summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* performance fix for podman events with large journaldsbaude2019-08-27
| | | | | | | | | in the case where the host has a large journald, iterating the journal without using a Match is very poor performance. this might be a temporary fix while we figure out why the systemd library does not seem to behave properly. Signed-off-by: baude <bbaude@redhat.com>
* Small optimization - only store exit code when nonzeroMatthew Heon2019-08-27
| | | | | | | JSON optimizes it out in that case anyways, so don't waste cycles doing an Itoa (and Atoi on the decode side). Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Fix container exit code with Journald backendMatthew Heon2019-08-27
| | | | | | | | | | We weren't actually storing this, so we'd lose the exit code for containers run with --rm or force-removed while running if the journald backend for events was in use. Fixes #3795 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Avoid a read-write transaction on DB initMatthew Heon2019-08-05
| | | | | | | | Instead, use a less expensive read-only transaction to see if the DB is ready for use (it probably is), and only fire the expensive RW transaction if absolutely necessary. Signed-off-by: Matthew Heon <mheon@redhat.com>
* Make configuration validation not require a DB commitMatthew Heon2019-08-05
| | | | | | | If there are missing fields, we still require a commit, but that should not happen often. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Remove exec PID files after use to prevent memory leaksMatthew Heon2019-08-05
| | | | | | | | | | | | We have another patch running to do the same for exit files, with a much more in-depth explanation of why it's necessary. Suffice to say that persistent files in tmpfs tied to container CGroups lead to significant memory allocations that last for the lifetime of the file. Based on a patch by Andrea Arcangeli (aarcange@redhat.com). Signed-off-by: Matthew Heon <mheon@redhat.com>
* Use file-based eventer for integration testsMatthew Heon2019-08-05
| | | | | | | | This adds several top-level Podman flags for specifying different events backend types, which are then used in CI. It resolves a number of serious issues with events-based testing. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* get last container eventbaude2019-08-05
| | | | | | | | an internal change in libpod will soon required the ability to lookup the last container event using the continer name or id and the type of event. this pr is in preperation for that need. Signed-off-by: baude <bbaude@redhat.com>
* podman: fix memleak caused by renaming and not deletingMatthew Heon2019-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the exit file If the container exit code needs to be retained, it cannot be retained in tmpfs, because libpod runs in a memcg itself so it can't leave traces with a daemon-less design. This wasn't a memleak detectable by kmemleak for example. The kernel never lost track of the memory and there was no erroneous refcounting either. The reference count dependencies however are not easy to track because when a refcount is increased, there's no way to tell who's still holding the reference. In this case it was a single page of tmpfs pagecache holding a refcount that kept pinned a whole hierarchy of dying memcg, slab kmem, cgropups, unrechable kernfs nodes and the respective dentries and inodes. Such a problem wouldn't happen if the exit file was stored in a regular filesystem because the pagecache could be reclaimed in such case under memory pressure. The tmpfs page can be swapped out, but that's not enough to release the memcg with CONFIG_MEMCG_SWAP_ENABLED=y. No amount of more aggressive kernel slab shrinking could have solved this. Not even assigning slab kmem of dying cgroups to alive cgroup would fully solve this. The only way to free the memory of a dying cgroup when a struct page still references it, would be to loop over all "struct page" in the kernel to find which one is associated with the dying cgroup which is a O(N) operation (where N is the number of pages and can reach billions). Linking all the tmpfs pages to the memcg would cost less during memcg offlining, but it would waste lots of memory and CPU globally. So this can't be optimized in the kernel. A cronjob running this command can act as workaround and will allow all slab cache to be released, not just the single tmpfs pages. rm -f /run/libpod/exits/* This patch solved the memleak with a reproducer, booting with cgroup.memory=nokmem and with selinux disabled. The reason memcg kmem and selinux were disabled for testing of this fix, is because kmem greatly decreases the kernel effectiveness in reusing partial slab objects. cgroup.memory=nokmem is strongly recommended at least for workstation usage. selinux needs to be further analyzed because it causes further slab allocations. The upstream podman commit used for testing is 1fe2965e4f672674f7b66648e9973a0ed5434bb4 (v1.4.4). The upstream kernel commit used for testing is f16fea666898dbdd7812ce94068c76da3e3fcf1e (v5.2-rc6). Reported-by: Michele Baldessari <michele@redhat.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> <Applied with small tweaks to comments> Signed-off-by: Matthew Heon <matthew.heon@pm.me> <Further tweaks to cherry pick into 1.4.2> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #3358 from mheon/use_disk_specOpenShift Merge Robot2019-06-18
|\ | | | | Swap to using the on-disk spec for inspect mounts
| * Swap to using the on-disk spec for inspect mountsMatthew Heon2019-06-18
| | | | | | | | | | | | | | | | | | | | When available, using the on-disk spec will show full mount options in use when the container is running, which can differ from mount options provided in the original spec - on generating the final spec, for example, we ensure that some form of root propagation is set. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3352 from mheon/inspect_config_to_libpodOpenShift Merge Robot2019-06-18
|\ \ | |/ |/| Move the Config portion of Inspect into libpod
| * Move the Config portion of Inspect into libpodMatthew Heon2019-06-17
| | | | | | | | | | | | | | | | While we're at it, rewrite how we populate it. There were several potential segfaults in the optional spec.Process block, and a few fields not being populated correctly versus 'docker inspect'. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | Merge pull request #3257 from weirdwiz/loadOpenShift Merge Robot2019-06-17
|\ \ | | | | | | Add warning while untagging an image podman-load
| * | Add warning while untagging an image podman-loadDivyansh Kamboj2019-06-04
| | | | | | | | | | | | Signed-off-by: Divyansh Kamboj <kambojdivyansh2000@gmail.com>
* | | Merge pull request #3297 from rhatdan/systemdOpenShift Merge Robot2019-06-17
|\ \ \ | |_|/ |/| | Accidently removed /run/lock from systemd mounts
| * | Accidently removed /run/lock from systemd mountsDaniel J Walsh2019-06-11
| | | | | | | | | | | | | | | | | | This is blowing up systemd containers on Ubuntu. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #3348 from vrothberg/kill-errorOpenShift Merge Robot2019-06-17
|\ \ \ | | | | | | | | kill: print ID and state for non-running containers
| * | | stop/kill: inproper state errors: s/in state/is in state/Valentin Rothberg2019-06-17
| | | | | | | | | | | | | | | | Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | kill: print ID and state for non-running containersValentin Rothberg2019-06-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extend kill's error message to include the container's ID and state. This address cases where error messages caused by other containers may confuse users. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | Remove unnecessary var type to fix lint warningLawrence Chan2019-06-14
| | | | | | | | | | | | | | | | Signed-off-by: Lawrence Chan <element103@gmail.com>
* | | | Move installPrefix and etcDir into runtime.goLawrence Chan2019-06-14
| | | | | | | | | | | | | | | | Signed-off-by: Lawrence Chan <element103@gmail.com>
* | | | Improve DESTDIR/PREFIX/ETCDIR handlingLawrence Chan2019-06-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - PREFIX is now passed saved in the binary at build-time so that default paths match installation paths. - ETCDIR is also overridable in a similar way. - DESTDIR is now applied on top of PREFIX for install/uninstall steps. Previously, a DESTDIR=/foo PREFIX=/bar make would install into /bar, rather than /foo/bar. Signed-off-by: Lawrence Chan <element103@gmail.com>
* | | | Add --storage flag to 'podman rm' (local only)Matthew Heon2019-06-13
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This flag switches to removing containers directly from c/storage and is mostly used to remove orphan containers. It's a superior solution to our former one, which attempted removal from storage under certain circumstances and could, under some conditions, not trigger. Also contains the beginning of support for storage in `ps` but wiring that in is going to be a much bigger pain. Fixes #3329. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #3312 from mheon/podman_inspect_fixes_contOpenShift Merge Robot2019-06-13
|\ \ \ | | | | | | | | Further fixes for podman inspect
| * | | Split mount options in inspect furtherMatthew Heon2019-06-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Docker only uses Mode for :z/:Z, so move other options out into a new field. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Make Inspect's mounts struct accurate to DockerMatthew Heon2019-06-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were formerly dumping spec.Mount structs, with no care as to whether it was user-generated or not - a relic of the very early days when we didn't know whether a user made a mount or not. Now that we do, match our output to Docker's dedicated mount struct. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Provide OCI spec path in `podman inspect` outputMatthew Heon2019-06-12
| |/ / | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #3319 from mheon/purge_easyjsonOpenShift Merge Robot2019-06-13
|\ \ \ | | | | | | | | Purge all use of easyjson and ffjson in libpod
| * | | Purge all use of easyjson and ffjson in libpodMatthew Heon2019-06-13
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | We're no longer using either of these JSON libraries, dropped them in favor of jsoniter. We can't completely remove ffjson as c/storage uses it and can't easily migrate, but we can make sure that libpod itself isn't doing anything with them anymore. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | oci: allow to specify what runtimes support JSONGiuseppe Scrivano2019-06-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | add a new configuration `runtime_supports_json` to list what OCI runtimes support the --log-format=json option. If the runtime is not listed here, libpod will redirect stdout/stderr from the runtime process. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | oci: use json formatted errors from the runtimeGiuseppe Scrivano2019-06-13
| | | | | | | | | | | | | | | | | | | | | request json formatted error messages from the OCI runtime so that we can nicely print them. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3305 from giuseppe/slirp-dns-firstOpenShift Merge Robot2019-06-12
|\ \ \ | | | | | | | | rootless: use the slirp4netns builtin DNS first
| * | | rootless: use the slirp4netns builtin DNS firstGiuseppe Scrivano2019-06-12
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | When using slirp4netns, be sure the built-in DNS server is the first one to be used. Closes: https://github.com/containers/libpod/issues/3277 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / / If container is not in correct state podman exec should exit with 126Daniel J Walsh2019-06-12
|/ / | | | | | | | | | | | | | | | | | | | | | | This way a tool can determine if the container exists or not, but is in the wrong state. Since 126 is documeted as: **_126_** if the **_contained command_** cannot be invoked It makes sense that the container would exit with this state. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #3240 from rhatdan/storageoptsOpenShift Merge Robot2019-06-10
|\ \ | | | | | | When you change the storage driver we ignore the storage-options
| * | When you change the storage driver we ignore the storage-optionsDaniel J Walsh2019-06-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The storage driver and the storage options in storage.conf should match, but if you change the storage driver via the command line then we need to nil out the default storage options from storage.conf. If the user wants to change the storage driver and use storage options, they need to specify them on the command line. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #3180 from mheon/inspect_volumesOpenShift Merge Robot2019-06-08
|\ \ \ | |/ / |/| | Begin to break up pkg/inspect
| * | Begin to break up pkg/inspectMatthew Heon2019-06-03
| |/ | | | | | | | | | | | | | | | | | | Let's put inspect structs where they're actually being used. We originally made pkg/inspect to solve circular import issues. There are no more circular import issues. Image structs remain for now, I'm focusing on container inspect. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #2272 from adrianreber/migrationOpenShift Merge Robot2019-06-07
|\ \ | | | | | | Add support to migrate containers
| * | migration: add possibility to restore a container with a new nameAdrian Reber2019-06-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The option to restore a container from an external checkpoint archive (podman container restore -i /tmp/checkpoint.tar.gz) restores a container with the same name and same ID as id had before checkpointing. This commit adds the option '--name,-n' to 'podman container restore'. With this option the restored container gets the name specified after '--name,-n' and a new ID. This way it is possible to restore one container multiple times. If a container is restored with a new name Podman will not try to request the same IP address for the container as it had during checkpointing. This implicitly assumes that if a container is restored from a checkpoint archive with a different name, that it will be restored multiple times and restoring a container multiple times with the same IP address will fail as each IP address can only be used once. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Added support to migrate containersAdrian Reber2019-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds an option to the checkpoint command to export a checkpoint into a tar.gz file as well as importing a checkpoint tar.gz file during restore. With all checkpoint artifacts in one file it is possible to easily transfer a checkpoint and thus enabling container migration in Podman. With the following steps it is possible to migrate a running container from one system (source) to another (destination). Source system: * podman container checkpoint -l -e /tmp/checkpoint.tar.gz * scp /tmp/checkpoint.tar.gz destination:/tmp Destination system: * podman pull 'container-image-as-on-source-system' * podman container restore -i /tmp/checkpoint.tar.gz The exported tar.gz file contains the checkpoint image as created by CRIU and a few additional JSON files describing the state of the checkpointed container. Now the container is running on the destination system with the same state just as during checkpointing. If the container is kept running on the source system with the checkpoint flag '-R', the result will be that the same container is running on two different hosts. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Added helper functions for container migrationAdrian Reber2019-06-03
| |/ | | | | | | | | | | | | | | This adds a couple of function in structure members needed in the next commit to make container migration actually work. This just splits of the function which are not modifying existing code. Signed-off-by: Adrian Reber <areber@redhat.com>
* / Inherit rootless init_path from system libpod.confLawrence Chan2019-06-03
|/ | | | Signed-off-by: Lawrence Chan <element103@gmail.com>
* Merge pull request #2709 from haircommander/journaldOpenShift Merge Robot2019-05-29
|\ | | | | Add libpod journald logging
| * Add --follow to journald ctr loggingPeter Hunt2019-05-28
| | | | | | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
| * Address commentsPeter Hunt2019-05-28
| | | | | | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
| * Implement podman logs with log-driver journaldPeter Hunt2019-05-28
| | | | | | | | | | | | | | | | Add a journald reader that translates the journald entry to a k8s-file formatted line, to be added as a log line Note: --follow with journald hasn't been implemented. It's going to be a larger undertaking that can wait. Signed-off-by: Peter Hunt <pehunt@redhat.com>
| * Added --log-driver and journald loggingPeter Hunt2019-05-28
| | | | | | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | Merge pull request #3188 from giuseppe/fix-join-existing-containersOpenShift Merge Robot2019-05-29
|\ \ | | | | | | rootless: new function to join existing conmon processes
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-18 02:54:52 +0000