summaryrefslogtreecommitdiff
path: root/cmd/podman/common
Commit message (Collapse)AuthorAge
* personality: Add support for setting execution domain.flouthoc2021-08-06
| | | | | | | | | | Execution domains tell Linux how to map signal numbers into signal actions. The execution domain system allows Linux to provide limited support for binaries compiled under other UNIX-like operating systems. Reference: https://man7.org/linux/man-pages/man2/personality.2.html Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* implement init containers in podmanBrent Baude2021-08-04
| | | | | | | | | | | | | | this is the first pass at implementing init containers for podman pods. init containersare made popular by k8s as a way to run setup for pods before the pods standard containers run. unlike k8s, we support two styles of init containers: always and oneshot. always means the container stays in the pod and starts whenever a pod is started. this does not apply to pods restarting. oneshot means the container runs onetime when the pod starts and then is removed. Signed-off-by: Brent Baude <bbaude@redhat.com>
* Merge pull request #11048 from cdoern/heatlhCheckCompatOpenShift Merge Robot2021-07-29
|\ | | | | Fixed Healthcheck formatting, string to []string
| * Fixed Healthcheck formatting, string to []stringcdoern2021-07-28
| | | | | | | | | | | | | | | | | | | | Compat healthcheck tests are of the format []string but podman's were of the format string. Converted podman's to []string at the specgen level since it has the same effect and removed the incorrect parsing of compat healthchecks. fixes #10617 Signed-off-by: cdoern <cdoern@redhat.com>
| * Fixed Healthcheck formatting, string to []stringcdoern2021-07-26
| | | | | | | | | | | | | | | | | | | | Compat healthcheck tests are of the format []string but podman's were of the format string. Converted podman's to []string at the specgen level since it has the same effect and removed the incorrect parsing of compat healthchecks. fixes #10617 Signed-off-by: cdoern <cdoern@redhat.com>
* | command: migrate doesn't move process to cgroupGiuseppe Scrivano2021-07-27
| | | | | | | | | | | | | | | | | | | | | | | | add a new annotation for the "system migrate" command to not move the pause process to a separate cgroup. The operation is not needed since "system migrate" destroys the pause process, so there won't be any process left to move to a cgroup. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Support DeviceCgroupRules to actually get added.Daniel J Walsh2021-07-21
| | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/10302 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Drop podman create --storage-opt container flagDaniel J Walsh2021-07-20
|/ | | | | | | | | | | | | The global flag will work in either location, and this flag just breaks users expectations, and is basically a noop. Also fix global storage-opt so that podman-remote can use it. [NO TESTS NEEDED] Since it would be difficult to test in ci/cd. Fixes: https://github.com/containers/podman/issues/10264 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Handle advanced --network options in podman play kubeDaniel J Walsh2021-06-30
| | | | | | | | Since Podman create/run can support this, so should play. Fixes: https://github.com/containers/podman/issues/10807 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #10774 from vrothberg/registriesOpenShift Merge Robot2021-06-25
|\ | | | | remove `pkg/registries`
| * remove `pkg/registries`Valentin Rothberg2021-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull the trigger on the `pkg/registries` package which acted as a proxy for `c/image/pkg/sysregistriesv2`. Callers should be using the packages from c/image directly, if needed at all. Also make use of libimage's SystemContext() method which returns a copy of a system context, further reducing the risk of unintentionally altering global data. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | fix: swapped volume relabel option valuesXabier Napal2021-06-24
|/ | | | Signed-off-by: Xabier Napal <xabiernapal@pm.me>
* Merge pull request #10591 from mheon/fix_10569OpenShift Merge Robot2021-06-08
|\ | | | | Fix compat create with NetworkMode=default
| * Fix compat create with NetworkMode=defaultMatthew Heon2021-06-07
| | | | | | | | | | | | | | | | | | | | | | The rework of namespace handling for rootless CNI broke this, as CNI networks were being computed incorrectly. Fix handling of CNI networks for the Compat Create REST API for containers, and add a test so we don't regress again. Fixes #10569 Signed-off-by: Matthew Heon <mheon@redhat.com>
* | Merge pull request #10381 from adrianreber/2021-05-18-publishOpenShift Merge Robot2021-06-07
|\ \ | | | | | | Add --publish to container restore
| * | Allow changing of port forward rules on restoreAdrian Reber2021-06-04
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restored containers, until now, had the same port mappings as the original started container. This commit adds the parameter '--publish' to 'podman container restore' with the same semantic as during create/run. With this change it is possible to create a copy from a container with a '--publish' rule and replace the original '--publish' setting with a new one. # podman run -p 2345:8080 container # podman container checkpoint -l --export=dump.tar # podman container restore -p 5432:8080 --import=dump.tar The restored container will now listen on localhost:5432 instead of localhost:2345 as the original created container. Signed-off-by: Adrian Reber <areber@redhat.com>
* / Add parameter to specify checkpoint archive compressionAdrian Reber2021-06-07
|/ | | | | | | | | | | | | | | The checkpoint archive compression was hardcoded to `archive.Gzip`. There have been requests to make the used compression algorithm selectable. There was especially the request to not compress the checkpoint archive to be able to create faster checkpoints when not compressing it. This also changes the default from `gzip` to `zstd`. This change should not break anything as the restore code path automatically handles whatever compression the user provides during restore. Signed-off-by: Adrian Reber <areber@redhat.com>
* Enable port forwarding on hostBrent Baude2021-06-01
| | | | | | | | | | | Using the gvproxy application on the host, we can now port forward from the machine vm on the host. It requires that 'gvproxy' be installed in an executable location. gvproxy can be found in the containers/gvisor-tap-vsock github repo. [NO TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* Add the option of Rootless CNI networking by defaultMatthew Heon2021-05-26
| | | | | | | | | | | | | | | | | | | When the containers.conf field "NetNS" is set to "Bridge" and the "RootlessNetworking" field is set to "cni", Podman will now handle rootless in the same way it does root - all containers will be joined to a default CNI network, instead of exclusively using slirp4netns. If no CNI default network config is present for the user, one will be auto-generated (this also works for root, but it won't be nearly as common there since the package should already ship a config). I eventually hope to remove the "NetNS=Bridge" bit from containers.conf, but let's get something in for Brent to work with. Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #10366 from ashley-cui/secretoptionsOpenShift Merge Robot2021-05-17
|\ | | | | Support uid,gid,mode options for secrets
| * Support uid,gid,mode options for secretsAshley Cui2021-05-17
| | | | | | | | | | | | | | Support UID, GID, Mode options for mount type secrets. Also, change default secret permissions to 444 so all users can read secret. Signed-off-by: Ashley Cui <acui@redhat.com>
* | Several shell completion fixesPaul Holzinger2021-05-17
|/ | | | | | | | | | - fix network filters - add prune filters - pod create --share support comma separated namespaces [NO TESTS NEEDED] Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Move filter parsing to common utilsJakub Guzik2021-05-12
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Merge pull request #10221 from ashley-cui/envsecOpenShift Merge Robot2021-05-07
|\ | | | | Add support for environment variable secrets
| * Add support for environment variable secretsAshley Cui2021-05-06
| | | | | | | | | | | | | | | | Env var secrets are env vars that are set inside the container but not commited to and image. Also support reading from env var when creating a secret. Signed-off-by: Ashley Cui <acui@redhat.com>
* | Merge pull request #10246 from zhangguanzhang/compose-static-ipOpenShift Merge Robot2021-05-06
|\ \ | | | | | | Fixes docker-compose cannot set static ip when use ipam
| * | Fixes docker-compose cannot set static ip when use ipamzhangguanzhang2021-05-06
| | | | | | | | | | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
* | | codespell cleanupDaniel J Walsh2021-05-05
|/ / | | | | | | | | | | [NO TESTS NEEDED] This is just running codespell on podman Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #10185 from rhatdan/volumeOpenShift Merge Robot2021-05-05
|\ \ | | | | | | Add filepath glob support to --security-opt unmask
| * | Add filepath glob support to --security-opt unmaskDaniel J Walsh2021-05-04
| | | | | | | | | | | | | | | | | | | | | | | | Want to allow users to specify --security-opt unmask=/proc/*. This allows us to run podman within podman more securely, then specifing umask=all, also gives the user more flexibilty. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #10220 from giuseppe/rm-volatileOpenShift Merge Robot2021-05-05
|\ \ \ | | | | | | | | podman: set volatile storage flag for --rm containers
| * | | podman: set volatile storage flag for --rm containersGiuseppe Scrivano2021-05-05
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | volatile containers are a storage optimization that disables *sync() syscalls for the container rootfs. If a container is created with --rm, then automatically set the volatile storage flag as anyway the container won't persist after a reboot or machine crash. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / / migrate Podman to containers/common/libimageValentin Rothberg2021-05-05
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Migrate the Podman code base over to `common/libimage` which replaces `libpod/image` and a lot of glue code entirely. Note that I tried to leave bread crumbs for changed tests. Miscellaneous changes: * Some errors yield different messages which required to alter some tests. * I fixed some pre-existing issues in the code. Others were marked as `//TODO`s to prevent the PR from exploding. * The `NamesHistory` of an image is returned as is from the storage. Previously, we did some filtering which I think is undesirable. Instead we should return the data as stored in the storage. * Touched handlers use the ABI interfaces where possible. * Local image resolution: previously Podman would match "foo" on "myfoo". This behaviour has been changed and Podman will now only match on repository boundaries such that "foo" would match "my/foo" but not "myfoo". I consider the old behaviour to be a bug, at the very least an exotic corner case. * Futhermore, "foo:none" does *not* resolve to a local image "foo" without tag anymore. It's a hill I am (almost) willing to die on. * `image prune` prints the IDs of pruned images. Previously, in some cases, the names were printed instead. The API clearly states ID, so we should stick to it. * Compat endpoint image removal with _force_ deletes the entire not only the specified tag. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* / Add podman run --timeout optionDaniel J Walsh2021-04-23
|/ | | | | | | | | This option allows users to specify the maximum amount of time to run before conmon sends the kill signal to the container. Fixes: https://github.com/containers/podman/issues/6412 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Parse slirp4netns net options with compat apiPaul Holzinger2021-04-23
| | | | | | | | | Parse the slirp4netns network options when called via compat api. The options must be extracted from the NetworkMode string. Fixes #10110 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Merge pull request #10099 from Luap99/format-completionOpenShift Merge Robot2021-04-22
|\ | | | | Add go template shell completion for --format
| * Add go template shell completion for --formatPaul Holzinger2021-04-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The --format flags accepts go template strings. I use this often but I consistently forget the field names. This commit adds a way to provide shell completion for the --format flag. It works by automatically receiving the field names with the reflect package from the given struct. This requires almost no maintenance since this ensures that we always use the correct field names. This also works for nested structs. ``` $ podman ps --format "{{.P" {{.Pid}} {{.PIDNS}} {{.Pod}} {{.PodName}} {{.Ports}} ``` NOTE: This only works when you use quotes otherwise the shell does not provide completions. Also this does not work for fish at the moment. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Add --group-add keep-groups: suplimentary groups into containerDaniel J Walsh2021-04-21
|/ | | | | | | | | | | | | Currently we have rootless users who want to leak their groups access into containers, but this group access is only able to be pushed in by a hard to find OCI Runtime annotation. This PR makes this option a lot more visable and hides the complexity within the podman client. This option is only really needed for local rootless users. It makes no sense for remote clients, and probably makes little sense for rootfull containers. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* add flag autocompletechenkang2021-04-16
| | | | Signed-off-by: chenkang <kongchen28@gmail.com>
* add flag "--pidfile" for podman create/runwuhua.ck2021-04-16
| | | | Signed-off-by: chenkang <kongchen28@gmail.com>
* Recognize --log-level=traceNalin Dahyabhai2021-04-14
| | | | | | | "trace" is a valid logrus debugging level, so we should be able to tell the library to display messages logged at that level. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* Merge pull request #9935 from EduardoVega/5788-kube-volumeOpenShift Merge Robot2021-04-12
|\ | | | | Add support for play/generate kube PersistentVolumeClaims and Podman volumes
| * Add support for play/generate kube volumesEduardo Vega2021-04-09
| | | | | | | | Signed-off-by: Eduardo Vega <edvegavalerio@gmail.com>
* | Merge pull request #9754 from mheon/add_depOpenShift Merge Robot2021-04-06
|\ \ | |/ |/| Add --requires flag to podman run/create
| * Add --requires flag to podman run/createMatthew Heon2021-04-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Podman has, for a long time, had an internal concept of dependency management, used mainly to ensure that pod infra containers are started before any other container in the pod. We also have the ability to recursively start these dependencies, which we use to ensure that `podman start` on a container in a pod will not fail because the infra container is stopped. We have not, however, exposed these via the command line until now. Add a `--requires` flag to `podman run` and `podman create` to allow users to manually specify dependency containers. These containers must be running before the container will start. Also, make recursive starting with `podman start` default so we can start these containers and their dependencies easily. Fixes #9250 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | podman machine shell completionPaul Holzinger2021-03-31
| | | | | | | | | | | | | | | | | | | | Add shell completion for machine names. [NO TESTS NEEDED] I would like to add one to the shell completion test however using podman machine init is to expensive. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Document --volume from podman-remote run/create clientDaniel J Walsh2021-03-30
|/ | | | | | | | | | | [NO TESTS NEEDED] This PR is mainly documentation and some code cleanup. Also cleanup and consolidate handling of other hanlding of podman-remote hidden options. Fixes: https://github.com/containers/podman/issues/9874 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Improvements for machinebaude2021-03-25
| | | | | | clean up ci failures and add appropriate arch,os exclusion tags Signed-off-by: baude <bbaude@redhat.com>
* Do not leak libpod package into the remote clientPaul Holzinger2021-03-15
| | | | | | | | | | | | | | | | | | Some packages used by the remote client imported the libpod package. This is not wanted because it adds unnecessary bloat to the client and also causes problems with platform specific code(linux only), see #9710. The solution is to move the used functions/variables into extra packages which do not import libpod. This change shrinks the remote client size more than 6MB compared to the current master. [NO TESTS NEEDED] I have no idea how to test this properly but with #9710 the cross compile should fail. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Compat API: Avoid trying to create volumes if they already existPablo Greco2021-03-08
| | | | | | Fixes commit: 53d22c779c5d2df5ccda5a8e23db0501a0dadf44 Signed-off-by: Pablo Greco <pgreco@centosproject.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-01 03:32:46 +0000