summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* libpod: deduplicate ports in dbPaul Holzinger2021-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OCICNI port format has one big problem: It does not support ranges. So if a users forwards a range of 1k ports with podman run -p 1001-2000 we have to store each of the thousand ports individually as array element. This bloats the db and makes the JSON encoding and decoding much slower. In many places we already use a better port struct type which supports ranges, e.g. `pkg/specgen` or the new network interface. Because of this we have to do many runtime conversions between the two port formats. If everything uses the new format we can skip the runtime conversions. This commit adds logic to replace all occurrences of the old format with the new one. The database will automatically migrate the ports to new format when the container config is read for the first time after the update. The `ParsePortMapping` function is `pkg/specgen/generate` has been reworked to better work with the new format. The new logic is able to deduplicate the given ports. This is necessary the ensure we store them efficiently in the DB. The new code should also be more performant than the old one. To prove that the code is fast enough I added go benchmarks. Parsing 1 million ports took less than 0.5 seconds on my laptop. Benchmark normalize PortMappings in specgen: Please note that the 1 million ports are actually 20x 50k ranges because we cannot have bigger ranges than 65535 ports. ``` $ go test -bench=. -benchmem ./pkg/specgen/generate/ goos: linux goarch: amd64 pkg: github.com/containers/podman/v3/pkg/specgen/generate cpu: Intel(R) Core(TM) i7-10850H CPU @ 2.70GHz BenchmarkParsePortMappingNoPorts-12 480821532 2.230 ns/op 0 B/op 0 allocs/op BenchmarkParsePortMapping1-12 38972 30183 ns/op 131584 B/op 9 allocs/op BenchmarkParsePortMapping100-12 18752 60688 ns/op 141088 B/op 315 allocs/op BenchmarkParsePortMapping1k-12 3104 331719 ns/op 223840 B/op 3018 allocs/op BenchmarkParsePortMapping10k-12 376 3122930 ns/op 1223650 B/op 30027 allocs/op BenchmarkParsePortMapping1m-12 3 390869926 ns/op 124593840 B/op 4000624 allocs/op BenchmarkParsePortMappingReverse100-12 18940 63414 ns/op 141088 B/op 315 allocs/op BenchmarkParsePortMappingReverse1k-12 3015 362500 ns/op 223841 B/op 3018 allocs/op BenchmarkParsePortMappingReverse10k-12 343 3318135 ns/op 1223650 B/op 30027 allocs/op BenchmarkParsePortMappingReverse1m-12 3 403392469 ns/op 124593840 B/op 4000624 allocs/op BenchmarkParsePortMappingRange1-12 37635 28756 ns/op 131584 B/op 9 allocs/op BenchmarkParsePortMappingRange100-12 39604 28935 ns/op 131584 B/op 9 allocs/op BenchmarkParsePortMappingRange1k-12 38384 29921 ns/op 131584 B/op 9 allocs/op BenchmarkParsePortMappingRange10k-12 29479 40381 ns/op 131584 B/op 9 allocs/op BenchmarkParsePortMappingRange1m-12 927 1279369 ns/op 143022 B/op 164 allocs/op PASS ok github.com/containers/podman/v3/pkg/specgen/generate 25.492s ``` Benchmark convert old port format to new one: ``` go test -bench=. -benchmem ./libpod/ goos: linux goarch: amd64 pkg: github.com/containers/podman/v3/libpod cpu: Intel(R) Core(TM) i7-10850H CPU @ 2.70GHz Benchmark_ocicniPortsToNetTypesPortsNoPorts-12 663526126 1.663 ns/op 0 B/op 0 allocs/op Benchmark_ocicniPortsToNetTypesPorts1-12 7858082 141.9 ns/op 72 B/op 2 allocs/op Benchmark_ocicniPortsToNetTypesPorts10-12 2065347 571.0 ns/op 536 B/op 4 allocs/op Benchmark_ocicniPortsToNetTypesPorts100-12 138478 8641 ns/op 4216 B/op 4 allocs/op Benchmark_ocicniPortsToNetTypesPorts1k-12 9414 120964 ns/op 41080 B/op 4 allocs/op Benchmark_ocicniPortsToNetTypesPorts10k-12 781 1490526 ns/op 401528 B/op 4 allocs/op Benchmark_ocicniPortsToNetTypesPorts1m-12 4 250579010 ns/op 40001656 B/op 4 allocs/op PASS ok github.com/containers/podman/v3/libpod 11.727s ``` Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #12066 from matejvasek/set-docker-hostOpenShift Merge Robot2021-10-27
|\ | | | | Set DOCKER_HOST in the VM
| * Set DOCKER_HOST in the VMMatej Vasek2021-10-23
| | | | | | | | | | | | [NO TESTS NEEDED] Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | Merge pull request #12064 from vrothberg/fix-11933OpenShift Merge Robot2021-10-27
|\ \ | | | | | | container create: fix --tls-verify parsing
| * | container create: fix --tls-verify parsingValentin Rothberg2021-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that the value is only set if specified on the CLI. c/image already defaults to true but if set in the system context, we'd skip settings in the registries.conf. Fixes: #11933 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #12111 from giuseppe/fix-warning-move-pause-processOpenShift Merge Robot2021-10-27
|\ \ \ | | | | | | | | runtime: check for pause pid existence
| * | | runtime: check for pause pid existenceGiuseppe Scrivano2021-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | check that the pause pid exists before trying to move it to a separate scope. Closes: https://github.com/containers/podman/issues/12065 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | utils: do not overwrite the err variableGiuseppe Scrivano2021-10-27
| | | | | | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Merge pull request #12110 from cevich/fix_systemd_pid1OpenShift Merge Robot2021-10-27
|\ \ \ \ | |_|/ / |/| | | Fix systemd PID1 test
| * | | Fix systemd PID1 testChris Evich2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously this test used an ad-hoc timeout mechanism to synchronize with output of the container ID. However, depending on runtime conditions this may not correctly correspond with complete startup of the systemd process. Consequently this test fails under some conditions with an error like: `System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down` Fix this by using the more appropriate `WaitContainerReady()` against output from system startup, close to finalization. In this way, the test status command cannot run until systemd is fully operational. Signed-off-by: Chris Evich <cevich@redhat.com>
* | | | Merge pull request #11956 from vrothberg/pauseOpenShift Merge Robot2021-10-27
|\ \ \ \ | |_|/ / |/| | | remove need to download pause image
| * | | pod create: remove need for pause imageValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So far, the infra containers of pods required pulling down an image rendering pods not usable in disconnected environments. Instead, build an image locally which uses local pause binary. Fixes: #10354 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | add kubernetes pauseValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the k8s pause binary to `pause/pause.c` and do the plumbing in the Makefile to install it in $libexec/podman/pause/pause. It is intended to replace the k8s pause image and hence the need for network connectivity when creating pods. [NO NEW TESTS NEEDED] since it will be tested in a following commit. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | cirrus: containers: mount directory in /var/tmp to /tmpValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mount a directory from /var/tmp to /tmp to make sure that /tmp is not on an overlay mount. This should make overlay mounts possible in the containerized tests which we're currently skipping. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | overlay root fs: create mount on runtime dirValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure to create the mounts for containers with an overlay root FS in the runtime dir (e.g., /run/user/1000/...) to guarantee that we can actually overlay mount on the specific path which is not the case for the graph root. [NO NEW TESTS NEEDED] since it is not a user-facing change. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | Merge pull request #12107 from giuseppe/fix-dbus-process-leakOpenShift Merge Robot2021-10-27
|\ \ \ \ | | | | | | | | | | cgroups: use SessionBusPrivateNoAutoStartup
| * | | | cgroups: use SessionBusPrivateNoAutoStartupGiuseppe Scrivano2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | do not start up a dbus daemon if it is not already running. [NO NEW TESTS NEEDED] the fix is in a dependency. Closes: https://github.com/containers/podman/issues/9727 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | vendor: update godbus to v5.0.6Giuseppe Scrivano2021-10-26
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | Merge pull request #12098 from Luap99/slirp-dadOpenShift Merge Robot2021-10-26
|\ \ \ \ \ | |_|_|/ / |/| | | | Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
| * | | | Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0Paul Holzinger2021-10-26
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Duplicate Address Detection slows the ipv6 setup down for 1-2 seconds. Since slirp4netns is run it is own namespace and not directly routed we can skip this to make the ipv6 address immediately available. We change the default to make sure the slirp tap interface gets the correct value assigned so DAD is disabled for it. Also make sure to change this value back to the original after slirp4netns is ready in case users rely on this sysctl. Fixes #11062 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | | Merge pull request #12067 from hshiina/logs-journal-tailOpenShift Merge Robot2021-10-26
|\ \ \ \ | |_|/ / |/| | | Fix a few problems in 'podman logs --tail' with journald driver
| * | | Fix a few problems in 'podman logs --tail' with journald driverHironori Shiina2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following problems regarding `logs --tail` with the journald log driver are fixed: - One more line than a specified value is displayed. - '--tail 0' displays all lines while the other log drivers displays nothing. - Partial lines are not considered. - If the journald events backend is used and a container has exited, nothing is displayed. Integration tests that should have detected the bugs are also fixed. The tests are executed with json-file log driver three times without this fix. Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
* | | | Merge pull request #12092 from rhatdan/buildOpenShift Merge Robot2021-10-26
|\ \ \ \ | | | | | | | | | | If Dockerfile exists in same directory as service, we should not use it.
| * | | | If Dockerfile exists in same directory as service, we should not use it.Daniel J Walsh2021-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should only use the Containerfiles/Dockerfiles found in the context directory. Fixes: https://github.com/containers/podman/issues/12054 [NO NEW TESTS NEEDED] It is difficult to setup a test for this in the CI/CD system, but build tests should find if this PR broke anything. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | Merge pull request #12088 from adrianreber/2021-10-25-fix-label-ipc-hostOpenShift Merge Robot2021-10-26
|\ \ \ \ \ | | | | | | | | | | | | Allow 'container restore' with '--ipc host'
| * | | | | Allow 'container restore' with '--ipc host'Adrian Reber2021-10-26
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trying to restore a container that was started with '--ipc host' fails with: Error: error creating container storage: ProcessLabel and Mountlabel must either not be specified or both specified We already fixed this exact same error message for containers started with '--privileged'. The previous fix was to check if the to be restored container is a privileged container (c.config.Privileged). Unfortunately this does not work for containers started with '--ipc host'. This commit changes the check for a privileged container to check if both the ProcessLabel and the MountLabel is actually set and only then re-uses those labels. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | | Merge pull request #12096 from ↵OpenShift Merge Robot2021-10-26
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | containers/dependabot/go_modules/github.com/docker/docker-20.10.10incompatible Bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible
| * | | | | Bump github.com/docker/dockerdependabot[bot]2021-10-26
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.9+incompatible to 20.10.10+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Changelog](https://github.com/moby/moby/blob/master/CHANGELOG.md) - [Commits](https://github.com/docker/docker/compare/v20.10.9...v20.10.10) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | | | Merge pull request #12099 from Luap99/cni-k8s-envOpenShift Merge Robot2021-10-26
|\ \ \ \ \ | |/ / / / |/| | | | [CI:DOCS] Document to not set K8S envars for CNI
| * | | | Document to not set K8S envars for CNIPaul Holzinger2021-10-26
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | Setting these environment variables can cause issues with custom CNI plugins, see #12083. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | | Merge pull request #12086 from rhatdan/logOpenShift Merge Robot2021-10-26
|\ \ \ \ | | | | | | | | | | Add support to play kube for --log-opt
| * | | | Add support to play kube for --log-optDaniel J Walsh2021-10-25
| |/ / / | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/11727 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #12084 from rhatdan/VENDOROpenShift Merge Robot2021-10-26
|\ \ \ \ | |/ / / |/| | | Update vendor github.com/opencontainers/runtime-tools
| * | | Update vendor github.com/opencontainers/runtime-toolsDaniel J Walsh2021-10-25
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | This will change mount of /dev within container to noexec, making containers slightly more secure. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12079 from stweil/lgtmOpenShift Merge Robot2021-10-25
|\ \ \ | | | | | | | | [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
| * | | [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)Stefan Weil2021-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LGTM alert: Off-by-one index comparison against length may lead to out-of-bounds read. Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | | | Merge pull request #12078 from stweil/typosOpenShift Merge Robot2021-10-25
|\ \ \ \ | |/ / / |/| | | [CI:DOCS Fix some typos in documentation and comments (found by codespell)
| * | | Fix some typos in documentation and comments (found by codespell)Stefan Weil2021-10-25
| | |/ | |/| | | | | | | Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | | Merge pull request #12071 from eriksjolund/fix_typo_keep_idOpenShift Merge Robot2021-10-24
|\ \ \ | | | | | | | | [CI:DOCS] Fix typo keep_id -> keep-id
| * | | [CI:DOCS] Fix typo keep_id -> keep-idErik Sjölund2021-10-24
| |/ / | | | | | | | | | Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
* | | Merge pull request #12077 from stweil/mainOpenShift Merge Robot2021-10-24
|\ \ \ | |/ / |/| | [CI:DOCS] Replace 'an user' => 'a user'
| * | Replace 'an user' => 'a user'Stefan Weil2021-10-24
|/ / | | | | | | Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | Merge pull request #12061 from dancerj/typoOpenShift Merge Robot2021-10-22
|\ \ | | | | | | [CI:DOCS] fuse-overlay probably means fuse-overlayfs.
| * | fuse-overlay probably means fuse-overlayfs.Junichi Uekawa2021-10-22
| |/ | | | | | | | | | | fuse-overlayfs is usually the package name. Signed-off-by: Junichi Uekawa <dancer@debian.org>
* | Merge pull request #11991 from rhatdan/sizeOpenShift Merge Robot2021-10-22
|\ \ | | | | | | Allow API to specify size and inode quota
| * | Allow API to specify size and inode quotaDaniel J Walsh2021-10-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/11016 [NO NEW TESTS NEEDED] We have no easy way to tests this in CI/CD systems. Requires quota to be setup on directories to work. Fixes: https://github.com/containers/podman/issues/11016 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12021 from rhatdan/kubeOpenShift Merge Robot2021-10-22
|\ \ \ | |_|/ |/| | Generate Kube should not print default structs
| * | Generate Kube should not print default structsDaniel J Walsh2021-10-19
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If podman uses Workdir="/" or the workdir specified in the image, it should not add it to the yaml. If Podman find environment variables in the image, they should not get added to the yaml. If the container or pod do not have changes to SELinux we should not print seLinuxOpt{} If the container or pod do not change any dns options the yaml should not have a dnsOption={} If the container is not privileged it should not have privileged=false in the yaml. Fixes: https://github.com/containers/podman/issues/11995 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #12048 from rhatdan/manOpenShift Merge Robot2021-10-22
|\ \ | | | | | | Remove --kernel-memory options
| * | Remove --kernel-memory optionsDaniel J Walsh2021-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel memory option has been depracated in runtime-spec, It is believed that it will not work properly on certain kernels. runc ignores it. This PR removes documentation of the flag and also prints a warning if a user uses it. [NO NEW TESTS NEEDED] Helps Fix: https://github.com/containers/podman/issues/12045 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-01 02:47:20 +0000