summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Make slirp MTU configurable (network_cmd_options)bitstrings2021-02-04
| | | | | | | | The mtu default value is currently forced to 65520. This let the user control it using the config key network_cmd_options, i.e.: network_cmd_options=["mtu=9000"] Signed-off-by: bitstrings <pino.silvaggio@gmail.com>
* Fix podman generate systemd --new special char handlingPaul Holzinger2021-02-04
| | | | | | | | | | In a systemd unit dollar and percent signs are used for variables. A backslash is used for escape sequences. If any of these characters are used in the create command we have to properly escape them so systemd does not try to interpret them. Fixes #9176 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix --network parsing for podman pod createPaul Holzinger2021-02-04
| | | | | | | | | | | | The `--network` flag is parsed differently for `podman pod create`. This causes confusion and problems for users. The extra parsing logic ignored unsupported network options such as `none`, `container:...` and `ns:...` and instead interpreted them as cni network names. Tests are added to ensure the correct errors are shown. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Endpoint that lists containers does not return correct Status valueMilivoje Legenovic2021-02-04
| | | | | | | | | | | | | Eclipse and Intellij Docker plugin determines the state of the container via the Status field, returned from /containers/json call. Podman always returns empty string, and because of that, both IDEs show the wrong state of the container. Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Docker ignores mount flags that begin with constencyDaniel J Walsh2021-02-04
| | | | | | | | | | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1915332 ``` According to the Docker docs, the consistency option should be ignored on Linux. the possible values are 'cached', 'delegated', and 'consistent', but they should be ignored equally. This is a widely used option in scripts run by developer machines, as this makes file I/O less horribly slow on MacOS. ``` Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* podman generate kube ignores --network=hostMilivoje Legenovic2021-02-04
| | | | Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com>
* Honor custom DNS in play|generate kubebaude2021-02-04
| | | | | | | | | | | | | | | | | | when creating kubernetes yaml from containers and pods, we should honor any custom dns settings the user provided. in the case of generate kube, these would be provided by --dns, --dns-search, and --dns-opt. if multiple containers are involved in the generate, the options will be cumulative and unique with the exception of dns-opt. when replaying a kube file that has kubernetes dns information, we now also add that information to the pod creation. the options for dnspolicy is not enabled as there seemed to be no direct correlation between kubernetes and podman. Fixes: #9132 Signed-off-by: baude <bbaude@redhat.com>
* Don't fail if one of the cgroups is not setupDaniel J Walsh2021-02-04
| | | | | | | | | | | It is fairly common for certain cgroups controllers to not be enabled on a system. We should Warn when this happens versus failing, when doing podman stats command. This way users can get information from the other controllers. Fixes: https://github.com/containers/podman/issues/8588 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix #9100 Change console mode message to debugGerard Braad2021-02-04
| | | | | | [NO TESTS NEEDED] Signed-off-by: Gerard Braad <me@gbraad.nl>
* Update release notes from masterMatthew Heon2021-02-04
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #9225 from mheon/fix_CVE-2021-20199_30OpenShift Merge Robot2021-02-03
|\ | | | | Fix CVE-2021-20199 for Podman v3.0
| * libpod: move slirp magic IPs to constsGiuseppe Scrivano2021-02-03
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * rootlessport: set source IP to slirp4netns deviceGiuseppe Scrivano2021-02-03
| | | | | | | | | | | | | | | | | | set the source IP to the slirp4netns address instead of 127.0.0.1 when using rootlesskit. Closes: https://github.com/containers/podman/issues/5138 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * Bump rootless-containers/rootlesskit to v0.12.0Matthew Heon2021-02-03
|/ | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #9213 from edsantiago/bats_diff_workaround_v3OpenShift Merge Robot2021-02-03
|\ | | | | [v3.0] Gating tests: diff test: workaround for RHEL8 failure
| * Gating tests: diff test: workaround for RHEL8 failureEd Santiago2021-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RHEL8 rootless gating tests are inconsistently failing with: $ podman diff --format json -l # {"changed":["/etc"],"added":["/sys/fs","/sys/fs/cgroup","/pMOm1Q0fnN"],"deleted":["/etc/services"]} # #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv # #| FAIL: added # #| expected: '/pMOm1Q0fnN' # #| actual: '/sys/fs' # #| > '/sys/fs/cgroup' # #| > '/pMOm1Q0fnN' # #\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Reason: PR #8561, I think (something to do with /sys on RHEL). Workaround: ignore '/sys/fs' in diffs. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #9187 from rhatdan/v3.0OpenShift Merge Robot2021-02-03
|\ \ | | | | | | Bump to containers/common v0.33.2
| * | Bump to containers/common v0.33.3Daniel J Walsh2021-02-02
|/ / | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #9184 from vrothberg/3.0-fix-9134OpenShift Merge Robot2021-02-02
|\ \ | | | | | | [3.0] podman build --pull: refine help message and docs
| * | podman build --pull: refine help message and docsValentin Rothberg2021-02-01
| | | | | | | | | | | | | | | | | | | | | Refine and correct the wording of the `--pull` flag in the help message and the docs. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #9198 from baude/v3backportmacvlanOpenShift Merge Robot2021-02-02
|\ \ \ | | | | | | | | [3.0]add macvlan as a supported network driver
| * | | add macvlan as a supported network driverbaude2021-02-02
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | instead of using the --macvlan to indicate that you want to make a macvlan network, podman network create now honors the driver name of *macvlan*. Any options to macvlan, like the parent device, should be specified as a -o option. For example, -o parent=eth0. the --macvlan option was marked as deprecated in the man page but is still supported for the duration of 3.0. Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #9180 from cevich/v3.0_static_remoteOpenShift Merge Robot2021-02-01
|\ \ \ | | | | | | | | [v3.0] Use cachix for static build & include podman-remote build
| * | | Cirrus: Build static podman-remoteChris Evich2021-02-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this commit, the "Static Build" task only produced a `bin/podman`. Update this to also include a `bin/podman-remote` binary. Update the pr-should-include-tests checker to ignore the `nix` directory, which isn't applicable. Lastly, restore the static build task to 'required' for CI success. Leaving the comment inplace in case it needs to be bypassed in the future on short notice. Signed-off-by: Chris Evich <cevich@redhat.com>
| * | | Fix static build cache by using cachixSascha Grunert2021-02-01
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like we always hit the caching issue in Cirrus CI described within #8313. A solution around that is to use cachix, which has been pre-populated from my local machine. To push all (runtime and build) dependencies, we can leverage a pre-populated store by: ``` > nix-store -qR --include-outputs $(nix-instantiate nix/default.nix) | cachix push podman ``` The cache can be re-used by everybody to rapidly build static Podman binaries: https://app.cachix.org/cache/podman [NO TESTS NEEDED] Signed-off-by: Sascha Grunert <mail@saschagrunert.de>
* | | Merge pull request #9179 from cevich/v3.0_fix_validateOpenShift Merge Robot2021-02-01
|\ \ \ | |/ / |/| | [v3.0] Cirrus: Fix running Validate task on branches
| * | Cirrus: Fix running Validate task on branchesChris Evich2021-02-01
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Followup to 4c60523 Despite skipping the `Smoke` check, it was observed on a *new* branch, the `validate` task (specifically `git-validation`) will fail. This is because: * `$CIRRUS_LAST_GREEN_CHANGE` will be empty on a new branch. * `$CIRRUS_BASE_SHA` is always empty for runs triggered by branch-push * `$EPOCH_TEST_COMMIT` will be set to `YOU_FOUND_A_BUG`. Fix this by eliminating the `Smoke` task entirely, simplifying all the `make validate` operations into the `validate` cirrus task. Ensure this task does not run when a new branch or tag is pushed. Also, eliminate the `$CIRRUS_BUILD_ID` value as it's confusing and not actually used anywhere. It was formerly used for building VM images, but this has moved to another repo entirely. Signed-off-by: Chris Evich <cevich@redhat.com>
* | Merge pull request #9163 from mheon/backports_rc2OpenShift Merge Robot2021-01-29
|\ \ | | | | | | Backports for v3.0 RC2
| * | Bump to v3.0.0-devMatthew Heon2021-01-29
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | Bump to v3.0.0-RC2v3.0.0-rc2Matthew Heon2021-01-29
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | Cirrus: add bindings checksValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that bindings are in sync with the code. The check is similar to what's already being done with `make vendor`, so integrate the two. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make bindings generation explicitValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | Instead of implicitly generating the bindings, make it explicit, similar to `make vendor`. This should prevent redundant and possibly error prone generations. A following commit will shield CI. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make bindings generation more robutsValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Go gods did not shine upon us trying to understand what's going on in #9000. The symptom is that `go generate` did not add required imports to a generated file, ultimately breaking subsequent compilation. While it still remains unclear *why* Go is behaving like that, the symptom disappears when `go generate` runs in module mode; that is without `-mod=vendor` and without `GO111MODULE=off`. This was reproducible on two separate machines (Ubuntu and Fedora). Also, when facing an unset GOPATH, set it to Go's default (i.e., $HOME/go) and make sure that GOBIN is in PATH since `goimports` is required by `go generate`. Fixes: #9000 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | simplify bindings generationValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Run `go generate ./pkg/bindings/...` once for all bindings instead of generating them separately. This should speed up bindings generation as a given package is visited only once, and it fixes #8989 by dropping the use of pushd and popd. Fixes: #8989 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make: generate bindings: use vendorValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | Set `-mod=vendor` when generating the bindings. We expect all dependencies to be vendored already. This should slightly speed up the bindings generation and prevent redundant network accesses. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | Make generate systemd --new robust against double curly bracesPaul Holzinger2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the container create command contains an argument with double curly braces the golang template parsing can fail since it tries to interpret the value as variable. To fix this change the default delimiter for the internal template to `{{{{`. Fixes #9034 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * | Ensure shutdown handler access is syncronizedMatthew Heon2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a potential race where two handlers could be added at the same time. Go Maps are not thread-safe, so that could do unpleasant things. Add a mutex to keep things safe. Also, swap the order or Register and Start for the handlers in Libpod runtime created. As written, there was a small gap between Start and Register where SIGTERM/SIGINT would be completely ignored, instead of stopping Podman. Swapping the two closes this gap. Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | workdir presence checksValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A container's workdir can be specified via the CLI via `--workdir` and via an image config with the CLI having precedence. Since images have a tendency to specify workdirs without necessarily shipping the paths with the root FS, make sure that Podman creates the workdir. When specified via the CLI, do not create the path, but check for its existence and return a human-friendly error. NOTE: `crun` is performing a similar check that would yield exit code 127. With this change, however, Podman performs the check and yields exit code 126. Since this is specific to `crun`, I do not consider it to be a breaking change of Podman. Fixes: #9040 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | libpod: add (*Container).ResolvePath()Valentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add an API to libpod to resolve a path on the container. We can refactor the code that was originally written for copy. Other functions are requiring a proper path resolution, so libpod seems like a reasonable home for sharing that code. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | Add default net info in container inspectbaude2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when inspecting a container that is only connected to the default network, we should populate the default network in the container inspect information. Fixes: #6618 Signed-off-by: baude <bbaude@redhat.com> MH: Small fixes, added another test Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | Fix podman history --no-trunc for the CREATED BY fieldPaul Holzinger2021-01-29
| | | | | | | | | | | | | | | | | | Fixes #9120 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * | Ensure the Volumes field in Compat Create is honoredMatthew Heon2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Docker has, for unclear reasons, three separate fields in their Create Container struct in which volumes can be placed. Right now we support two of those - Binds and Mounts, which (roughly) correspond to `-v` and `--mount` respectively. Unfortunately, we did not support the third, `Volumes`, which is used for anonymous named volumes created by `-v` (e.g. `-v /test`). It seems that volumes listed here are *not* included in the remaining two from my investigation, so it should be safe to just append them into our handling of the `Binds` (`-v`) field. Fixes #8649 Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | remote exec: write conmon error on hijacked connectionValentin Rothberg2021-01-29
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure to write error from conmon on the hijacked http connection. This fixes issues where errors were not reported on the client side, for instance, when specified command was not found on the container. To future generations: I am sorry. The code is complex, and there are many interdependencies among the concurrent goroutines. I added more complexity on top but I don't have a good idea of how to reduce complexity in the available time. Fixes: #8281 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #9141 from Luap99/v3-rootless-cniOpenShift Merge Robot2021-01-29
|\ \ | | | | | | [v3.0] Add support for rootless network-aliases and static ip/mac
| * | Add support for rootless network-aliasesPaul Holzinger2021-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure we pass the network aliases as capability args to the cnitool in the rootless-cni-infra container. Also update the dnsname plugin in the cni-infra container. Fixes #8567 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * | Allow static ip and mac with rootless cni networkPaul Holzinger2021-01-28
|/ / | | | | | | | | | | | | | | Make sure we pass the ip and mac address as CNI_ARGS to the cnitool which is executed in the rootless-cni-infra container. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Merge pull request #9107 from baude/v3backportdnsnameinternalOpenShift Merge Robot2021-01-26
|\ \ | | | | | | [3.0] disable dnsname when --internal
| * | disable dnsname when --internalbaude2021-01-26
| | | | | | | | | | | | | | | | | | | | | | | | when doing a network creation, the dnsname plugin should be disabled when the --internal bool is set. a warning is displayed if this happens and docs are updated. Signed-off-by: baude <bbaude@redhat.com>
| * | Use random network names in the e2e testsPaul Holzinger2021-01-26
| |/ | | | | | | | | | | | | | | | | Unlike the container storage all e2e test are using the same cni config directory. This causes problems if the network name already exists. Using random names will make the second run pass even if the first failed. This is only done to prevent full CI failures. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Merge pull request #9112 from baude/v3.0correctpathOpenShift Merge Robot2021-01-26
|\ \ | | | | | | [CI:DOCS]Correct static API html path
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-13 23:14:36 +0000