summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Merge pull request #3876 from mheon/fix_mount_flagsOpenShift Merge Robot2019-09-04
|\ | | | | Allow suid, exec, dev mount options to cancel nosuid/noexec/nodev
| * Add test to verify noexec works with volume mountsMatthew Heon2019-09-04
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add a test for the new suid/exec/dev optionsMatthew Heon2019-08-28
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Fix addition of mount options when using RO tmpfsMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | For read-only containers set to create tmpfs filesystems over /run and other common destinations, we were incorrectly setting mount options, resulting in duplicate mount options. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Allow :z and :Z with ProcessOptionsMatthew Heon2019-08-28
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Set base mount options for bind mounts from base systemMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If I mount, say, /usr/bin into my container - I expect to be able to run the executables in that mount. Unconditionally applying noexec would be a bad idea. Before my patches to change mount options and allow exec/dev/suid being set explicitly, we inferred the mount options from where on the base system the mount originated, and the options it had there. Implement the same functionality for the new option handling. There's a lot of performance left on the table here, but I don't know that this is ever going to take enough time to make it worth optimizing. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Don't double-process tmpfs optionsMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | We already process the options on all tmpfs filesystems during final addition of mounts to the spec. We don't need to do it before that in parseVolumes. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add support for 'exec', 'suid', 'dev' mount flagsMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we explicitly set noexec/nosuid/nodev on every mount, with no ability to disable them. The 'mount' command on Linux will accept their inverses without complaint, though - 'noexec' is counteracted by 'exec', 'nosuid' by 'suid', etc. Add support for passing these options at the command line to disable our explicit forcing of security options. This also cleans up mount option handling significantly. We are still parsing options in more than one place, which isn't good, but option parsing for bind and tmpfs mounts has been unified. Fixes: #3819 Fixes: #3803 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Update buildah to current masterMatthew Heon2019-08-28
| | | | | | | | | | | | Vendor some changes to parsing code that we need for Podman. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3933 from giuseppe/skip-polling-on-runOpenShift Merge Robot2019-09-04
|\ \ | | | | | | libpod: avoid polling container status
| * | libpod: avoid polling container statusGiuseppe Scrivano2019-09-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | use the inotify backend to be notified on the container exit instead of polling continuosly the runtime. Polling the runtime slowns significantly down the podman execution time for short lived processes: $ time bin/podman run --rm -ti fedora true real 0m0.324s user 0m0.088s sys 0m0.064s from: $ time podman run --rm -ti fedora true real 0m4.199s user 0m5.339s sys 0m0.344s Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3902 from baude/dnsmasqaddresponseOpenShift Merge Robot2019-09-04
|\ \ \ | |/ / |/| | handle dns response from cni
| * | handle dns response from cnibaude2019-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when cni returns a list of dns servers, we should add them under the right conditions. the defined conditions are as follows: - if the user provides dns, it and only it are added. - if not above and you get a cni name server, it is added and a forwarding dns instance is created for what was in resolv.conf. - if not either above, the entries from the host's resolv.conf are used. Signed-off-by: baude <bbaude@redhat.com> Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #3928 from edsantiago/enable_man_page_checker_in_ciOpenShift Merge Robot2019-09-04
|\ \ \ | | | | | | | | Enable hack/man-page-checker in CI
| * | | Enable hack/man-page-checker in CIEd Santiago2019-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With huge thanks to @rwha for #3915. All man pages are clean and consistent now - let's keep them that way. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #3930 from cevich/update_irc_tableOpenShift Merge Robot2019-09-04
|\ \ \ \ | | | | | | | | | | Cirrus: Update e-mail -> IRC Nick table
| * | | | Cirrus: Update e-mail -> IRC Nick tableChris Evich2019-09-03
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also add fixes to help prevent 'fatal: Invalid revision range' error. Should obtaining all authors from the range still fail, only grab the HEAD commit author as a fallback. Signed-off-by: Chris Evich <cevich@redhat.com>
* | | | Merge pull request #3926 from giuseppe/add-warning-mismatch-configurationOpenShift Merge Robot2019-09-03
|\ \ \ \ | | | | | | | | | | rootless: detect user namespace configuration changes
| * | | | pkg/util: use rootless function to read additional usersGiuseppe Scrivano2019-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make pkg/rootless.GetConfiguredMappings public so that it can be used from pkg/util. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | rootless: detect user namespace configuration changesGiuseppe Scrivano2019-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | detect if the current user namespace doesn't match the configuration in the /etc/subuid and /etc/subgid files. If there is a mismatch, raise a warning and suggest the user to recreate the user namespace with "system migrate", that also restarts the containers. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | Merge pull request #3904 from cevich/fix_img_pruneOpenShift Merge Robot2019-09-03
|\ \ \ \ \ | |_|/ / / |/| | | | Cirrus: imgprune fixes
| * | | | Cirrus: Load base-image names indirectlyChris Evich2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than hard-coding all four base-image env. var name, load the values based on the shared variable name suffix. Thanks to Ed Santiago <santiago@redhat.com> for the suggestion. Signed-off-by: Chris Evich <cevich@redhat.com>
| * | | | Cirrus: Remove image_prune YAML-alias workaroundChris Evich2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Originally when written, the image_prune_task was passing incorrect credentials into it's container. This was traced back to mishandling of a YAML-alias, and worked-around (including a comment). However, as of this commit, it appear YAML-alias substitution problem has been addressed. Restore the (correct) use of a YAML-alias so the correct credentials are passed into the prune container. Signed-off-by: Chris Evich <cevich@redhat.com>
* | | | | Merge pull request #3915 from rwha/fix_man_page_testsOpenShift Merge Robot2019-09-03
|\ \ \ \ \ | | | | | | | | | | | | Fix formatting and enable hack/man-page-checker
| * | | | | Add command aliases to SYNOPSIS sectionRyan Whalen2019-08-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The files under docs/links reference another man page, e.g. `man podman-container-list` displays `podman-ps(1)`. This adds the alias to the in the displayed page's SYNOPSIS section. Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | Exclude podman-remoteRyan Whalen2019-08-31
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | Fix table spacingRyan Whalen2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | Revert the descriptive text for podman-remoteRyan Whalen2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | WIP - ignore man pages for commands besides podmanRyan Whalen2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | podman-remote is not a subcommandRyan Whalen2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
| * | | | | Fix formatting and enable hack/man-page-checkerRyan Whalen2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
* | | | | | Merge pull request #3925 from MatMaul/doc-rootless-systemdOpenShift Merge Robot2019-09-03
|\ \ \ \ \ \ | |_|_|/ / / |/| | | | | rootless.md: add systemd unit example
| * | | | | rootless.md: add systemd unit exampleMathieu Velten2019-09-03
|/ / / / / | | | | | | | | | | | | | | | Signed-off-by: Mathieu Velten <matmaul@gmail.com>
* | | | | Merge pull request #3909 from giuseppe/rootless-bind-mount-devOpenShift Merge Robot2019-09-02
|\ \ \ \ \ | |_|_|/ / |/| | | | rootless: bind mount devices instead of creating them
| * | | | spec: provide custom implementation for getDevicesGiuseppe Scrivano2019-09-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | provide an implementation for getDevices that skip unreadable directories for the current user. Based on the implementation from runc/libcontainer. Closes: https://github.com/containers/libpod/issues/3919 Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | spec: do not set devices cgroup when rootlessGiuseppe Scrivano2019-09-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | eBPF requires to be root in the init namespace. Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
| * | | | rootless: bind mount devices instead of creating themGiuseppe Scrivano2019-09-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when running in rootless mode, --device creates a bind mount from the host instead of specifying the device in the OCI configuration. This is required as an unprivileged user cannot use mknod, even when root in a user namespace. Closes: https://github.com/containers/libpod/issues/3905 Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
* | | | | Merge pull request #3922 from giuseppe/add-note-failing-systemd-cgroups-v1OpenShift Merge Robot2019-09-02
|\ \ \ \ \ | |/ / / / |/| | | | docs: add note about failing rhel7 systemd on cgroups v2
| * | | | docs: add note about failing rhel7 systemd on cgroups v2Giuseppe Scrivano2019-09-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1747933 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | Merge pull request #3916 from cevich/personalize_successOpenShift Merge Robot2019-09-01
|\ \ \ \ \ | |_|/ / / |/| | | | Personalize CI success messages to IRC
| * | | | Cirrus: On success, add IRC nick mention to msgChris Evich2019-08-30
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than spamming the podman channel with impersonal success messages referring to PR numbers, mention the author by nick name and include the PR title and link. Also avoid needless logging of all bot-script interactions with IRC when there is no error detected. Signed-off-by: Chris Evich <cevich@redhat.com>
* | | | Merge pull request #3911 from vrothberg/go-proxyOpenShift Merge Robot2019-08-30
|\ \ \ \ | | | | | | | | | | Makefile: use go proxy
| * | | | Makefile: use go proxyValentin Rothberg2019-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use GOPROXY=https://proxy.golang.org to speed up fetching dependencies. Setting it makes `make vendor` three times faster in my local env. For details please refer to https://proxy.golang.org/. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | | Merge pull request #3913 from rwha/fix/manpage-linksOpenShift Merge Robot2019-08-30
|\ \ \ \ \ | |_|_|/ / |/| | | | Fix links to manpages
| * | | | Fix links to manpagesRyan Whalen2019-08-30
|/ / / / | | | | | | | | | | | | Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
* | | | Merge pull request #3908 from TomasTomecek/man-ev-bkndOpenShift Merge Robot2019-08-30
|\ \ \ \ | |/ / / |/| | | man: events-logger → events-backend
| * | | man: events-logger → events-backendTomas Tomecek2019-08-29
| | | | | | | | | | | | | | | | Signed-off-by: Tomas Tomecek <ttomecek@redhat.com>
* | | | Merge pull request #3907 from baude/commitcapsOpenShift Merge Robot2019-08-29
|\ \ \ \ | |/ / / |/| | | dont panic when using varlink commit and uppercase image names
| * | | dont panic when using varlink commit and uppercase image namesbaude2019-08-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when using an upper case image name for container commit, we observed panics due to a channel closing early. Fixes: #3897 Signed-off-by: baude <bbaude@redhat.com>
* | | | Merge pull request #3710 from cevich/release_redoOpenShift Merge Robot2019-08-29
|\ \ \ \ | | | | | | | | | | Release redo
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-18 18:57:42 +0000