summaryrefslogtreecommitdiff
path: root/libpod/oci.go
Commit message (Collapse)AuthorAge
* Remove SELinux transition rule after conmon is started.Daniel J Walsh2018-06-06
| | | | | | | | | | | | We have an issue where iptables command is being executed by podman and attempted to run with a different label. This fix changes podman to only change the label on the conmon command and then set the SELinux interface back to the default. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #906 Approved by: giuseppe
* Catch does not exist errorDaniel J Walsh2018-05-31
| | | | | | | | | | There was a new line at the end of does not exist which was causing this to fail. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #863 Approved by: baude
* We need to change the SELinux label of the conmon process to s0Daniel J Walsh2018-05-31
| | | | | | | | | | | | | If SELinux is enabled, we are leaking in pipes into the container owned by conmon. The container processes are not allowed to use these pipes, if the calling process is fully ranged. By changing the level of the conmon process to s0, this allows container processes to use the pipes. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #854 Approved by: mheon
* Use container cleanup() functions when removingMatthew Heon2018-05-17
| | | | | | | | | | | | Instead of manually calling the individual functions that cleanup uses to tear down a container's resources, just call the cleanup function to make sure that cleanup only needs to happen in one place. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #790 Approved by: rhatdan
* Place Conmon and Container in separate CGroupsMatthew Heon2018-05-11
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #507 Approved by: baude
* Add --cgroup-manager flag to Podman binaryMatthew Heon2018-05-11
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #507 Approved by: baude
* Major fixes to systemd cgroup handlingMatthew Heon2018-05-11
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #507 Approved by: baude
* Should not error out if container no longer exists in ociDaniel J Walsh2018-05-04
| | | | | | | | | | This prevents you from cleaning up the container database, if some how runc and friends db gets screwed up. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #725 Approved by: mheon
* podman, userNS: configure an intermediate mount namespaceGiuseppe Scrivano2018-05-04
| | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #690 Approved by: mheon
* Prevent a potential race when stopping containersMatthew Heon2018-04-04
| | | | | | | | | | | If sending a signal fails, check if the container is alive. If it is not, it probably stopped on its own before we could send the signal, so don't error out. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #591 Approved by: rhatdan
* podman: new option --conmon-pidfile=Giuseppe Scrivano2018-03-29
| | | | | | | | | | | | | | | | | | | so that it is possible to use systemd to automatically restart the container: [Service] Type=forking PIDFile=/run/awesome-service.pid ExecStart=/usr/bin/podman run --conmon-pidfile=/run/awesome-service.pid --name awesome -d IMAGE /usr/bin/do-something ExecStopPost=/usr/bin/podman rm awesome Restart=always Closes: https://github.com/projectatomic/libpod/issues/534 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #549 Approved by: rhatdan
* Include error in error messageMatthew Heon2018-03-02
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #438 Approved by: rhatdan
* Instead of erroring on exit file not being found, warnMatthew Heon2018-03-02
| | | | | | | | | | | Erroring can cause us to get into an state where a container which has no exit file cannot be shown in PS, cannot be removed, etc. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #438 Approved by: rhatdan
* Replace usage of runc with runtimeMatthew Heon2018-03-01
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #412 Approved by: baude
* Convert exec session tracking to use a dedicated structMatthew Heon2018-03-01
| | | | | | | | | | | This will behave better if we need to add anything to it at a later date - we can add fields to the struct without breaking existing BoltDB databases. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #412 Approved by: baude
* Handle removing containers with active exec sessionsMatthew Heon2018-03-01
| | | | | | | | | | | | | For containers without --force set, an error will be returned For containers with --force, all pids in the container will be stopped, first with SIGTERM and then with SIGKILL after a timeout (this mimics the behavior of stopping a container). Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #412 Approved by: baude
* Add tracking for exec session IDsMatthew Heon2018-03-01
| | | | | | | | | | | Exec sessions now have an ID generated and assigned to their PID and stored in the database state. This allows us to track what exec sessions are currently active. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #412 Approved by: baude
* Rework exec to enable splitting to retrieve exec PIDMatthew Heon2018-03-01
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #412 Approved by: baude
* Ensure we don't repeatedly poll disk for exit codesMatthew Heon2018-02-20
| | | | | | | | | | | | Change logic for refreshing our state using runc to only poll for conmon exit files when we first transition to the Stopped state. After that, we should already have the exit code stored in the database, so we don't need to look it up again. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #363 Approved by: TomSweeneyRedHat
* Merge pull request #293 from rhatdan/sd_notifyMatthew Heon2018-02-07
|\ | | | | Need to add LISTEN_PID environment variable to conmon command
| * Need to add LISTEN_PID environment variable to conmon commandDaniel J Walsh2018-02-05
| | | | | | | | | | | | | | Without this field then conmon will not pass the proper data down to the OCI Runtime. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Change stop signal default to SIGTERMMatthew Heon2018-02-06
|/ | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com> Closes: #299 Approved by: rhatdan
* Pass NOTIFY_SOCKET and LISTEN_FDS env to OCI RUntime if setDaniel J Walsh2018-02-05
| | | | | | | | | | | | | | In order to have sd_notify from systemd to work in containers we need to pass down the NOTIFY_SOCKET environment variable to the container. LISTEN_FDS, tells the application inside of the container to use socket activation and grab the FDS that are leaked into the container. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #271 Approved by: umohnani8
* Allow users to specify logpathDaniel J Walsh2018-02-03
| | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #135 Approved by: mheon
* libpod/oci.go: Perf issuebaude2018-01-23
| | | | | | | | | | | | Matt Heon and I found that a defer statement was costing podman run dearly. We dont think the defer function was working (nor needed) and was timing out as well. Removing this defer statement decreased podman runtime by 1.5s or more. Signed-off-by: baude <bbaude@redhat.com> Closes: #253 Approved by: baude
* Plumb through the --stop-timeout signal handlingDaniel J Walsh2017-12-20
| | | | | | | | | | | | | podman run/create have the ability to set the stop timeout flag. We need to stop it in the database. Also Allowing negative time for stop timeout makes no sense, so switching to timeout of uint, allows user to specify huge timeout values. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #158 Approved by: TomSweeneyRedHat
* Merge pull request #111 from mheon/crio_1206Daniel J Walsh2017-12-11
|\ | | | | Carry CRI-O #1206 to fix a potential runtime issue
| * Carry CRI-O #1206 to fix a potential runtime issueMatthew Heon2017-12-07
| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | kpod execbaude2017-12-11
|/ | | | | | | | | | | | | | Initial wiring of kpod exec. We wont support the following options for exec: * detach -- unsure of use case * detach-keys -- not supported by runc * interactive -- all terminals will be interactive Not adding exec tests as we need to think about how to support a test that requires console access but our CI tests have no console. Signed-off-by: baude <bbaude@redhat.com>
* Add NetMode, UTSMode and IPCModeDaniel J Walsh2017-12-02
| | | | | | | | | | | | | | Allow kpod create/run to create contianers in different network namespaces, uts namespaces and IPC Namespaces. This patch just handles the simple join the host, or another containers namespaces. Lots more work needed to full integrate --net Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #64 Approved by: mheon
* Change location of created runc specs to make them survive rebootMatthew Heon2017-11-29
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #78 Approved by: rhatdan
* Add ability to kill and stop containersMatthew Heon2017-11-29
| | | | | | | | | | | | | | Also migrates kpod kill and kpod stop to libpod to use the new code Fixes force removing containers, and actually deletes containers in runc when removing them Start is now capable of starting even when the container is unmounted Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #68 Approved by: rhatdan
* Update kpod pause and unpause to use new container stateumohnani82017-11-24
| | | | | | | Signed-off-by: umohnani8 <umohnani@redhat.com> Closes: #66 Approved by: mheon
* Add ability to retrieve container's log path to APIMatthew Heon2017-11-21
| | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #56 Approved by: rhatdan
* Add ability to update container status from runcMatthew Heon2017-11-21
| | | | | | | | | | | | Wire this in to all state-bound container operations to ensure syncronization of container state. Also exposes PID of running containers via API. Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #56 Approved by: rhatdan
* Enhancements to papr testsbaude2017-11-17
| | | | | | | | | | | | | | | The PR contains several enhancements to our CI testing. - enable lint testing on Fedora - add Centos Atomic as test platform - integration tests on run on the OS natively (uncontainerized) - builds are done in containers - inclusion of Vagrant file for local testing Signed-off-by: baude <bbaude@redhat.com> Closes: #18 Approved by: mheon
* Prune Server package. Convert to new github location.Matthew Heon2017-11-01
| | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* Initial checkin from CRI-O repoMatthew Heon2017-11-01
Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-06 05:28:12 +0000