summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* rootless: use RootlessKit port forwarderAkihiro Suda2020-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RootlessKit port forwarder has a lot of advantages over the slirp4netns port forwarder: * Very high throughput. Benchmark result on Travis: socat: 5.2 Gbps, slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps (https://travis-ci.org/rootless-containers/rootlesskit/builds/597056377) * Connections from the host are treated as 127.0.0.1 rather than 10.0.2.2 in the namespace. No UDP issue (#4586) * No tcp_rmem issue (#4537) * Probably works with IPv6. Even if not, it is trivial to support IPv6. (#4311) * Easily extensible for future support of SCTP * Easily extensible for future support of `lxc-user-nic` SUID network RootlessKit port forwarder has been already adopted as the default port forwarder by Rootless Docker/Moby, and no issue has been reported AFAIK. As the port forwarder is imported as a Go package, no `rootlesskit` binary is required for Podman. Fix #4586 May-fix #4559 Fix #4537 May-fix #4311 See https://github.com/rootless-containers/rootlesskit/blob/v0.7.0/pkg/port/builtin/builtin.go Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* Merge pull request #4781 from haircommander/seccomp-profile-rootOpenShift Merge Robot2020-01-07
|\ | | | | play kube: make seccomp handling better conform to k8s
| * play kube: make seccomp handling better conform to k8sPeter Hunt2020-01-03
| | | | | | | | | | | | | | Add flag --seccomp-profile-root in play kube to allow users to specify where to look for seccomp profiles update tests Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | Merge pull request #4788 from vrothberg/staleOpenShift Merge Robot2020-01-07
|\ \ | | | | | | github stale workflow: rephrase and bump close time
| * | github stale workflow: rephrase and bump close timeValentin Rothberg2020-01-07
| | | | | | | | | | | | | | | | | | | | | | | | Rephrase the stale message to be friendlier and bump the closing time to 365 days. The docs of the stale workflow do not indicate whether we can not close, so a limit of 365 days seems fair. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #4774 from QiWang19/cp_src_pathOpenShift Merge Robot2020-01-07
|\ \ \ | |/ / |/| | fix bug copy from container directory
| * | fix bug copy from container directoryQi Wang2020-01-02
| | | | | | | | | | | | | | | | | | Keep the original input source path with "/." so podman can copy the content of the directory when copying from container to host. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | Merge pull request #4800 from mheon/bump-1.7.0OpenShift Merge Robot2020-01-06
|\ \ \ | | | | | | | | Bump to v1.7.0
| * | | Bump gitvalidation epochMatthew Heon2020-01-06
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | | Bump to v1.7.1-devMatthew Heon2020-01-06
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | | Bump to v1.7.0v1.7.0Matthew Heon2020-01-06
|/ / / | | | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | Merge pull request #4762 from NevilleC/nc-issue4367OpenShift Merge Robot2020-01-06
|\ \ \ | | | | | | | | Generate binaries only if there are changes in src code.
| * | | Generate binaries only if they are changes in src code.Neville Cain2020-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes I am making: 1. The target `.gopathok` was listed in `.PHONY` which looks wrong as it regenerates `.gopathok` every time we re-run it, which was a part of the issue. I removed it to avoid that. If `.gopathok` is present', makefile should not need to rerun it. 2. Ensure the binaries are created only if they don't exist by adding `bin/podman` and `bin/podman-remote`. 3. Add a `SOURCES = $(shell find . -name "*.go")` and put it as a dependency of the podman binaries target. It allows us to re-generate the binaries only when there is a change in the source files. The downside is it increases the running time of the command that generates them (20 seconds on my virtual machine running Centos 7). If this is a problem, we could introduce a hidden file that would list all the files to track, that would need to be updated only when a dev is introducing new files. 4. Fixed the make package-install as it does not work with yum. I updated the build_rpm.sh to ensure it works on centos 7 and centos 8 with no pre-required installation. Closes #4367 Signed-off-by: Neville Cain <neville.cain@qonto.eu>
* | | | Merge pull request #4797 from edsantiago/policy_json_manpageOpenShift Merge Robot2020-01-06
|\ \ \ \ | | | | | | | | | | (minor) fix broken links to container-policy.json.5
| * | | | (minor) fix broken links to container-policy.json.5Ed Santiago2020-01-06
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two man pages had incorrect references to a nonexistent policy.conf(5) or policy-conf(5) [dot vs dash]. Fix them. Also checked for other broken references via: $ for i in registries.conf storage.conf policy.json ; do grep -R $i.5 docs/source | grep -v containers-$i;done (No further results found. That's not a guarantee that there aren't other broken links though). Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #4780 from rhatdan/manOpenShift Merge Robot2020-01-03
|\ \ \ \ | |_|_|/ |/| | | Fix presentation of man page tables
| * | | Fix presentation of man page tablesDaniel J Walsh2020-01-03
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | Currently the use of "*" in tables is causing go-md2man to screw up the format of the man page. This PR removes the "*" since it is not really necessary. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #4777 from mheon/bump-1.7.0-rc2OpenShift Merge Robot2020-01-02
|\ \ \ | | | | | | | | Bump to v1.7.0-RC2
| * | | Bump gitvalidation epochMatthew Heon2020-01-02
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Bump to v1.7.0-devMatthew Heon2020-01-02
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Bump to v1.7.0-rc2v1.7.0-rc2Matthew Heon2020-01-02
|/ / / | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #4776 from mheon/release_notes_v1.7.0_rc2OpenShift Merge Robot2020-01-02
|\ \ \ | |_|/ |/| | Update release notes with further changes from 1.7.0
| * | Update release notes with further changes from 1.7.0Matthew Heon2020-01-02
|/ / | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #4757 from baude/networkrefactorOpenShift Merge Robot2019-12-31
|\ \ | |/ |/| refactor network commands
| * refactor network commandsbaude2019-12-29
| | | | | | | | | | | | | | move core of network commands from pkg/adapter to pkg/network to assist with api development and remote podman commands. Signed-off-by: baude <bbaude@redhat.com>
* | Merge pull request #4748 from NevilleC/nc-podnameOpenShift Merge Robot2019-12-29
|\ \ | | | | | | [Issue #4703] Add the pod name when we use `podman ps -p`
| * | Add the pod name when we use `podman ps -p`Neville Cain2019-12-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pod name does not appear when doing `podman ps -p`. It is missing as the documentation says: -p, --pod Print the ID and name of the pod the containers are associated with The pod name is added in the ps output and checked in unit tests. Closes #4703 Signed-off-by: NevilleC <neville.cain@qonto.eu>
* | | Merge pull request #4756 from edsantiago/fix_kill_test_hang_safelyOpenShift Merge Robot2019-12-29
|\ \ \ | | | | | | | | Fix race condition in kill test leading to hang
| * | | Fix race condition in kill test leading to hangEd Santiago2019-12-28
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When you open a FIFO for reading, but there's no writer, you hang. This is just one of those obscure UNIXisms we all know but just forget all too often. My last PR was guilty of introducing such a condition; I caught it by accident while testing other stuff. In short, the signal container was doing 'echo DONE' as its last step, and we (BATS) were reading the FIFO to check for it; but if the container exited before we opened the FIFO for read, the open would hang. This is not a hang that we can catch in the test: it would hang the entire job forever. CI would presumably time out eventually, but with no useful indication of the cause of the error. Solution: use 'exec' to open the FIFO early and keep it open, and use 'read -u FD' instead of 'read <$fifo': the former reads from an open FD, the latter forces a new open() each time. There is a shorter, more maintainable solution -- see #4755 -- but that suffers from the same hanging problem in the (unlikely) case where the signal-handling container exits, e.g. if signal handling is broken in podman. The test would hang, with no helpful indicator. Although this PR is a little more advanced scripting, I have commented the relevant code well and believe the maintenance cost is worth the risk of undebuggable hangs. There is still a hang risk: if 'podman logs -f' fails and exits immediately, the 'exec' will hang. I can't think of a non-racy way to prevent that, and choose to live with that risk. Tested by temporarily including 9 (SIGKILL) in the signals list. The read timeout triggers, and the end user has a fair chance of tracking down the root cause. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | Merge pull request #4754 from NevilleC/nc-improvemakeuninstallOpenShift Merge Robot2019-12-28
|\ \ \ | |/ / |/| | Ensure 'make uninstall' removes bin and conf files.
| * | Ensure 'make uninstall' remove bin and conf files.Neville Cain2019-12-28
| |/ | | | | | | | | | | | | | | | | | | | | | | I updated the 'make uninstall' command to remove: 1. podman and remote bin 2. cni/net.d/87-podman-bridge.conflist 3. podman.conf 4. systemd conf files: io.podman.socket.* Closes #4572 Signed-off-by: Neville Cain <neville.cain@qonto.eu>
* | Merge pull request #4753 from NevilleC/nc-missingsizeOpenShift Merge Robot2019-12-28
|\ \ | | | | | | Ensure SizeRw is shown when a user does 'inspect --size -t container'.
| * | Ensure SizeRw is shown when a user does 'inspect --size -t container'.Neville Cain2019-12-27
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, if a user requests the size on a container (inspect --size -t container), the SizeRw does not show up if the value is 0. It's because InspectContainerData is defined as int64 and there is an omit when empty. We do want to display it even if the value is empty. I have changed the type of SizeRw to be a pointer to an int64 instead of an int64. It will allow us todistinguish the empty value to the missing value. I updated the test "podman inspect container with size" to ensure we check thatSizeRw is displayed correctly. Closes #4744 Signed-off-by: NevilleC <neville.cain@qonto.eu>
* | Merge pull request #4749 from edsantiago/parse_and_validate_signalOpenShift Merge Robot2019-12-27
|\ \ | | | | | | signal parsing - better input validation
| * | signal parsing - better input validationEd Santiago2019-12-26
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The helper function we use for signal name mapping does not check for negative numbers nor invalid (too-high) ones. This can yield unexpected error messages: # podman kill -s -1 foo ERRO[0000] unknown signal "18446744073709551615" This PR introduces a small wrapper for it that: 1) Strips off a leading dash, allowing '-1' or '-HUP' as valid inputs; and 2) Rejects numbers <1 or >64 (SIGRTMAX) Also adds a test suite checking signal handling as well as ensuring that invalid signals are rejected by the command line. Fixes: #4746 Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #4751 from mheon/quiet_template_noconflictOpenShift Merge Robot2019-12-27
|\ \ | |/ |/| The --quiet flag does not conflict with templates in ps
| * The --quiet flag does not conflict with templates in psMatthew Heon2019-12-26
|/ | | | | | | | To match Docker behavior, make `--quiet` and `--format` with a Go template not conflict. Instead, just turn off `--quiet` in such cases, as we'll be using Go template output instead. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #4742 from rhatdan/vendorOpenShift Merge Robot2019-12-23
|\ | | | | Update containers/storage to v1.15.4
| * Update containers/storage to v1.15.4Daniel J Walsh2019-12-23
| | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #4743 from baude/imageresponseOpenShift Merge Robot2019-12-23
|\ \ | | | | | | add struct response for removal of images
| * | add struct response for removal of imagesbaude2019-12-23
| |/ | | | | | | | | | | | | | | when removing an image from storage, we should return a struct that details what was untagged vs deleted. this replaces the simple println's used previously and assists in API development. Signed-off-by: baude <bbaude@redhat.com>
* | Merge pull request #4740 from edsantiago/zsh_completion_flagfixOpenShift Merge Robot2019-12-23
|\ \ | | | | | | zsh completion: ignore multi-line output in Flags
| * | zsh completion: ignore multi-line output in FlagsEd Santiago2019-12-23
| |/ | | | | | | | | | | | | | | | | | | | | | | | | PR #4475 introduced an interesting twist on --help: a help string that spans multiple lines. This broke zsh completion. I'm not keen on that multi-line output, but it shouldn't break completion. Fix is simple: look only for flag lines beginning with '-', filter out anything else. Fixes: #4738 Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #4697 from rhatdan/contextOpenShift Merge Robot2019-12-23
|\ \ | |/ |/| Set contextdir to current PWD if user did not specify a context dir.
| * Update containers/storage to v1.15.4Daniel J Walsh2019-12-23
|/ | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #4708 from ↵OpenShift Merge Robot2019-12-20
|\ | | | | | | | | containers/dependabot/go_modules/github.com/containers/image/v5-5.1.0 build(deps): bump github.com/containers/image/v5 from 5.0.0 to 5.1.0
| * build(deps): bump github.com/containers/image/v5 from 5.0.0 to 5.1.0Daniel J Walsh2019-12-20
| | | | | | | | | | | | | | | | | | Bumps [github.com/containers/image/v5](https://github.com/containers/image) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/containers/image/releases) - [Commits](https://github.com/containers/image/compare/v5.0.0...v5.1.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #4727 from rhatdan/pidnsOpenShift Merge Robot2019-12-20
|\ \ | | | | | | if container is not in a pid namespace, stop all processes
| * | if container is not in a pid namespace, stop all processesDaniel J Walsh2019-12-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | When a container is in a PID namespace, it is enought to send the stop signal to the PID 1 of the namespace, only send signals to all processes in the container when the container is not in a pid namespace. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #4722 from giuseppe/drop-arbitrary-limitOpenShift Merge Robot2019-12-19
|\ \ \ | |_|/ |/| | libpod: drop arbitrary memory limit of 4M
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-06 15:37:46 +0000