aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Merge pull request #7399 from rhatdan/v2.0OpenShift Merge Robot2020-08-21
|\ | | | | In podman 1.* regression on --cap-add
| * In podman 1.* regression on --cap-addDaniel J Walsh2020-08-21
|/ | | | | | | | | | | | In podman 1.0 if you executed a command like: podman run --user dwalsh --cap-add net_bind_service alpine nc -l 80 It would work, and the user dwalsh would get the capability, in podman 2.0, only root and the binding set gets the capability. This change restores us back to the way podman 1.0 worked. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #7363 from mheon/lets_try_this_againOpenShift Merge Robot2020-08-21
|\ | | | | Lets try this again: v2.0.5 backports, round 2
| * fix pod creation with "new:" syntax followup + allow hostnamePaul Holzinger2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: 4c75fe3f70ed ("fix pod creation with "new:" syntax") Commit 4c75fe3f70ed passes all net options to the pod but forgot to unset the options for the container creation. This leads to erros when using flags like `--ip` since we tried setting the ip on the pod and container which obviously fails. I didn't notice the bug because we don't throw an error when specifing port bindings on a container which joins the pods network namespace. (#7373) Also allow the use of `--hostname` and pass that option to the pod and unset it for the container. The container has to use the pods hostname anyway. This would error otherwise. Added tests to prevent regression. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * Fix a Makefile issueMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Fix a system test failureMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Fix imports (podman -> libpod for v2.0 branch)Matthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Final set of updates to release notesMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add support for --connectionDaniel J Walsh2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * override --url and/or --identity fields from containers.conf * --connection flag has higher precedence than ActiveService from containers.conf. Which is set via podman system connection default * Add newline to error message printed on stderr * Added --connection to bash completion and documentation * Updated bindings to query server in case of no path or / Closes #jira-991 Fixes #7276 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Signed-off-by: Jhon Honce <jhonce@redhat.com> Squashed commits to work around CI issue <MH: Fixed rebase conflicts on v2.0> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * remove --latest for all remote commandsBrent Baude2020-08-20
| | | | | | | | | | | | | | | | instead of hiding the latest options for podman-remote or catching an error if podman --remote <cmd> -l is used, we no longer add the latest option to any remote command. podman will error with a "unknown flag" option. Fixes: #7127 Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Further release notes updates for v2.0.5Matthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * fix podman create/run UTS NS docsPaul Holzinger2020-08-20
| | | | | | | | | | | | | | | | Add better error message when using `--pod` and `--hostname`. Improve the docs to better explain the uts hostname relation. Add more valid options for the `--uts` flag. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * abi: fix detection for systemdGiuseppe Scrivano2020-08-20
| | | | | | | | | | | | | | | | | | create a scope everytime we don't own the current cgroup and we are running on systemd. Closes: https://github.com/containers/podman/issues/6734 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * fix podman version output to include git commit and builttimePaul Holzinger2020-08-20
| | | | | | | | | | | | Add the go module version v2 to the libpod path. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
| * generate systemd: quote arguments with whitespaceValentin Rothberg2020-08-20
| | | | | | | | | | | | | | | | | | | | | | Make sure that arguments with whitespace are properly quoted so they are interpreted as one (and not multiple ones) by systemd. Now `-e tz="america/new york"` will be generated as `-e "tz=america/new york"`. The quotes are moving but the argument is still correct. Fixes: #7285 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * Unmount c/storage containers before removing themMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When `podman rmi --force` is run, it will remove any containers that depend on the image. This includes Podman containers, but also any other c/storage users who may be using it. With Podman containers, we use the standard Podman removal function for containers, which handles all edge cases nicely, shutting down running containers, ensuring they're unmounted, etc. Unfortunately, no such convient function exists (or can exist) for all c/storage containers. Identifying the PID of a Buildah, CRI-O, or Podman container is extremely different, and those are just the implementations under the containers org. We can't reasonably be able to know if a c/storage container is *in use* and safe for removal if it's not a Podman container. At the very least, though, we can attempt to unmount a storage container before removing it. If it is in use, this will fail (probably with a not-particularly-helpful error message), but if it is not in use but not fully cleaned up, this should make our removing it much more robust than it normally is. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * [WIP] Refactor podman system connectionJhon Honce2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support to manage multiple connections * Add connection * Remove connection * Rename connection * Set connection as default * Add markdown/man pages * Fix recursion in hack/xref-helpmsgs-manpages Signed-off-by: Jhon Honce <jhonce@redhat.com> <MH: Fixed build after rebase> Signed-off-by: Matt Heon <matthew.heon@pm.me>
| * Fix `podman system connection` panicJhon Honce2020-08-20
| | | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
| * Revert "remove podman system connection"Matthew Heon2020-08-20
| | | | | | | | | | | | | | This reverts commit 66e1626282fab661ac12a354f70b3b2221c69d7c. We are reenabling podman-system-connection. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Bump github.com/containers/common to v0.14.7Matthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Fix imports for runtime_img.goMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Fix one import path pointing to containers/podmanMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * HACK: Disable build-each-commitMatthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Ensure DefaultEnvVariables is used in SpecgenMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | When we rewrote Podman's pkg/spec, one of the things that was lost was our use of a set of default environment variables, that ensure all containers have at least $PATH and $TERM set. While we're in the process of re-adding it, change it from a variable to a function, so we can ensure the Join function does not overwrite it and corrupt the defaults. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Update release notes for v2.0.5Matthew Heon2020-08-20
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * [CI:DOCS] BZ1860126 - Fix userns defaults in run man pageTomSweeneyRedHat2020-08-20
| | | | | | | | | | | | | | | | | | | | Addresses the multiple "default" userns values found in the podman-run(1) man page: http://docs.podman.io/en/latest/markdown/podman-run.1.html. This in response to: https://bugzilla.redhat.com/show_bug.cgi?id=1860126 which this PR wil fix. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
| * Unconditionally retrieve pod names via APIMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ListContainers API previously had a Pod parameter, which determined if pod name was returned (but, notably, not Pod ID, which was returned unconditionally). This was fairly confusing, so we decided to deprecate/remove the parameter and return it unconditionally. To do this without serious performance implications, we need to avoid expensive JSON decodes of pod configuration in the DB. The way our Bolt tables are structured, retrieving name given ID is actually quite cheap, but we did not expose this via the Libpod API. Add a new GetName API to do this. Fixes #7214 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Default .Repository and .Tag values to <none>Jhon Honce2020-08-20
| | | | | | | | | | | | | | | | | | | | Refactor the processing of Repository and Tag fields to default to <none> when printing via --format flag. Previously, the default format would print <none> but --format {{.Tag}} would not in some cases. Fixes #7123 Signed-off-by: Jhon Honce <jhonce@redhat.com>
| * Error pass through for more accurate error reportingParker Van Roy2020-08-20
| | | | | | | | | | | | Included old error + wrapped Signed-off-by: Parker Van Roy <pvanroy@redhat.com>
| * Fix handling of working dirDaniel J Walsh2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Buildah and podman build can create images without a working dir. FROM fedora WORKDIR /test If you build this image with caching twice, the second time the image will not have a working dir. Similarly if you execute podman run --workdir /foobar fedora It blows up since the workingdir is not created automatically. Finally there was duplicated code for getting the workingdir out of an image, that this PR removes. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
| * Do not use image CMD if user gave ENTRYPOINTMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This matches Docker behavior, and seems to make sense - the CMD may have been specific to the original entrypoint and probably does not make sense if it was changed. While we're in here, greatly simplify the logic for populating the SpecGen's Command. We create the full command when making the OCI spec, so the client should not be doing any more than setting it to the Command the user passed in, and completely ignoring ENTRYPOINT. Fixes #7115 Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Ensure WORKDIR from images is createdMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent crun change stopped the creation of the container's working directory if it does not exist. This is arguably correct for user-specified directories, to protect against typos; it is definitely not correct for image WORKDIR, where the image author definitely intended for the directory to be used. This makes Podman create the working directory and chown it to container root, if it does not already exist, and only if it was specified by an image, not the user. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Allow specifying seccomp profiles for privileged containersSascha Grunert2020-08-20
| | | | | | | | | | | | | | To sync the behavior between AppArmor and seccomp it is now possible to also specify seccomp profiles for privileged containers. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
| * Use set for systemd commandsChristian Heimes2020-08-20
| | | | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
| * Enable systemd mode for /usr/local/sbin/initChristian Heimes2020-08-20
| | | | | | | | | | | | | | | | | | | | Podman 1.6.2 changed systemd mode auto-detection from commands ending in ``init`` to hard-coded paths ``/sbin/init`` and ``/usr/sbin/init``. This broke FreeIPA container. ``podman run`` and ``podman create`` now activate systemd mode when the command is ``/usr/local/sbin/init``. Fixes: https://github.com/containers/podman/issues/7287 Signed-off-by: Christian Heimes <cheimes@redhat.com>
| * Replace deepcopy on history resultsBrent Baude2020-08-20
| | | | | | | | | | | | | | | | the deepcopy in the remote history code path was throwing an uncaught error on a type mismatch. we now manually do the conversion and fix the type mismatch on the fly. Fixes: #7122 Signed-off-by: Brent Baude <bbaude@redhat.com>
| * Add parameter verification for api creation networkzhangguanzhang2020-08-20
| | | | | | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
| * add event for image buildBrent Baude2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | upon image build completion, a new image type event is written for "build". more intricate details, like pulling an image, that might be done by build must be implemented in different vendored packages only after libpod is split from podman. Fixes: #7022 Signed-off-by: Brent Baude <bbaude@redhat.com> <MH: Fixed imports during cherry-pick> Signed-off-by: Matt Heon <matthew.heon@pm.me>
| * Change /sys/fs/cgroup/systemd mount to rprivateMatthew Heon2020-08-20
| | | | | | | | | | | | | | | | I used the wrong propagation first time around because I forgot that rprivate is the default propagation. Oops. Switch to rprivate so we're using the default. Signed-off-by: Matthew Heon <mheon@redhat.com>
| * podman save use named pipeQi Wang2020-08-20
| | | | | | | | | | | | | | | | | | | | | | podman save uses named pipe as output path, not directly using /dev/stdout. fix #7017 Signed-off-by: Qi Wang <qiwan@redhat.com> <MH: Corrected imports during cherry-pick> Signed-off-by: Matt Heon <matthew.heon@pm.me>
| * Fix hang when `path` doesn't existJonathan Dieter2020-08-20
| | | | | | | | | | | | | | | | | | | | I'm not sure if this is an OS-specific issue, but on CentOS 8, if `path` doesn't exist, this hangs while waiting to read from this socket, even though the socket is closed by the `reexec_in_user_namespace`. Switching to a pipe fixes the problem, and pipes shouldn't be an issue since this is Linux-specific code. Signed-off-by: Jonathan Dieter <jonathan.dieter@spearline.com>
| * podman.service: use sdnotiyValentin Rothberg2020-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 2b6dd3fb4384 set the killmode of the podman.service to the systemd default which ultimately lead to the problem that systemd will kill *all* processes inside the unit's cgroup and hence kill all containers whenever the service is stopped. Fix it by setting the type to sdnotify and the killmode to process. `podman system service` will send the necessary notify messages when the NOTIFY_SOCKET is set and unset it right after to prevent the backend and container runtimes from jumping in between and send messages as well. Fixes: #7294 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * podman support for IPv6 networksAntonio Ojea2020-08-20
| | | | | | | | | | | | | | | | | | | | | | podman containers using IPv6 were missing the default route, breaking deployments trying to use them. The problem is that the default route was hardcoded to IPv4, this takes into consideration the podman subnet IP family to generate the corresponding default route. Signed-off-by: Antonio Ojea <aojea@redhat.com>
* | Merge pull request #7353 from rhatdan/v2.0OpenShift Merge Robot2020-08-20
|\ \ | |/ |/| Cleanup handling of podman mount/unmount
| * Cleanup handling of podman mount/unmountDaniel J Walsh2020-08-20
|/ | | | | | | | | | | We should default to the user name unmount rather then the internal name of umount. Also User namespace was not being handled correctly. We want to inform the user that if they do a mount when in rootless mode that they have to be first in the podman unshare state. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #7356 from vrothberg/2.0-vendor-imageOpenShift Merge Robot2020-08-20
|\ | | | | [2.0] vendor c/image v5.5.2
| * vendor c/image v5.5.2Valentin Rothberg2020-08-20
|/ | | | | | | | Enable pagination until the search result reaches the limit, instead of returning default 100 limit from registry API. BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1866153 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #7381 from baude/v2CIFixOpenShift Merge Robot2020-08-19
|\ | | | | Fix v2.0.x CI
| * Fix v2.0.x CIBrent Baude2020-08-19
|/ | | | | | Fix the Ci for our 2.0.x branch. Signed-off-by: Brent Baude <bbaude@redhat.com>
* Merge pull request #7289 from vrothberg/v2-backportsOpenShift Merge Robot2020-08-11
|\ | | | | V2 backports
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-07 22:31:38 +0000