summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* rootless: unexport GetUserNSForPidGiuseppe Scrivano2018-08-29
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1371 Approved by: rhatdan
* rootless, exec: use the new function to join the usernsGiuseppe Scrivano2018-08-29
| | | | | | | | | | since we have a way for joining an existing userns use it instead of nsenter. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1371 Approved by: rhatdan
* rootless: fix topGiuseppe Scrivano2018-08-29
| | | | | | | | | | join the user namespace used to create the container so that psgo can work in the same way as with root containers. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1371 Approved by: rhatdan
* rootless: add new function to join existing namespaceGiuseppe Scrivano2018-08-29
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1371 Approved by: rhatdan
* Vendor in latest projectatomic/buildahDaniel J Walsh2018-08-29
| | | | | | | | | | | | This will help document the defaults in podman build. podman build --help will now show the defaults and mention the environment variables that can be set to change them. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #1364 Approved by: mheon
* Set nproc in containers unless explicitly overriddenMatthew Heon2018-08-28
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1355 Approved by: rhatdan
* Do not set max open files by default if we are rootlessMatthew Heon2018-08-28
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1355 Approved by: rhatdan
* Set default max open files in specMatthew Heon2018-08-28
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1355 Approved by: rhatdan
* Resolve /etc/resolv.conf before readingbaude2018-08-28
| | | | | | | | | | | | | | | | | In some cases, /etc/resolv.conf can be a symlink to something like /run/systemd/resolve/resolv.conf. We currently check for that file and if it exists, use it instead of /etc/resolv.conf. However, we are no seeing cases where the systemd resolv.conf exists but /etc/resolv.conf is NOT a symlink. Therefore, we now obtain the endpoint for /etc/resolv.conf whether it is a symlink or not. That endpoint is now what is read to generate a container's resolv.conf. Signed-off-by: baude <bbaude@redhat.com> Closes: #1368 Approved by: rhatdan
* document `--rm` semanticsValentin Rothberg2018-08-28
| | | | | | | | | | | | | | The `--rm` flag will only cause a container to be removed when it has been created and started successfully. Otherwise, it will not be removed to allow the container to be inspected and to analyze the root cause of the failure. Document those semantics more clearly in the manpages to avoid confusion for users. Fixes: #1359 Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1362 Approved by: rhatdan
* allow specification of entrypoint in the form of a sliceDaniel J Walsh2018-08-28
| | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #1352 Approved by: mheon
* Test RPM build and install for regressionsbaude2018-08-28
| | | | | | | | | | | | On Fedora and now Centos (added), we build RPMs based on the spec in contrib/spec to make sure we protect against regressions when creating RPMs. Once the RPM is built, we then test actually installing the RPM to ensure that no deps are missing for install. Signed-off-by: baude <bbaude@redhat.com> Closes: #1356 Approved by: rhatdan
* rootless, search: do not create a new usernsGiuseppe Scrivano2018-08-28
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1360 Approved by: vrothberg
* rootless, login, logout: do not create a new usernsGiuseppe Scrivano2018-08-28
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1360 Approved by: vrothberg
* rootless, kill: do not create a new usernsGiuseppe Scrivano2018-08-28
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1360 Approved by: vrothberg
* rootless, stop: do not create a new usernsGiuseppe Scrivano2018-08-28
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1360 Approved by: vrothberg
* Ensure return errors match API docsbaude2018-08-28
| | | | | | | | | | | In the API docs, we generally state the type of error that should be returned if a container or image cannot be found. In several cases, the code did not match the API doc, when the API doc was correct. Signed-off-by: baude <bbaude@redhat.com> Closes: #1353 Approved by: rhatdan
* Fix manpage to note how multiple filters are combinedMatthew Heon2018-08-27
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1345 Approved by: umohnani8
* Fix handling of multiple filters in podman psMatthew Heon2018-08-27
| | | | | | | | | | | | | Docker expects multiple filters to be passed with multiple uses of the --filter flag (e.g. --filter=label=a=b --filter=label=c=d) and not a single comma-separated list of filters as we expected. Convert to the Docker format, and make some small cleanups to our handling of filters along the way. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1345 Approved by: umohnani8
* Fix Mount PropagationGiuseppe Scrivano2018-08-27
| | | | | | | | | Default mount propagation inside of containes should be private Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #1305 Approved by: mheon
* docs: add containers-mounts.conf(5)Valentin Rothberg2018-08-27
| | | | | | | | | | | Add a containers-mounts.conf(5) manpage. The mounts.conf is used by other tools (e.g., CRI-O) as well. A dedicated manpage reduces redundancy. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1350 Approved by: rhatdan
* docs: use "containers-" prefix for registries and storageValentin Rothberg2018-08-27
| | | | | | | | | | | Use the "containers-" prefix for all references to the containers-registries.conf and containers-storage.conf configuration files. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1350 Approved by: rhatdan
* rootless: fix --pid=hostGiuseppe Scrivano2018-08-27
| | | | | | | | | | | | Unfortunately this is not enough to get it working as runc doesn't allow to bind mount /proc. Depends on: https://github.com/opencontainers/runc/pull/1832 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
* rootless: fix --ipc=hostGiuseppe Scrivano2018-08-27
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
* spec: bind mount /sys only when userNS are enabledGiuseppe Scrivano2018-08-27
| | | | | | | | | | | Fix the test for checking when /sys must be bind mounted from the host. It should be done only when userNS are enabled (the !UsernsMode.IsHost() check is not enough for that). Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
* rootless, tests: add test for --uts=hostGiuseppe Scrivano2018-08-27
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
* Dockerfile.Fedora: install slirp4netnsGiuseppe Scrivano2018-08-27
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
* rootless: don't use kill --allGiuseppe Scrivano2018-08-26
| | | | | | | | | | | | | The OCI runtime might use the cgroups to see what PIDs are inside the container, but that doesn't work with rootless containers. Closes: https://github.com/containers/libpod/issues/1337 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1331 Approved by: rhatdan
* rootless: exec handle processes that create an user namespaceGiuseppe Scrivano2018-08-26
| | | | | | | | | | | | | | Manage the case where the main process of the container creates and joins a new user namespace. In this case we want to join only the first child in the new hierarchy, which is the user namespace that was used to create the container. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1331 Approved by: rhatdan
* rootless: fix execGiuseppe Scrivano2018-08-26
| | | | | | | | | | | | | | | | | | | | | We cannot re-exec into a new user namespace to gain privileges and access an existing as the new namespace is not the owner of the existing container. "unshare" is used to join the user namespace of the target container. The current implementation assumes that the main process of the container didn't create a new user namespace. Since in the setup phase we are not running with euid=0, we must skip the setup for containers/storage. Closes: https://github.com/containers/libpod/issues/1329 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1331 Approved by: rhatdan
* Move whale-says test to end of baselineTomSweeneyRedHat2018-08-25
| | | | | | | Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com> Closes: #1346 Approved by: rhatdan
* Merge pull request #1343 from mheon/bump-0.8.4Matthew Heon2018-08-24
|\ | | | | Bump to 0.8.4
| * Bump gitvalidation epochMatthew Heon2018-08-24
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
| * Bump to v0.8.5-devMatthew Heon2018-08-24
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
| * Bump to v0.8.4v0.8.4Matthew Heon2018-08-24
|/ | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* Merge pull request #1342 from mheon/add_release_notesMatthew Heon2018-08-24
|\ | | | | Add release notes for 0.8.4
| * Add release notesMatthew Heon2018-08-24
|/ | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* Regenerate easyjson after rebaseMatthew Heon2018-08-24
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1322 Approved by: mheon
* Vendor easyjson code to fix buildMatthew Heon2018-08-24
| | | | | | | | | | | To ensure we can build without easyjson installed, vendor the easyjson repository as the generated files use the easyjson library. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1322 Approved by: mheon
* Swap from FFJSON to easyjsonMatthew Heon2018-08-24
| | | | | | | | | | | | | | | FFJSON has serialization differences versus stock Go - namely, it does not respect the MarshalText() and UnmarshalText() methods, particularly on []byte, which causes incompatability with pre-FFJSON containers which contained DNS servers. EasyJSON does not have these issues, and might even be slightly faster. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1322 Approved by: mheon
* Make 'make clean' remove FFJSON generated codeMatthew Heon2018-08-24
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1322 Approved by: mheon
* rootless: allow to override policy.json by the userGiuseppe Scrivano2018-08-24
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1336 Approved by: mheon
* add completion for --pod in run and createhaircommander2018-08-24
| | | | | | | Signed-off-by: haircommander <pehunt@redhat.com> Closes: #1339 Approved by: mheon
* Fixed formatting and lowered verbosity of pod pshaircommander2018-08-24
| | | | | | | | | CtrInfo now is formatted in the way originally intended. s/Number Of Containers/# Of Containers and s/Infra Container ID/Infra ID. Make json camel case. Signed-off-by: haircommander <pehunt@redhat.com> Closes: #1338 Approved by: mheon
* Do not try to enable AppArmor in rootless modeMarco Vedovati2018-08-24
| | | | | | | | | | | When in rootless mode it's not possible to load profiles or check which profiles are loaded. Added a few baseline tests to check all possible cases. Signed-off-by: Marco Vedovati <mvedovati@suse.com> Closes: #1250 Approved by: mheon
* exposes tcp port only if no proto specified.Kunal Kushwaha2018-08-24
| | | | | | | | | | Also it fix the issue of exposing both tc/udp port even if only one proto specified. Signed-off-by: Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp> Closes: #1325 Approved by: mheon
* rpm-spec: use skopeo-containers instead of containers-commonLokesh Mandvekar2018-08-24
| | | | | | | | | skopeo-containers is available everywhere, but not containers-common Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org> Closes: #1332 Approved by: rhatdan
* Reveal information about container capabilitiesDaniel J Walsh2018-08-24
| | | | | | | | | | | I am often asked about the list of capabilities availabel to a container. We should be listing this data in the inspect command for effective capabilities and the bounding set. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #1335 Approved by: TomSweeneyRedHat
* Vendor in latest projectatomic/buildahumohnani82018-08-23
| | | | | | | | | | Fixes to podman build for unknown image and ADD with url when doing --layers. Signed-off-by: umohnani8 <umohnani@redhat.com> Closes: #1330 Approved by: mheon
* Refactor error checking in With*NSFromPod optionshaircommander2018-08-23
| | | | | | | Signed-off-by: haircommander <pehunt@redhat.com> Closes: #1187 Approved by: mheon
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-07 01:26:46 +0000