summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* auto updatesValentin Rothberg2020-03-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support to auto-update containers running in systemd units as generated with `podman generate systemd --new`. `podman auto-update` looks up containers with a specified "io.containers.autoupdate" label (i.e., the auto-update policy). If the label is present and set to "image", Podman reaches out to the corresponding registry to check if the image has been updated. We consider an image to be updated if the digest in the local storage is different than the one of the remote image. If an image must be updated, Podman pulls it down and restarts the container. Note that the restarting sequence relies on systemd. At container-creation time, Podman looks up the "PODMAN_SYSTEMD_UNIT" environment variables and stores it verbatim in the container's label. This variable is now set by all systemd units generated by `podman-generate-systemd` and is set to `%n` (i.e., the name of systemd unit starting the container). This data is then being used in the auto-update sequence to instruct systemd (via DBUS) to restart the unit and hence to restart the container. Note that this implementation of auto-updates relies on systemd and requires a fully-qualified image reference to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If we used an image ID, we would not know which image to check/pull anymore. Fixes: #3575 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* pkg/systemd: add dbus supportValentin Rothberg2020-03-17
| | | | | | | Move the dbus-connection code from libpod's healthcheck to pkg/systemd to allow for sharing the logic. Needed for the auto-updates work. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #5252 from QiWang19/not-reset-tempdirOpenShift Merge Robot2020-03-16
|\ | | | | Fix bug podman reset to not remove $XDG_RUNTIME_DIR
| * Fix bug podman reset to not remove $XDG_RUNTIME_DIRQi Wang2020-03-05
| | | | | | | | | | | | In some older systems we point the temporary directory to /run/user/1000 which leads podman system reset to clear unrelated files under XDG_RUNTIME_DIR. This patch only removes files created by podman if TmpDir is the same as the XDG_RUNTIME_DIR. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | Merge pull request #5469 from giuseppe/no-size-create-containerOpenShift Merge Robot2020-03-12
|\ \ | | | | | | create: do not calculate image size
| * | create: do not calculate image sizeGiuseppe Scrivano2020-03-12
| | | | | | | | | | | | | | | | | | | | | calculating the image size can be an expensive operation. Avoid doing it when creating a new container since the size is not needed. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Follow up changes from #5244Abhijeet Kasurde2020-03-12
| | | | | | | | | | | | | | | | | | | | | | | | Code review change suggested by jwhonce in https://github.com/containers/libpod/pull/5244#pullrequestreview-366574431 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* | | update systemd & dbus dependenciesValentin Rothberg2020-03-10
| | | | | | | | | | | | | | | | | | | | | | | | Update the outdated systemd and dbus dependencies which are now provided as go modules. This will further tighten our dependencies and releases and pave the way for the upcoming auto-update feature. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #5307 from QiWang19/security-opt-genkubeOpenShift Merge Robot2020-03-09
|\ \ \ | | | | | | | | fix security-opt generate kube
| * | | fix security-opt generate kubeQi Wang2020-03-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | fix #4950 add selinux options from --security-opt of the container to generate kube result Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | Revert "exec: get the exit code from sync pipe instead of file"Matthew Heon2020-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4b72f9e4013411208751df2a92ab9f322d4da5b2. Continues what began with revert of d3d97a25e8c87cf741b2e24ac01ef84962137106 in previous commit. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Revert "Exec: use ErrorConmonRead"Matthew Heon2020-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit d3d97a25e8c87cf741b2e24ac01ef84962137106. This does not resolve the issues we expected it would, and has some unexpected side effects with the upcoming exec rework. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Revert "exec: fix error code when conmon fails"Matthew Heon2020-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4632b81c81a73025a960e339f40bc805f8a6c70a. We are reverting #5373 as well, which lays the foundation for this commit, so it has to go as well. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #5412 from rhatdan/tmpdirOpenShift Merge Robot2020-03-08
|\ \ \ \ | | | | | | | | | | Allow users to set TMPDIR environment
| * | | | Allow users to set TMPDIR environmentDaniel J Walsh2020-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some users have small /var/tmp directories and need to be able to specify a different location for temporary files, which includes more space. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | Fix spelling mistakes in code found by codespellDaniel J Walsh2020-03-07
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | add default network for apiv2 createBrent Baude2020-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | during container creation, if no network is provided, we need to add a default value so the container can be later started. use apiv2 container creation for RunTopContainer instead of an exec to the system podman. RunTopContainer now also returns the container id and an error. added a libpod commit endpoint. also, changed the use of the connections and bindings slightly to make it more convenient to write tests. Fixes: 5366 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | | vendor: update github.com/containernetworking/cni to ↵Dan Williams2020-03-06
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | v0.7.2-0.20200304161608-4fae32b84921 Specifically to get: https://github.com/containernetworking/cni/pull/735 6f29b0165883b2b52ccd4dcb937162ea4c86927b intercept netplugin std err But also pulls in some interface name validation and a compatibility fix for configurations that don't set a CNI version. Signed-off-by: Dan Williams <dcbw@redhat.com>
* | / / golangci: enable goimportsValentin Rothberg2020-03-05
| |/ / |/| | | | | | | | | | | | | | Enable the goimports linter and fix reports. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | exec: fix error code when conmon failsPeter Hunt2020-03-04
| | | | | | | | | | | | | | | | | | this is a cosmetic change that makes sure podman returns a sane error code when conmon dies underneath it Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | Exec: use ErrorConmonReadPeter Hunt2020-03-03
| | | | | | | | | | | | | | | | | | | | | | | | Before, we were using -1 as a bogus value in podman to signify something went wrong when reading from a conmon pipe. However, conmon uses negative values to indicate the runtime failed, and return the runtime's exit code. instead, we should use a bogus value that is actually bogus. Define that value in the define package as MinInt32 (-1<< 31 - 1), which is outside of the range of possible pids (-1 << 31) Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | exec: get the exit code from sync pipe instead of filePeter Hunt2020-03-03
| |/ |/| | | | | | | | | | | | | Before, we were getting the exit code from the file, in which we waited an arbitrary amount of time (5 seconds) for the file, and segfaulted if we didn't find it. instead, we should be a bit more certain conmon has sent the exit code. Luckily, it sends the exit code along the sync pipe fd, so we can read it from there Adapt the ExecContainer interface to pass along a channel to get the pid and exit code from conmon, to be able to read both from the pipe Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | Merge pull request #5206 from rhatdan/capabilitiesOpenShift Merge Robot2020-03-03
|\ \ | | | | | | Allow devs to set labels in container images for default capabilities.
| * | Allow devs to set labels in container images for default capabilities.Daniel J Walsh2020-03-02
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows users to specify the list of capabilities required to run their container image. Setting a image/container label "io.containers.capabilities=setuid,setgid" tells podman that the contained image should work fine with just these two capabilties, instead of running with the default capabilities, podman will launch the container with just these capabilties. If the user or image specified capabilities that are not in the default set, the container will print an error message and will continue to run with the default capabilities. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #5363 from mheon/add_ctr_validateOpenShift Merge Robot2020-03-02
|\ \ | |/ |/| Add validate() for containers
| * Add validate() for containersMatthew Heon2020-03-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until now, we've been validating every part of container configuration through the With... functions that set the options. This if fine when we are just validating the options to an individual function, but things get complicated once we need to validate conflicts between different options. We don't know the order in which things were passed, so we need the validation on both of the potential options that can conflict, resulting in significant code duplication. To solve this, add a validate() function for containers, and use this to check whether everything is in a good state. We can probably move more into this function (there are other parts of container creation that also do validation of a sort) but this is a good start to simplifying our options. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #5347 from baude/apiv2waitOpenShift Merge Robot2020-03-02
|\ \ | | | | | | rework apiv2 wait endpoint|binding
| * | rework apiv2 wait endpoint|bindingBrent Baude2020-02-28
| | | | | | | | | | | | | | | | | | | | | | | | added the ability to wait on a condition (stopped, running, paused...) for a container. if a condition is not provided, wait will default to the stopped condition which uses the original wait code paths. if the condition is stopped, the container exit code will be returned. also, correct a mux issue we discovered. Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | Merge pull request #5320 from sujil02/podtestOpenShift Merge Robot2020-03-02
|\ \ \ | |_|/ |/| | Add test to validate prune pod apiv2 binding.
| * | Update pod bindings and Add test to validate prune pod apiv2 binding.Sujil022020-02-28
| | | | | | | | | | | | | | | | | | | | | | | | Modify the pod inspect bindings to hold current pod status. Includes test to validate on pod status and added test to check no or few pods are pruned,if the pods are in exited state. Signed-off-by: Sujil02 <sushah@redhat.com>
* | | Merge pull request #5349 from mheon/ensure_exec_suppgroupsOpenShift Merge Robot2020-02-28
|\ \ \ | | | | | | | | Ensure that exec sessions inherit supplemental groups
| * | | Ensure that exec sessions inherit supplemental groupsMatthew Heon2020-02-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This corrects a regression from Podman 1.4.x where container exec sessions inherited supplemental groups from the container, iff the exec session did not specify a user. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #5244 from Akasurde/i4962OpenShift Merge Robot2020-02-28
|\ \ \ \ | |_|_|/ |/| | | Add cmd flag to show container name in log
| * | | Review commentsAbhijeet Kasurde2020-02-19
| | | | | | | | | | | | | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
| * | | [WIP] Add cmd flag to show container name in logAbhijeet Kasurde2020-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This flag allows user to show container name in podman log command Fixes: #4962 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* | | | binding tests for volumesBrent Baude2020-02-27
| |/ / |/| | | | | | | | | | | | | | | | | | | | add binding tests for volumes: inspect(get), create, remove, prune, and list implement filters ability for volumes Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | Add support for multiple CNI networks in podman inspectMatthew Heon2020-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When inspecting containers, info on CNI networks added to the container by name (e.g. --net=name1) should be displayed separately from the configuration of the default network, in a separate map called Networks. This patch adds this separation, improving our Docker compatibility and also adding the ability to see if a container has more than one IPv4 and IPv6 address and more than one MAC address. Fixes #4907 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Add basic deadlock detection for container start/removeMatthew Heon2020-02-24
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | We can easily tell if we're going to deadlock by comparing lock IDs before actually taking the lock. Add a few checks for this in common places where deadlocks might occur. This does not yet cover pod operations, where detection is more difficult (and costly) due to the number of locks being involved being higher than 2. Also, add some error wrapping on the Podman side, so we can tell people to use `system renumber` when it occurs. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #5213 from mheon/remove_db_imagevolOpenShift Merge Robot2020-02-21
|\ \ | | | | | | Remove ImageVolumes from database
| * | Remove ImageVolumes from databaseMatthew Heon2020-02-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before Libpod supported named volumes, we approximated image volumes by bind-mounting in per-container temporary directories. This was handled by Libpod, and had a corresponding database entry to enable/disable it. However, when we enabled named volumes, we completely rewrote the old implementation; none of the old bind mount implementation still exists, save one flag in the database. With nothing remaining to use it, it has no further purpose. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | Merge pull request #5263 from baude/logsizeOpenShift Merge Robot2020-02-21
|\ \ \ | | | | | | | | implement reverse reader for log reads
| * | | implement reverse reader for log readsBrent Baude2020-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in cases where the log file exceeds the available memory of a system, we had a bug that triggered an oom because the entire logfile was being read when the tail parameter was given. this reads in chunks and is more or less memory safe. fixes: #5131 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | Merge pull request #5236 from marusak/filter_by_idOpenShift Merge Robot2020-02-21
|\ \ \ \ | |_|/ / |/| | | apiv2: Image filtering and fixup docs
| * | | apiv2: Enable filtering images by IDMatej Marusak2020-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | It is more practical for API usage and also it is more in sync how filtering of containers works. Signed-off-by: Matej Marusak <mmarusak@redhat.com>
* | | | Merge pull request #5271 from baude/dnsnameusernsOpenShift Merge Robot2020-02-21
|\ \ \ \ | | | | | | | | | | populate resolv.conf with dnsname responses when in usernamespace
| * | | | populate resolv.conf with dnsname responses when in usernamespaceBrent Baude2020-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when using usernamespace, dnsname respondes from cni were not making it into the containers /etc/resolv.conf because of a timing issue. this corrects that behavior. Fixes: #5256 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | | podman images: add --filter=since=XXEd Santiago2020-02-20
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Looks like a bit of a misunderstanding from early on. Docker implements --filter=since=IMAGE. Podman implements 'after' instead of 'since'. Add an equivalent case statement to handle both, keeping 'after' because we have no way of knowing if it is used in the field. Update documentation ... and fix what looks like a complete misinterpretation of what the code actually does: the man page claimed that these were time fields, but I don't see any possible incantation in which a time value works or could work. Updated docs to reflect IMAGE usage. Also changed nonworking '==' to single '='. Added tests. [UPDATE: skip with broken podman-remote] Fixes: #5040 Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #5241 from mheon/pod_network_opts_addOpenShift Merge Robot2020-02-20
|\ \ \ \ | | | | | | | | | | Add network opts to pods
| * | | | Add network options to podman pod createMatthew Heon2020-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables most of the network-related functionality from `podman run` in `podman pod create`. Custom CNI networks can be specified, host networking is supported, DNS options can be configured. Also enables host networking in `podman play kube`. Fixes #2808 Fixes #3837 Fixes #4432 Fixes #4718 Fixes #4770 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | Add ability for pods to use the host networkMatthew Heon2020-02-17
| | |_|/ | |/| | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-26 22:42:37 +0000