summaryrefslogtreecommitdiff
path: root/vendor/github.com
diff options
context:
space:
mode:
Diffstat (limited to 'vendor/github.com')
-rw-r--r--vendor/github.com/containers/buildah/CONTRIBUTING.md2
-rw-r--r--vendor/github.com/containers/buildah/buildah.go2
-rw-r--r--vendor/github.com/containers/buildah/chroot/run.go2
-rw-r--r--vendor/github.com/containers/buildah/go.mod6
-rw-r--r--vendor/github.com/containers/buildah/go.sum13
-rw-r--r--vendor/github.com/containers/buildah/image.go2
-rw-r--r--vendor/github.com/containers/buildah/imagebuildah/stage_executor.go8
-rw-r--r--vendor/github.com/containers/buildah/pull.go7
-rw-r--r--vendor/github.com/containers/buildah/run_linux.go16
-rw-r--r--vendor/github.com/containers/buildah/util/util.go4
-rw-r--r--vendor/github.com/containers/buildah/util/util_linux.go9
-rw-r--r--vendor/github.com/containers/buildah/util/util_unsupported.go12
-rw-r--r--vendor/github.com/containers/common/pkg/config/config.go206
-rw-r--r--vendor/github.com/containers/common/pkg/config/containers.conf30
-rw-r--r--vendor/github.com/containers/common/pkg/config/default.go14
-rw-r--r--vendor/github.com/containers/common/pkg/config/libpodConfig.go382
16 files changed, 574 insertions, 141 deletions
diff --git a/vendor/github.com/containers/buildah/CONTRIBUTING.md b/vendor/github.com/containers/buildah/CONTRIBUTING.md
index 0178a517c..553cb15dc 100644
--- a/vendor/github.com/containers/buildah/CONTRIBUTING.md
+++ b/vendor/github.com/containers/buildah/CONTRIBUTING.md
@@ -178,7 +178,7 @@ that has been setup.
#### Buildah Mailing List
-You can join the Buildah mailing list by sending an email to `buildah-join@lists.buildah.io` with the word `subscribe` in the subject. You can also go to this [page](https://lists.podman.io/admin/lists/buildah.lists.buildah.io/), then scroll down to the bottom of the page and enter your email and optionally name, then click on the "Subscribe" buton.
+You can join the Buildah mailing list by sending an email to `buildah-join@lists.buildah.io` with the word `subscribe` in the subject. You can also go to this [page](https://lists.podman.io/admin/lists/buildah.lists.buildah.io/), then scroll down to the bottom of the page and enter your email and optionally name, then click on the "Subscribe" button.
#### GitHub
You can also use the github
diff --git a/vendor/github.com/containers/buildah/buildah.go b/vendor/github.com/containers/buildah/buildah.go
index 6d1d479b1..2ece11acd 100644
--- a/vendor/github.com/containers/buildah/buildah.go
+++ b/vendor/github.com/containers/buildah/buildah.go
@@ -27,7 +27,7 @@ const (
Package = "buildah"
// Version for the Package. Bump version in contrib/rpm/buildah.spec
// too.
- Version = "1.14.2"
+ Version = "1.15.0-dev"
// The value we use to identify what type of information, currently a
// serialized Builder structure, we are using as per-container state.
// This should only be changed when we make incompatible changes to
diff --git a/vendor/github.com/containers/buildah/chroot/run.go b/vendor/github.com/containers/buildah/chroot/run.go
index 482fef693..8dfa8aba0 100644
--- a/vendor/github.com/containers/buildah/chroot/run.go
+++ b/vendor/github.com/containers/buildah/chroot/run.go
@@ -656,7 +656,7 @@ func runUsingChrootExecMain() {
// Set the hostname. We're already in a distinct UTS namespace and are admins in the user
// namespace which created it, so we shouldn't get a permissions error, but seccomp policy
// might deny our attempt to call sethostname() anyway, so log a debug message for that.
- if options.Spec.Hostname != "" {
+ if options.Spec != nil && options.Spec.Hostname != "" {
if err := unix.Sethostname([]byte(options.Spec.Hostname)); err != nil {
logrus.Debugf("failed to set hostname %q for process: %v", options.Spec.Hostname, err)
}
diff --git a/vendor/github.com/containers/buildah/go.mod b/vendor/github.com/containers/buildah/go.mod
index 72fbffe2c..97b2eeae8 100644
--- a/vendor/github.com/containers/buildah/go.mod
+++ b/vendor/github.com/containers/buildah/go.mod
@@ -4,9 +4,9 @@ go 1.12
require (
github.com/containernetworking/cni v0.7.2-0.20190904153231-83439463f784
- github.com/containers/common v0.4.2
+ github.com/containers/common v0.5.0
github.com/containers/image/v5 v5.2.1
- github.com/containers/storage v1.16.1
+ github.com/containers/storage v1.16.2
github.com/cyphar/filepath-securejoin v0.2.2
github.com/docker/distribution v2.7.1+incompatible
github.com/docker/go-metrics v0.0.1 // indirect
@@ -25,7 +25,7 @@ require (
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7
github.com/opencontainers/runtime-tools v0.9.0
- github.com/opencontainers/selinux v1.3.3
+ github.com/opencontainers/selinux v1.4.0
github.com/openshift/api v0.0.0-20200106203948-7ab22a2c8316
github.com/openshift/imagebuilder v1.1.1
github.com/pkg/errors v0.9.1
diff --git a/vendor/github.com/containers/buildah/go.sum b/vendor/github.com/containers/buildah/go.sum
index 79dc064ce..191eb1f11 100644
--- a/vendor/github.com/containers/buildah/go.sum
+++ b/vendor/github.com/containers/buildah/go.sum
@@ -103,6 +103,14 @@ github.com/containers/common v0.4.1 h1:Uu7f2ZDM/5xsqOkZwIEVKSjUI3YxKjvNIY5x57kja
github.com/containers/common v0.4.1/go.mod h1:m62kenckrWi5rZx32kaLje2Og0hpf6NsaTBn6+b+Oys=
github.com/containers/common v0.4.2 h1:O5d1gj/xdpQdZi0MEivRQ/7AeRaVeHdbSP/bvShw458=
github.com/containers/common v0.4.2/go.mod h1:m62kenckrWi5rZx32kaLje2Og0hpf6NsaTBn6+b+Oys=
+github.com/containers/common v0.4.3 h1:TJ7UQxB8wf//IY4LNZobswrTjbhIjXpidrRbCA2l+kg=
+github.com/containers/common v0.4.3/go.mod h1:m62kenckrWi5rZx32kaLje2Og0hpf6NsaTBn6+b+Oys=
+github.com/containers/common v0.4.4 h1:oXQUPDQOIQ+XmQ2cWyLCs2TctDfISykAr1gEa3CNwlQ=
+github.com/containers/common v0.4.4/go.mod h1:vMkHkvczHslJbUj8xasSQmdNrLUgZYuUxVNGJDfjRIQ=
+github.com/containers/common v0.5.0 h1:ZAef7h3oO46PcbTyfooZf8XLHrYad+GkhSu3EhH6P24=
+github.com/containers/common v0.5.0/go.mod h1:m62kenckrWi5rZx32kaLje2Og0hpf6NsaTBn6+b+Oys=
+github.com/containers/common v1.0.0 h1:sZB48LzGP4bP1CmrkQIFUzdUVBysqRv3kWVk4+qbaVA=
+github.com/containers/common v1.0.0/go.mod h1:m62kenckrWi5rZx32kaLje2Og0hpf6NsaTBn6+b+Oys=
github.com/containers/conmon v2.0.10+incompatible/go.mod h1:hgwZ2mtuDrppv78a/cOBNiCm6O0UMWGx1mu7P00nu5I=
github.com/containers/image/v4 v4.0.1 h1:idNGHChj0Pyv3vLrxul2oSVMZLeFqpoq3CjLeVgapSQ=
github.com/containers/image/v4 v4.0.1/go.mod h1:0ASJH1YgJiX/eqFZObqepgsvIA4XjCgpyfwn9pDGafA=
@@ -149,6 +157,8 @@ github.com/containers/storage v1.16.0 h1:sD+s7BmiNBh61CuHN3j8PXGCwMtV9zPVJETAlsh
github.com/containers/storage v1.16.0/go.mod h1:nqN09JSi1/RSI1UAUwDYXPRiGSlq5FPbNkN/xb0TfG0=
github.com/containers/storage v1.16.1 h1:gVLVqbqaoyopLJbcQ9PQdsnm8SzVy6Vw24fofwMgkE0=
github.com/containers/storage v1.16.1/go.mod h1:toFp72SLn/iyJ6YbrnrZ0bW63aH2Qw3dA8JVwL4ADPo=
+github.com/containers/storage v1.16.2 h1:S77Y+lmJcnGoPEZB2OOrTrRGyjT8viDCGyhVNNz78h8=
+github.com/containers/storage v1.16.2/go.mod h1:/RNmsK01ajCL+VtMSi3W8kHzpBwN+Q5gLYWgfw5wlMg=
github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
@@ -281,6 +291,7 @@ github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5a
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
@@ -495,6 +506,8 @@ github.com/opencontainers/selinux v1.3.2 h1:DR4lL9SYVjgcTZKEZIncvDU06fKSc/eygjmN
github.com/opencontainers/selinux v1.3.2/go.mod h1:yTcKuYAh6R95iDpefGLQaPaRwJFwyzAJufJyiTt7s0g=
github.com/opencontainers/selinux v1.3.3 h1:RX0wAeqtvVSYQcr017X3pFXPkLEtB6V4NjRD7gVQgg4=
github.com/opencontainers/selinux v1.3.3/go.mod h1:yTcKuYAh6R95iDpefGLQaPaRwJFwyzAJufJyiTt7s0g=
+github.com/opencontainers/selinux v1.4.0 h1:cpiX/2wWIju/6My60T6/z9CxNG7c8xTQyEmA9fChpUo=
+github.com/opencontainers/selinux v1.4.0/go.mod h1:yTcKuYAh6R95iDpefGLQaPaRwJFwyzAJufJyiTt7s0g=
github.com/openshift/api v0.0.0-20200106203948-7ab22a2c8316 h1:enQG2QUGwug4fR1yM6hL0Fjzx6Km/exZY6RbSPwMu3o=
github.com/openshift/api v0.0.0-20200106203948-7ab22a2c8316/go.mod h1:dv+J0b/HWai0QnMVb37/H0v36klkLBi2TNpPeWDxX10=
github.com/openshift/api v3.9.1-0.20190810003144-27fb16909b15+incompatible h1:s55wx8JIG/CKnewev892HifTBrtKzMdvgB3rm4rxC2s=
diff --git a/vendor/github.com/containers/buildah/image.go b/vendor/github.com/containers/buildah/image.go
index d333442b8..94e97d870 100644
--- a/vendor/github.com/containers/buildah/image.go
+++ b/vendor/github.com/containers/buildah/image.go
@@ -627,7 +627,7 @@ func (i *containerImageSource) GetBlob(ctx context.Context, blob types.BlobInfo,
logrus.Debugf("error checking for layer %q in %q: %v", blob.Digest.String(), path, err)
}
}
- if err != nil {
+ if err != nil || layerFile == nil {
logrus.Debugf("error reading layer %q: %v", blob.Digest.String(), err)
return nil, -1, errors.Wrapf(err, "error opening file %q to buffer layer blob", filepath.Join(i.path, blob.Digest.String()))
}
diff --git a/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go b/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go
index 6216dac97..8e49395a4 100644
--- a/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go
+++ b/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go
@@ -238,7 +238,13 @@ func (s *StageExecutor) volumeCacheRestore() error {
if err := os.Chmod(archivedPath, st.Mode()); err != nil {
return errors.Wrapf(err, "error restoring permissions on %q", archivedPath)
}
- if err := os.Chown(archivedPath, 0, 0); err != nil {
+ uid := 0
+ gid := 0
+ if st.Sys() != nil {
+ uid = util.UID(st)
+ gid = util.GID(st)
+ }
+ if err := os.Chown(archivedPath, uid, gid); err != nil {
return errors.Wrapf(err, "error setting ownership on %q", archivedPath)
}
if err := os.Chtimes(archivedPath, st.ModTime(), st.ModTime()); err != nil {
diff --git a/vendor/github.com/containers/buildah/pull.go b/vendor/github.com/containers/buildah/pull.go
index 4a38abeab..cbb98cbcf 100644
--- a/vendor/github.com/containers/buildah/pull.go
+++ b/vendor/github.com/containers/buildah/pull.go
@@ -216,8 +216,13 @@ func Pull(ctx context.Context, imageName string, options PullOptions) (imageID s
} else {
imageID = img.ID
}
+ if errs == nil {
+ err = nil
+ } else {
+ err = errs.ErrorOrNil()
+ }
- return imageID, errs.ErrorOrNil()
+ return imageID, err
}
func pullImage(ctx context.Context, store storage.Store, srcRef types.ImageReference, options PullOptions, sc *types.SystemContext) (types.ImageReference, error) {
diff --git a/vendor/github.com/containers/buildah/run_linux.go b/vendor/github.com/containers/buildah/run_linux.go
index 6df6ef41a..6e4d31d78 100644
--- a/vendor/github.com/containers/buildah/run_linux.go
+++ b/vendor/github.com/containers/buildah/run_linux.go
@@ -702,7 +702,9 @@ func runUsingRuntime(isolation Isolation, options RunOptions, configureNetwork b
return 1, errors.Wrapf(err, "error creating pipe for notifying to stop stdio")
}
finishedCopy := make(chan struct{})
+ var pargs []string
if spec.Process != nil {
+ pargs = spec.Process.Args
if spec.Process.Terminal {
copyConsole = true
// Create a listening socket for accepting the container's terminal's PTY master.
@@ -773,7 +775,7 @@ func runUsingRuntime(isolation Isolation, options RunOptions, configureNetwork b
logrus.Debugf("Running %q", create.Args)
err = create.Run()
if err != nil {
- return 1, errors.Wrapf(err, "error creating container for %v: %s", spec.Process.Args, runCollectOutput(errorFds, closeBeforeReadingErrorFds))
+ return 1, errors.Wrapf(err, "error creating container for %v: %s", pargs, runCollectOutput(errorFds, closeBeforeReadingErrorFds))
}
defer func() {
err2 := del.Run()
@@ -808,7 +810,7 @@ func runUsingRuntime(isolation Isolation, options RunOptions, configureNetwork b
}()
if configureNetwork {
- teardown, err := runConfigureNetwork(isolation, options, configureNetworks, pid, containerName, spec.Process.Args)
+ teardown, err := runConfigureNetwork(isolation, options, configureNetworks, pid, containerName, pargs)
if teardown != nil {
defer teardown()
}
@@ -1044,6 +1046,9 @@ func runConfigureNetwork(isolation Isolation, options RunOptions, configureNetwo
}
continue
}
+ if nc.Network == nil {
+ continue
+ }
cl, err := libcni.ConfListFromConf(nc)
if err != nil {
return nil, errors.Wrapf(err, "error converting networking configuration from file %q for %v", file, command)
@@ -1450,8 +1455,13 @@ func runUsingRuntimeMain() {
if err := setChildProcess(); err != nil {
os.Exit(1)
}
+ var ospec *specs.Spec
+ if options.Spec != nil {
+ ospec = options.Spec
+ }
+
// Run the container, start to finish.
- status, err := runUsingRuntime(options.Isolation, options.Options, options.ConfigureNetwork, options.ConfigureNetworks, options.MoreCreateArgs, options.Spec, options.BundlePath, options.ContainerName)
+ status, err := runUsingRuntime(options.Isolation, options.Options, options.ConfigureNetwork, options.ConfigureNetworks, options.MoreCreateArgs, ospec, options.BundlePath, options.ContainerName)
if err != nil {
fmt.Fprintf(os.Stderr, "error running container: %v\n", err)
os.Exit(1)
diff --git a/vendor/github.com/containers/buildah/util/util.go b/vendor/github.com/containers/buildah/util/util.go
index 05d661b58..a358b7c54 100644
--- a/vendor/github.com/containers/buildah/util/util.go
+++ b/vendor/github.com/containers/buildah/util/util.go
@@ -365,7 +365,7 @@ func GetHostIDs(uidmap, gidmap []specs.LinuxIDMapping, uid, gid uint32) (uint32,
// GetHostRootIDs uses ID mappings in spec to compute the host-level IDs that will
// correspond to UID/GID 0/0 in the container.
func GetHostRootIDs(spec *specs.Spec) (uint32, uint32, error) {
- if spec.Linux == nil {
+ if spec == nil || spec.Linux == nil {
return 0, 0, nil
}
return GetHostIDs(spec.Linux.UIDMappings, spec.Linux.GIDMappings, 0, 0)
@@ -455,7 +455,7 @@ func FindLocalRuntime(runtime string) string {
logrus.Debugf("Error loading container config when searching for local runtime.")
return localRuntime
}
- for _, val := range conf.Libpod.OCIRuntimes[runtime] {
+ for _, val := range conf.Engine.OCIRuntimes[runtime] {
if fileExistsAndNotADir(val) {
localRuntime = val
break
diff --git a/vendor/github.com/containers/buildah/util/util_linux.go b/vendor/github.com/containers/buildah/util/util_linux.go
index cca1f9e7e..1a13699df 100644
--- a/vendor/github.com/containers/buildah/util/util_linux.go
+++ b/vendor/github.com/containers/buildah/util/util_linux.go
@@ -1,6 +1,7 @@
package util
import (
+ "os"
"syscall"
"golang.org/x/sys/unix"
@@ -18,3 +19,11 @@ func IsCgroup2UnifiedMode() (bool, error) {
})
return isUnified, isUnifiedErr
}
+
+func UID(st os.FileInfo) int {
+ return int(st.Sys().(*syscall.Stat_t).Uid)
+}
+
+func GID(st os.FileInfo) int {
+ return int(st.Sys().(*syscall.Stat_t).Gid)
+}
diff --git a/vendor/github.com/containers/buildah/util/util_unsupported.go b/vendor/github.com/containers/buildah/util/util_unsupported.go
index 05a68f60b..8810536a6 100644
--- a/vendor/github.com/containers/buildah/util/util_unsupported.go
+++ b/vendor/github.com/containers/buildah/util/util_unsupported.go
@@ -2,7 +2,19 @@
package util
+import (
+ "os"
+)
+
// IsCgroup2UnifiedMode returns whether we are running in cgroup 2 cgroup2 mode.
func IsCgroup2UnifiedMode() (bool, error) {
return false, nil
}
+
+func UID(st os.FileInfo) int {
+ return 0
+}
+
+func GID(st os.FileInfo) int {
+ return 0
+}
diff --git a/vendor/github.com/containers/common/pkg/config/config.go b/vendor/github.com/containers/common/pkg/config/config.go
index 4b536b3a5..0a09d994e 100644
--- a/vendor/github.com/containers/common/pkg/config/config.go
+++ b/vendor/github.com/containers/common/pkg/config/config.go
@@ -12,7 +12,6 @@ import (
"github.com/BurntSushi/toml"
"github.com/containers/common/pkg/capabilities"
"github.com/containers/common/pkg/unshare"
- "github.com/containers/storage"
units "github.com/docker/go-units"
selinux "github.com/opencontainers/selinux/go-selinux"
"github.com/pkg/errors"
@@ -29,14 +28,14 @@ const (
)
// RuntimeStateStore is a constant indicating which state store implementation
-// should be used by libpod
+// should be used by engine
type RuntimeStateStore int
const (
// InvalidStateStore is an invalid state store
InvalidStateStore RuntimeStateStore = iota
// InMemoryStateStore is an in-memory state that will not persist data
- // on containers and pods between libpod instances or after system
+ // on containers and pods between engine instances or after system
// reboot
InMemoryStateStore RuntimeStateStore = iota
// SQLiteStateStore is a state backed by a SQLite database
@@ -46,12 +45,24 @@ const (
BoltDBStateStore RuntimeStateStore = iota
)
+// PullPolicy whether to pull new image
+type PullPolicy int
+
+const (
+ // PullImageAlways always try to pull new image when create or run
+ PullImageAlways PullPolicy = iota
+ // PullImageMissing pulls image if it is not locally
+ PullImageMissing
+ // PullImageNever will never pull new image
+ PullImageNever
+)
+
// Config contains configuration options for container tools
type Config struct {
// Containers specify settings that configure how containers will run ont the system
Containers ContainersConfig `toml:"containers"`
- // Libpod specifies how the container engine based on Libpod will run
- Libpod LibpodConfig `toml:"libpod"`
+ // Engine specifies how the container engine based on Engine will run
+ Engine EngineConfig `toml:"engine"`
// Network section defines the configuration of CNI Plugins
Network NetworkConfig `toml:"network"`
}
@@ -164,8 +175,12 @@ type ContainersConfig struct {
UserNSSize int `toml:"userns_size"`
}
-// LibpodConfig contains configuration options used to set up a libpod runtime
-type LibpodConfig struct {
+// EngineConfig contains configuration options used to set up a engine runtime
+type EngineConfig struct {
+ // CgroupCheck indicates the configuration has been rewritten after an
+ // upgrade to Fedora 31 to change the default OCI runtime for cgroupsv2.
+ CgroupCheck bool `toml:"cgroup_check,omitempty"`
+
// CGroupManager is the CGroup Manager to use Valid values are "cgroupfs"
// and "systemd".
CgroupManager string `toml:"cgroup_manager"`
@@ -183,7 +198,7 @@ type LibpodConfig struct {
//DetachKeys is the sequence of keys used to detach a container.
DetachKeys string `toml:"detach_keys"`
- // EnablePortReservation determines whether libpod will reserve ports on the
+ // EnablePortReservation determines whether engine will reserve ports on the
// host when they are forwarded to containers. When enabled, when ports are
// forwarded to containers, they are held open by conmon as long as the
// container is running, ensuring that they cannot be reused by other
@@ -220,9 +235,9 @@ type LibpodConfig struct {
// LockType is the type of locking to use.
LockType string `toml:"lock_type,omitempty"`
- // Namespace is the libpod namespace to use. Namespaces are used to create
+ // Namespace is the engine namespace to use. Namespaces are used to create
// scopes to separate containers and pods in the state. When namespace is
- // set, libpod will only view containers and pods in the same namespace. All
+ // set, engine will only view containers and pods in the same namespace. All
// containers and pods created will default to the namespace set here. A
// namespace of "", the empty string, is equivalent to no namespace, and all
// containers and pods will be visible. The default namespace is "".
@@ -244,6 +259,15 @@ type LibpodConfig struct {
// OCIRuntimes are the set of configured OCI runtimes (default is runc).
OCIRuntimes map[string][]string `toml:"runtimes"`
+ // PullPolicy determines whether to pull image before creating or running a container
+ // default is "missing"
+ PullPolicy string `toml:"pull_policy"`
+ // RuntimePath is the path to OCI runtime binary for launching containers.
+ // The first path pointing to a valid file will be used This is used only
+ // when there are no OCIRuntime/OCIRuntimes defined. It is used only to be
+ // backward compatible with older versions of Podman.
+ RuntimePath []string `toml:"runtime_path,omitempty"`
+
// RuntimeSupportsJSON is the list of the OCI runtimes that support
// --format=json.
RuntimeSupportsJSON []string `toml:"runtime_supports_json"`
@@ -253,7 +277,7 @@ type LibpodConfig struct {
RuntimeSupportsNoCgroups []string `toml:"runtime_supports_nocgroups"`
// SetOptions contains a subset of config options. It's used to indicate if
- // a given option has either been set by the user or by a parsed libpod
+ // a given option has either been set by the user or by the parsed
// configuration file. If not, the corresponding option might be
// overwritten by values from the database. This behavior guarantees
// backwards compat with older version of libpod and Podman.
@@ -278,11 +302,6 @@ type LibpodConfig struct {
// before sending kill signal.
StopTimeout uint `toml:"stop_timeout"`
- // StorageConfig is the configuration used by containers/storage Not
- // included in the on-disk config, use the dedicated containers/storage
- // configuration file instead.
- StorageConfig storage.StoreOptions `toml:"-"`
-
// TmpDir is the path to a temporary directory to store per-boot container
// files. Must be stored in a tmpfs.
TmpDir string `toml:"tmp_dir"`
@@ -294,7 +313,7 @@ type LibpodConfig struct {
}
// SetOptions contains a subset of options in a Config. It's used to indicate if
-// a given option has either been set by the user or by a parsed libpod
+// a given option has either been set by the user or by a parsed engine
// configuration file. If not, the corresponding option might be overwritten by
// values from the database. This behavior guarantees backwards compat with
// older version of libpod and Podman.
@@ -364,16 +383,9 @@ func NewConfig(userConfigPath string) (*Config, error) {
return nil, err
}
- // If the caller specified a config path to use, then we read this
- // rather then using the system defaults.
- if userConfigPath != "" {
- var err error
- // readConfigFromFile reads in container config in the specified
- // file and then merge changes with the current default.
- config, err = readConfigFromFile(userConfigPath, config)
- if err != nil {
- return nil, errors.Wrapf(err, "error reading user config %q", userConfigPath)
- }
+ // read libpod.conf and convert the config to *Config
+ if err = newLibpodConfig(config); err != nil && !os.IsNotExist(err) {
+ logrus.Errorf("error reading libpod.conf: %v", err)
}
// Now, gather the system configs and merge them as needed.
@@ -392,7 +404,18 @@ func NewConfig(userConfigPath string) (*Config, error) {
logrus.Debugf("Merged system config %q: %v", path, config)
}
- config.checkCgroupsAndAdjustConfig()
+ // If the caller specified a config path to use, then we read it to
+ // override the system defaults.
+ if userConfigPath != "" {
+ var err error
+ // readConfigFromFile reads in container config in the specified
+ // file and then merge changes with the current default.
+ config, err = readConfigFromFile(userConfigPath, config)
+ if err != nil {
+ return nil, errors.Wrapf(err, "error reading user config %q", userConfigPath)
+ }
+ logrus.Debugf("Merged user config %q: %v", userConfigPath, config)
+ }
config.addCAPPrefix()
if err := config.Validate(); err != nil {
@@ -412,14 +435,14 @@ func readConfigFromFile(path string, config *Config) (*Config, error) {
if err != nil {
return nil, fmt.Errorf("unable to decode configuration %v: %v", path, err)
}
- if config.Libpod.VolumePath != "" {
- config.Libpod.VolumePathSet = true
+ if config.Engine.VolumePath != "" {
+ config.Engine.VolumePathSet = true
}
- if config.Libpod.StaticDir != "" {
- config.Libpod.StaticDirSet = true
+ if config.Engine.StaticDir != "" {
+ config.Engine.StaticDirSet = true
}
- if config.Libpod.TmpDir != "" {
- config.Libpod.TmpDirSet = true
+ if config.Engine.TmpDir != "" {
+ config.Engine.TmpDirSet = true
}
return config, err
@@ -455,11 +478,11 @@ func systemConfigs() ([]string, error) {
return configs, nil
}
-// checkCgroupsAndAdjustConfig checks if we're running rootless with the systemd
+// CheckCgroupsAndAdjustConfig checks if we're running rootless with the systemd
// cgroup manager. In case the user session isn't available, we're switching the
// cgroup manager to cgroupfs. Note, this only applies to rootless.
-func (c *Config) checkCgroupsAndAdjustConfig() {
- if !unshare.IsRootless() || c.Libpod.CgroupManager != SystemdCgroupsManager {
+func (c *Config) CheckCgroupsAndAdjustConfig() {
+ if !unshare.IsRootless() || c.Engine.CgroupManager != SystemdCgroupsManager {
return
}
@@ -475,7 +498,7 @@ func (c *Config) checkCgroupsAndAdjustConfig() {
logrus.Warningf("For using systemd, you may need to login using an user session")
logrus.Warningf("Alternatively, you can enable lingering with: `loginctl enable-linger %d` (possibly as root)", unshare.GetRootlessUID())
logrus.Warningf("Falling back to --cgroup-manager=cgroupfs")
- c.Libpod.CgroupManager = CgroupfsCgroupsManager
+ c.Engine.CgroupManager = CgroupfsCgroupsManager
}
}
@@ -495,32 +518,47 @@ func (c *Config) addCAPPrefix() {
func (c *Config) Validate() error {
if err := c.Containers.Validate(); err != nil {
- return errors.Wrapf(err, "containers config")
+ return errors.Wrapf(err, " error validating containers config")
}
if !c.Containers.EnableLabeling {
selinux.SetDisabled()
}
+ if err := c.Engine.Validate(); err != nil {
+ return errors.Wrapf(err, "error validating engine configs")
+ }
+
+ if err := c.Network.Validate(); err != nil {
+ return errors.Wrapf(err, "error validating network configs")
+ }
+
return nil
}
-// Validate is the main entry point for Libpod configuration validation
+// Validate is the main entry point for Engine configuration validation
// It returns an `error` on validation failure, otherwise
// `nil`.
-func (c *LibpodConfig) Validate() error {
+func (c *EngineConfig) Validate() error {
// Relative paths can cause nasty bugs, because core paths we use could
// shift between runs (or even parts of the program - the OCI runtime
// uses a different working directory than we do, for example.
- if !filepath.IsAbs(c.StaticDir) {
+ if c.StaticDir != "" && !filepath.IsAbs(c.StaticDir) {
return fmt.Errorf("static directory must be an absolute path - instead got %q", c.StaticDir)
}
- if !filepath.IsAbs(c.TmpDir) {
+ if c.TmpDir != "" && !filepath.IsAbs(c.TmpDir) {
return fmt.Errorf("temporary directory must be an absolute path - instead got %q", c.TmpDir)
}
- if !filepath.IsAbs(c.VolumePath) {
+ if c.VolumePath != "" && !filepath.IsAbs(c.VolumePath) {
return fmt.Errorf("volume path must be an absolute path - instead got %q", c.VolumePath)
}
+
+ // Check if the pullPolicy from containers.conf is valid
+ // if it is invalid returns the error
+ pullPolicy := strings.ToLower(c.PullPolicy)
+ if _, err := ValidatePullPolicy(pullPolicy); err != nil {
+ return errors.Wrapf(err, "invalid pull type from containers.conf %q", c.PullPolicy)
+ }
return nil
}
@@ -583,69 +621,21 @@ func (c *NetworkConfig) Validate() error {
return errors.Errorf("invalid cni_plugin_dirs: %s", strings.Join(c.CNIPluginDirs, ","))
}
-// DBConfig is a set of Libpod runtime configuration settings that are saved in
-// a State when it is first created, and can subsequently be retrieved.
-type DBConfig struct {
- LibpodRoot string
- LibpodTmp string
- StorageRoot string
- StorageTmp string
- GraphDriver string
- VolumePath string
-}
-
-// MergeDBConfig merges the configuration from the database.
-func (c *Config) MergeDBConfig(dbConfig *DBConfig) error {
-
- if !c.Libpod.StorageConfigRunRootSet && dbConfig.StorageTmp != "" {
- if c.Libpod.StorageConfig.RunRoot != dbConfig.StorageTmp &&
- c.Libpod.StorageConfig.RunRoot != "" {
- logrus.Debugf("Overriding run root %q with %q from database",
- c.Libpod.StorageConfig.RunRoot, dbConfig.StorageTmp)
- }
- c.Libpod.StorageConfig.RunRoot = dbConfig.StorageTmp
- }
-
- if !c.Libpod.StorageConfigGraphRootSet && dbConfig.StorageRoot != "" {
- if c.Libpod.StorageConfig.GraphRoot != dbConfig.StorageRoot &&
- c.Libpod.StorageConfig.GraphRoot != "" {
- logrus.Debugf("Overriding graph root %q with %q from database",
- c.Libpod.StorageConfig.GraphRoot, dbConfig.StorageRoot)
- }
- c.Libpod.StorageConfig.GraphRoot = dbConfig.StorageRoot
- }
-
- if !c.Libpod.StorageConfigGraphDriverNameSet && dbConfig.GraphDriver != "" {
- if c.Libpod.StorageConfig.GraphDriverName != dbConfig.GraphDriver &&
- c.Libpod.StorageConfig.GraphDriverName != "" {
- logrus.Errorf("User-selected graph driver %q overwritten by graph driver %q from database - delete libpod local files to resolve",
- c.Libpod.StorageConfig.GraphDriverName, dbConfig.GraphDriver)
- }
- c.Libpod.StorageConfig.GraphDriverName = dbConfig.GraphDriver
- }
-
- if !c.Libpod.StaticDirSet && dbConfig.LibpodRoot != "" {
- if c.Libpod.StaticDir != dbConfig.LibpodRoot && c.Libpod.StaticDir != "" {
- logrus.Debugf("Overriding static dir %q with %q from database", c.Libpod.StaticDir, dbConfig.LibpodRoot)
- }
- c.Libpod.StaticDir = dbConfig.LibpodRoot
- }
-
- if !c.Libpod.TmpDirSet && dbConfig.LibpodTmp != "" {
- if c.Libpod.TmpDir != dbConfig.LibpodTmp && c.Libpod.TmpDir != "" {
- logrus.Debugf("Overriding tmp dir %q with %q from database", c.Libpod.TmpDir, dbConfig.LibpodTmp)
- }
- c.Libpod.TmpDir = dbConfig.LibpodTmp
- c.Libpod.EventsLogFilePath = filepath.Join(dbConfig.LibpodTmp, "events", "events.log")
- }
-
- if !c.Libpod.VolumePathSet && dbConfig.VolumePath != "" {
- if c.Libpod.VolumePath != dbConfig.VolumePath && c.Libpod.VolumePath != "" {
- logrus.Debugf("Overriding volume path %q with %q from database", c.Libpod.VolumePath, dbConfig.VolumePath)
- }
- c.Libpod.VolumePath = dbConfig.VolumePath
+// ValidatePullPolicy check if the pullPolicy from CLI is valid and returns the valid enum type
+// if the value from CLI or containers.conf is invalid returns the error
+func ValidatePullPolicy(pullPolicy string) (PullPolicy, error) {
+ switch pullPolicy {
+ case "always":
+ return PullImageAlways, nil
+ case "missing":
+ return PullImageMissing, nil
+ case "never":
+ return PullImageNever, nil
+ case "":
+ return PullImageMissing, nil
+ default:
+ return PullImageMissing, errors.Errorf("invalid pull policy %q", pullPolicy)
}
- return nil
}
// FindConmon iterates over (*Config).ConmonPath and returns the path
@@ -653,7 +643,7 @@ func (c *Config) MergeDBConfig(dbConfig *DBConfig) error {
// to do a path lookup of "conmon".
func (c *Config) FindConmon() (string, error) {
foundOutdatedConmon := false
- for _, path := range c.Libpod.ConmonPath {
+ for _, path := range c.Engine.ConmonPath {
stat, err := os.Stat(path)
if err != nil {
continue
@@ -689,7 +679,7 @@ func (c *Config) FindConmon() (string, error) {
return "", errors.Wrapf(ErrInvalidArg,
"could not find a working conmon binary (configured options: %v)",
- c.Libpod.ConmonPath)
+ c.Engine.ConmonPath)
}
// GetDefaultEnv returns the environment variables for the container.
diff --git a/vendor/github.com/containers/common/pkg/config/containers.conf b/vendor/github.com/containers/common/pkg/config/containers.conf
index 91106b576..b01db5f88 100644
--- a/vendor/github.com/containers/common/pkg/config/containers.conf
+++ b/vendor/github.com/containers/common/pkg/config/containers.conf
@@ -1,9 +1,9 @@
# The containers configuration file specifies all of the available configuration
-# command-line options/flags for container runtime tools like Podman & Buildah,
+# command-line options/flags for container engine tools like Podman & Buildah,
# but in a TOML format that can be easily modified and versioned.
# Please refer to containers.conf(5) for details of all configuration options.
-# Not all container tools implement all of the options.
+# Not all container engines implement all of the options.
# All of the options have hard coded defaults and these options will override
# the built in defaults. Users can then override these options via the command
# line. Container engines will read containers.conf files in up to three
@@ -30,7 +30,7 @@
#
# volumes = []
-# Used to change the name of the default AppArmor profile of container engines.
+# Used to change the name of the default AppArmor profile of container engine.
#
# apparmor_profile = "container-default"
@@ -143,7 +143,8 @@
#
# ipcns = "private"
-# container engines use container separation using MAC(SELinux) labeling.
+# Flag tells container engine to whether to use container separation using
+# MAC(SELinux)labeling or not.
# Flag is ignored on label disabled systems.
#
# label = true
@@ -167,7 +168,7 @@
#
# netns = "private"
-# Create /etc/hosts for the container. By default, container engines manage
+# Create /etc/hosts for the container. By default, container engine manage
# /etc/hosts, automatically adding the container's own IP address.
#
# no_hosts = false
@@ -228,7 +229,7 @@
#
# network_config_dir = "/etc/cni/net.d/"
-[libpod]
+[engine]
# Cgroup management implementation used for the runtime.
# Valid options “systemd” or “cgroupfs”
@@ -260,7 +261,7 @@
#
# detach_keys = "ctrl-p,ctrl-q"
-# Determines whether libpod will reserve ports on the host when they are
+# Determines whether engine will reserve ports on the host when they are
# forwarded to containers. When enabled, when ports are forwarded to containers,
# ports are held open by as long as the container is running, ensuring that
# they cannot be reused by other programs on the host. However, this can cause
@@ -297,8 +298,8 @@
#
# lock_type** = "shm"
-# Default libpod namespace
-# If libpod is joined to a namespace, it will see only containers and pods
+# Default engine namespace
+# If engine is joined to a namespace, it will see only containers and pods
# that were created in the same namespace, and will create new containers and
# pods in that namespace.
# The default namespace is "", which corresponds to no namespace. When no
@@ -316,7 +317,10 @@
#
# num_locks = 2048
-# Directory for persistent libpod files (database, etc)
+# Whether to pull new image before running a container
+# pull_policy = "missing"
+
+# Directory for persistent engine files (database, etc)
# By default, this will be configured relative to where the containers/storage
# stores containers
# Uncomment to change location from this default
@@ -339,12 +343,12 @@
# runtime = "runc"
# List of the OCI runtimes that support --format=json. When json is supported
-# libpod will use it for reporting nicer errors.
+# engine will use it for reporting nicer errors.
#
# runtime_supports_json = ["crun", "runc"]
# Paths to look for a valid OCI runtime (runc, runv, etc)
-[libpod.runtimes]
+[engine.runtimes]
# runc = [
# "/usr/bin/runc",
# "/usr/sbin/runc",
@@ -368,7 +372,7 @@
# Number of seconds to wait for container to exit before sending kill signal.
#stop_timeout = 10
-# The [libpod.runtimes] table MUST be the last entry in this file.
+# The [engine.runtimes] table MUST be the last entry in this file.
# (Unless another table is added)
# TOML does not provide a way to end a table other than a further table being
# defined, so every key hereafter will be part of [runtimes] and not the main
diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
index 6b83d7703..dca320d87 100644
--- a/vendor/github.com/containers/common/pkg/config/default.go
+++ b/vendor/github.com/containers/common/pkg/config/default.go
@@ -98,6 +98,8 @@ const (
// DefaultPidsLimit is the default value for maximum number of processes
// allowed inside a container
DefaultPidsLimit = 2048
+ // DefaultPullPolicy pulls the image if it does not exist locally
+ DefaultPullPolicy = "missing"
// DefaultRootlessSignaturePolicyPath is the default value for the
// rootless policy.json file.
DefaultRootlessSignaturePolicyPath = ".config/containers/policy.json"
@@ -116,7 +118,7 @@ const (
// DefaultConfig defines the default values from containers.conf
func DefaultConfig() (*Config, error) {
- defaultLibpodConfig, err := defaultConfigFromMemory()
+ defaultEngineConfig, err := defaultConfigFromMemory()
if err != nil {
return nil, err
}
@@ -175,14 +177,14 @@ func DefaultConfig() (*Config, error) {
NetworkConfigDir: cniConfigDir,
CNIPluginDirs: cniBinDir,
},
- Libpod: *defaultLibpodConfig,
+ Engine: *defaultEngineConfig,
}, nil
}
-// defaultConfigFromMemory returns a default libpod configuration. Note that the
+// defaultConfigFromMemory returns a default engine configuration. Note that the
// config is different for root and rootless. It also parses the storage.conf.
-func defaultConfigFromMemory() (*LibpodConfig, error) {
- c := new(LibpodConfig)
+func defaultConfigFromMemory() (*EngineConfig, error) {
+ c := new(EngineConfig)
tmp, err := defaultTmpDir()
if err != nil {
return nil, err
@@ -201,7 +203,6 @@ func defaultConfigFromMemory() (*LibpodConfig, error) {
}
c.StaticDir = filepath.Join(storeOpts.GraphRoot, "libpod")
c.VolumePath = filepath.Join(storeOpts.GraphRoot, "volumes")
- c.StorageConfig = storeOpts
c.HooksDir = DefaultHooksDirs
c.ImageDefaultTransport = _defaultTransport
@@ -249,6 +250,7 @@ func defaultConfigFromMemory() (*LibpodConfig, error) {
"/usr/local/sbin/conmon",
"/run/current-system/sw/bin/conmon",
}
+ c.PullPolicy = DefaultPullPolicy
c.RuntimeSupportsJSON = []string{
"crun",
"runc",
diff --git a/vendor/github.com/containers/common/pkg/config/libpodConfig.go b/vendor/github.com/containers/common/pkg/config/libpodConfig.go
new file mode 100644
index 000000000..be168208b
--- /dev/null
+++ b/vendor/github.com/containers/common/pkg/config/libpodConfig.go
@@ -0,0 +1,382 @@
+package config
+
+/* libpodConfig.go contains deprecated functionality and should not be used any longer */
+
+import (
+ "fmt"
+ "os"
+ "os/exec"
+ "path/filepath"
+
+ "github.com/BurntSushi/toml"
+ "github.com/containers/common/pkg/unshare"
+ "github.com/pkg/errors"
+ "github.com/sirupsen/logrus"
+)
+
+const (
+ // _rootlessConfigPath is the path to the rootless libpod.conf in $HOME.
+ _rootlessConfigPath = ".config/containers/libpod.conf"
+
+ // _rootConfigPath is the path to the libpod configuration file
+ // This file is loaded to replace the builtin default config before
+ // runtime options (e.g. WithStorageConfig) are applied.
+ // If it is not present, the builtin default config is used instead
+ // This path can be overridden when the runtime is created by using
+ // NewRuntimeFromConfig() instead of NewRuntime().
+ _rootConfigPath = _installPrefix + "/share/containers/libpod.conf"
+
+ // _rootOverrideConfigPath is the path to an override for the default libpod
+ // configuration file. If OverrideConfigPath exists, it will be used in
+ // place of the configuration file pointed to by ConfigPath.
+ _rootOverrideConfigPath = _etcDir + "/containers/libpod.conf"
+)
+
+// ConfigFromLibpod contains configuration options used to set up a libpod runtime
+type ConfigFromLibpod struct {
+ // NOTE: when changing this struct, make sure to update (*Config).Merge().
+
+ // SetOptions contains a subset of config options. It's used to indicate if
+ // a given option has either been set by the user or by a parsed libpod
+ // configuration file. If not, the corresponding option might be
+ // overwritten by values from the database. This behavior guarantees
+ // backwards compat with older version of libpod and Podman.
+ SetOptions
+
+ // VolumePath is the default location that named volumes will be created
+ // under. This convention is followed by the default volume driver, but
+ // may not be by other drivers.
+ VolumePath string `toml:"volume_path,omitempty"`
+
+ // ImageDefaultTransport is the default transport method used to fetch
+ // images.
+ ImageDefaultTransport string `toml:"image_default_transport,omitempty"`
+
+ // SignaturePolicyPath is the path to a signature policy to use for
+ // validating images. If left empty, the containers/image default signature
+ // policy will be used.
+ SignaturePolicyPath string `toml:"signature_policy_path,omitempty"`
+
+ // OCIRuntime is the OCI runtime to use.
+ OCIRuntime string `toml:"runtime,omitempty"`
+
+ // OCIRuntimes are the set of configured OCI runtimes (default is runc).
+ OCIRuntimes map[string][]string `toml:"runtimes,omitempty"`
+
+ // RuntimeSupportsJSON is the list of the OCI runtimes that support
+ // --format=json.
+ RuntimeSupportsJSON []string `toml:"runtime_supports_json,omitempty"`
+
+ // RuntimeSupportsNoCgroups is a list of OCI runtimes that support
+ // running containers without CGroups.
+ RuntimeSupportsNoCgroups []string `toml:"runtime_supports_nocgroups,omitempty"`
+
+ // RuntimePath is the path to OCI runtime binary for launching containers.
+ // The first path pointing to a valid file will be used This is used only
+ // when there are no OCIRuntime/OCIRuntimes defined. It is used only to be
+ // backward compatible with older versions of Podman.
+ RuntimePath []string `toml:"runtime_path,omitempty"`
+
+ // ConmonPath is the path to the Conmon binary used for managing containers.
+ // The first path pointing to a valid file will be used.
+ ConmonPath []string `toml:"conmon_path,omitempty"`
+
+ // ConmonEnvVars are environment variables to pass to the Conmon binary
+ // when it is launched.
+ ConmonEnvVars []string `toml:"conmon_env_vars,omitempty"`
+
+ // CGroupManager is the CGroup Manager to use Valid values are "cgroupfs"
+ // and "systemd".
+ CgroupManager string `toml:"cgroup_manager,omitempty"`
+
+ // InitPath is the path to the container-init binary.
+ InitPath string `toml:"init_path,omitempty"`
+
+ // StaticDir is the path to a persistent directory to store container
+ // files.
+ StaticDir string `toml:"static_dir,omitempty"`
+
+ // TmpDir is the path to a temporary directory to store per-boot container
+ // files. Must be stored in a tmpfs.
+ TmpDir string `toml:"tmp_dir,omitempty"`
+
+ // MaxLogSize is the maximum size of container logfiles.
+ MaxLogSize int64 `toml:"max_log_size,omitempty"`
+
+ // NoPivotRoot sets whether to set no-pivot-root in the OCI runtime.
+ NoPivotRoot bool `toml:"no_pivot_root,omitempty"`
+
+ // CNIConfigDir sets the directory where CNI configuration files are
+ // stored.
+ CNIConfigDir string `toml:"cni_config_dir,omitempty"`
+
+ // CNIPluginDir sets a number of directories where the CNI network
+ // plugins can be located.
+ CNIPluginDir []string `toml:"cni_plugin_dir,omitempty"`
+
+ // CNIDefaultNetwork is the network name of the default CNI network
+ // to attach pods to.
+ CNIDefaultNetwork string `toml:"cni_default_network,omitempty"`
+
+ // HooksDir holds paths to the directories containing hooks
+ // configuration files. When the same filename is present in in
+ // multiple directories, the file in the directory listed last in
+ // this slice takes precedence.
+ HooksDir []string `toml:"hooks_dir,omitempty"`
+
+ // Namespace is the libpod namespace to use. Namespaces are used to create
+ // scopes to separate containers and pods in the state. When namespace is
+ // set, libpod will only view containers and pods in the same namespace. All
+ // containers and pods created will default to the namespace set here. A
+ // namespace of "", the empty string, is equivalent to no namespace, and all
+ // containers and pods will be visible. The default namespace is "".
+ Namespace string `toml:"namespace,omitempty"`
+
+ // InfraImage is the image a pod infra container will use to manage
+ // namespaces.
+ InfraImage string `toml:"infra_image,omitempty"`
+
+ // InfraCommand is the command run to start up a pod infra container.
+ InfraCommand string `toml:"infra_command,omitempty"`
+
+ // EnablePortReservation determines whether libpod will reserve ports on the
+ // host when they are forwarded to containers. When enabled, when ports are
+ // forwarded to containers, they are held open by conmon as long as the
+ // container is running, ensuring that they cannot be reused by other
+ // programs on the host. However, this can cause significant memory usage if
+ // a container has many ports forwarded to it. Disabling this can save
+ // memory.
+ EnablePortReservation bool `toml:"enable_port_reservation,omitempty"`
+
+ // EnableLabeling indicates whether libpod will support container labeling.
+ EnableLabeling bool `toml:"label,omitempty"`
+
+ // NetworkCmdPath is the path to the slirp4netns binary.
+ NetworkCmdPath string `toml:"network_cmd_path,omitempty"`
+
+ // NumLocks is the number of locks to make available for containers and
+ // pods.
+ NumLocks uint32 `toml:"num_locks,omitempty"`
+
+ // LockType is the type of locking to use.
+ LockType string `toml:"lock_type,omitempty"`
+
+ // EventsLogger determines where events should be logged.
+ EventsLogger string `toml:"events_logger,omitempty"`
+
+ // EventsLogFilePath is where the events log is stored.
+ EventsLogFilePath string `toml:"events_logfile_path,omitempty"`
+
+ //DetachKeys is the sequence of keys used to detach a container.
+ DetachKeys string `toml:"detach_keys,omitempty"`
+
+ // SDNotify tells Libpod to allow containers to notify the host systemd of
+ // readiness using the SD_NOTIFY mechanism.
+ SDNotify bool `toml:",omitempty"`
+
+ // CgroupCheck indicates the configuration has been rewritten after an
+ // upgrade to Fedora 31 to change the default OCI runtime for cgroupsv2.
+ CgroupCheck bool `toml:"cgroup_check,omitempty"`
+}
+
+// newLibpodConfig creates a new ConfigFromLibpod and converts it to Config.
+// Depending if we're running as root or rootless, we then merge the system configuration followed
+// by merging the default config (hard-coded default in memory).
+// Note that the OCI runtime is hard-set to `crun` if we're running on a system
+// with cgroupsv2. Other OCI runtimes are not yet supporting cgroupsv2. This
+// might change in the future.
+func newLibpodConfig(c *Config) error {
+ // Start with the default config and interatively merge
+ // fields in the system configs.
+ config := c.libpodConfig()
+
+ // Now, check if the user can access system configs and merge them if needed.
+ configs, err := systemLibpodConfigs()
+ if err != nil {
+ return errors.Wrapf(err, "error finding config on system")
+ }
+
+ for _, path := range configs {
+ config, err = readLibpodConfigFromFile(path, config)
+ if err != nil {
+ return errors.Wrapf(err, "error reading system config %q", path)
+ }
+ }
+
+ // Since runc does not currently support cgroupV2
+ // Change to default crun on first running of libpod.conf
+ // TODO Once runc has support for cgroups, this function should be removed.
+ if !config.CgroupCheck && unshare.IsRootless() {
+ cgroupsV2, err := isCgroup2UnifiedMode()
+ if err != nil {
+ return err
+ }
+ if cgroupsV2 {
+ path, err := exec.LookPath("crun")
+ if err != nil {
+ // Can't find crun path so do nothing
+ logrus.Warnf("Can not find crun package on the host, containers might fail to run on cgroup V2 systems without crun: %q", err)
+ } else {
+ config.CgroupCheck = true
+ config.OCIRuntime = path
+ }
+ }
+ }
+
+ c.libpodToContainersConfig(config)
+
+ return nil
+}
+
+// readConfigFromFile reads the specified config file at `path` and attempts to
+// unmarshal its content into a Config. The config param specifies the previous
+// default config. If the path, only specifies a few fields in the Toml file
+// the defaults from the config parameter will be used for all other fields.
+func readLibpodConfigFromFile(path string, config *ConfigFromLibpod) (*ConfigFromLibpod, error) {
+ logrus.Debugf("Reading configuration file %q", path)
+ _, err := toml.DecodeFile(path, config)
+ if err != nil {
+ return nil, fmt.Errorf("unable to decode configuration %v: %v", path, err)
+ }
+
+ // For the sake of backwards compat we need to check if the config fields
+ // with *Set suffix are set in the config. Note that the storage-related
+ // fields are NOT set in the config here but in the storage.conf OR directly
+ // by the user.
+ if config.VolumePath != "" {
+ config.VolumePathSet = true
+ }
+ if config.StaticDir != "" {
+ config.StaticDirSet = true
+ }
+ if config.TmpDir != "" {
+ config.TmpDirSet = true
+ }
+
+ return config, err
+}
+
+func systemLibpodConfigs() ([]string, error) {
+ if unshare.IsRootless() {
+ path, err := rootlessLibpodConfigPath()
+ if err != nil {
+ return nil, err
+ }
+ if _, err := os.Stat(path); err == nil {
+ containersConfPath, err := rootlessConfigPath()
+ if err != nil {
+ containersConfPath = filepath.Join("$HOME", UserOverrideContainersConfig)
+ }
+ // TODO: Raise to Warnf, when Podman is updated to
+ // remove libpod.conf by default
+ logrus.Debugf("Found deprecated file %s, please remove. Use %s to override defaults.\n", path, containersConfPath)
+ return []string{path}, nil
+ }
+ return nil, err
+ }
+
+ configs := []string{}
+ if _, err := os.Stat(_rootConfigPath); err == nil {
+ // TODO: Raise to Warnf, when Podman is updated to
+ // remove libpod.conf by default
+ logrus.Debugf("Found deprecated file %s, please remove. Use %s to override defaults.\n", _rootConfigPath, OverrideContainersConfig)
+ configs = append(configs, _rootConfigPath)
+ }
+ if _, err := os.Stat(_rootOverrideConfigPath); err == nil {
+ // TODO: Raise to Warnf, when Podman is updated to
+ // remove libpod.conf by default
+ logrus.Debugf("Found deprecated file %s, please remove. Use %s to override defaults.\n", _rootOverrideConfigPath, OverrideContainersConfig)
+ configs = append(configs, _rootOverrideConfigPath)
+ }
+ return configs, nil
+}
+
+func rootlessLibpodConfigPath() (string, error) {
+ home, err := unshare.HomeDir()
+ if err != nil {
+ return "", err
+ }
+
+ return filepath.Join(home, _rootlessConfigPath), nil
+}
+
+func (c *Config) libpodConfig() *ConfigFromLibpod {
+ return &ConfigFromLibpod{
+ SignaturePolicyPath: c.Containers.SignaturePolicyPath,
+ InitPath: c.Containers.InitPath,
+ MaxLogSize: c.Containers.LogSizeMax,
+ EnableLabeling: c.Containers.EnableLabeling,
+
+ SetOptions: c.Engine.SetOptions,
+ VolumePath: c.Engine.VolumePath,
+ ImageDefaultTransport: c.Engine.ImageDefaultTransport,
+ OCIRuntime: c.Engine.OCIRuntime,
+ OCIRuntimes: c.Engine.OCIRuntimes,
+ RuntimeSupportsJSON: c.Engine.RuntimeSupportsJSON,
+ RuntimeSupportsNoCgroups: c.Engine.RuntimeSupportsNoCgroups,
+ RuntimePath: c.Engine.RuntimePath,
+ ConmonPath: c.Engine.ConmonPath,
+ ConmonEnvVars: c.Engine.ConmonEnvVars,
+ CgroupManager: c.Engine.CgroupManager,
+ StaticDir: c.Engine.StaticDir,
+ TmpDir: c.Engine.TmpDir,
+ NoPivotRoot: c.Engine.NoPivotRoot,
+ HooksDir: c.Engine.HooksDir,
+ Namespace: c.Engine.Namespace,
+ InfraImage: c.Engine.InfraImage,
+ InfraCommand: c.Engine.InfraCommand,
+ EnablePortReservation: c.Engine.EnablePortReservation,
+ NetworkCmdPath: c.Engine.NetworkCmdPath,
+ NumLocks: c.Engine.NumLocks,
+ LockType: c.Engine.LockType,
+ EventsLogger: c.Engine.EventsLogger,
+ EventsLogFilePath: c.Engine.EventsLogFilePath,
+ DetachKeys: c.Engine.DetachKeys,
+ SDNotify: c.Engine.SDNotify,
+ CgroupCheck: c.Engine.CgroupCheck,
+
+ CNIConfigDir: c.Network.NetworkConfigDir,
+ CNIPluginDir: c.Network.CNIPluginDirs,
+ CNIDefaultNetwork: c.Network.DefaultNetwork,
+ }
+}
+
+func (c *Config) libpodToContainersConfig(libpodConf *ConfigFromLibpod) {
+
+ c.Containers.SignaturePolicyPath = libpodConf.SignaturePolicyPath
+ c.Containers.InitPath = libpodConf.InitPath
+ c.Containers.LogSizeMax = libpodConf.MaxLogSize
+ c.Containers.EnableLabeling = libpodConf.EnableLabeling
+
+ c.Engine.SetOptions = libpodConf.SetOptions
+ c.Engine.VolumePath = libpodConf.VolumePath
+ c.Engine.ImageDefaultTransport = libpodConf.ImageDefaultTransport
+ c.Engine.OCIRuntime = libpodConf.OCIRuntime
+ c.Engine.OCIRuntimes = libpodConf.OCIRuntimes
+ c.Engine.RuntimeSupportsJSON = libpodConf.RuntimeSupportsJSON
+ c.Engine.RuntimeSupportsNoCgroups = libpodConf.RuntimeSupportsNoCgroups
+ c.Engine.RuntimePath = libpodConf.RuntimePath
+ c.Engine.ConmonPath = libpodConf.ConmonPath
+ c.Engine.ConmonEnvVars = libpodConf.ConmonEnvVars
+ c.Engine.CgroupManager = libpodConf.CgroupManager
+ c.Engine.StaticDir = libpodConf.StaticDir
+ c.Engine.TmpDir = libpodConf.TmpDir
+ c.Engine.NoPivotRoot = libpodConf.NoPivotRoot
+ c.Engine.HooksDir = libpodConf.HooksDir
+ c.Engine.Namespace = libpodConf.Namespace
+ c.Engine.InfraImage = libpodConf.InfraImage
+ c.Engine.InfraCommand = libpodConf.InfraCommand
+ c.Engine.EnablePortReservation = libpodConf.EnablePortReservation
+ c.Engine.NetworkCmdPath = libpodConf.NetworkCmdPath
+ c.Engine.NumLocks = libpodConf.NumLocks
+ c.Engine.LockType = libpodConf.LockType
+ c.Engine.EventsLogger = libpodConf.EventsLogger
+ c.Engine.EventsLogFilePath = libpodConf.EventsLogFilePath
+ c.Engine.DetachKeys = libpodConf.DetachKeys
+ c.Engine.SDNotify = libpodConf.SDNotify
+ c.Engine.CgroupCheck = libpodConf.CgroupCheck
+
+ c.Network.NetworkConfigDir = libpodConf.CNIConfigDir
+ c.Network.CNIPluginDirs = libpodConf.CNIPluginDir
+ c.Network.DefaultNetwork = libpodConf.CNIDefaultNetwork
+}