summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* systemd: symlink user->systemValentin Rothberg2020-07-21
| | | | | | | | | Symlink the user to the system services in `contrib/systemd`. There is no diference between the services, so we can reduce redundancy while not breaking downstream packages which might already be referencing `./contrib/systemd/user`. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #6996 from vrothberg/2.0-update-x/textOpenShift Merge Robot2020-07-16
|\ | | | | [2.0] vendor golang.org/x/text@v0.3.3
| * vendor golang.org/x/text@v0.3.3Valentin Rothberg2020-07-16
|/ | | | | | Fixes: CVE-2020-14040 Fixes: bugzilla.redhat.com/show_bug.cgi?id=1854718 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #6910 from mheon/fix_out_of_rangeOpenShift Merge Robot2020-07-15
|\ | | | | Fix a bug where --pids-limit was parsed incorrectly
| * Fix a bug where --pids-limit was parsed incorrectlyMatthew Heon2020-07-15
|/ | | | | | | | | | | | | | The --pids-limit flag was using strconv.ParseInt with bad arguments, resulting in it being unable to parse standard integers (1024, for example, would produce an 'out of range' error). Change the arguments to make sense (base 10, max 32-bit) and add a test to ensure we don't regress again. Fixes #6908 Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #6921 from vrothberg/2.0-wildcard-searchOpenShift Merge Robot2020-07-15
|\ | | | | [2.0] search: allow wildcards
| * search: allow wildcardsValentin Rothberg2020-07-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow wildcards in the search term. Note that not all registries support wildcards and it may only work with v1 registries. Note that searching implies figuring out if the specified search term includes a registry. If there's not registry detected, the search term will be used against all configured "unqualified-serach-registries" in the registries.conf. The parsing logic considers a registry to be the substring before the first slash `/`. With these changes we now not only support wildcards but arbitrary input; ultimately it's up to the registries to decide whether they support given input or not. Fixes: bugzilla.redhat.com/show_bug.cgi?id=1846629 Cherry-pick-of: commit b05888a97dbb Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * [CI:DOCS]Do not copy policy.json into gating imageBrent Baude2020-07-15
| | | | | | | | | | | | test/policy.json should not need to be copied into the gating image Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Fix systemd pid 1 testBrent Baude2020-07-15
| | | | | | | | | | | | | | | | | | | | fedora removed the systemd package from its standard container image causing our systemd pid1 test to fail. Replacing usage of fedora to ubi-init. adding ubi images to the cache for local tests. also, remove installation of test/policy.json to the system wide /etc/containers Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Cirrus: Rotate keys post repo. renameChris Evich2020-07-15
|/ | | | | | | | | | | Encode credentials at new repository settings page https://cirrus-ci.com/settings/repository/6707778565701632 Ref: https://cirrus-ci.org/guide/writing-tasks/#encrypted-variables Backport-of: commit 576ce0f1b501 Signed-off-by: Chris Evich <cevich@redhat.com> Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #6888 from mheon/bump_202OpenShift Merge Robot2020-07-07
|\ | | | | [CI:DOCS] Bump to v2.0.2
| * Bump to v2.0.3-devMatthew Heon2020-07-07
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Bump to v2.0.2v2.0.2Matthew Heon2020-07-07
|/ | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #6883 from vrothberg/2.0-events-raceOpenShift Merge Robot2020-07-07
|\ | | | | [2.0] fix race condition in `libpod.GetEvents(...)`
| * fix race condition in `libpod.GetEvents(...)`Valentin Rothberg2020-07-07
| | | | | | | | | | | | | | | | | | | | Fix a race that could cause read errors to be masked. Masking such errors is likely to report red herrings since users don't see that reading failed for some reasons but that a given event could not be found. Backport-of: commit f4a2d25c0fca Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #6886 from mheon/final_202_relnotesOpenShift Merge Robot2020-07-07
|\ \ | |/ |/| [CI:DOCS] Finalize release notes for Podman v2.0.2
| * Finalize release notes for Podman v2.0.2Matthew Heon2020-07-07
|/ | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #6873 from baude/v2.0disableconnectionOpenShift Merge Robot2020-07-07
|\ | | | | remove podman system connection
| * remove podman system connectionBrent Baude2020-07-06
| | | | | | | | | | | | podman system connection was panic'ing and not working as expected. we are temporarily removing to as to not confuse users until we can fix it and prevent regressions with integrations tests. Signed-off-by: Brent Baude <bbaude@redhat.com>
* | Merge pull request #6874 from mheon/backport_mount_fixOpenShift Merge Robot2020-07-06
|\ \ | |/ |/| Backport 'podman mount' bugfix
| * Fix bug where `podman mount` didn't error as rootlessMatthew Heon2020-07-06
|/ | | | | | | | | | | | | | | | | | We require that rootless `podman mount` be run inside a shell spawned by `podman unshare` (which gives us a mount namespace which actually lets other commands use the mounted filesystem). The fix is simple - we need to mark the command as requiring the rootless user namespace not be configured, so we can test for it later as part of the mount code and error if we needed to make one. Disable rootless tests as part of this - they were never expected to work. Fixes #6856 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #6871 from mheon/202_backportsOpenShift Merge Robot2020-07-06
|\ | | | | Backports for v2.0.2
| * Fix imports to ensure v2 is used with libpodMatthew Heon2020-07-06
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Update release notes for v2.0.2Matthew Heon2020-07-06
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * specgen: fix order for setting rlimitsRalf Haferkamp2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | Also make sure that the limits we set for rootless are not higher than what we'd set for root containers. Rootless containers failed to start when the calling user already had ulimit (e.g. on NOFILE) set. This is basically a cherry-pick of 76f8efc0d0d into specgen Signed-off-by: Ralf Haferkamp <rhafer@suse.com>
| * Ensure umask is set appropriately for 'system service'Matthew Heon2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | We need a umask of 0022 to ensure containers are created correctly, but we set a different one prior to starting the server (to ensure the unix socket has the right permissions). Thus, we need to set the umask after the socket has been bound, but before the server begins accepting requests. Fixes #6787 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * generate systemd: improve pod-flags filterValentin Rothberg2020-07-06
| | | | | | | | | | | | | | | | | | | | When generating systemd unit for pods, we need to remove certain pod-related flags from the containers' create commands. Make sure to account for all the syntax including a single argument with key and value being split by `=`. Fixes: #6766 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * Fix a bug with APIv2 compat network remove to log an ErrNetworkNotFound ↵Maximilian Müller2020-07-06
| | | | | | | | | | | | instead of nil Signed-off-by: Maximilian Müller <maxm123@techie.com>
| * Fixes --remote flag issuesJhon Honce2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * --remote, --url and --identity are now anchored to podman command. Subcommands should no longer have issues * TraverseChildren now set to V1 expectations * Latest flag now has helper function. Now has consistent usage. * IsRemote() uses cobra parser to determin if --remote is given * Moved validation functions from parser pkg to validate pkg * Fixes #6598 Fixes #6704 Signed-off-by: Jhon Honce <jhonce@redhat.com> <MH: Fixed import issues> Signed-off-by: Matt Heon <matthew.heon@pm.me>
| * Set console mode for windowsBrent Baude2020-07-06
| | | | | | | | | | | | | | | | | | | | Windows terminal handling is different than darwin and linux. It needs to have the terminal mode set to enable virtual terminal processing. This allows colors and other things to work. Signed-off-by: Brent Baude <bbaude@redhat.com> <MH: Tweaked imports to compile> Signed-off-by: Matt Heon <matthew.heon@pm.me>
| * Allow empty host port in --publish flagMatthew Heon2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I didn't believe that this was actually legal, but it looks like it is. And, unlike our previous understanding (host port being empty means just use container port), empty host port actually carries the same meaning as `--expose` + `--publish-all` (that is, assign a random host port to the given container port). This requires a significant rework of our port handling code to handle this new case. I don't foresee this being commonly used, so I optimized having a fixed port number as fast path, which this random assignment code running after the main port handling code only if necessary. Fixes #6806 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add a note on the APIs supported by `system service`Matthew Heon2020-07-06
| | | | | | | | | | | | | | | | This makes it clear that we target compatibility with a specific Docker version (v1.40), but do not reject other versions. It also adds a link to documentation on the Podman-specific API. Signed-off-by: Matthew Heon <mheon@redhat.com>
| * fix: Don't override entrypoint if it's `nil`maybe-sybr2020-07-06
| | | | | | | | | | | | | | This change ensures that we only override a container's entrypoint if it is set to something other than `nil`. Signed-off-by: Matt Brindley <58414429+maybe-sybr@users.noreply.github.com>
| * Set TMPDIR to /var/tmp by default if not setDaniel J Walsh2020-07-06
| | | | | | | | | | | | | | | | | | Containers/image will use TMPDIR for the location of pulled layer blobs. If TMPDIR is not set, it will use /tmp. Since this is known to be of limited space on most systems, we change the default to /var/tmp if the user has not told the tools where to store temporary files. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
| * test: add tests for --user and volumesValentin Rothberg2020-07-06
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * container: move volume chown after spec generationGiuseppe Scrivano2020-07-06
| | | | | | | | | | | | | | | | | | move the chown for newly created volumes after the spec generation so the correct UID/GID are known. Closes: https://github.com/containers/libpod/issues/5698 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * libpod: volume copyup honors namespace mappingsGiuseppe Scrivano2020-07-06
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * Fix `system service` panic from early hangup in eventsMatthew Heon2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | We weren't actually halting the goroutine that sent events, so it would continue sending even when the channel closed (the most notable cause being early hangup - e.g. Control-c on a curl session). Use a context to cancel the events goroutine and stop sending events. Fixes #6805 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * stop podman service in e2e testsBrent Baude2020-07-06
| | | | | | | | | | | | when running e2e tests, each test knows to stop its service when running remote; however, during setup and teardown remote services were not being killed when we were done with them. Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Print errors from individual containers in podsMatthew Heon2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The infra/abi code for pods was written in a flawed way, assuming that the map[string]error containing individual container errors was only set when the global error for the pod function was nil; that is not accurate, and we are actually *guaranteed* to set the global error when any individual container errors. Thus, we'd never actually include individual container errors, because the infra code assumed that err being set meant everything failed and no container operations were attempted. We were originally setting the cause of the error to something nonsensical ("container already exists"), so I made a new error indicating that some containers in the pod failed. We can then ignore that error when building the report on the pod operation and actually return errors from individual containers. Unfortunately, this exposed another weakness of the infra code, which was discarding the container IDs. Errors from individual containers are not guaranteed to identify which container they came from, hence the use of map[string]error in the Pod API functions. Rather than restructuring the structs we return from pkg/infra, I just wrapped the returned errors with a message including the ID of the container. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * auto-update: clarify systemd-unit requirementsValentin Rothberg2020-07-06
| | | | | | | | | | | | | | | | | | | | Clarify in the help message and the man page that auto updates only work with systemd units that are similar to the ones from `generate systemd --new`. Units that merely start/stop a container do not work as they will use the same image. Fixes: #6793 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * podman ps truncate the commandPaul Holzinger2020-07-06
| | | | | | | | | | | | | | | | | | With a long create command the output from ps is basically unreadable. This is a regression that was introduced with Podman 2.0. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Merge pull request #6870 from rhatdan/v2.0OpenShift Merge Robot2020-07-06
|\ \ | |/ |/| Pids-limit should only be set if the user set it
| * Pids-limit should only be set if the user set itDaniel J Walsh2020-07-06
|/ | | | | | | | | | Currently we are sending over pids-limits from the user even if they never modified the defaults. The pids limit should be set at the server side unless modified by the user. This issue has led to failures on systems that were running with cgroups V1. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #6865 from vrothberg/2.0-v2-moduleOpenShift Merge Robot2020-07-06
|\ | | | | [2.0] move go module to v2
| * move go module to v2Valentin Rothberg2020-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the advent of Podman 2.0.0 we crossed the magical barrier of go modules. While we were able to continue importing all packages inside of the project, the project could not be vendored anymore from the outside. Move the go module to new major version and change all imports to github.com/containers/libpod/v2. The renaming of the imports was done via gomove [1]. [1] https://github.com/KSubedi/gomove Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #6860 from rhatdan/v2.0OpenShift Merge Robot2020-07-06
|\ \ | |/ |/| Vendor containers/common v0.14.4
| * Vendor containers/common v0.14.4Daniel J Walsh2020-07-06
|/ | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #6849 from TomSweeneyRedHat/dev/tsweeney/ib_v1.1.6_v2OpenShift Merge Robot2020-07-06
|\ | | | | Bump to imagebuilder v1.1.6 on v2 branch
| * Bump to imagebuilder v1.1.6 on v2 branchTomSweeneyRedHat2020-07-02
|/ | | | | | | | As the title says. Addresses: https://github.com/containers/buildah/issues/2424 Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-01 04:05:00 +0000