aboutsummaryrefslogtreecommitdiff
path: root/cmd/podman/common
Commit message (Collapse)AuthorAge
* podman ssh work, using new c/common interfaceCharlie Doern2022-08-09
| | | | | | | | | | | | | | | | | | | implement new ssh interface into podman this completely redesigns the entire functionality of podman image scp, podman system connection add, and podman --remote. All references to golang.org/x/crypto/ssh have been moved to common as have native ssh/scp execs and the new usage of the sftp package. this PR adds a global flag, --ssh to podman which has two valid inputs `golang` and `native` where golang is the default. Users should not notice any difference in their everyday workflows if they continue using the golang option. UNLESS they have been using an improperly verified ssh key, this will now fail. This is because podman was incorrectly using the ssh callback method to IGNORE the ssh known hosts file which is very insecure and golang tells you not yo use this in production. The native paths allows for immense flexibility, with a new containers.conf field `SSH_CONFIG` that specifies a specific ssh config file to be used in all operations. Else the users ~/.ssh/config file will be used. podman --remote currently only uses the golang path, given its deep interconnection with dialing multiple clients and urls. My goal after this PR is to go back and abstract the idea of podman --remote from golang's dialed clients, as it should not be so intrinsically connected. Overall, this is a v1 of a long process of offering native ssh, and one that covers some good ground with podman system connection add and podman image scp. Signed-off-by: Charlie Doern <cdoern@redhat.com>
* Add support for creating sigstore signatures, and providing passphrasesMiloslav Trmač2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Allow creating sigstore signatures via --sign-by-sigstore-private-key . Like existing --sign-by, it does not work remote (in this case because we would have to copy the private key to the server). - Allow passing a passphrase (which is mandatory for sigstore private keys) via --sign-passphrase-file; if it is not provided, prompt interactively. - Also, use that passphrase for --sign-by as well, allowing non-interactive GPG use. (But --sign-passphrase-file can only be used with _one of_ --sign-by and --sign-by-sigstore-private-key.) Note that unlike the existing code, (podman build) does not yet implement sigstore (I'm not sure why it needs to, it seems not to push images?) because Buildah does not expose the feature yet. Also, (podman image sign) was not extended to support sigstore. The test for this follows existing (podman image sign) tests and doesn't work rootless; that could be improved by exposing a registries.d override option. The test for push is getting large; I didn't want to start yet another registry container, but that would be an alternative. In the future, Ginkgo's Ordered/BeforeAll would allow starting a registry once and using it for two tests. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* resource limits for podsCharlie Doern2022-07-21
| | | | | | | | | | | | | | | | | | added the following flags and handling for podman pod create --memory-swap --cpuset-mems --device-read-bps --device-write-bps --blkio-weight --blkio-weight-device --cpu-shares given the new backend for systemd in c/common, all of these can now be exposed to pod create. most of the heavy lifting (nearly all) is done within c/common. However, some rewiring needed to be done here as well! Signed-off-by: Charlie Doern <cdoern@redhat.com>
* Merge pull request #14904 from giuseppe/move-to-subcgroup-in-a-containeropenshift-ci[bot]2022-07-13
|\ | | | | abi: create new cgroup when running in a container
| * podman: always call into SetupRootlessGiuseppe Scrivano2022-07-13
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Docker uses "-c" to mean "--cpu-shares" in create and runDaniel J Walsh2022-07-12
|/ | | | | | | Add support for -c as an alias for --cpu-shares to be compatible with Docker. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* improve pull-policy documentationValentin Rothberg2022-07-08
| | | | | | | | | | | | Make sure that the docs for pull policies is consistent with Buildah and reflects the implementation. Further improve the help messages and auto completions. [NO NEW TESTS NEEDED] Fixes: #14846 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Merge pull request #14501 from cdoern/podUTSopenshift-ci[bot]2022-07-06
|\ | | | | podman pod create --uts support
| * podman pod create --uts supportcdoern2022-07-05
| | | | | | | | | | | | | | | | | | | | | | | | add support for the --uts flag in pod create, allowing users to avoid issues with default values in containers.conf. uts follows the same format as other namespace flags: --uts=private (default), --uts=host, --uts=ns:PATH resolves #13714 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | Fix podman pod unpaue TODOUrvashi Mohnani2022-07-05
|/ | | | | | | | | | | Update the podman pod unpause to only show the paused containers with autocomplete. Fix a typo in the help command. Update the unpause function to only attempt an unpause on pasued pods instead of all the pods. Update the tests accordingly. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* podman pod create --memoryCharlie Doern2022-07-01
| | | | | | | | using the new resource backend, implement podman pod create --memory which enables users to modify memory.max inside of the parent cgroup (the pod), implicitly impacting all children unless overriden Signed-off-by: Charlie Doern <cdoern@redhat.com>
* cmd/podman: switch to golang native error wrappingSascha Grunert2022-06-30
| | | | | | | We now use the golang error wrapping format specifier `%w` instead of the deprecated github.com/pkg/errors package. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
* Merge pull request #14659 from eriksjolund/setup_to_set_up_in_codeopenshift-ci[bot]2022-06-21
|\ | | | | [CI:DOCS] "setup" -> "set up" in source code comments
| * [CI:DOCS] "setup" -> "set up" in source code commentsErik Sjölund2022-06-19
| | | | | | | | | | | | | | * Replace "setup", "lookup" with "set up", "look up" when used as verbs. Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
* | podman pod create --shm-sizecdoern2022-06-20
|/ | | | | | | | | expose the --shm-size flag to podman pod create and add proper handling and inheritance for the option. resolves #14609 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* Merge pull request #14299 from cdoern/podCloneopenshift-ci[bot]2022-06-16
|\ | | | | implement podman pod clone
| * podman pod clonecdoern2022-06-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement podman pod clone, a command to create an exact copy of a pod while changing certain config elements current supported flags are: --name change the pod name --destroy remove the original pod --start run the new pod on creation and all infra-container related flags from podman pod create (namespaces etc) resolves #12843 Signed-off-by: cdoern <cdoern@redhat.com>
* | golangci-lint: enable nolintlintPaul Holzinger2022-06-14
|/ | | | | | | | | | The nolintlint linter does not deny the use of `//nolint` Instead it allows us to enforce a common nolint style: - force that a linter name must be specified - do not add a space between `//` and `nolint` - make sure nolint is only used when there is actually a problem Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #14539 from Luap99/completion5OpenShift Merge Robot2022-06-09
|\ | | | | shell completion: fix problems with container path completion
| * shell completion: fix problems with container path completionPaul Holzinger2022-06-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When you try to complete a path which exists and it is a file the completion logic did not check the parent dir for other matching file names. To fix that we have to check if the current completion is not a dir and use the parent dir in this case. See the updated test for an example why this is required. Also make sure directories are correctly completed, the shell always adds the "/" as suffix to signal the user that this path is a directory. In this case we do not want to automatically add a space. When the path is a regular file we want the space after the suggestion since there is nothing more to complete. This better matches the normal default shell completion. The test were changed to not assume any particular ordering since this is irrelevant for the shell completion script and there is no guarantee about the ordering. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | compat api: fix regressions from "Swagger refactor/cleanup"Paul Holzinger2022-06-09
|/ | | | | | | | | | | | | | | | | | | | For some reason commit 5b79cf15a022 moved the container create options parsing from cmd/podman/common to pkg/api/handlers. However it did not remove the old code. Unfortunately it moved the code from an outdated version and did not update it before this commit was merged. Therefore a couple of regressions were introduced. I manually compared both versions and found three missing bugfixes. I fixed the network test again that was changed in bce97a3b5dd1. We want bridge as default even as rootless. Sine the test is not run as rootless in CI the regression was not caught. Also the no hosts test never worked since it was missing the import check if the hosts file exists. I don't think we can check for the volume parsing change since this only works on windows/wsl. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* changed megabyte to mebibyteKarthik Elango2022-06-02
| | | | | | | | In podman run --help, the message said megabyte, gigabyte, etc. In reality podman takes mebibytes, gibibytes, etc. [CI:DOCS] Signed-off-by: Karthik Elango <kelango@redhat.com>
* Merge pull request #14457 from Luap99/completion4OpenShift Merge Robot2022-06-02
|\ | | | | shell completion for paths inside the image/container
| * shell completion for paths inside the image/containerPaul Holzinger2022-06-02
| | | | | | | | | | | | | | | | | | | | | | | | | | Add shell completion for paths inside the container or image. Currently podman run IMAGE [TAB] only uses the default shell completion which suggests paths on the host. This is fine for some cases but often the user wants a path which only exists in the image/container. This commits adds support for that. Both podman create/run can now complete the paths from the image, podman cp ctr:... now completes paths from the actual container. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Support setting image_volume_mode in containers.confDaniel J Walsh2022-05-26
|/ | | | | | Fixes: https://github.com/containers/podman/issues/14230 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix codespell errorsDaniel J Walsh2022-05-25
| | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #14330 from Luap99/completion3OpenShift Merge Robot2022-05-24
|\ | | | | cmd/podman/common/completion.go: fix FIXMEs
| * cmd/podman/common/completion.go: fix FIXMEsPaul Holzinger2022-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no good way to recommend labels for podman container runlabel. Add the missing max-size log option. These are the only documented options so the completion should not suggest something different. Add proper --stop-signal completion. It will now complete all supported signal names both upper and lowercase depending on the user input. Also it work with and without the SIG prefix. Fixing the TODOs in this file are more complicated since they describe bigger features. [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | autocomplete `podman search --filter`Valentin Rothberg2022-05-24
|/ | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Merge pull request #14263 from Luap99/completionOpenShift Merge Robot2022-05-23
|\ | | | | shell completion --format: various improvements
| * shell completion --format: add help to function with argsPaul Holzinger2022-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From a template users POV it is not importent when they use a struct field or method. They only notice the difference when the function requires arguments. So lets be nice and let the user know that this method requires arguments via the help text. This is how it now looks like when the completion descriptions are enabled on bash: ``` $ bin/podman ps --format {{.Created.A {{.Created.AddDate (This is a function and requires 3 arguments) {{.Created.After (This is a function and requires 1 argument) {{.Created.Add (This is a function and requires 1 argument) {{.Created.AppendFormat (This is a function and requires 2 arguments) ``` Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * shell completion --format: support maps and functionsPaul Holzinger2022-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we only support structs in a template string like this: `{{.var1.test.` -> this meams that test must be a struct field on var1. Now with this var1 and test could also be either a map or function which returns a struct. A actual example: `podman container inspect --format {{.NetworkSettings.Networks.netname.` Now we can complete the struct fileds after netname. Note that this cannot complete map keys since they are empty by default, so it is impossible to get them in the completion logic. Also this fixes a panic with embeeded nil structs Fixes #14223 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * shell completion --format: fix embedded struct handlingPaul Holzinger2022-05-18
| | | | | | | | | | | | | | | | | | | | | | | | When a struct is embeeded it is possible that we end up with same names but different types, this results in incorrect completions. The go template logic always preferes the actual field/method name before the one from the embedded one. Thefore the completion logic should do the same. First get all method/fields names from the struct and then only add the field names from the embedded struct when they are not already present in the list. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * shell completion --format: only show usable methodsPaul Holzinger2022-05-18
| | | | | | | | | | | | | | | | In a template you cann call function that are defined on a type, however this is only useful if they return one value. If it returns more than one the template cannot know what value it has to display. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * shell completion --format: only show exported fieldsPaul Holzinger2022-05-18
| | | | | | | | | | | | | | go templates only support exported fields, so the completion logic must filter the private fields out. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #14272 from Luap99/completion2OpenShift Merge Robot2022-05-19
|\ \ | | | | | | shell completion: use more constants in the code
| * | shell completion: use more constants instead of duplicating stringsPaul Holzinger2022-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | It is better to just reuse the existing constants instead of duplicating the strings. [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * | shell completion: podman save --format use all valid valuesPaul Holzinger2022-05-19
| | | | | | | | | | | | | | | | | | | | | docker-archive was missing from the completions. To prevent duplication use the same format list as podman save. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * | shell completion: update podman inspect --type optionsPaul Holzinger2022-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add all option that are supported by the podman inspect --type flag to the completions. Also use the same constants instead of duplicating the strings. In order to do this I had to move the definitions into the common package to prevent an import cycle. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * | shell completion: fix podman event --filter valuesPaul Holzinger2022-05-19
| |/ | | | | | | | | | | | | | | The completion suggested incorrect values for `podman events --filter type=` . It should only list types not the event status. Also make sure to use the constants instead of duplicating the strings. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* / linter: enable unconvert linterValentin Rothberg2022-05-19
|/ | | | | | | Detects unneccessary type conversions and helps in keeping the code base cleaner. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* shell completion --format: work with pointer functionsPaul Holzinger2022-05-12
| | | | | | | | | | | The completion logic currently suggest also the functions that are defined for this type. However this did not work correctly when it was defined as pointer to that type on not the actual type. This commit fixes that problem. To test you can compare the difference between `podman stats --format {{.[TAB]` with and without this commit. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* play kube default log driverNiall Crowe2022-05-04
| | | | | | | | | The default log driver is not used when using play kube without --log-driver. The LogDriver function needs to be called in order to use the default log driver. fixes #13781 Signed-off-by: Niall Crowe <nicrowe@redhat.com>
* pod: add exit policiesValentin Rothberg2022-05-02
| | | | | | | | | | | | | | | | | | | | | | | | Add the notion of an "exit policy" to a pod. This policy controls the behaviour when the last container of pod exits. Initially, there are two policies: - "continue" : the pod continues running. This is the default policy when creating a pod. - "stop" : stop the pod when the last container exits. This is the default behaviour for `play kube`. In order to implement the deferred stop of a pod, add a worker queue to the libpod runtime. The queue will pick up work items and in this case helps resolve dead locks that would otherwise occur if we attempted to stop a pod during container cleanup. Note that the default restart policy of `play kube` is "Always". Hence, in order to really solve #13464, the YAML files must set a custom restart policy; the tests use "OnFailure". Fixes: #13464 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* shell completion --format: use anonymous struct field oncePaul Holzinger2022-04-28
| | | | | | | | | | We should not include the anonymous twice in the suggestions. one example is `podman network ls --format {{.` it will also show `{{.Network` but since Network is the actual struct all fields are already shown so there is no need for it to be suggested. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* shell completion --format: work with nil structsPaul Holzinger2022-04-28
| | | | | | | | | | | | | AutocompleteFormat() takes the format struct as argument. Often the structs are deeply nested and contain other structs. Up until now if there was a pointer to a struct the logic was not able to get the field names from that, simply because the pointer was nil. However it is possible to create a new initialized type with reflect.New(). This allows us to complete all struct fields/functions even when there nil pointers. Therefore we can drop the extra initialization which was done by some callers. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* enable gocritic linterPaul Holzinger2022-04-26
| | | | | | | | | | | | | | | | | | | | | | The linter ensures a common code style. - use switch/case instead of else if - use if instead of switch/case for single case statement - add space between comment and text - detect the use of defer with os.Exit() - use short form var += "..." instead of var = var + "..." - detect problems with append() ``` newSlice := append(orgSlice, val) ``` This could lead to nasty bugs because the orgSlice will be changed in place if it has enough capacity too hold the new elements. Thus we newSlice might not be a copy. Of course most of the changes are just cosmetic and do not cause any logic errors but I think it is a good idea to enforce a common style. This should help maintainability. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Implements Windows volume/mount supportJason T. Greene2022-04-25
| | | | | | | Based on WSL2 9p support: remaps windows paths to /mnt/<drive> locations for both podman and Docker API clients. Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Add support for --userns=nomapDaniel J Walsh2022-04-21
| | | | | | | | | | | From a security point of view, it would be nice to be able to map a rootless usernamespace that does not use your own UID within the container. This would add protection against a hostile process escapping the container and reading content in your homedir. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Add missing events to podman-events man pageDaniel J Walsh2022-04-19
| | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-29 16:02:02 +0000