aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* podman create: building local pause image: do not read ignore filesValentin Rothberg2022-03-30
| | | | | | | | | Make sure to ignore local {container,docker}ignore files when building a local pause image. Otherwise, we may mistakenly not be able to copy catatonit into the build container. Fixes: #13529 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Separator is no longer prepended when prefix is empty on podman generate systemdNirmal Patel2022-03-30
| | | | | | | | | | | | | | When podman generate systemd is invoked, it previously did not check if container-prefix or pod-prefix are empty. When these are empty, the file name starts with the separator, which is hyphen by default. This results in files like '-containername.service'. The code now checks if these prefixes are empty. If they are, the filename no longer adds a separator. Instead, it uses name or ID of the container or pod. Closes #13272 Signed-off-by: Nirmal Patel <npate012@gmail.com>
* [CI:DOCS]: Mention netavark limitations for macvlan/ipvlan driversClayton Craft2022-03-30
| | | | | | | The example is also improved to add the --subnet option, this option is required with netavark, else you get: Error: macvlan driver needs at least one subnet specified, DHCP is not supported with netavark Signed-off-by: Clayton Craft <clayton@craftyguy.net>
* fix empty newline in version outputPaul Holzinger2022-03-30
| | | | | | | | | | | | | When podman is build without git commit information it will print a empty newline instead. This is undesirable and a regression introduced in commit 7d22cc88ef38. To test build podman with `go build -mod=vendor -o bin/podman ./cmd/podman` and check the output of bin/podman version with and without this commit. [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* slirp: fix setup on ipv6 disabled systemsPaul Holzinger2022-03-30
| | | | | | | | | | | | | | | | | When enable_ipv6=true is set for slirp4netns (default since podman v4), we will try to set the accept sysctl. This sysctl will not exist on systems that have ipv6 disabled. In this case we should not error and just ignore the extra ipv6 setup. Also the current logic to wait for the slirp4 setup was kinda broken, it did not actually wait until the sysctl was set before starting slirp. This should now be fixed by using two `sync.WaitGroup`s. [NO NEW TESTS NEEDED] Fixes #13388 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fixes TTY & resizing on Mac and WindowsJason T. Greene2022-03-30
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Fix handling of tmpfs-mode for tmpfs creation in compat modeDaniel J Walsh2022-03-30
| | | | | | | | | | | | The permissions on disk were wrong since we were not converting to octal. Fixes: https://github.com/containers/podman/issues/13108 [NO NEW TESTS NEEDED] Since we don't currently test using the docker client Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Skip flaky pprof testsEd Santiago2022-03-30
| | | | | | | | | | pprof tests are way too flaky, and are causing problems for community contributors who don't have privs to press Re-run. There has been no activity or interest in fixing the bug, and it's not something I can fix. So, just disable the test. Signed-off-by: Ed Santiago <santiago@redhat.com>
* Move secret-verify-leak containerfile into its own DirectoryAshley Cui2022-03-30
| | | | | | | | | | | | | | | | | | Secret-verify-leak is causing flakes, when running in parallel tests. This is because remote secrets are copied into the context directory to send to the API server, and secret-verify-leak is doing a COPY * and then checking if the temporary secret file ends up in the container or not. Since all the temporary files are prefixed with "podman-build-secret", this test checks if podman-build-secret is in the image. However, when run in parallel with other tests, other temporary podman-build-secrets might be in the context dir. Moving secret-verify-leak into its own directory makes sure that the context dir is used only by this one test. Also renamed Dockerfile -> Containerfile and cleaned up unused Containerfiles. Signed-off-by: Ashley Cui <acui@redhat.com>
* Fixes: #13301 ("machine rm removes the mounted socket file on macos")Thibault Gagnaux2022-03-30
| | | | | [NO NEW TESTS NEEDED] Signed-off-by: Thibault Gagnaux <tgagnaux@gmail.com>
* Throw an error if kube yaml has duplicate ctr namesUrvashi Mohnani2022-03-30
| | | | | | | Error out if the kube yaml passed to play kube has more than one container or init container with the same name. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* libpod: pods do not use cgroups if --cgroups=disabledGiuseppe Scrivano2022-03-30
| | | | | | | | | do not attempt to use cgroups with pods if the cgroups are disabled. A similar check is already in place for containers. Closes: https://github.com/containers/podman/issues/13411 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* container: workdir resolution must consider symlink if explicitly configuredAditya R2022-03-30
| | | | | | | | | | | | | | | | | | | | | | | While resolving `workdir` we mostly create a `workdir` when `stat` fails with `ENOENT` or `ErrNotExist` however following cases are not true when user explicitly specifies a `workdir` while `running` using `--workdir` which tells `podman` to only use workdir if its exists on the container. Following configuration is implicity set with other `run` mechanism like `podman play kube` Problem with explicit `--workdir` or similar implicit config in `podman play kube` is that currently podman ignores the fact that workdir can also be a `symlink` and actual `link` could be valid. Hence following commit ensures that in such scenarios when a `workdir` is not found and we cannot create a `workdir` podman must perform a check to ensure that if `workdir` is a `symlink` and `link` is resolved successfully and resolved link is present on the container then we return as it is. Docker performs a similar behviour. Signed-off-by: Aditya R <arajan@redhat.com>
* Merge pull request #13694 from giuseppe/v4.0-backport-no-inheritableOpenShift Merge Robot2022-03-30
|\ | | | | [4.0] do not set the inheritable capabilities
| * test: fix podman run test as rootlessGiuseppe Scrivano2022-03-30
| | | | | | | | | | | | | | aafa80918a245edcbdaceb1191d749570f1872d0 introduced the regression. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> (cherry picked from commit 640c2d53a88f46e997d4e5a594cfc85a57e74d36)
| * do not set the inheritable capabilitiesGiuseppe Scrivano2022-03-30
|/ | | | | | | | | | The kernel never sets the inheritable capabilities for a process, they are only set by userspace. Emulate the same behavior. Closes: CVE-2022-27649 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> (cherry picked from commit aafa80918a245edcbdaceb1191d749570f1872d0)
* Merge pull request #13568 from n1hility/upgrade-v4.0OpenShift Merge Robot2022-03-25
|\ | | | | [v4.0] Add Windows installer support for upgrades
| * Add Windows installer support for upgradesJason T. Greene2022-03-19
| | | | | | | | | | | | Fixes duplicate installer entries after multiple installs Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* | Merge pull request #13614 from vrothberg/backportDaniel J Walsh2022-03-24
|\ \ | | | | | | [v4.0] vendor c/common@v0.47.5
| * | vendor c/common@v0.47.5Valentin Rothberg2022-03-23
| |/ | | | | | | | | | | | | | | | | Update the login tests to reflect the latest changes to allow http{s} prefixes (again) to address bugzilla.redhat.com/show_bug.cgi?id=2062072. Backport of commit 57cdc21b0057. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | Merge pull request #13630 from flouthoc/backport-race-build-v4.0OpenShift Merge Robot2022-03-24
|\ \ | | | | | | [v4.0 backport] bump to race-free `c/image` and `c/storage` along with test to verify `concurrent/parallel` builds
| * | test: add a test to verify race free concurrent/parallel buildsAditya R2022-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Invoking parallel/concurrent builds from podman race against each other following behviour was fixed in containers/storage#1153 and containers/image#1480 Test verifies if following bug is fixed in new race-free API or not. Read more about this issue, see bz 2055487 for more details. Test manually backported from: containers@63f92d0 Signed-off-by: Aditya R <arajan@redhat.com>
| * | vendor: bump c/image to v5.19.2Aditya R2022-03-24
| | | | | | | | | | | | | | | | | | | | | Bump c/image to upstream v5.19.2 so podman could use new race-free code. Signed-off-by: Aditya R <arajan@redhat.com>
| * | vendor: bump c/storage to v1.38.3Aditya R2022-03-24
| |/ | | | | | | | | | | | | Bump c/storage to v1.38.3 so podman could use new `race-free` `AddNames` and `RemoveNames` api Signed-off-by: Aditya R <arajan@redhat.com>
* | Merge pull request #13645 from lsm5/v4.0-cve-2022-21698OpenShift Merge Robot2022-03-24
|\ \ | |/ |/| Bump github.com/prometheus/client_golang to v1.11.1
| * Bump github.com/prometheus/client_golang to v1.11.1Lokesh Mandvekar2022-03-24
|/ | | | | | Resolves: CVE-2022-21698 Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
* Merge pull request #13560 from n1hility/backport-handle-incompatibleOpenShift Merge Robot2022-03-19
|\ | | | | [v4.0] Backport handling of incompatible machines
| * Handle incompatible machinesJason T. Greene2022-03-18
| | | | | | | | | | | | Start in a reduced mode for recovery, warn, and provide instructions to recreate them Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
| * Fix type-o and cleanup doc punctuationJason T. Greene2022-03-18
| | | | | | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
| * machine rm -f stops and removes machineBrent Baude2022-03-18
| | | | | | | | | | | | | | | | | | | | | | | | If you want to remove a running machine, you can now pass the --force/-f to podman machine rm and the machine will be stopped and removed without confirmations. Fixes: #13448 [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Improve agent install message to add restart instructionsJason T. Greene2022-03-18
| | | | | | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
| * MacOS improvementsBrent Baude2022-03-18
|/ | | | | | | | * Enable support of virtfs in Podman and darwin. At the time of this writing, it requires a special patch not yet included in upstream qemu. * Prefer to use a specially built qemu to support virtfs. The qemu is installed under libexec/podman. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* Merge pull request #13545 from cevich/backport_gvisor_url_fixOpenShift Merge Robot2022-03-18
|\ | | | | [v4.0] Backport: Fix windows win-sshproxy build
| * Fix windows win-sshproxy buildPaul Holzinger2022-03-17
|/ | | | | | | | | Github no longer supports the unauthenticated git protocol, so switch to using https instead. https://github.blog/2021-09-01-improving-git-protocol-security-github/ Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #13480 from TomSweeneyRedHat/dev/tsweeney/fujibackOpenShift Merge Robot2022-03-13
|\ | | | | [v4.0] Backport Set default rule at the head of dev config
| * [v4.0] Backport Set default rule at the head of dev configtomsweeneyredhat2022-03-10
|/ | | | | | | | | | | | | | | | | | | Backports: #13421 Set default rule at the head of device configuration by @hshiina The default rule should be set at the head of device configuration. Otherwise, rules for user devices are overridden by the default rule so that any access to the user devices are denied. This has been requested to backport and to include in RHEL 8.6 and 9.0. The exception process is underway. Addresses these BZs for the backport: https://bugzilla.redhat.com/show_bug.cgi?id=2059296 https://bugzilla.redhat.com/show_bug.cgi?id=2062835 Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
* Merge pull request #13405 from lsm5/v402OpenShift Merge Robot2022-03-02
|\ | | | | Release v4.0.2
| * Bump to v4.0.3-devLokesh Mandvekar2022-03-02
| | | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
| * Bump to v4.0.2v4.0.2Lokesh Mandvekar2022-03-02
| | | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
| * Update release notes for v4.0.2Lokesh Mandvekar2022-03-02
|/ | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
* Merge pull request #13392 from baude/v4revertsOpenShift Merge Robot2022-03-01
|\ | | | | V4reverts
| * Revert "use GetRuntimeDir() from c/common"Brent Baude2022-03-01
| | | | | | | | | | | | | | | | This reverts commit fc5cf812c81a10f8a021aae11df5f12ab2a6f6f6. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Revert "Option --url and --connection should imply --remote."Brent Baude2022-03-01
|/ | | | | | This reverts commit ca980c2e024bd33f4be3a33bb1dbb22c86bfe072. Signed-off-by: Brent Baude <bbaude@redhat.com>
* Merge pull request #13357 from ↵OpenShift Merge Robot2022-02-28
|\ | | | | | | | | Romain-Geissler-1A/backport-connection-implies-remote Option --url and --connection should imply --remote.
| * Option --url and --connection should imply --remote.Romain Geissler2022-02-26
|/ | | | | | Closes #13242 Signed-off-by: Romain Geissler <romain.geissler@amadeus.com>
* Merge pull request #13329 from mheon/bump_401OpenShift Merge Robot2022-02-23
|\ | | | | Bump to v4.0.1
| * Bump to v4.0.2-devMatthew Heon2022-02-23
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Bump to v4.0.1v4.0.1Matthew Heon2022-02-23
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Update release notes for v4.0.1Matthew Heon2022-02-23
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Fix a potential flake in volume plugins testsMatthew Heon2022-02-23
| | | | | | | | | | | | | | | | | | We could remove the container running the volume plugins, before the containers using the volume plugins; this could cause unmounting the volumes to fail because the plugin could not be contacted. Signed-off-by: Matthew Heon <mheon@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-22 05:49:42 +0000