summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* volumes: be more tolerant and fix infinite loopValentin Rothberg2021-10-28
| | | | | | | | | | | | | | | | | | | | | | Make Podman more tolerant when parsing image volumes during container creation and further fix an infinite loop when checking them. Consider `VOLUME ['/etc/foo', '/etc/bar']` in a Containerfile. While it looks correct to the human eye, the single quotes are wrong and yield the two volumes to be `[/etc/foo,` and `/etc/bar]` in Podman and Docker. When running the container, it'll create a directory `bar]` in `/etc` and a directory `[` in `/` with two subdirectories `etc/foo,`. This behavior is surprising to me but how Docker behaves. We may improve on that in the future. Note that the correct way to syntax for volumes in a Containerfile is `VOLUME /A /B /C` or `VOLUME ["/A", "/B", "/C"]`; single quotes are not supported. This change restores this behavior without breaking container creation or ending up in an infinite loop. BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2014149 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #11956 from vrothberg/pauseOpenShift Merge Robot2021-10-27
|\ | | | | remove need to download pause image
| * pod create: remove need for pause imageValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | So far, the infra containers of pods required pulling down an image rendering pods not usable in disconnected environments. Instead, build an image locally which uses local pause binary. Fixes: #10354 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * add kubernetes pauseValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | Add the k8s pause binary to `pause/pause.c` and do the plumbing in the Makefile to install it in $libexec/podman/pause/pause. It is intended to replace the k8s pause image and hence the need for network connectivity when creating pods. [NO NEW TESTS NEEDED] since it will be tested in a following commit. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * cirrus: containers: mount directory in /var/tmp to /tmpValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | Mount a directory from /var/tmp to /tmp to make sure that /tmp is not on an overlay mount. This should make overlay mounts possible in the containerized tests which we're currently skipping. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * overlay root fs: create mount on runtime dirValentin Rothberg2021-10-26
| | | | | | | | | | | | | | | | | | | | | | Make sure to create the mounts for containers with an overlay root FS in the runtime dir (e.g., /run/user/1000/...) to guarantee that we can actually overlay mount on the specific path which is not the case for the graph root. [NO NEW TESTS NEEDED] since it is not a user-facing change. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #12107 from giuseppe/fix-dbus-process-leakOpenShift Merge Robot2021-10-27
|\ \ | | | | | | cgroups: use SessionBusPrivateNoAutoStartup
| * | cgroups: use SessionBusPrivateNoAutoStartupGiuseppe Scrivano2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | do not start up a dbus daemon if it is not already running. [NO NEW TESTS NEEDED] the fix is in a dependency. Closes: https://github.com/containers/podman/issues/9727 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | vendor: update godbus to v5.0.6Giuseppe Scrivano2021-10-26
| | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #12098 from Luap99/slirp-dadOpenShift Merge Robot2021-10-26
|\ \ \ | | | | | | | | Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
| * | | Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0Paul Holzinger2021-10-26
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Duplicate Address Detection slows the ipv6 setup down for 1-2 seconds. Since slirp4netns is run it is own namespace and not directly routed we can skip this to make the ipv6 address immediately available. We change the default to make sure the slirp tap interface gets the correct value assigned so DAD is disabled for it. Also make sure to change this value back to the original after slirp4netns is ready in case users rely on this sysctl. Fixes #11062 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | Merge pull request #12067 from hshiina/logs-journal-tailOpenShift Merge Robot2021-10-26
|\ \ \ | |_|/ |/| | Fix a few problems in 'podman logs --tail' with journald driver
| * | Fix a few problems in 'podman logs --tail' with journald driverHironori Shiina2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following problems regarding `logs --tail` with the journald log driver are fixed: - One more line than a specified value is displayed. - '--tail 0' displays all lines while the other log drivers displays nothing. - Partial lines are not considered. - If the journald events backend is used and a container has exited, nothing is displayed. Integration tests that should have detected the bugs are also fixed. The tests are executed with json-file log driver three times without this fix. Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
* | | Merge pull request #12092 from rhatdan/buildOpenShift Merge Robot2021-10-26
|\ \ \ | | | | | | | | If Dockerfile exists in same directory as service, we should not use it.
| * | | If Dockerfile exists in same directory as service, we should not use it.Daniel J Walsh2021-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should only use the Containerfiles/Dockerfiles found in the context directory. Fixes: https://github.com/containers/podman/issues/12054 [NO NEW TESTS NEEDED] It is difficult to setup a test for this in the CI/CD system, but build tests should find if this PR broke anything. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #12088 from adrianreber/2021-10-25-fix-label-ipc-hostOpenShift Merge Robot2021-10-26
|\ \ \ \ | | | | | | | | | | Allow 'container restore' with '--ipc host'
| * | | | Allow 'container restore' with '--ipc host'Adrian Reber2021-10-26
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trying to restore a container that was started with '--ipc host' fails with: Error: error creating container storage: ProcessLabel and Mountlabel must either not be specified or both specified We already fixed this exact same error message for containers started with '--privileged'. The previous fix was to check if the to be restored container is a privileged container (c.config.Privileged). Unfortunately this does not work for containers started with '--ipc host'. This commit changes the check for a privileged container to check if both the ProcessLabel and the MountLabel is actually set and only then re-uses those labels. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | Merge pull request #12096 from ↵OpenShift Merge Robot2021-10-26
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | containers/dependabot/go_modules/github.com/docker/docker-20.10.10incompatible Bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible
| * | | | Bump github.com/docker/dockerdependabot[bot]2021-10-26
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.9+incompatible to 20.10.10+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Changelog](https://github.com/moby/moby/blob/master/CHANGELOG.md) - [Commits](https://github.com/docker/docker/compare/v20.10.9...v20.10.10) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | | Merge pull request #12099 from Luap99/cni-k8s-envOpenShift Merge Robot2021-10-26
|\ \ \ \ | |/ / / |/| | | [CI:DOCS] Document to not set K8S envars for CNI
| * | | Document to not set K8S envars for CNIPaul Holzinger2021-10-26
|/ / / | | | | | | | | | | | | | | | | | | Setting these environment variables can cause issues with custom CNI plugins, see #12083. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | Merge pull request #12086 from rhatdan/logOpenShift Merge Robot2021-10-26
|\ \ \ | | | | | | | | Add support to play kube for --log-opt
| * | | Add support to play kube for --log-optDaniel J Walsh2021-10-25
| |/ / | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/11727 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12084 from rhatdan/VENDOROpenShift Merge Robot2021-10-26
|\ \ \ | |/ / |/| | Update vendor github.com/opencontainers/runtime-tools
| * | Update vendor github.com/opencontainers/runtime-toolsDaniel J Walsh2021-10-25
|/ / | | | | | | | | | | | | | | | | This will change mount of /dev within container to noexec, making containers slightly more secure. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #12079 from stweil/lgtmOpenShift Merge Robot2021-10-25
|\ \ | | | | | | [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
| * | [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)Stefan Weil2021-10-25
| | | | | | | | | | | | | | | | | | | | | | | | LGTM alert: Off-by-one index comparison against length may lead to out-of-bounds read. Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | | Merge pull request #12078 from stweil/typosOpenShift Merge Robot2021-10-25
|\ \ \ | |/ / |/| | [CI:DOCS Fix some typos in documentation and comments (found by codespell)
| * | Fix some typos in documentation and comments (found by codespell)Stefan Weil2021-10-25
| | | | | | | | | | | | Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | | Merge pull request #12071 from eriksjolund/fix_typo_keep_idOpenShift Merge Robot2021-10-24
|\ \ \ | | | | | | | | [CI:DOCS] Fix typo keep_id -> keep-id
| * | | [CI:DOCS] Fix typo keep_id -> keep-idErik Sjölund2021-10-24
| |/ / | | | | | | | | | Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
* | | Merge pull request #12077 from stweil/mainOpenShift Merge Robot2021-10-24
|\ \ \ | |/ / |/| | [CI:DOCS] Replace 'an user' => 'a user'
| * | Replace 'an user' => 'a user'Stefan Weil2021-10-24
|/ / | | | | | | Signed-off-by: Stefan Weil <sw@weilnetz.de>
* | Merge pull request #12061 from dancerj/typoOpenShift Merge Robot2021-10-22
|\ \ | | | | | | [CI:DOCS] fuse-overlay probably means fuse-overlayfs.
| * | fuse-overlay probably means fuse-overlayfs.Junichi Uekawa2021-10-22
| |/ | | | | | | | | | | fuse-overlayfs is usually the package name. Signed-off-by: Junichi Uekawa <dancer@debian.org>
* | Merge pull request #11991 from rhatdan/sizeOpenShift Merge Robot2021-10-22
|\ \ | | | | | | Allow API to specify size and inode quota
| * | Allow API to specify size and inode quotaDaniel J Walsh2021-10-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/11016 [NO NEW TESTS NEEDED] We have no easy way to tests this in CI/CD systems. Requires quota to be setup on directories to work. Fixes: https://github.com/containers/podman/issues/11016 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12021 from rhatdan/kubeOpenShift Merge Robot2021-10-22
|\ \ \ | |_|/ |/| | Generate Kube should not print default structs
| * | Generate Kube should not print default structsDaniel J Walsh2021-10-19
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If podman uses Workdir="/" or the workdir specified in the image, it should not add it to the yaml. If Podman find environment variables in the image, they should not get added to the yaml. If the container or pod do not have changes to SELinux we should not print seLinuxOpt{} If the container or pod do not change any dns options the yaml should not have a dnsOption={} If the container is not privileged it should not have privileged=false in the yaml. Fixes: https://github.com/containers/podman/issues/11995 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #12048 from rhatdan/manOpenShift Merge Robot2021-10-22
|\ \ | | | | | | Remove --kernel-memory options
| * | Remove --kernel-memory optionsDaniel J Walsh2021-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel memory option has been depracated in runtime-spec, It is believed that it will not work properly on certain kernels. runc ignores it. This PR removes documentation of the flag and also prints a warning if a user uses it. [NO NEW TESTS NEEDED] Helps Fix: https://github.com/containers/podman/issues/12045 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12047 from mheon/remove_infra_from_dbOpenShift Merge Robot2021-10-21
|\ \ \ | |/ / |/| | [NO NEW TESTS NEEDED] Remove infra ID from DB before removing containers
| * | Remove infra ID from DB before removing containersMatthew Heon2021-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we interrupt pod removal between removing containers and removing the whole pod, the infra ID was still in the DB, and most pod operations would try to retrieve the infra container (and would this fail). Clear the infra ID from the DB just before we remove all containers to prevent this. Fixes #12034 [NO NEW TESTS NEEDED] This is a very narrow race and I have no idea how to repro it. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | Merge pull request #12057 from flouthoc/allow-tagging-manifest-listOpenShift Merge Robot2021-10-21
|\ \ \ | | | | | | | | tag: Support tagging manifest list instead of resolving to images
| * | | tag: Support tagging manifest list instead of resolving to imagesAditya Rajan2021-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following commit makes sure when buildah tag is invoked on a manifest list, it tags the same manifest list instead of resolving to an image and tagging it. Port of: https://github.com/containers/buildah/pull/3483 Signed-off-by: Aditya Rajan <arajan@redhat.com>
* | | | Merge pull request #12028 from edsantiago/test_system_connectionOpenShift Merge Robot2021-10-21
|\ \ \ \ | |/ / / |/| | | Add test for system connection
| * | | Add test for system connectionEd Santiago2021-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First a basic (connectionless) one to make sure we 'add', 'ls', and 'rm' work; then an actual one with a service; then (if ssh to localhost is set up and works) test ssh Requires a little trickery to work around the CI definition of $PODMAN, which includes "--url /path/to/sock", which overrides podman's detection of whether to use a connection or not. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #12049 from edsantiago/test_dash_a_with_lOpenShift Merge Robot2021-10-20
|\ \ \ \ | |_|/ / |/| | | System tests: confirm that -a and -l clash
| * | | System tests: confirm that -a and -l clashEd Santiago2021-10-20
|/ / / | | | | | | | | | | | | | | | ...and fix one instance where there was no check Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | Merge pull request #11851 from cdoern/podRmOpenShift Merge Robot2021-10-20
|\ \ \ | | | | | | | | Pod Rm Infra Handling Improvements
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-07 16:33:44 +0000