct {
}
// ContainerRunlabelReport contains the results from executing container-runlabel.
-type ContainerRunlabelReport struct {
-}
+type ContainerRunlabelReport struct{}
type WaitOptions struct {
Condition []define.ContainerStatus
@@ -165,6 +164,9 @@ type CopyOptions struct {
Chown bool
// Map to translate path names.
Rename map[string]string
+ // NoOverwriteDirNonDir when true prevents an existing directory or file from being overwritten
+ // by the other type
+ NoOverwriteDirNonDir bool
}
type CommitReport struct {
diff --git a/pkg/domain/entities/types.go b/pkg/domain/entities/types.go
index 5ae8a4931..3e6e54e7d 100644
--- a/pkg/domain/entities/types.go
+++ b/pkg/domain/entities/types.go
@@ -78,10 +78,9 @@ type InspectOptions struct {
// DiffOptions all API and CLI diff commands and diff sub-commands use the same options
type DiffOptions struct {
- Format string `json:",omitempty"` // CLI only
- Latest bool `json:",omitempty"` // API and CLI, only supported by containers
- Archive bool `json:",omitempty"` // CLI only
- Type define.DiffType // Type which should be compared
+ Format string `json:",omitempty"` // CLI only
+ Latest bool `json:",omitempty"` // API and CLI, only supported by containers
+ Type define.DiffType // Type which should be compared
}
// DiffReport provides changes for object
diff --git a/pkg/domain/infra/abi/archive.go b/pkg/domain/infra/abi/archive.go
index 01e3c7dd1..de96cf8b0 100644
--- a/pkg/domain/infra/abi/archive.go
+++ b/pkg/domain/infra/abi/archive.go
@@ -12,10 +12,10 @@ func (ic *ContainerEngine) ContainerCopyFromArchive(ctx context.Context, nameOrI
if err != nil {
return nil, err
}
- return container.CopyFromArchive(ctx, containerPath, options.Chown, options.Rename, reader)
+ return container.CopyFromArchive(ctx, containerPath, options.Chown, options.NoOverwriteDirNonDir, options.Rename, reader)
}
-func (ic *ContainerEngine) ContainerCopyToArchive(ctx context.Context, nameOrID string, containerPath string, writer io.Writer) (entities.ContainerCopyFunc, error) {
+func (ic *ContainerEngine) ContainerCopyToArchive(ctx context.Context, nameOrID, containerPath string, writer io.Writer) (entities.ContainerCopyFunc, error) {
container, err := ic.Libpod.LookupContainer(nameOrID)
if err != nil {
return nil, err
diff --git a/pkg/domain/infra/runtime_libpod.go b/pkg/domain/infra/runtime_libpod.go
index ac557e9de..daa6f0cbf 100644
--- a/pkg/domain/infra/runtime_libpod.go
+++ b/pkg/domain/infra/runtime_libpod.go
@@ -9,9 +9,9 @@ import (
"os"
"os/signal"
"sync"
+ "syscall"
"github.com/containers/common/pkg/cgroups"
- "github.com/containers/podman/v4/cmd/podman/utils"
"github.com/containers/podman/v4/libpod"
"github.com/containers/podman/v4/pkg/domain/entities"
"github.com/containers/podman/v4/pkg/namespaces"
@@ -375,7 +375,7 @@ func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []strin
func StartWatcher(rt *libpod.Runtime) {
// Setup the signal notifier
ch := make(chan os.Signal, 1)
- signal.Notify(ch, utils.SIGHUP)
+ signal.Notify(ch, syscall.SIGHUP)
go func() {
for {
diff --git a/pkg/machine/config.go b/pkg/machine/config.go
index d34776714..abbebc9f9 100644
--- a/pkg/machine/config.go
+++ b/pkg/machine/config.go
@@ -138,14 +138,15 @@ type DistributionDownload interface {
Get() *Download
}
type InspectInfo struct {
- ConfigPath VMFile
- Created time.Time
- Image ImageConfig
- LastUp time.Time
- Name string
- Resources ResourceConfig
- SSHConfig SSHConfig
- State Status
+ ConfigPath VMFile
+ ConnectionInfo ConnectionConfig
+ Created time.Time
+ Image ImageConfig
+ LastUp time.Time
+ Name string
+ Resources ResourceConfig
+ SSHConfig SSHConfig
+ State Status
}
func (rc RemoteConnectionType) MakeSSHURL(host, path, port, userName string) url.URL {
@@ -286,11 +287,11 @@ func NewMachineFile(path string, symlink *string) (*VMFile, error) {
// makeSymlink for macOS creates a symlink in $HOME/.podman/
// for a machinefile like a socket
func (m *VMFile) makeSymlink(symlink *string) error {
- homedir, err := os.UserHomeDir()
+ homeDir, err := os.UserHomeDir()
if err != nil {
return err
}
- sl := filepath.Join(homedir, ".podman", *symlink)
+ sl := filepath.Join(homeDir, ".podman", *symlink)
// make the symlink dir and throw away if it already exists
if err := os.MkdirAll(filepath.Dir(sl), 0700); err != nil && !errors2.Is(err, os.ErrNotExist) {
return err
@@ -335,3 +336,9 @@ type SSHConfig struct {
// RemoteUsername of the vm user
RemoteUsername string
}
+
+// ConnectionConfig contains connections like sockets, etc.
+type ConnectionConfig struct {
+ // PodmanSocket is the exported podman service socket
+ PodmanSocket *VMFile `json:"PodmanSocket"`
+}
diff --git a/pkg/machine/e2e/config.go b/pkg/machine/e2e/config.go
index c17b840d3..248a2f0ad 100644
--- a/pkg/machine/e2e/config.go
+++ b/pkg/machine/e2e/config.go
@@ -85,6 +85,14 @@ func (ms *machineSession) outputToString() string {
return strings.Join(fields, " ")
}
+// errorToString returns the error output from a session in string form
+func (ms *machineSession) errorToString() string {
+ if ms == nil || ms.Err == nil || ms.Err.Contents() == nil {
+ return ""
+ }
+ return string(ms.Err.Contents())
+}
+
// newMB constructor for machine test builders
func newMB() (*machineTestBuilder, error) {
mb := machineTestBuilder{
diff --git a/pkg/machine/e2e/inspect_test.go b/pkg/machine/e2e/inspect_test.go
index 2c9de5664..cdf13bb1a 100644
--- a/pkg/machine/e2e/inspect_test.go
+++ b/pkg/machine/e2e/inspect_test.go
@@ -2,6 +2,7 @@ package e2e
import (
"encoding/json"
+ "strings"
"github.com/containers/podman/v4/pkg/machine"
"github.com/containers/podman/v4/pkg/machine/qemu"
@@ -86,6 +87,7 @@ var _ = Describe("podman machine stop", func() {
var inspectInfo []machine.InspectInfo
err = jsoniter.Unmarshal(inspectSession.Bytes(), &inspectInfo)
Expect(err).To(BeNil())
+ Expect(strings.HasSuffix(inspectInfo[0].ConnectionInfo.PodmanSocket.GetPath(), "podman.sock"))
inspect := new(inspectMachine)
inspect = inspect.withFormat("{{.Name}}")
diff --git a/pkg/machine/e2e/ssh_test.go b/pkg/machine/e2e/ssh_test.go
index 155d39a64..9ee31ac26 100644
--- a/pkg/machine/e2e/ssh_test.go
+++ b/pkg/machine/e2e/ssh_test.go
@@ -56,5 +56,12 @@ var _ = Describe("podman machine ssh", func() {
Expect(err).To(BeNil())
Expect(sshSession).To(Exit(0))
Expect(sshSession.outputToString()).To(ContainSubstring("Fedora CoreOS"))
+
+ // keep exit code
+ sshSession, err = mb.setName(name).setCmd(ssh.withSSHComand([]string{"false"})).run()
+ Expect(err).To(BeNil())
+ Expect(sshSession).To(Exit(1))
+ Expect(sshSession.outputToString()).To(Equal(""))
+ Expect(sshSession.errorToString()).To(Equal(""))
})
})
diff --git a/pkg/machine/fcos.go b/pkg/machine/fcos.go
index df58b8a1e..77427139a 100644
--- a/pkg/machine/fcos.go
+++ b/pkg/machine/fcos.go
@@ -146,13 +146,6 @@ func GetFCOSDownload(imageStream string) (*FcosDownloadInfo, error) { //nolint:s
streamType string
)
- // This is being hard set to testing. Once podman4 is in the
- // fcos trees, we should remove it and re-release at least on
- // macs.
- // TODO: remove when podman4.0 is in coreos
-
- imageStream = "podman-testing" //nolint:staticcheck
-
switch imageStream {
case "podman-testing":
streamType = "podman-testing"
diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
index 6e36b0886..b9f23662e 100644
--- a/pkg/machine/qemu/machine.go
+++ b/pkg/machine/qemu/machine.go
@@ -952,7 +952,8 @@ func (v *MachineVM) SSH(_ string, opts machine.SSHOptions) error {
sshDestination := username + "@localhost"
port := strconv.Itoa(v.Port)
- args := []string{"-i", v.IdentityPath, "-p", port, sshDestination, "-o", "UserKnownHostsFile=/dev/null", "-o", "StrictHostKeyChecking=no"}
+ args := []string{"-i", v.IdentityPath, "-p", port, sshDestination, "-o", "UserKnownHostsFile=/dev/null",
+ "-o", "StrictHostKeyChecking=no", "-o", "LogLevel=ERROR"}
if len(opts.Args) > 0 {
args = append(args, opts.Args...)
} else {
@@ -1471,16 +1472,22 @@ func (v *MachineVM) Inspect() (*machine.InspectInfo, error) {
if err != nil {
return nil, err
}
-
+ connInfo := new(machine.ConnectionConfig)
+ podmanSocket, err := v.forwardSocketPath()
+ if err != nil {
+ return nil, err
+ }
+ connInfo.PodmanSocket = podmanSocket
return &machine.InspectInfo{
- ConfigPath: v.ConfigPath,
- Created: v.Created,
- Image: v.ImageConfig,
- LastUp: v.LastUp,
- Name: v.Name,
- Resources: v.ResourceConfig,
- SSHConfig: v.SSHConfig,
- State: state,
+ ConfigPath: v.ConfigPath,
+ ConnectionInfo: *connInfo,
+ Created: v.Created,
+ Image: v.ImageConfig,
+ LastUp: v.LastUp,
+ Name: v.Name,
+ Resources: v.ResourceConfig,
+ SSHConfig: v.SSHConfig,
+ State: state,
}, nil
}
@@ -1545,7 +1552,7 @@ func (v *MachineVM) editCmdLine(flag string, value string) {
}
}
-// RemoveAndCleanMachines removes all machine and cleans up any other files associatied with podman machine
+// RemoveAndCleanMachines removes all machine and cleans up any other files associated with podman machine
func (p *Provider) RemoveAndCleanMachines() error {
var (
vm machine.VM
diff --git a/pkg/machine/wsl/machine.go b/pkg/machine/wsl/machine.go
index 0b2874baf..06020aded 100644
--- a/pkg/machine/wsl/machine.go
+++ b/pkg/machine/wsl/machine.go
@@ -831,16 +831,16 @@ func (v *MachineVM) Set(_ string, opts machine.SetOptions) ([]error, error) {
}
if opts.CPUs != nil {
- setErrors = append(setErrors, errors.Errorf("changing CPUs not suppored for WSL machines"))
+ setErrors = append(setErrors, errors.Errorf("changing CPUs not supported for WSL machines"))
}
if opts.Memory != nil {
- setErrors = append(setErrors, errors.Errorf("changing memory not suppored for WSL machines"))
+ setErrors = append(setErrors, errors.Errorf("changing memory not supported for WSL machines"))
}
if opts.DiskSize != nil {
- setErrors = append(setErrors, errors.Errorf("changing Disk Size not suppored for WSL machines"))
+ setErrors = append(setErrors, errors.Errorf("changing Disk Size not supported for WSL machines"))
}
return setErrors, v.writeConfig()
@@ -1477,7 +1477,7 @@ func (v *MachineVM) getResources() (resources machine.ResourceConfig) {
return
}
-// RemoveAndCleanMachines removes all machine and cleans up any other files associatied with podman machine
+// RemoveAndCleanMachines removes all machine and cleans up any other files associated with podman machine
func (p *Provider) RemoveAndCleanMachines() error {
var (
vm machine.VM
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
index 603506241..777097ac5 100644
--- a/pkg/specgen/podspecgen.go
+++ b/pkg/specgen/podspecgen.go
@@ -4,6 +4,7 @@ import (
"net"
"github.com/containers/common/libnetwork/types"
+ storageTypes "github.com/containers/storage/types"
spec "github.com/opencontainers/runtime-spec/specs-go"
)
@@ -222,6 +223,10 @@ type PodResourceConfig struct {
type PodSecurityConfig struct {
SecurityOpt []string `json:"security_opt,omitempty"`
+ // IDMappings are UID and GID mappings that will be used by user
+ // namespaces.
+ // Required if UserNS is private.
+ IDMappings *storageTypes.IDMappingOptions `json:"idmappings,omitempty"`
}
// NewPodSpecGenerator creates a new pod spec
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index 9cb2f200b..efaade9cd 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -622,7 +622,14 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
if opt == "no-new-privileges" {
s.ContainerSecurityConfig.NoNewPrivileges = true
} else {
- con := strings.SplitN(opt, "=", 2)
+ // Docker deprecated the ":" syntax but still supports it,
+ // so we need to as well
+ var con []string
+ if strings.Contains(opt, "=") {
+ con = strings.SplitN(opt, "=", 2)
+ } else {
+ con = strings.SplitN(opt, ":", 2)
+ }
if len(con) != 2 {
return fmt.Errorf("invalid --security-opt 1: %q", opt)
}
@@ -650,6 +657,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
}
case "unmask":
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
+ case "no-new-privileges":
+ noNewPrivileges, err := strconv.ParseBool(con[1])
+ if err != nil {
+ return fmt.Errorf("invalid --security-opt 2: %q", opt)
+ }
+ s.ContainerSecurityConfig.NoNewPrivileges = noNewPrivileges
default:
return fmt.Errorf("invalid --security-opt 2: %q", opt)
}
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 1b7663330..ad5db9a1a 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -79,7 +79,7 @@ func ParseRegistryCreds(creds string) (*types.DockerAuthConfig, error) {
}, nil
}
-// StringInSlice is depracated, use containers/common/pkg/util/StringInSlice
+// StringInSlice is deprecated, use containers/common/pkg/util/StringInSlice
func StringInSlice(s string, sl []string) bool {
return util.StringInSlice(s, sl)
}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-10 03:29:32 +0000