aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* play kube selinux test caseSteven Taylor2021-02-05
| | | | | | added skip to test case where selinux not enabled Signed-off-by: Steven Taylor <steven@taylormuff.co.uk>
* play kube selinux test caseSteven Taylor2021-02-05
| | | | | | fixed typo in the label comparison Signed-off-by: Steven Taylor <steven@taylormuff.co.uk>
* play kube selinux label test caseSteven Taylor2021-02-05
| | | | | | | test case added to e2e test suite to validate process label being correctly set on play kube Signed-off-by: Steven Taylor <steven@taylormuff.co.uk>
* play kube selinux label issueSteven Taylor2021-02-05
| | | | | | | | | play kube function not respecting selinux options in kube yaml, all options were being mapped to role. fixes issue 8710 Signed-off-by: Steven Taylor <steven@taylormuff.co.uk>
* Fix podman network disconnect wrong NetworkStatus numberPaul Holzinger2021-02-05
| | | | | | | | | | | | | The allocated `tmpNetworkStatus` must be allocated with the length 0. Otherwise append would add new elements to the end of the slice and not at the beginning of the allocated memory. This caused inspect to fail since the number of networks did not matched the number of network statuses. Fixes #9234 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Update release notes for v3.0.0-RC3Matthew Heon2021-02-04
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* generate kube: handle entrypointValentin Rothberg2021-02-04
| | | | | | | | | | The spec of a Kube Container has a `Command` and `Args`. While both are slices, the `Command` is the counterpart of the entrypoint of a libpod container. Kube is also happily accepting the arguments to as following items in the slice but it's cleaner to move those to `Args`. Fixes: #9211 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Allow pods to use --net=noneMatthew Heon2021-02-04
| | | | | | | | | | | We need an extra field in the pod infra container config. We may want to reevaluate that struct at some point, as storing network modes as bools will rapidly become unsustainable, but that's a discussion for another time. Otherwise, straightforward plumbing. Fixes #9165 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Report StatusConflict on Pod opt partial failuresJhon Honce2021-02-04
| | | | | | | | | | | | | | | | | | | - When one or more containers in the Pod reports an error on an operation report StatusConflict and report the error(s) - jsoniter type encoding used to marshal error as string using error.Error() - Update test framework to allow setting any flag when creating pods - Fix test_resize() result check Fixes #8865 Signed-off-by: Jhon Honce <jhonce@redhat.com> <MH: Fix cherry-pick conflicts> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* bindings: attach: warn correct errorValentin Rothberg2021-02-04
| | | | | | | | | The resize warning logged the wrong error. While this does not fix #9172, it may very well be helpful finding its root cause. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Make slirp MTU configurable (network_cmd_options)bitstrings2021-02-04
| | | | | | | | The mtu default value is currently forced to 65520. This let the user control it using the config key network_cmd_options, i.e.: network_cmd_options=["mtu=9000"] Signed-off-by: bitstrings <pino.silvaggio@gmail.com>
* Fix podman generate systemd --new special char handlingPaul Holzinger2021-02-04
| | | | | | | | | | In a systemd unit dollar and percent signs are used for variables. A backslash is used for escape sequences. If any of these characters are used in the create command we have to properly escape them so systemd does not try to interpret them. Fixes #9176 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Fix --network parsing for podman pod createPaul Holzinger2021-02-04
| | | | | | | | | | | | The `--network` flag is parsed differently for `podman pod create`. This causes confusion and problems for users. The extra parsing logic ignored unsupported network options such as `none`, `container:...` and `ns:...` and instead interpreted them as cni network names. Tests are added to ensure the correct errors are shown. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Endpoint that lists containers does not return correct Status valueMilivoje Legenovic2021-02-04
| | | | | | | | | | | | | Eclipse and Intellij Docker plugin determines the state of the container via the Status field, returned from /containers/json call. Podman always returns empty string, and because of that, both IDEs show the wrong state of the container. Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Docker ignores mount flags that begin with constencyDaniel J Walsh2021-02-04
| | | | | | | | | | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1915332 ``` According to the Docker docs, the consistency option should be ignored on Linux. the possible values are 'cached', 'delegated', and 'consistent', but they should be ignored equally. This is a widely used option in scripts run by developer machines, as this makes file I/O less horribly slow on MacOS. ``` Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* podman generate kube ignores --network=hostMilivoje Legenovic2021-02-04
| | | | Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com>
* Honor custom DNS in play|generate kubebaude2021-02-04
| | | | | | | | | | | | | | | | | | when creating kubernetes yaml from containers and pods, we should honor any custom dns settings the user provided. in the case of generate kube, these would be provided by --dns, --dns-search, and --dns-opt. if multiple containers are involved in the generate, the options will be cumulative and unique with the exception of dns-opt. when replaying a kube file that has kubernetes dns information, we now also add that information to the pod creation. the options for dnspolicy is not enabled as there seemed to be no direct correlation between kubernetes and podman. Fixes: #9132 Signed-off-by: baude <bbaude@redhat.com>
* Don't fail if one of the cgroups is not setupDaniel J Walsh2021-02-04
| | | | | | | | | | | It is fairly common for certain cgroups controllers to not be enabled on a system. We should Warn when this happens versus failing, when doing podman stats command. This way users can get information from the other controllers. Fixes: https://github.com/containers/podman/issues/8588 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix #9100 Change console mode message to debugGerard Braad2021-02-04
| | | | | | [NO TESTS NEEDED] Signed-off-by: Gerard Braad <me@gbraad.nl>
* Update release notes from masterMatthew Heon2021-02-04
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #9225 from mheon/fix_CVE-2021-20199_30OpenShift Merge Robot2021-02-03
|\ | | | | Fix CVE-2021-20199 for Podman v3.0
| * libpod: move slirp magic IPs to constsGiuseppe Scrivano2021-02-03
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * rootlessport: set source IP to slirp4netns deviceGiuseppe Scrivano2021-02-03
| | | | | | | | | | | | | | | | | | set the source IP to the slirp4netns address instead of 127.0.0.1 when using rootlesskit. Closes: https://github.com/containers/podman/issues/5138 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * Bump rootless-containers/rootlesskit to v0.12.0Matthew Heon2021-02-03
|/ | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #9213 from edsantiago/bats_diff_workaround_v3OpenShift Merge Robot2021-02-03
|\ | | | | [v3.0] Gating tests: diff test: workaround for RHEL8 failure
| * Gating tests: diff test: workaround for RHEL8 failureEd Santiago2021-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RHEL8 rootless gating tests are inconsistently failing with: $ podman diff --format json -l # {"changed":["/etc"],"added":["/sys/fs","/sys/fs/cgroup","/pMOm1Q0fnN"],"deleted":["/etc/services"]} # #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv # #| FAIL: added # #| expected: '/pMOm1Q0fnN' # #| actual: '/sys/fs' # #| > '/sys/fs/cgroup' # #| > '/pMOm1Q0fnN' # #\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Reason: PR #8561, I think (something to do with /sys on RHEL). Workaround: ignore '/sys/fs' in diffs. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #9187 from rhatdan/v3.0OpenShift Merge Robot2021-02-03
|\ \ | | | | | | Bump to containers/common v0.33.2
| * | Bump to containers/common v0.33.3Daniel J Walsh2021-02-02
|/ / | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #9184 from vrothberg/3.0-fix-9134OpenShift Merge Robot2021-02-02
|\ \ | | | | | | [3.0] podman build --pull: refine help message and docs
| * | podman build --pull: refine help message and docsValentin Rothberg2021-02-01
| | | | | | | | | | | | | | | | | | | | | Refine and correct the wording of the `--pull` flag in the help message and the docs. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #9198 from baude/v3backportmacvlanOpenShift Merge Robot2021-02-02
|\ \ \ | | | | | | | | [3.0]add macvlan as a supported network driver
| * | | add macvlan as a supported network driverbaude2021-02-02
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | instead of using the --macvlan to indicate that you want to make a macvlan network, podman network create now honors the driver name of *macvlan*. Any options to macvlan, like the parent device, should be specified as a -o option. For example, -o parent=eth0. the --macvlan option was marked as deprecated in the man page but is still supported for the duration of 3.0. Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #9180 from cevich/v3.0_static_remoteOpenShift Merge Robot2021-02-01
|\ \ \ | | | | | | | | [v3.0] Use cachix for static build & include podman-remote build
| * | | Cirrus: Build static podman-remoteChris Evich2021-02-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this commit, the "Static Build" task only produced a `bin/podman`. Update this to also include a `bin/podman-remote` binary. Update the pr-should-include-tests checker to ignore the `nix` directory, which isn't applicable. Lastly, restore the static build task to 'required' for CI success. Leaving the comment inplace in case it needs to be bypassed in the future on short notice. Signed-off-by: Chris Evich <cevich@redhat.com>
| * | | Fix static build cache by using cachixSascha Grunert2021-02-01
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like we always hit the caching issue in Cirrus CI described within #8313. A solution around that is to use cachix, which has been pre-populated from my local machine. To push all (runtime and build) dependencies, we can leverage a pre-populated store by: ``` > nix-store -qR --include-outputs $(nix-instantiate nix/default.nix) | cachix push podman ``` The cache can be re-used by everybody to rapidly build static Podman binaries: https://app.cachix.org/cache/podman [NO TESTS NEEDED] Signed-off-by: Sascha Grunert <mail@saschagrunert.de>
* | | Merge pull request #9179 from cevich/v3.0_fix_validateOpenShift Merge Robot2021-02-01
|\ \ \ | |/ / |/| | [v3.0] Cirrus: Fix running Validate task on branches
| * | Cirrus: Fix running Validate task on branchesChris Evich2021-02-01
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Followup to 4c60523 Despite skipping the `Smoke` check, it was observed on a *new* branch, the `validate` task (specifically `git-validation`) will fail. This is because: * `$CIRRUS_LAST_GREEN_CHANGE` will be empty on a new branch. * `$CIRRUS_BASE_SHA` is always empty for runs triggered by branch-push * `$EPOCH_TEST_COMMIT` will be set to `YOU_FOUND_A_BUG`. Fix this by eliminating the `Smoke` task entirely, simplifying all the `make validate` operations into the `validate` cirrus task. Ensure this task does not run when a new branch or tag is pushed. Also, eliminate the `$CIRRUS_BUILD_ID` value as it's confusing and not actually used anywhere. It was formerly used for building VM images, but this has moved to another repo entirely. Signed-off-by: Chris Evich <cevich@redhat.com>
* | Merge pull request #9163 from mheon/backports_rc2OpenShift Merge Robot2021-01-29
|\ \ | | | | | | Backports for v3.0 RC2
| * | Bump to v3.0.0-devMatthew Heon2021-01-29
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | Bump to v3.0.0-RC2v3.0.0-rc2Matthew Heon2021-01-29
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | Cirrus: add bindings checksValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that bindings are in sync with the code. The check is similar to what's already being done with `make vendor`, so integrate the two. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make bindings generation explicitValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | Instead of implicitly generating the bindings, make it explicit, similar to `make vendor`. This should prevent redundant and possibly error prone generations. A following commit will shield CI. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make bindings generation more robutsValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Go gods did not shine upon us trying to understand what's going on in #9000. The symptom is that `go generate` did not add required imports to a generated file, ultimately breaking subsequent compilation. While it still remains unclear *why* Go is behaving like that, the symptom disappears when `go generate` runs in module mode; that is without `-mod=vendor` and without `GO111MODULE=off`. This was reproducible on two separate machines (Ubuntu and Fedora). Also, when facing an unset GOPATH, set it to Go's default (i.e., $HOME/go) and make sure that GOBIN is in PATH since `goimports` is required by `go generate`. Fixes: #9000 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | simplify bindings generationValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Run `go generate ./pkg/bindings/...` once for all bindings instead of generating them separately. This should speed up bindings generation as a given package is visited only once, and it fixes #8989 by dropping the use of pushd and popd. Fixes: #8989 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | make: generate bindings: use vendorValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | Set `-mod=vendor` when generating the bindings. We expect all dependencies to be vendored already. This should slightly speed up the bindings generation and prevent redundant network accesses. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | Make generate systemd --new robust against double curly bracesPaul Holzinger2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the container create command contains an argument with double curly braces the golang template parsing can fail since it tries to interpret the value as variable. To fix this change the default delimiter for the internal template to `{{{{`. Fixes #9034 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * | Ensure shutdown handler access is syncronizedMatthew Heon2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a potential race where two handlers could be added at the same time. Go Maps are not thread-safe, so that could do unpleasant things. Add a mutex to keep things safe. Also, swap the order or Register and Start for the handlers in Libpod runtime created. As written, there was a small gap between Start and Register where SIGTERM/SIGINT would be completely ignored, instead of stopping Podman. Swapping the two closes this gap. Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | workdir presence checksValentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A container's workdir can be specified via the CLI via `--workdir` and via an image config with the CLI having precedence. Since images have a tendency to specify workdirs without necessarily shipping the paths with the root FS, make sure that Podman creates the workdir. When specified via the CLI, do not create the path, but check for its existence and return a human-friendly error. NOTE: `crun` is performing a similar check that would yield exit code 127. With this change, however, Podman performs the check and yields exit code 126. Since this is specific to `crun`, I do not consider it to be a breaking change of Podman. Fixes: #9040 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | libpod: add (*Container).ResolvePath()Valentin Rothberg2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add an API to libpod to resolve a path on the container. We can refactor the code that was originally written for copy. Other functions are requiring a proper path resolution, so libpod seems like a reasonable home for sharing that code. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | Add default net info in container inspectbaude2021-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when inspecting a container that is only connected to the default network, we should populate the default network in the container inspect information. Fixes: #6618 Signed-off-by: baude <bbaude@redhat.com> MH: Small fixes, added another test Signed-off-by: Matthew Heon <matthew.heon@pm.me>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-03-06 03:23:10 +0000