summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Fix `podman system connection` panicJhon Honce2020-08-20
| | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Revert "remove podman system connection"Matthew Heon2020-08-20
| | | | | | | This reverts commit 66e1626282fab661ac12a354f70b3b2221c69d7c. We are reenabling podman-system-connection. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Bump github.com/containers/common to v0.14.7Matthew Heon2020-08-20
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Fix imports for runtime_img.goMatthew Heon2020-08-20
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Fix one import path pointing to containers/podmanMatthew Heon2020-08-20
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* HACK: Disable build-each-commitMatthew Heon2020-08-20
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Ensure DefaultEnvVariables is used in SpecgenMatthew Heon2020-08-20
| | | | | | | | | | | | When we rewrote Podman's pkg/spec, one of the things that was lost was our use of a set of default environment variables, that ensure all containers have at least $PATH and $TERM set. While we're in the process of re-adding it, change it from a variable to a function, so we can ensure the Join function does not overwrite it and corrupt the defaults. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Update release notes for v2.0.5Matthew Heon2020-08-20
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* [CI:DOCS] BZ1860126 - Fix userns defaults in run man pageTomSweeneyRedHat2020-08-20
| | | | | | | | | | Addresses the multiple "default" userns values found in the podman-run(1) man page: http://docs.podman.io/en/latest/markdown/podman-run.1.html. This in response to: https://bugzilla.redhat.com/show_bug.cgi?id=1860126 which this PR wil fix. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* Unconditionally retrieve pod names via APIMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | The ListContainers API previously had a Pod parameter, which determined if pod name was returned (but, notably, not Pod ID, which was returned unconditionally). This was fairly confusing, so we decided to deprecate/remove the parameter and return it unconditionally. To do this without serious performance implications, we need to avoid expensive JSON decodes of pod configuration in the DB. The way our Bolt tables are structured, retrieving name given ID is actually quite cheap, but we did not expose this via the Libpod API. Add a new GetName API to do this. Fixes #7214 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Default .Repository and .Tag values to <none>Jhon Honce2020-08-20
| | | | | | | | | | Refactor the processing of Repository and Tag fields to default to <none> when printing via --format flag. Previously, the default format would print <none> but --format {{.Tag}} would not in some cases. Fixes #7123 Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Error pass through for more accurate error reportingParker Van Roy2020-08-20
| | | | | | Included old error + wrapped Signed-off-by: Parker Van Roy <pvanroy@redhat.com>
* Fix handling of working dirDaniel J Walsh2020-08-20
| | | | | | | | | | | | | | | | | | | | | Buildah and podman build can create images without a working dir. FROM fedora WORKDIR /test If you build this image with caching twice, the second time the image will not have a working dir. Similarly if you execute podman run --workdir /foobar fedora It blows up since the workingdir is not created automatically. Finally there was duplicated code for getting the workingdir out of an image, that this PR removes. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Do not use image CMD if user gave ENTRYPOINTMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | This matches Docker behavior, and seems to make sense - the CMD may have been specific to the original entrypoint and probably does not make sense if it was changed. While we're in here, greatly simplify the logic for populating the SpecGen's Command. We create the full command when making the OCI spec, so the client should not be doing any more than setting it to the Command the user passed in, and completely ignoring ENTRYPOINT. Fixes #7115 Signed-off-by: Matthew Heon <mheon@redhat.com>
* Ensure WORKDIR from images is createdMatthew Heon2020-08-20
| | | | | | | | | | | | | | A recent crun change stopped the creation of the container's working directory if it does not exist. This is arguably correct for user-specified directories, to protect against typos; it is definitely not correct for image WORKDIR, where the image author definitely intended for the directory to be used. This makes Podman create the working directory and chown it to container root, if it does not already exist, and only if it was specified by an image, not the user. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Allow specifying seccomp profiles for privileged containersSascha Grunert2020-08-20
| | | | | | | To sync the behavior between AppArmor and seccomp it is now possible to also specify seccomp profiles for privileged containers. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* Use set for systemd commandsChristian Heimes2020-08-20
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Enable systemd mode for /usr/local/sbin/initChristian Heimes2020-08-20
| | | | | | | | | | Podman 1.6.2 changed systemd mode auto-detection from commands ending in ``init`` to hard-coded paths ``/sbin/init`` and ``/usr/sbin/init``. This broke FreeIPA container. ``podman run`` and ``podman create`` now activate systemd mode when the command is ``/usr/local/sbin/init``. Fixes: https://github.com/containers/podman/issues/7287 Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Replace deepcopy on history resultsBrent Baude2020-08-20
| | | | | | | | the deepcopy in the remote history code path was throwing an uncaught error on a type mismatch. we now manually do the conversion and fix the type mismatch on the fly. Fixes: #7122 Signed-off-by: Brent Baude <bbaude@redhat.com>
* Add parameter verification for api creation networkzhangguanzhang2020-08-20
| | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
* add event for image buildBrent Baude2020-08-20
| | | | | | | | | | | | upon image build completion, a new image type event is written for "build". more intricate details, like pulling an image, that might be done by build must be implemented in different vendored packages only after libpod is split from podman. Fixes: #7022 Signed-off-by: Brent Baude <bbaude@redhat.com> <MH: Fixed imports during cherry-pick> Signed-off-by: Matt Heon <matthew.heon@pm.me>
* Change /sys/fs/cgroup/systemd mount to rprivateMatthew Heon2020-08-20
| | | | | | | | I used the wrong propagation first time around because I forgot that rprivate is the default propagation. Oops. Switch to rprivate so we're using the default. Signed-off-by: Matthew Heon <mheon@redhat.com>
* podman save use named pipeQi Wang2020-08-20
| | | | | | | | | | | podman save uses named pipe as output path, not directly using /dev/stdout. fix #7017 Signed-off-by: Qi Wang <qiwan@redhat.com> <MH: Corrected imports during cherry-pick> Signed-off-by: Matt Heon <matthew.heon@pm.me>
* Fix hang when `path` doesn't existJonathan Dieter2020-08-20
| | | | | | | | | | I'm not sure if this is an OS-specific issue, but on CentOS 8, if `path` doesn't exist, this hangs while waiting to read from this socket, even though the socket is closed by the `reexec_in_user_namespace`. Switching to a pipe fixes the problem, and pipes shouldn't be an issue since this is Linux-specific code. Signed-off-by: Jonathan Dieter <jonathan.dieter@spearline.com>
* podman.service: use sdnotiyValentin Rothberg2020-08-20
| | | | | | | | | | | | | | | | Commit 2b6dd3fb4384 set the killmode of the podman.service to the systemd default which ultimately lead to the problem that systemd will kill *all* processes inside the unit's cgroup and hence kill all containers whenever the service is stopped. Fix it by setting the type to sdnotify and the killmode to process. `podman system service` will send the necessary notify messages when the NOTIFY_SOCKET is set and unset it right after to prevent the backend and container runtimes from jumping in between and send messages as well. Fixes: #7294 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* podman support for IPv6 networksAntonio Ojea2020-08-20
| | | | | | | | | | | podman containers using IPv6 were missing the default route, breaking deployments trying to use them. The problem is that the default route was hardcoded to IPv4, this takes into consideration the podman subnet IP family to generate the corresponding default route. Signed-off-by: Antonio Ojea <aojea@redhat.com>
* Merge pull request #7356 from vrothberg/2.0-vendor-imageOpenShift Merge Robot2020-08-20
|\ | | | | [2.0] vendor c/image v5.5.2
| * vendor c/image v5.5.2Valentin Rothberg2020-08-20
|/ | | | | | | | Enable pagination until the search result reaches the limit, instead of returning default 100 limit from registry API. BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1866153 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #7381 from baude/v2CIFixOpenShift Merge Robot2020-08-19
|\ | | | | Fix v2.0.x CI
| * Fix v2.0.x CIBrent Baude2020-08-19
|/ | | | | | Fix the Ci for our 2.0.x branch. Signed-off-by: Brent Baude <bbaude@redhat.com>
* Merge pull request #7289 from vrothberg/v2-backportsOpenShift Merge Robot2020-08-11
|\ | | | | V2 backports
| * system tests: invoke with abs path to podmanEd Santiago2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reversion of one part of #6679: my handling of 'realpath' would not work when $PODMAN is 'podman-remote --url etc'. Trying to handle that case got unmaintainable; so instead let's just force 'make {local,remote}system' to invoke with a full PODMAN path. This breaks down if someone runs the tests with a manual 'bats' invocation, but I think I'm the only one who ever does that. Since podman path will now be very long in the logs, add code to logformatter to abbreviate it like we do for the ginkgo logs. And, one thing that has bugged me for a long time: in the error logs, show a different prompt ('#' vs '$') to distinguish root vs rootless. This should make it much easier to see at-a-glance whether a log file is root or not. Add tests for it. Signed-off-by: Ed Santiago <santiago@redhat.com>
| * Make changes to /etc/passwd on disk for non-read onlyMatthew Heon2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bind-mounting /etc/passwd into the container is problematic becuase of how system utilities like `useradd` work. They want to make a copy and then rename to try to prevent breakage; this is, unfortunately, impossible when the file they want to rename is a bind mount. The current behavior is fine for read-only containers, though, because we expect useradd to fail in those cases. Instead of bind-mounting, we can edit /etc/passwd in the container's rootfs. This is kind of gross, because the change will show up in `podman diff` and similar tools, and will be included in images made by `podman commit`. However, it's a lot better than breaking important system tools. Fixes #6953 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add username to /etc/passwd inside of container if --userns keep-idDaniel J Walsh2020-08-11
| | | | | | | | | | | | | | | | | | | | If I enter a continer with --userns keep-id, my UID will be present inside of the container, but most likely my user will not be defined. This patch will take information about the user and stick it into the container. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
| * Fix close fds of exec --preserve-fdsQi Wang2020-08-11
| | | | | | | | | | | | Fix the closing of fds from --preserve-fds to avoid the operation on unrelated fds. Signed-off-by: Qi Wang <qiwan@redhat.com>
| * fix pod creation with "new:" syntaxPaul Holzinger2020-08-11
| | | | | | | | | | | | | | | | | | | | | | When you execute podman create/run with the --pod new:<name> syntax the pod was created but the namespaces where not shared and therefore containers could not communicate over localhost. Add the default namespaces and pass the network options to the pod create options. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * Fix podman service --valink timeoutJhon Honce2020-08-11
| | | | | | | | | | | | | | | | Documentation and unit files call for a millisecond timeout while the code was using a second resolution. Code change is smaller given varlink has been deprecated. Signed-off-by: Jhon Honce <jhonce@redhat.com>
| * Add versioned _ping endpointJhon Honce2020-08-11
| | | | | | | | | | | | Fixes #7008 Signed-off-by: Jhon Honce <jhonce@redhat.com>
| * Change recommended systemd unit path for root.Paul Holzinger2020-08-11
| | | | | | | | | | | | | | | | | | | | `/usr/lib/systemd/system` should only be used by the package manager administrators should use: `/etc/systemd/system` or `/usr/local/lib/systemd/system` see: man systemd.unit Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * API returns 500 in case network is not found instead of 404zhangguanzhang2020-08-11
| | | | | | | | | | Backported-by: Valentin Rothberg <rothberg@redhat.com> Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
| * podman.service: drop install sectionValentin Rothberg2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman.service is socket activated through podman.socket. It should not have its own [Install] section, it does not make sense to systemctl enable podman.service. This leads to podman.service always running on a Debian system, as Debian's policy is to enable/start running services by default. We don't want a daemon :^) Fixes: #7190 Reported-by: @martinpitt Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * Handle podman-remote run --rmDaniel J Walsh2020-08-11
| | | | | | | | | | | | | | | | We need to remove the container after it has exited for podman-remote run --rm commands. If we don't remove this container at this step, we open ourselves up to race conditions. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
| * correct go-binding key for volumesBrent Baude2020-08-11
| | | | | | | | | | | | | | | | the go binding for remove container was using 'vols' for a key to remove volumes associated to the container. the correct key should be "v" and is documented as such. Fixes: #7128 Signed-off-by: Brent Baude <bbaude@redhat.com>
| * cherry-pick: Reenable remote system testsEd Santiago2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NOTE: the remote tests are not reenabled but the changes are applied. Future commits depend on some of the changes and having the commit applied will likely facilitate future backports as well. podman-remote is in better shape now. Let's see what needs to be done to reenable remote system tests. - logs test: skip multilog, it doesn't work remote - diff test: use -l only when local, not with remote - many other tests: skip_if_remote, with 'FIXME: pending #xxxx' where xxxx is a filed issue. Unrelated: added new helper to skip_if_remote and _if_rootless, where we check if the source message includes "remote"/"rootless" and insert it if missing. This is a minor usability enhancement to make it easier to understand at-a-glance why a skip triggers. Backported-by: Valentin Rothberg <rothberg@redhat.com> Signed-off-by: Ed Santiago <santiago@redhat.com>
| * system tests: new tests for run, execEd Santiago2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Issue #6735 : problem with multiple namespaces; confirms combinations of --userns=keep-id, --privileged, --user=XX - Issue #6829 : --userns=keep-id will add a /etc/passwd entry - Issue #6593 : podman exec, with --userns=keep-id, errors (test is currently skipped because issue remains live) ...and, addendum: add new helper function, remove_same_dev_warning. Some CI systems issue a warning on podman run --privileged: WARNING: The same type, major and minor should not be used for multiple devices. We already had special-case code to ignore than in the SELinux test, but now we're seeing it in the new run tests I added, so I've refactored the "ignore this warning" code and written tests for the removal code. Signed-off-by: Ed Santiago <santiago@redhat.com>
| * implement the exitcode when start a container with attachzhangguanzhang2020-08-11
| | | | | | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
| * Do not set host IP on ports when 0.0.0.0 requestedMatthew Heon2020-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Docker and CNI have very different ideas of what 0.0.0.0 means. Docker takes it to be 0.0.0.0/0 - that is, bind to every IPv4 address on the host. CNI (and, thus, root Podman) take it to mean the literal IP 0.0.0.0. Instead, CNI interprets the empty string ("") as "bind to all IPs". We could ask CNI to change, but given this is established behavior, that's unlikely. Instead, let's just catch 0.0.0.0 and turn it into "" when we parse ports. Fixes #7014 Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Missing return after early exitBrent Baude2020-08-11
| | | | | | | | | | | | | | | | the exists code was plagued by a missing return statement meant to trigger an early exit. Fixes: #7197 Signed-off-by: Brent Baude <bbaude@redhat.com>
| * docker-compose uses application/tarBrent Baude2020-08-11
| | | | | | | | | | | | | | | | even though the official documentation suggests that application/x-tar should be used for tar files, it seems docker-compose uses application/tar. we now accept them and issue a warning. Fixes: #7185 Signed-off-by: Brent Baude <bbaude@redhat.com>
| * rootless: system service joins immediately the namespacesGiuseppe Scrivano2020-08-11
| | | | | | | | | | | | | | | | | | | | when there is a pause process running, let the "system service" podman instance join immediately the existing namespaces. Closes: https://github.com/containers/podman/issues/7180 Closes: https://github.com/containers/podman/issues/6660 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-15 06:02:11 +0000