summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* abi: set default umask and rlimitsGiuseppe Scrivano2020-07-17
| | | | | | | | the code got lost in the migration to podman 2.0, reintroduce it. Closes: https://github.com/containers/podman/issues/6989 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #7000 from ↵OpenShift Merge Robot2020-07-17
|\ | | | | | | | | containers/dependabot/go_modules/github.com/containers/common-0.16.0 Bump github.com/containers/common from 0.15.2 to 0.16.0
| * Bump github.com/containers/common from 0.15.2 to 0.16.0Daniel J Walsh2020-07-16
| | | | | | | | | | | | | | | | | | Bumps [github.com/containers/common](https://github.com/containers/common) from 0.15.2 to 0.16.0. - [Release notes](https://github.com/containers/common/releases) - [Commits](https://github.com/containers/common/compare/v0.15.2...v0.16.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #6965 from giuseppe/followup-pr6324OpenShift Merge Robot2020-07-17
|\ \ | | | | | | allow switching of port-forward approaches in rootless/using slirp4netns
| * | docs: document the new slirp4netns optionsGiuseppe Scrivano2020-07-16
| | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | network, slirp4netns: add option to allow host loopbackGiuseppe Scrivano2020-07-16
| | | | | | | | | | | | | | | | | | Closes: https://github.com/containers/podman/issues/6912 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | libpod: pass down network optionsGiuseppe Scrivano2020-07-16
| | | | | | | | | | | | | | | | | | do not pass network specific options through the network namespace. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | allow switching of port-forward approaches in rootless/using slirp4netnsaleks-mariusz2020-07-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As of podman 1.8.0, because of commit da7595a, the default approach of providing port-forwarding in rootless mode has switched (and been hard-coded) to rootlessport, for the purpose of providing super performance. The side-effect of this switch is source within the container to the port-forwarded service always appears to originate from 127.0.0.1 (see issue #5138). This commit allows a user to specify if they want to revert to the previous approach of leveraging slirp4netns add_hostfwd() api which, although not as stellar performance, restores usefulness of seeing incoming traffic origin IP addresses. The change should be transparent; when not specified, rootlessport will continue to be used, however if specifying --net slirp4netns:slirplisten the old approach will be used. Note: the above may imply the restored port-forwarding via slirp4netns is not as performant as the new rootlessport approach, however the figures shared in the original commit that introduced rootlessport are as follows: slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps, which are more than sufficient for many use cases where the origin of traffic is more important than limits that cannot be reached due to bottlenecks elsewhere. Signed-off-by: Aleks Mariusz <m.k@alek.cx> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #6963 from ↵OpenShift Merge Robot2020-07-16
|\ \ \ | | | | | | | | | | | | | | | | containers/dependabot/go_modules/github.com/uber/jaeger-client-go-2.25.0incompatible Bump github.com/uber/jaeger-client-go from 2.24.0+incompatible to 2.25.0+incompatible
| * | | Bump github.com/uber/jaeger-client-godependabot-preview[bot]2020-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github.com/uber/jaeger-client-go](https://github.com/uber/jaeger-client-go) from 2.24.0+incompatible to 2.25.0+incompatible. - [Release notes](https://github.com/uber/jaeger-client-go/releases) - [Changelog](https://github.com/jaegertracing/jaeger-client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/uber/jaeger-client-go/compare/v2.24.0...v2.25.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #7003 from mheon/404_on_noimageOpenShift Merge Robot2020-07-16
|\ \ \ \ | |_|_|/ |/| | | The compat create endpoint should 404 on no such image
| * | | The compat create endpoint should 404 on no such imageMatthew Heon2020-07-16
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | This matches Docker behavior, and will make the Docker frontend work with `podman system service` (Docker tries to create, then if that fails with 404 sends a request to pull the image). Fixes #6960 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #6988 from jwhonce/wip/connectionOpenShift Merge Robot2020-07-16
|\ \ \ | | | | | | | | Fix `podman system connection` panic
| * | | Fix `podman system connection` panicJhon Honce2020-07-15
| | | | | | | | | | | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | | | Merge pull request #7001 from containers/dependabot/go_modules/k8s.io/api-0.18.6OpenShift Merge Robot2020-07-16
|\ \ \ \ | | | | | | | | | | Bump k8s.io/api from 0.18.5 to 0.18.6
| * | | | Bump k8s.io/api from 0.18.5 to 0.18.6Daniel J Walsh2020-07-16
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [k8s.io/api](https://github.com/kubernetes/api) from 0.18.5 to 0.18.6. - [Release notes](https://github.com/kubernetes/api/releases) - [Commits](https://github.com/kubernetes/api/compare/v0.18.5...v0.18.6) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #6998 from ↵OpenShift Merge Robot2020-07-16
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | containers/dependabot/go_modules/github.com/containers/conmon-2.0.19incompatible Bump github.com/containers/conmon from 2.0.18+incompatible to 2.0.19+incompatible
| * | | | Bump github.com/containers/conmondependabot-preview[bot]2020-07-16
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github.com/containers/conmon](https://github.com/containers/conmon) from 2.0.18+incompatible to 2.0.19+incompatible. - [Release notes](https://github.com/containers/conmon/releases) - [Changelog](https://github.com/containers/conmon/blob/master/changelog.txt) - [Commits](https://github.com/containers/conmon/compare/v2.0.18...v2.0.19) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #6999 from ↵OpenShift Merge Robot2020-07-16
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | containers/dependabot/go_modules/k8s.io/apimachinery-0.18.6 Bump k8s.io/apimachinery from 0.18.5 to 0.18.6
| * | | | Bump k8s.io/apimachinery from 0.18.5 to 0.18.6dependabot-preview[bot]2020-07-16
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.18.5 to 0.18.6. - [Release notes](https://github.com/kubernetes/apimachinery/releases) - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.18.5...v0.18.6) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #6997 from vrothberg/update-x/textOpenShift Merge Robot2020-07-16
|\ \ \ \ | |/ / / |/| | | vendor golang.org/x/text@v0.3.3
| * | | vendor golang.org/x/text@v0.3.3Valentin Rothberg2020-07-16
|/ / / | | | | | | | | | | | | | | | Fixes: CVE-2020-14040 Fixes: bugzilla.redhat.com/show_bug.cgi?id=1854718 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #6903 from ashley-cui/problemlangOpenShift Merge Robot2020-07-15
|\ \ \ | | | | | | | | Fix & add notes regarding problematic language in codebase
| * | | Fix & add notes regarding problematic language in codebaseAshley Cui2020-07-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Podman is committed to inclusivity, a core value of open source. Historically, there have been technology terms that are problematic and divisive, and should be changed. We are currently taking time to audit our repository in order to eliminate such terminology, and replace it with more inclusive terms. We are starting where we can, with our own code, comments, and documentation. However, such terms may be used in dependencies, and must be used in our repositories at the current moment for compatibility. Podman will change these terms in our repo as soon as new and better terminology is available to us via our dependencies. For more information: https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language?sc_cid=701600000011gf0AAA Signed-off-by: Ashley Cui <acui@redhat.com>
* | | | Merge pull request #6975 from baude/rootlessIPMACOpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | Error on rootless mac and ip addresses
| * | | | Error on rootless mac and ip addressesBrent Baude2020-07-15
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | When creating a pod or container where a static MAC or IP address is provided, we should return a proper error and exit as 125. Fixes: #6972 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | Merge pull request #6979 from edsantiago/bats_masked_dirsOpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | system tests: check for masked-device leaks
| * | | | system tests: check for masked-device leaksEd Santiago2020-07-14
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PR #6957 added a new path (/sys/devs) to an existing list of masked mount points which an unprivileged container should not be able to access. Here we add a test for those: run 'stat' on those devices in the container, and make sure that they are dummies. This is kind of kludgy, and relies on heuristics that may not be 100% accurate. It also adds duplication, a list that must be kept in sync with the original list in pkg/specgen/generate/config_linux.go. I'd love to hear suggestions on how to do it better. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #6977 from mheon/fix_6953OpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | Preserve passwd on container restart
| * | | | Preserve passwd on container restartMatthew Heon2020-07-15
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We added code to create a `/etc/passwd` file that we bind-mount into the container in some cases (most notably, `--userns=keep-id` containers). This, unfortunately, was not persistent, so user-added users would be dropped on container restart. Changing where we store the file should fix this. Further, we want to ensure that lookups of users in the container use the right /etc/passwd if we replaced it. There was already logic to do this, but it only worked for user-added mounts; it's easy enough to alter it to use our mounts as well. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #6958 from edsantiago/batsOpenShift Merge Robot2020-07-15
|\ \ \ \ | |/ / / |/| | | system tests: new tests for run, exec
| * | | system tests: new tests for run, execEd Santiago2020-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Issue #6735 : problem with multiple namespaces; confirms combinations of --userns=keep-id, --privileged, --user=XX - Issue #6829 : --userns=keep-id will add a /etc/passwd entry - Issue #6593 : podman exec, with --userns=keep-id, errors (test is currently skipped because issue remains live) ...and, addendum: add new helper function, remove_same_dev_warning. Some CI systems issue a warning on podman run --privileged: WARNING: The same type, major and minor should not be used for multiple devices. We already had special-case code to ignore than in the SELinux test, but now we're seeing it in the new run tests I added, so I've refactored the "ignore this warning" code and written tests for the removal code. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #6949 from AkihiroSuda/fix-6948OpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | Fix "Error: unrecognized protocol \"TCP\" in port mapping"
| * | | | Fix "Error: unrecognized protocol \"TCP\" in port mapping"Akihiro Suda2020-07-15
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | "TCP" in upper characters was not recognized as a valid protocol name. Fix #6948 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* | | | Merge pull request #6974 from sshnaidm/fixdocs1OpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | docs: user namespace can't be shared in pods
| * | | | docs: user namespace can't be shared in podsSagi Shnaidman2020-07-14
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | When running "podman pod create --share user" the errors appears: Error: User sharing functionality not supported on pod level Fix docs and remove 'user' from shareable parameters. Signed-off-by: Sagi Shnaidman <sshnaidm@redhat.com>
* | | | Merge pull request #6978 from edsantiago/apiv2_flake_fixOpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | APIv2 tests: fix race condition causing CI flake
| * | | | APIv2 tests: fix race condition causing CI flakeEd Santiago2020-07-14
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A newly-added test in #6835 was flaking in CI with: not ok 143 [20-containers] DELETE libpod/containers/SHA 500 cannot remove container <sha> as it is running - running or paused containers cannot be removed without force: container state improper Root cause: DELETE being run immediately after container start. Although the container is short-lived, it does take time to run and exit. Solution: wait for container to exit (should be quick) before deleting. This gives us a new test for the /wait endpoint. Also: tweaked some comments for readability, removed unnecessary container ps, added actual container status checks, and added actual message checks to another test that was merely checking exit status. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #6971 from TristanCacqueray/masterOpenShift Merge Robot2020-07-15
|\ \ \ \ | | | | | | | | | | play-kube: add suport for "IfNotPresent" pull type
| * | | | play-kube: add suport for "IfNotPresent" pull typeTristan Cacqueray2020-07-14
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | This change prevents this exception when loading a pod spec using the "IfNotPresent" pull policy: Error: invalid pull type "IfNotPresent" Signed-off-by: Tristan Cacqueray <tdecacqu@redhat.com>
* | | | Merge pull request #6956 from mheon/add_ports_to_pod_inspectOpenShift Merge Robot2020-07-15
|\ \ \ \ | |_|_|/ |/| | | Include infra container information in `pod inspect`
| * | | Fix lintMatthew Heon2020-07-14
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | | Populate remaining unused fields in `pod inspect`Matthew Heon2020-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were hard-coding two fields to false, instead of grabbing their value from the pod config, which means that `pod inspect` would print the wrong value always. Fixes #6968 Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | | Include infra container information in `pod inspect`Matthew Heon2020-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We had a field for this in the inspect data, but it was never being populated. Because of this, `podman pod inspect` stopped showing port bindings (and other infra container settings). Add code to populate the infra container inspect data, and add a test to ensure we don't regress again. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | | Merge pull request #6957 from rhatdan/sysdevOpenShift Merge Robot2020-07-14
|\ \ \ \ | | | | | | | | | | Mask out /sys/dev to prevent information leak from the host
| * | | | Mask out /sys/dev to prevent information leak from the hostDaniel J Walsh2020-07-14
| | |/ / | |/| | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #6964 from ↵OpenShift Merge Robot2020-07-14
|\ \ \ \ | |_|_|/ |/| | | | | | | | | | | containers/dependabot/go_modules/github.com/containers/storage-1.21.1 Bump github.com/containers/storage from 1.21.0 to 1.21.1
| * | | Bump github.com/containers/storage from 1.21.0 to 1.21.1dependabot-preview[bot]2020-07-14
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github.com/containers/storage](https://github.com/containers/storage) from 1.21.0 to 1.21.1. - [Release notes](https://github.com/containers/storage/releases) - [Changelog](https://github.com/containers/storage/blob/master/docs/containers-storage-changes.md) - [Commits](https://github.com/containers/storage/compare/v1.21.0...v1.21.1) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #6939 from rhatdan/entrypointOpenShift Merge Robot2020-07-14
|\ \ \ | | | | | | | | Fix handling of entrypoint
| * | | Fix handling of entrypointDaniel J Walsh2020-07-14
| |/ / | | | | | | | | | | | | | | | | | | If a user specifies an entrypoint of "" then we should not use the images entrypoint. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>