summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* libpod: Execute poststop hooks locallyW. Trevor King2018-06-04
| | | | | | | | | | | | Instead of delegating to the runtime, since some runtimes do not seem to handle these reliably [1]. [1]: https://github.com/projectatomic/libpod/issues/730#issuecomment-392959938 Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #864 Approved by: rhatdan
* Add some test for podman run flag security-optYiqiao Pu2018-06-04
| | | | | | | | | | | | | | Add following test cases for security-opt: - Check default selinux value - Disable security options in container - Setup selinux type in security-opt - Disable seccomp protection - Configure custom seccomp.json Signed-off-by: Yiqiao Pu <ypu@redhat.com> Closes: #837 Approved by: rhatdan
* Add a function for e2e test to write json fileYiqiao Pu2018-06-04
| | | | | | | | | This function is used to write json format configure files. Signed-off-by: Yiqiao Pu <ypu@redhat.com> Closes: #837 Approved by: rhatdan
* Use go-selinux for selinux checkYiqiao Pu2018-06-04
| | | | | | | | | | Use function in opencontainers/selinux/go-selinux to check the selinux status in our test. Signed-off-by: Yiqiao Pu <ypu@redhat.com> Closes: #837 Approved by: rhatdan
* Add flag to add annotations to a containerMatthew Heon2018-06-04
| | | | | | | | | | Also add annotations from the image the container was created from. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #886 Approved by: rhatdan
* Want to change the log level on buildah by default to warnfDaniel J Walsh2018-06-04
| | | | | | | | | | | | | | | Change the level of missing /etc/containers/mount.conf to a debug, since this is expected on most machines. Also raised the level of some warnings to errors, so they will be better seen, even if we are skipping. Fixed the wording of one error, since stating is not the correct word. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #882 Approved by: mheon
* vendor in latest github.com/varlink/goValentin Rothberg2018-06-04
| | | | | | | | Fixes: #888 Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #890 Approved by: rhatdan
* hooks: Add debug logging for initial hook loadingW. Trevor King2018-06-04
| | | | | | | | | | | | | We've had logrus logging in the monitor code since it landed in 68eb128f (pkg/hooks: Version the hook structure and add 1.0.0 hooks, 2018-04-27, #686). This commit adds similar logging to the initial hook.New() and Manager.Hooks() calls to make it easier to see if those are working as expected. Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #887 Approved by: rhatdan
* hooks/docs: Fix 1.0.0 Nvidia example (adding version, etc.)W. Trevor King2018-06-04
| | | | | | | | | | | | | Reported by Gary Edwards [1]. Both typos are originally from 68eb128f (pkg/hooks: Version the hook structure and add 1.0.0 hooks, 2018-04-27, #686). [1]: https://github.com/projectatomic/libpod/issues/884#issuecomment-394174571 Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #887 Approved by: rhatdan
* hooks/1.0.0/when_test: Fix "both, and" -> "both, or" name typoW. Trevor King2018-06-04
| | | | | | | | | | The typo is a copy/paste error from 68eb128f (pkg/hooks: Version the hook structure and add 1.0.0 hooks, 2018-04-27, #686). Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #887 Approved by: rhatdan
* hooks/1.0.0: Fix 'annotation' -> 'annotations' in JSONW. Trevor King2018-06-04
| | | | | | | | | | | This typo from 68eb128f (pkg/hooks: Version the hook structure and add 1.0.0 hooks, 2018-04-27, #686) was causing any 'annotations' entries in hook JSON to be silently ignored. Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #887 Approved by: rhatdan
* hooks: Fail ReadDir if a configured hook executable is missingW. Trevor King2018-06-04
| | | | | | | | | | | | | | | | The continue here is from 5676597f (hooks/read: Ignore IsNotExist for JSON files in ReadDir, 2018-04-27, #686), where it was intended to silently ignore missing JSON files. However, the old logic was also silently ignoring not-exist errors from the os.Stat(hook.Hook.Path) from 68eb128f (pkg/hooks: Version the hook structure and add 1.0.0 hooks, 2018-04-27, #686). This commit adjusts the check so JSON not-exist errors continue to be silently ignored while hook executable not-exist errors become fatal. Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #887 Approved by: rhatdan
* Cleanup transfer.md page, remove CRI-O contentDaniel J Walsh2018-06-03
| | | | | | | | | This page has not been updated since we copied it from CRI-O repo. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #883 Approved by: mheon
* Vendor in latest containers/storageDaniel J Walsh2018-06-02
| | | | | | | | | | | | This vendor will improve the performance of using userns since it will save aside the image layer of the chown, so followup runnings of podman will use the new layer rather then chowning again. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #881 Approved by: mheon
* Merge pull request #880 from mheon/bump-0.6.1Matthew Heon2018-06-01
|\ | | | | Bump to v0.6.1
| * Bump gitvalidation epochMatthew Heon2018-06-01
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
| * Bump to v0.6.2-devMatthew Heon2018-06-01
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
| * Bump to v0.6.1v0.6.1Matthew Heon2018-06-01
|/ | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* hack/release.sh: Bump spec in dev_version_commitW. Trevor King2018-06-01
| | | | | | | | | | | | | | | | | | Bump it to the next version (without a -dev suffix), based on the precedent set by 70672652 (Bump to v0.6.1-dev, 2018-05-25, #834). Previously I had VERSION there, which was a copy/paste error. I've also added an explicit write_spec_version to release_commit. That *should* be a no-op, with the spec version having already been set by the previous release's dev_version_commit. But better to be safe than to cut a release with the wrong version number in the spec file (e.g. maybe we guessed NEXT_VERSION wrong during the last release). Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #879 Approved by: mheon
* hack/release.sh: No longer need to bump setup.pyW. Trevor King2018-06-01
| | | | | | | | | | | | Since 727ecfea (Use Version from spec file in setup.py, 2018-05-18, #807), setup.py has been pulling this from a PODMAN_VERSION environment variable (which can be set in spec files), and there's no need for us to bump it as part of our releases. Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #879 Approved by: mheon
* Provide examples for python podman APIJhon Honce2018-06-01
| | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com> Closes: #870 Approved by: rhatdan
* Bump Buildah vendor to pick up fix for testsMatthew Heon2018-06-01
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #878 Approved by: mheon
* Log podman build failures in paprMatthew Heon2018-06-01
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #875 Approved by: mheon
* Use Version from spec file in setup.pyJhon Honce2018-06-01
| | | | | | | | | - If envvar PODMAN_VERSION not set use default version of 0.0.0 Signed-off-by: Jhon Honce <jhonce@redhat.com> Closes: #807 Approved by: rhatdan
* Attempt to use fedora 28 atomic hostDaniel J Walsh2018-06-01
| | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #873 Approved by: mheon
* Merge pull request #876 from jwhonce/wip/commitDaniel J Walsh2018-06-01
|\ | | | | Fix label handling
| * Fix lable handlingJhon Honce2018-06-01
| | | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | Merge pull request #839 from baude/varlinkcreatefixesDaniel J Walsh2018-06-01
|\ \ | | | | | | varlink build
| * | varlink buildbaude2018-06-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the endpoint and methods for build so users can build an image with varlink. build can also use the more method for streaming output back more regularily; however, it looks like a bug in buildah does not output all build output to the writer provided. Tidy up some create fixes and add endpoint for GetImage requested by jhonce. Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #859 from rhatdan/onbuildDaniel J Walsh2018-06-01
|\ \ \ | | | | | | | | Add OnBuild support for podman build
| * | | Add OnBuild support for podman buildDaniel J Walsh2018-06-01
| |/ / | | | | | | | | | | | | | | | Only supported for docker formated images. OCI Does not support this flag. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #872 from giuseppe/add-usr-libexec-podman-conmonDaniel J Walsh2018-06-01
|\ \ \ | |_|/ |/| | runtime: add /usr/libexec/podman/conmon to the conmon paths
| * | runtime: add /usr/libexec/podman/conmon to the conmon pathsGiuseppe Scrivano2018-06-01
| | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #869 from jwhonce/wip/attachDaniel J Walsh2018-06-01
|\ \ \ | |_|/ |/| | Implement container attach
| * | Implement container attachJhon Honce2018-05-31
| | | | | | | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | | Merge pull request #867 from wking/release-scriptMatthew Heon2018-06-01
|\ \ \ | |_|/ |/| | hack/release.sh: Add a release script
| * | hack/release.sh: Add a release scriptW. Trevor King2018-05-31
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matthew had expressed interest in a lovely release script on IRC. Here's my attempt to encode the changes from the v0.5.4 release branch. I've also added tag signing, so you may be prompted for your passphrase during that step. The version scheme for 0.x.y is 0.${month}.${count_that_month} [1]. We could automatically calculate those with a dozen or so lines of shell script, but we don't think that's worth the maintenance burden when it's easy enough for the caller to think them up on their own [2]. The spec sed also bumps the Python package version to match, which seems like the intended behavior until 1.0 when the Python code will move into its own repository [3]. [1]: https://github.com/projectatomic/libpod/pull/867#issuecomment-393731907 [2]: https://github.com/projectatomic/libpod/pull/867#issuecomment-393743295 [3]: https://github.com/projectatomic/libpod/issues/786#issuecomment-390682012 Signed-off-by: W. Trevor King <wking@tremily.us>
* | return all inspect info for varlink containerinspectbaude2018-06-01
| | | | | | | | | | | | | | | | | | | | | | when obtaining the inspect information for a container through varlink, we need to extract more container related information by parsing the data through the method 'GetCtrInspectInfo' which was previously only in podman's main. Signed-off-by: baude <bbaude@redhat.com> Closes: #866 Approved by: rhatdan
* | hooks/exec: Allow successful reaps for 0s post-kill timeoutsW. Trevor King2018-06-01
|/ | | | | | | | | | | | | | | | | | | | | | | | | I'd been getting the failed-to-reap errors locally, but on an unrelated pull-request the FAH27 suite successfully reaped that hook [1]: --- FAIL: TestRunKillTimeout (0.50s) assertions.go:226: Error Trace: exec_test.go:210 Error: Expect "signal: killed" to match "^failed to reap process within 0s of the kill signal$" FAIL The successful-reap cases limit our coverage, but I don't think that's a big enough problem to be worth repeated polling or similar until we do get the failed-to-reap error. [1]: https://s3.amazonaws.com/aos-ci/ghprb/projectatomic/libpod/96c1535fdc11b2de24421863d7ad5d3b94338b37.0.1527811547665239762/output.log Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #868 Approved by: rhatdan
* If user specifies UIDMapSlice without GIDMapSlice, set them equalDaniel J Walsh2018-05-31
| | | | | | | | | | | We need to map slices set for both UID and GID maps to be equivalent if not specified by user. Currently if you do not specify both the containers are not running. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #865 Approved by: baude
* fix panic with podman pullbaude2018-05-31
| | | | | | | | | | when there are no registries configured for the system and the user provided a short image name, we panic'd due a logic bug in recent image pull changes. Signed-off-by: baude <bbaude@redhat.com> Closes: #841 Approved by: rhatdan
* pkg/hooks/exec: Add a new package for local hook executionW. Trevor King2018-05-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This wraps os/exec to: * Clear the environment when the hook doesn't set 'env'. The runtime spec has [1]: > * env (array of strings, OPTIONAL) with the same semantics as IEEE > Std 1003.1-2008's environ. And running execle or similar with NULL env results in an empty environment: $ cat test.c #include <unistd.h> int main() { return execle("/usr/bin/env", "env", NULL, NULL); } $ cc -o test test.c $ ./test ...no output... Go's Cmd.Env, on the other hand, has [2]: > If Env is nil, the new process uses the current process's environment. This commit works around that by setting []string{} in those cases to avoid leaking the runtime environment into the hooks. * Roll the 'timeout' value (if set) into the passed context. There's no need for two separate ways to cancel hook execution. * Add a configurable timeout on abandoning a post-kill wait. The waiting goroutine will continue and eventually reap the process, but this avoids blocking the Run() call when that takes inordinately long (for example, if a GPU cleanup hook is stuck in I/O sleep [3]). The 'env' output format is specified in POSIX [4]. [1]: https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks [2]: https://golang.org/pkg/os/exec/#Cmd [3]: https://github.com/projectatomic/libpod/pull/857#discussion_r192191002 [4]: http://pubs.opengroup.org/onlinepubs/9699919799/utilities/env.html Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #857 Approved by: mheon
* Remove --net flag and make it an alias for --networkMatthew Heon2018-05-31
| | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com> Closes: #862 Approved by: rhatdan
* Catch does not exist errorDaniel J Walsh2018-05-31
| | | | | | | | | | There was a new line at the end of does not exist which was causing this to fail. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #863 Approved by: baude
* hooks: Rename Hooks() output to extensionStageHooksW. Trevor King2018-05-31
| | | | | | | | | | To more clearly distinguish between the extensionStages input to New() (a slice of strings) and the map output from Hooks(). Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #855 Approved by: rhatdan
* hooks: Allow local control of OCI stages via extensionStagesW. Trevor King2018-05-31
| | | | | | | | | | | | This allows callers to avoid delegating to OCI runtimes for cases where they feel that the runtime hook handling is unreliable [1]. [1]: https://github.com/projectatomic/libpod/issues/730#issuecomment-392959938 Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #855 Approved by: rhatdan
* We need to change the SELinux label of the conmon process to s0Daniel J Walsh2018-05-31
| | | | | | | | | | | | | If SELinux is enabled, we are leaking in pipes into the container owned by conmon. The container processes are not allowed to use these pipes, if the calling process is fully ranged. By changing the level of the conmon process to s0, this allows container processes to use the pipes. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #854 Approved by: mheon
* Clear all caps, except the bounding set, when --user is specified.Daniel J Walsh2018-05-31
| | | | | | | | | | | | Currently we are giving all caps to users when running with podman run --user, They should get none by default. If the command line includes --cap-add, then we need to run with those capabilties. Similarly we need to drop caps from bounding set, if user specifies --cap-drop Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #851 Approved by: mheon
* Makefile: Add stderr redirect to HAS_PYTHON3 definitionW. Trevor King2018-05-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For two reasons: * When a system is missing python3, we don't need to spam them with "Command not found" in their stderr. * Without the redirect, GNU Make (at least version 4.2.1) is overly clever and tries to invoke the command itself, not realizing that it's a shell builtin [1]. $ make --version GNU Make 4.2.1 Built for aarch64-unknown-linux-gnu Copyright (C) 1988-2016 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. $ cat Makefile PYTHON3_A := $(shell command -v python3) PYTHON3_B := $(shell command -v python3 2>/dev/null) test: @echo "SHELL: '$(SHELL)'" @echo "PYTHON3_A: '$(PYTHON3_A)'" @echo "PYTHON3_B: '$(PYTHON3_B)'" $ make make: command: Command not found SHELL: '/bin/sh' PYTHON3_A: '' PYTHON3_B: '/usr/bin/python3' By adding the redirect we actually hit the shell and can successfully invoke command. [1]: https://stackoverflow.com/a/17550243 Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #856 Approved by: rhatdan
* Force update of API.mdMatthew Heon2018-05-30
| | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com> Closes: #849 Approved by: rhatdan
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-27 09:40:33 +0000