summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Backport rm --storage to Podman 1.0Matthew Heon2019-08-05
| | | | | | | | This amounted to a near-complete rewrite in parts, but in the end is a pretty simple change. The core functionality was already review in #3330. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Remove exec PID files after use to prevent memory leaksMatthew Heon2019-07-18
| | | | | | | | | | | | We have another patch running to do the same for exit files, with a much more in-depth explanation of why it's necessary. Suffice to say that persistent files in tmpfs tied to container CGroups lead to significant memory allocations that last for the lifetime of the file. Based on a patch by Andrea Arcangeli (aarcange@redhat.com). Signed-off-by: Matthew Heon <mheon@redhat.com>
* Avoid a read-write transaction on DB initMatthew Heon2019-06-25
| | | | | | | | Instead, use a less expensive read-only transaction to see if the DB is ready for use (it probably is), and only fire the expensive RW transaction if absolutely necessary. Signed-off-by: Matthew Heon <mheon@redhat.com>
* Make configuration validation not require a DB commitMatthew Heon2019-06-25
| | | | | | | | | If there are missing fields, we still require a commit, but that should not happen often. <Fixed conflicts for backport> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* If container is not in correct state podman exec should exit with 126Daniel J Walsh2019-06-25
| | | | | | | | | | | | | | This way a tool can determine if the container exists or not, but is in the wrong state. Since 126 is documeted as: **_126_** if the **_contained command_** cannot be invoked It makes sense that the container would exit with this state. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> <Fixed conflicts> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* spec: add nosuid,noexec,nodev to ro bind mountGiuseppe Scrivano2019-02-08
| | | | | | | runc fails to change the ro mode of a rootless bind mount if the other flags are not kept. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Preserve exited state across rebootMatthew Heon2019-02-08
| | | | | | | | | | | | | Instead of unconditionally resetting to ContainerStateConfigured after a reboot, allow containers in the Exited state to remain there, preserving their exit code in podman ps after a reboot. This does not affect the ability to use and restart containers after a reboot, as the Exited state can be used (mostly) interchangeably with Configured for starting and managing containers. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* libpod/image: Use RepoDigests() in Inspect()W. Trevor King2019-02-08
| | | | | | | To get the more-robust handling from 0f6535cf (libpod/image: Use ParseNormalizedNamed in RepoDigests, 2019-01-08, #2106) here too. Signed-off-by: W. Trevor King <wking@tremily.us>
* podman image prune -- implement all flagbaude2019-02-08
| | | | | | | | | | | | | | | we now, by default, only prune dangling images. if --all is passed, we prune dangling images AND images that do not have an associated containers. also went ahead and enabled the podman-remote image prune side of things. Fixes: #2192 Signed-off-by: baude <bbaude@redhat.com> MH: Removed dependence on remote-client adapter work to limit scale of changes Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Show a better error message when podman info fails during a refreshRyan Gonzalez2019-02-08
| | | | Signed-off-by: Ryan Gonzalez <rymg19@gmail.com>
* Vendor in latest opencontainers/selinuxDaniel J Walsh2019-02-08
| | | | | | | | | | | This will now verify labels passed in by the user. Will also prevent users from accidently relabeling their homedir. podman run -ti -v ~/home/user:Z fedora sh Is not a good idea. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Do not unmarshal into c.config.SpecMatthew Heon2019-02-08
| | | | | | | | | | | | | We try to keep c.config immutable, but Go doesn't really agree with me that things other than strings and ints can be immutable, so occasionally things like this slip through. When unmarshalling the OCI spec from disk, do it into a separate struct, to ensure we don't make lasting modifications to the spec in the Container struct (which could affect container restart). Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Ensure that wait exits on state transitionMatthew Heon2019-02-08
| | | | | | | | | | | When waiting for a container, there is a long interval between status checks - plenty long enough for the container in question to start, then subsequently be cleaned up and returned to Created state to be restarted. As such, we can't wait on container state to go to Stopped or Exited - anything that is not Running or Paused indicates the container is dead. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Regenerate EasyJSON to fix JSON issuesMatthew Heon2019-01-11
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Revert "Merge pull request #1235 from mheon/shm_locking"Matthew Heon2019-01-10
| | | | | | | This reverts commit bf5f779331870d31863c486619daae3fcea458eb, reversing changes made to 6868b5aa1444404113bc6a4582203fbbf89490c2. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #2134 from containers/revert-2083-shm_locking_fixesMatthew Heon2019-01-10
|\ | | | | Revert "Address lingering review comments from SHM locking PR"
| * Revert "Address lingering review comments from SHM locking PR"Matthew Heon2019-01-10
| |
* | Revert "If you fail to open shm lock then attempt to create it"Matthew Heon2019-01-10
|/
* Merge pull request #2126 from giuseppe/set-prlimitOpenShift Merge Robot2019-01-10
|\ | | | | podman: bump RLIMIT_NOFILE also without CAP_SYS_RESOURCE
| * podman: bump RLIMIT_NOFILE also without CAP_SYS_RESOURCEGiuseppe Scrivano2019-01-10
| | | | | | | | | | | | | | | | | | | | If we are not able to make arbitrary changes to the RLIMIT_NOFILE when lacking CAP_SYS_RESOURCE, don't fail but bump the limit to the maximum allowed. In this way the same code path works with rootless mode. Closes: https://github.com/containers/libpod/issues/2123 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #2114 from vrothberg/issue-2107OpenShift Merge Robot2019-01-10
|\ \ | |/ |/| apparmor: apply default profile at container initialization
| * apparmor: apply default profile at container initializationValentin Rothberg2019-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apply the default AppArmor profile at container initialization to cover all possible code paths (i.e., podman-{start,run}) before executing the runtime. This allows moving most of the logic into pkg/apparmor. Also make the loading and application of the default AppArmor profile versio-indepenent by checking for the `libpod-default-` prefix and over-writing the profile in the run-time spec if needed. The intitial run-time spec of the container differs a bit from the applied one when having started the container, which results in displaying a potentially outdated AppArmor profile when inspecting a container. To fix that, load the container config from the file system if present and use it to display the data. Fixes: #2107 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | libpod/image: Use ParseNormalizedNamed in RepoDigestsW. Trevor King2019-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid generating quay.io/openshift-release-dev/ocp-release@sha256@sha256:239... and similar when the image name is already digest-based [1]. It's not clear exactly how we get into this state, but as shown by the unit tests, the new code handles this case correctly (while the previous code does not). [1]: https://github.com/containers/libpod/issues/2086 Signed-off-by: W. Trevor King <wking@tremily.us> Closes: #2106 Approved by: rhatdan
* | If you fail to open shm lock then attempt to create itDaniel J Walsh2019-01-09
|/ | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #2061 from adrianreber/static-ipOpenShift Merge Robot2019-01-09
|\ | | | | Use existing interface to request IP address during restore
| * Use existing interface to request IP address during restoreAdrian Reber2019-01-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The initial implementation to request the same IP address for a container during a restore was based on environment variables influencing CNI. With this commit the IP address selection switches to Podman's internal static IP API. This commit does a comment change in libpod/container_easyjson.go to avoid unnecessary re-generation of libpod/container_easyjson.go during build as this fails in CI. The reason for this is that make sees that libpod/container_easyjson.go needs to be re-created. The commit, however, only changes a part of libpod/container.go which is marked as 'ffjson: skip'. Signed-off-by: Adrian Reber <areber@redhat.com>
* | hooks: Add pre-create hooks for runtime-config manipulationW. Trevor King2019-01-08
|/ | | | | | | | | | | | | | | | | | | | | | | There's been a lot of discussion over in [1] about how to support the NVIDIA folks and others who want to be able to create devices (possibly after having loaded kernel modules) and bind userspace libraries into the container. Currently that's happening in the middle of runc's create-time mount handling before the container pivots to its new root directory with runc's incorrectly-timed prestart hook trigger [2]. With this commit, we extend hooks with a 'precreate' stage to allow trusted parties to manipulate the config JSON before calling the runtime's 'create'. I'm recycling the existing Hook schema from pkg/hooks for this, because we'll want Timeout for reliability and When to avoid the expense of fork/exec when a given hook does not need to make config changes [3]. [1]: https://github.com/opencontainers/runc/pull/1811 [2]: https://github.com/opencontainers/runc/issues/1710 [3]: https://github.com/containers/libpod/issues/1828#issuecomment-439888059 Signed-off-by: W. Trevor King <wking@tremily.us>
* Add a --workdir option to 'podman exec'Debarshi Ray2019-01-08
| | | | Signed-off-by: Debarshi Ray <rishi@fedoraproject.org>
* Merge pull request #2099 from mheon/config_to_containerconfigOpenShift Merge Robot2019-01-08
|\ | | | | Rename libpod.Config back to ContainerConfig
| * Rename libpod.Config back to ContainerConfigMatthew Heon2019-01-07
| | | | | | | | | | | | | | | | | | | | During an earlier bugfix, we swapped all instances of ContainerConfig to Config, which was meant to fix some data we were returning from Inspect. This unfortunately also renamed a libpod internal struct for container configs. Undo the rename here. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #2078 from rhatdan/config.fileOpenShift Merge Robot2019-01-07
|\ \ | | | | | | Add the configuration file used to setup storage to podman info
| * | Add the configuration file used to setup storage to podman infoDaniel J Walsh2019-01-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users have no idea what storage configuration file is used to setup storage, so adding this to podman info, should make it easier to discover. This requires a revendor of containers/storage Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #2098 from baude/remoteOpenShift Merge Robot2019-01-07
|\ \ \ | |_|/ |/| | Add ability to build golang remote client
| * | Add ability to build golang remote clientbaude2019-01-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the ability to build a remote client in golang that uses all the same front-end cli code and output code. The initial limitations here are that it can only be a local client while the bridge and resolver code is being written for the golang varlink client. Tests and docs will be added in subsequent PRs. Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #2075 from baude/runlabelnameOpenShift Merge Robot2019-01-07
|\ \ \ | | | | | | | | container runlabel NAME implementation
| * | | container runlabel NAME implementationbaude2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when using container runlabel, if a --name is not provided, we must deduce the container name from the base name of the image to maintain parity with the atomic cli. fixed small bug where we split the cmd on " " rather than using fields could lead to extra spaces in command output. Signed-off-by: baude <bbaude@redhat.com>
* | | | Address lingering review comments from SHM locking PRMatthew Heon2019-01-07
| |_|/ |/| | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Rootless with shmlocks was not working.Daniel J Walsh2019-01-05
| | | | | | | | | | | | | | | | | | | | | | | | This patch makes the path unigue to each UID. Also cleans up some return code to return the path it is trying to lock. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Move lock init after tmp dir is populated properlyMatthew Heon2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | Don't initialize the lock manager until almost the end of libpod init, so we can guarantee our tmp dir is properly set up and exists. This wasn't an issue on systems that had previously run Podman, but CI caught it. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | When refreshing libpod, if SHM locks exist, remove themMatthew Heon2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will hopefully help cases where libpod is initialized multiple times on the same system (as on our CI tests). We still run into potential issues where multiple Podmans with multiple tmp paths try to run on the same system - we could end up thrashing the locks. I think we need a file locks driver for situations like that. We can also see about storing paths in the SHM segment, to make sure multiple libpod instances aren't using the same one. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Ensure different error messages and creating/opening locksMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Update unit tests to use in-memory lock managerMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Remove runtime lockDir and add in-memory lock managerMatthew Heon2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | Remove runtime's lockDir as it is no longer needed after the lock rework. Add a trivial in-memory lock manager for unit testing Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Convert pods to SHM locksMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Convert containers to SHM lockingMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Add lock manager to libpod runtimeMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Move to POSIX mutexes for SHM locksMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Disable lint on SHMLock structMatthew Heon2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | Golint wants to rename the struct. I think the name is fine. I can disable golint. Golint will no longer complain about the name. Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Refactor locks package to build on non-LinuxMatthew Heon2019-01-04
| | | | | | | | | | | | | | | | | | | | | | | | Move SHM specific code into a subpackage. Within the main locks package, move the manager to be linux-only and add a non-Linux unsupported build file. Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
* | | Add an SHM-backed Lock Manager implementationMatthew Heon2019-01-04
| | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-03-15 05:11:19 +0000