summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* libpod: fix --userns=keep-id with big UIDsGiuseppe Scrivano2020-01-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | when creating a keep-id namespace, we split the original user namespace in: inner ns | outer ns | size: 0 | 1 | ID ID | 0 | 1 ID+1 | ID+1 | availableIds - ID When the user ID is bigger than the number of available subuids/subgids we fail to create the user namespace because the first slice is bigger than the available number of IDs and the third one has a negative size. Fix it by not using more than the available number of IDs in the first slice and creating the third one only if there are other IDs left. When the user ID is bigger than the number of additional IDs, there will be a gap between the two mappings so the IDs between the maximum additional ID and the user ID won't be present inside of the namespace. Closes: https://github.com/containers/libpod/issues/4838 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #4832 from baude/apiv2tomasterOpenShift Merge Robot2020-01-10
|\ | | | | Apiv2tomaster
| * fix e2e test failurebaude2020-01-10
| | | | | | | | | | | | it is possible for layers.names to be nil and we must account for that. Signed-off-by: baude <bbaude@redhat.com>
| * address review comments before mergebaude2020-01-10
| | | | | | | | Signed-off-by: baude <bbaude@redhat.com>
| * [CI:DOCS]update apiv2 documentation with swagger goodsbaude2020-01-10
| | | | | | | | Signed-off-by: baude <bbaude@redhat.com>
| * Initial commit on compatible APIJhon Honce2020-01-10
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com> Create service command Use cd cmd/service && go build . $ systemd-socket-activate -l 8081 cmd/service/service & $ curl http://localhost:8081/v1.24/images/json Signed-off-by: Jhon Honce <jhonce@redhat.com> Correct Makefile Signed-off-by: Jhon Honce <jhonce@redhat.com> Two more stragglers Signed-off-by: Jhon Honce <jhonce@redhat.com> Report errors back as http headers Signed-off-by: Jhon Honce <jhonce@redhat.com> Split out handlers, updated output Output aligned to docker structures Signed-off-by: Jhon Honce <jhonce@redhat.com> Refactored routing, added more endpoints and types * Encapsulated all the routing information in the handler_* files. * Added more serviceapi/types, including podman additions. See Info Signed-off-by: Jhon Honce <jhonce@redhat.com> Cleaned up code, implemented info content * Move Content-Type check into serviceHandler * Custom 404 handler showing the url, mostly for debugging * Refactored images: better method names and explicit http codes * Added content to /info * Added podman fields to Info struct * Added Container struct Signed-off-by: Jhon Honce <jhonce@redhat.com> Add a bunch of endpoints containers: stop, pause, unpause, wait, rm images: tag, rmi, create (pull only) Signed-off-by: baude <bbaude@redhat.com> Add even more handlers * Add serviceapi/Error() to improve error handling * Better support for API return payloads * Renamed unimplemented to unsupported these are generic endpoints we don't intend to ever support. Swarm broken out since it uses different HTTP codes to signal that the node is not in a swarm. * Added more types * API Version broken out so it can be validated in the future Signed-off-by: Jhon Honce <jhonce@redhat.com> Refactor to introduce ServiceWriter Signed-off-by: Jhon Honce <jhonce@redhat.com> populate pods endpoints /libpod/pods/.. exists, kill, pause, prune, restart, remove, start, stop, unpause Signed-off-by: baude <bbaude@redhat.com> Add components to Version, fix Error body Signed-off-by: Jhon Honce <jhonce@redhat.com> Add images pull output, fix swarm routes * docker-py tests/integration/api_client_test.py pass 100% * docker-py tests/integration/api_image_test.py pass 4/16 + Test failures include services podman does not support Signed-off-by: Jhon Honce <jhonce@redhat.com> pods endpoint submission 2 add create and others; only top and stats is left. Signed-off-by: baude <bbaude@redhat.com> Update pull image to work from empty registry Signed-off-by: Jhon Honce <jhonce@redhat.com> pod create and container create first pass at pod and container create. the container create does not quite work yet but it is very close. pod create needs a partial rewrite. also broken off the DELETE (rm/rmi) to specific handler funcs. Signed-off-by: baude <bbaude@redhat.com> Add docker-py demos, GET .../containers/json * Update serviceapi/types to reflect libpod not podman * Refactored removeImage() to provide non-streaming return Signed-off-by: Jhon Honce <jhonce@redhat.com> create container part2 finished minimal config needed for create container. started demo.py for upcoming talk Signed-off-by: baude <bbaude@redhat.com> Stop server after honoring request * Remove casting for method calls * Improve WriteResponse() * Update Container API type to match docker API Signed-off-by: Jhon Honce <jhonce@redhat.com> fix namespace assumptions cleaned up namespace issues with libpod. Signed-off-by: baude <bbaude@redhat.com> wip Signed-off-by: baude <bbaude@redhat.com> Add sliding window when shutting down server * Added a Timeout rather than closing down service on each call * Added gorilla/schema dependency for Decode'ing query parameters * Improved error handling * Container logs returned and multiplexed for stdout and stderr * .../containers/{name}/logs?stdout=True&stderr=True * Container stats * .../containers/{name}/stats Signed-off-by: Jhon Honce <jhonce@redhat.com> Improve error handling * Add check for at least one std stream required for /containers/{id}/logs * Add check for state in /containers/{id}/top * Fill in more fields for /info * Fixed error checking in service start code Signed-off-by: Jhon Honce <jhonce@redhat.com> get rest of image tests for pass Signed-off-by: baude <bbaude@redhat.com> linting our content Signed-off-by: baude <bbaude@redhat.com> more linting Signed-off-by: baude <bbaude@redhat.com> more linting Signed-off-by: baude <bbaude@redhat.com> pruning Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]apiv2 pods migrate from using args in the url to using a json struct in body for pod create. Signed-off-by: baude <bbaude@redhat.com> fix handler_images prune prune's api changed slightly to deal with filters. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]enabled base container create tests enabling the base container create tests which allow us to get more into the stop, kill, etc tests. many new tests now pass. Signed-off-by: baude <bbaude@redhat.com> serviceapi errors: append error message to API message I dearly hope this is not breaking any other tests but debugging "Internal Server Error" is not helpful to any user. In case, it breaks tests, we can rever the commit - that's why it's a small one. Signed-off-by: Valentin Rothberg <rothberg@redhat.com> serviceAPI: add containers/prune endpoint Signed-off-by: Valentin Rothberg <rothberg@redhat.com> add `service` make target Also remove the non-functional sub-Makefile. Signed-off-by: Valentin Rothberg <rothberg@redhat.com> add make targets for testing the service * `sudo make run-service` for running the service. * `DOCKERPY_TEST="tests/integration/api_container_test.py::ListContainersTest" \ make run-docker-py-tests` for running a specific tests. Run all tests by leaving the env variable empty. Signed-off-by: Valentin Rothberg <rothberg@redhat.com> Split handlers and server packages The files were split to help contain bloat. The api/server package will contain all code related to the functioning of the server while api/handlers will have all the code related to implementing the end points. api/server/register_* will contain the methods for registering endpoints. Additionally, they will have the comments for generating the swagger spec file. See api/handlers/version.go for a small example handler, api/handlers/containers.go contains much more complex handlers. Signed-off-by: Jhon Honce <jhonce@redhat.com> [CI:DOCS]enabled more tests Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]libpod endpoints small refactor for libpod inclusion and began adding endpoints. Signed-off-by: baude <bbaude@redhat.com> Implement /build and /events * Include crypto libraries for future ssh work Signed-off-by: Jhon Honce <jhonce@redhat.com> [CI:DOCS]more image implementations convert from using for to query structs among other changes including new endpoints. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]add bindings for golang Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]add volume endpoints for libpod create, inspect, ls, prune, and rm Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]apiv2 healthcheck enablement wire up container healthchecks for the api. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]Add mount endpoints via the api, allow ability to mount a container and list container mounts. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]Add search endpoint add search endpoint with golang bindings Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]more apiv2 development misc population of methods, etc Signed-off-by: baude <bbaude@redhat.com> rebase cleanup and epoch reset Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]add more network endpoints also, add some initial error handling and convenience functions for standard endpoints. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]use helper funcs for bindings use the methods developed to make writing bindings less duplicative and easier to use. Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]add return info for prereview begin to add return info and status codes for errors so that we can review the apiv2 Signed-off-by: baude <bbaude@redhat.com> [CI:DOCS]first pass at adding swagger docs for api Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #4825 from cevich/fix_libseccomp_commitOpenShift Merge Robot2020-01-10
|\ | | | | Fix Makefile ref libseccomp branch as a commit
| * Fix Makefile ref libseccomp branch as a commitChris Evich2020-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit a824186ac9 mistakenly updated LIBSECCOMP_COMMIT with a branch name instead of a commit reference. This breaks on Ubuntu's git with the `--detach` option, causing it to throw this error: ``` fatal: '--detach' cannot be used with '-b/-B/--orphan' ``` Fix this by using the tag `v2.3.3` which at the time of this commit, is the current HEAD of the release-2.3 branch. Thanks to Ed Santiago <santiago@redhat.com> for helping figure out the error and the fix. Signed-off-by: Chris Evich <cevich@redhat.com>
* | Merge pull request #4828 from giuseppe/drop-pause-checkOpenShift Merge Robot2020-01-10
|\ \ | |/ |/| cp: drop check for rootless
| * cp: drop check for rootlessGiuseppe Scrivano2020-01-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rootless containers can use pause on cgroups v2. Whether it is possible or not to use pause depends from multiple conditions, such as: - be on a cgroup v2 unified hierarchy, - using systemd cgroup manager, - the kernel has the freezer controller, The last one may fail for root as well. Instead of trying to catch all the possible conditions in Podman, let the OCI runtime complain if pause cannot be performed. Closes: https://github.com/containers/libpod/issues/4813 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #4819 from TomSweeneyRedHat/dev/tsweeney/fixpodmanimageOpenShift Merge Robot2020-01-09
|\ \ | | | | | | Update podmanimage build process
| * | Update podmanimage build processTomSweeneyRedHat2020-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (Stealing from: @rhatdan 's https://github.com/containers/buildah/pull/2038 ) 1 We need to update all packages in the podman image to make sure they are up2date. 2 reinstall shadow-utils. For some reason the fedora base image does not include the file capabilities assigned to /usr/bin/newuidmap and /usr/bin/newgidmap. Reinstalling shadow-utils, brings them back. 3 Add a default user build to the system. This will create the /etc/subuid and /etc/subgid maps get created correctly. Once we have this we should be able to build a container starting with a non privileged user podman run -ti --user build --device=/dev/fuse -v ./Dockerfile:/Dockerfile:z quay.io/podman/stable podman buildd / Addresses: #4741 Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* | | Merge pull request #4818 from haircommander/piped-exec-fixOpenShift Merge Robot2020-01-09
|\ \ \ | | | | | | | | exec: fix pipes
| * | | exec: fix pipesPeter Hunt2020-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a largely anticlimatic solution to the saga of piped input from conmon, we come to this solution. When we pass the Stdin stream to the exec.Command structure, it's immediately consumed and lost, instead of being consumed through CopyDetachable(). When we don't pass -i in, conmon is not told to create a masterfd_stdin, and won't pass anything to the container. With both, we can do echo hi | podman exec -til cat and get the expected hi Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | | Merge pull request #4821 from AkihiroSuda/fix-rootlessportOpenShift Merge Robot2020-01-09
|\ \ \ \ | | | | | | | | | | rootlessport: remove state dir on exit + honor ctr.runtime.config.TmpDir
| * | | | rootlessport: honor ctr.runtime.config.TmpDirAkihiro Suda2020-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, rootlessport was using /var/tmp as the tmp dir. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
| * | | | rootlessport: remove state dir on exitAkihiro Suda2020-01-09
| | |/ / | |/| | | | | | | | | | Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* | | | Merge pull request #4820 from edsantiago/consistent_option_enumerationsOpenShift Merge Robot2020-01-09
|\ \ \ \ | |_|_|/ |/| | | Usage messages: show possible option values
| * | | Usage messages: show possible option valuesEd Santiago2020-01-08
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ...in a consistent manner: ("a"|"b"|"c") This makes it possible (and easy) for zsh completion to pick those out of the --help messages and offer them as values when user hits TAB. I chose this format because it's an already-existing convention in cmd/podman/common.go. Also: removed two duplicate "default: x" messages (Cobra displays those automatically where a non-null default is specified). Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | Merge pull request #4802 from rhatdan/varlinkOpenShift Merge Robot2020-01-09
|\ \ \ | |/ / |/| | Fix podman-remote info to show registry data
| * | Fix podman-remote info to show registry dataDaniel J Walsh2020-01-07
| | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #4758 from rhatdan/validateOpenShift Merge Robot2020-01-08
|\ \ \ | | | | | | | | Don't show PASS on success for gitvalidate
| * | | Don't show PASS on success for gitvalidateDaniel J Walsh2020-01-06
| | | | | | | | | | | | | | | | | | | | | | | | Make test logs less verbose so that failures are easier to spot. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #4816 from vrothberg/lintOpenShift Merge Robot2020-01-08
|\ \ \ \ | | | | | | | | | | Fix golint errors
| * | | | fix lint - pkg/varlinkapi/virtwriterValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - pkg/util: func commentValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - pkg/specValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint in pkg/rootlessValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - pkg/network: comment exported typesValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - pkg/adapter: comment exported APIValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - ignore image.ImageDeleteResponse definitionValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Golint claims that image.Image stutters but renaming the type would be a breaking change which isn't worth the consequences. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint - drop else blockValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint: add comment for NameRegex and errorValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint: correct func identifier in commentValentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | fix lint: "guarantess" is a misspelling of "guarantees"Valentin Rothberg2020-01-08
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | | Merge pull request #4712 from openSUSE/untag-commandOpenShift Merge Robot2020-01-08
|\ \ \ \ \ | | | | | | | | | | | | Add `untag` sub-command
| * | | | | Add `untag` sub-commandSascha Grunert2020-01-08
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Podman now supports untagging images via the `untag` sub-command for the root and `image` commands. Testing and documentation has been added as well. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | | | | Merge pull request #4810 from ↵Daniel J Walsh2020-01-08
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | TomSweeneyRedHat/dev/tsweeney/updateinspectcommands Update demo for the inspect command
| * | | | | Update demo for the inspect commandTomSweeneyRedHat2020-01-07
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updates the inspect command demo with an up to date variant and adds a link to script that ran it. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* | | | | Merge pull request #4795 from ssbarnea/masterOpenShift Merge Robot2020-01-08
|\ \ \ \ \ | |_|/ / / |/| | | | packaging: validate installed rpms
| * | | | packaging: validate installed rpmsSorin Sbarnea2020-01-07
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously we builded RPMs that contained an outdated conmon which was not compatible. From now on `make-install` will also call `podman version` and `podman info` in order to perform a minimal sanity check of the installation. Fixes: #4665 Signed-off-by: Sorin Sbarnea <ssbarnea@redhat.com>
* | | | Merge pull request #4592 from AkihiroSuda/rootlesskit-port-forwarderOpenShift Merge Robot2020-01-08
|\ \ \ \ | |_|/ / |/| | | rootless: use RootlessKit port forwarder
| * | | rootless: use RootlessKit port forwarderAkihiro Suda2020-01-08
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RootlessKit port forwarder has a lot of advantages over the slirp4netns port forwarder: * Very high throughput. Benchmark result on Travis: socat: 5.2 Gbps, slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps (https://travis-ci.org/rootless-containers/rootlesskit/builds/597056377) * Connections from the host are treated as 127.0.0.1 rather than 10.0.2.2 in the namespace. No UDP issue (#4586) * No tcp_rmem issue (#4537) * Probably works with IPv6. Even if not, it is trivial to support IPv6. (#4311) * Easily extensible for future support of SCTP * Easily extensible for future support of `lxc-user-nic` SUID network RootlessKit port forwarder has been already adopted as the default port forwarder by Rootless Docker/Moby, and no issue has been reported AFAIK. As the port forwarder is imported as a Go package, no `rootlesskit` binary is required for Podman. Fix #4586 May-fix #4559 Fix #4537 May-fix #4311 See https://github.com/rootless-containers/rootlesskit/blob/v0.7.0/pkg/port/builtin/builtin.go Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* | | Merge pull request #4781 from haircommander/seccomp-profile-rootOpenShift Merge Robot2020-01-07
|\ \ \ | |/ / |/| | play kube: make seccomp handling better conform to k8s
| * | play kube: make seccomp handling better conform to k8sPeter Hunt2020-01-03
| | | | | | | | | | | | | | | | | | | | | Add flag --seccomp-profile-root in play kube to allow users to specify where to look for seccomp profiles update tests Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | Merge pull request #4788 from vrothberg/staleOpenShift Merge Robot2020-01-07
|\ \ \ | | | | | | | | github stale workflow: rephrase and bump close time
| * | | github stale workflow: rephrase and bump close timeValentin Rothberg2020-01-07
| | |/ | |/| | | | | | | | | | | | | | | | | | | Rephrase the stale message to be friendlier and bump the closing time to 365 days. The docs of the stale workflow do not indicate whether we can not close, so a limit of 365 days seems fair. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #4774 from QiWang19/cp_src_pathOpenShift Merge Robot2020-01-07
|\ \ \ | |/ / |/| | fix bug copy from container directory
| * | fix bug copy from container directoryQi Wang2020-01-02
| | | | | | | | | | | | | | | | | | Keep the original input source path with "/." so podman can copy the content of the directory when copying from container to host. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | Merge pull request #4800 from mheon/bump-1.7.0OpenShift Merge Robot2020-01-06
|\ \ \ | | | | | | | | Bump to v1.7.0
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-18 08:14:16 +0000