summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Set base mount options for bind mounts from base systemMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | If I mount, say, /usr/bin into my container - I expect to be able to run the executables in that mount. Unconditionally applying noexec would be a bad idea. Before my patches to change mount options and allow exec/dev/suid being set explicitly, we inferred the mount options from where on the base system the mount originated, and the options it had there. Implement the same functionality for the new option handling. There's a lot of performance left on the table here, but I don't know that this is ever going to take enough time to make it worth optimizing. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Add support for 'exec', 'suid', 'dev' mount flagsMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | Previously, we explicitly set noexec/nosuid/nodev on every mount, with no ability to disable them. The 'mount' command on Linux will accept their inverses without complaint, though - 'noexec' is counteracted by 'exec', 'nosuid' by 'suid', etc. Add support for passing these options at the command line to disable our explicit forcing of security options. This also cleans up mount option handling significantly. We are still parsing options in more than one place, which isn't good, but option parsing for bind and tmpfs mounts has been unified. Fixes: #3819 Fixes: #3803 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #3893 from mheon/readd_volume_locksOpenShift Merge Robot2019-08-28
|\ | | | | Re-add volume locks
| * Re-add locks to volumes.Matthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | This will require a 'podman system renumber' after being applied to get lock numbers for existing volumes. Add the DB backend code for rewriting volume configs and use it for updating lock numbers as part of 'system renumber'. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3728 from mheon/systemd_container_testOpenShift Merge Robot2019-08-28
|\ \ | | | | | | Add an integration test for systemd in a container
| * | Add an integration test for systemd in a containerMatthew Heon2019-08-28
| |/ | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* / image: remove unused Decompose methodDan Williams2019-08-28
|/ | | | | | | Decompose() returns an error defined in CNI which has been removed upstream because it had no in-tree (eg in CNI) users. Signed-off-by: Dan Williams <dcbw@redhat.com>
* Merge pull request #3800 from vrothberg/generate-podOpenShift Merge Robot2019-08-22
|\ | | | | generate systemd pod
| * generate systemd: support pods and geneartig filesValentin Rothberg2019-08-21
| | | | | | | | | | | | | | | | | | | | | | Support generating systemd unit files for a pod. Podman generates one unit file for the pod including the PID file for the infra container's conmon process and one unit file for each container (excluding the infra container). Note that this change implies refactorings in the `pkg/systemdgen` API. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #3863 from TomSweeneyRedHat/dev/tsweeney/digestfile2OpenShift Merge Robot2019-08-21
|\ \ | | | | | | Add --digestfile option to push
| * | Add --digestfile option to pushTomSweeneyRedHat2019-08-21
| |/ | | | | | | | | | | | | | | | | | | Add the digestfile option to the push command so the digest can be stored away in a file when requested by the user. Also have added a debug statement to show the completion of the push. Emulates Buildah's https://github.com/containers/buildah/pull/1799/files Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* | Merge pull request #2940 from giuseppe/drop-firewallOpenShift Merge Robot2019-08-21
|\ \ | |/ |/| networking: use firewall plugin
| * networking: use firewall pluginGiuseppe Scrivano2019-08-19
| | | | | | | | | | | | | | drop the pkg/firewall module and start using the firewall CNI plugin. It requires an updated package for CNI plugins. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3858 from haircommander/exec-userOpenShift Merge Robot2019-08-20
|\ \ | | | | | | exec: run with user specified on container start
| * | exec: run with user specified on container startPeter Hunt2019-08-20
| | | | | | | | | | | | | | | | | | | | | Before, if the container was run with a specified user that wasn't root, exec would fail because it always set to root unless respecified by user. instead, inherit the user from the container start. Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | Merge pull request #3569 from rhatdan/cgroupsv1OpenShift Merge Robot2019-08-20
|\ \ \ | |/ / |/| | Fix error message on podman stats on cgroups v1 rootless environments
| * | Fix error message on podman stats on cgroups v1 rootless environmentsDaniel J Walsh2019-08-19
| | | | | | | | | | | | | | | | | | | | | podman stats does not work in rootless environments with cgroups V1. Fix error message and document this fact. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #3760 from rhatdan/authOpenShift Merge Robot2019-08-19
|\ \ \ | | | | | | | | Use GetRuntimeDir to setup auth.json for login
| * | | Use GetRuntimeDir to setup auth.json for loginDaniel J Walsh2019-08-12
| | | | | | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #3849 from openSUSE/directory-pullOpenShift Merge Robot2019-08-19
|\ \ \ \ | | | | | | | | | | Fix directory pull image name for OCI images
| * | | | Fix directory pull image name for OCI imagesSascha Grunert2019-08-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a breaking change and modifies the resulting image name when pulling from an directory via `oci:...`. Without this patch, the image names pulled via a local directory got processed incorrectly, like this: ``` > podman pull oci:alpine > podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/oci alpine 4fa153a82426 5 weeks ago 5.85 MB ``` We now use the same approach as in the corresponding [buildah fix][1] to adapt the behavior for correct `localhost/` prefixing. [1]: https://github.com/containers/buildah/pull/1800 After applying the patch the same OCI image pull looks like this: ``` > ./bin/podman pull oci:alpine > podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/alpine latest 4fa153a82426 5 weeks ago 5.85 MB ``` End-to-end tests have been adapted as well to cover the added scenario. Relates to: https://github.com/containers/buildah/issues/1797 Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | | | | Merge pull request #3848 from giuseppe/enable-all-tests-crunOpenShift Merge Robot2019-08-19
|\ \ \ \ \ | |_|_|_|/ |/| | | | tests: enable all tests for crun
| * | | | libpod, pkg: lookup also for crun failuresGiuseppe Scrivano2019-08-19
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | libpod: still attempt to read the oci log file if not outputGiuseppe Scrivano2019-08-19
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | if we didn't receive any data on the pipe, still attempt to read the specified log file. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Merge pull request #3709 from mheon/volume_inspectOpenShift Merge Robot2019-08-19
|\ \ \ \ | |_|_|/ |/| | | Change backend code for 'volume inspect'
| * | | Fix typosMatthew Heon2019-08-02
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Implement backend for 'volume inspect'Matthew Heon2019-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Begin to separate the internal structures and frontend for inspect on volumes. We can't rely on keeping internal data structures for external presentation - separating presentation and internal data format is good practice. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #3836 from chenzhiwei/hostnameOpenShift Merge Robot2019-08-19
|\ \ \ \ | |_|/ / |/| | | Allow customizing pod hostname
| * | | Allow customizing pod hostnameChen Zhiwei2019-08-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * set hostname in pod yaml file * set --hostname in pod create command Signed-off-by: Chen Zhiwei <zhiweik@gmail.com>
* | | | Merge pull request #3813 from baude/nofdsOpenShift Merge Robot2019-08-18
|\ \ \ \ | | | | | | | | | | do not activate sd_notify support when varlink
| * | | | do not activate sd_notify support when varlinkbaude2019-08-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add ability to not activate sd_notify when running under varlink as it causes deadlocks and hangs. Fixes: #3572 Signed-off-by: baude <bbaude@redhat.com>
* | | | | Merge pull request #3617 from QiWang19/create_pullOpenShift Merge Robot2019-08-17
|\ \ \ \ \ | |_|/ / / |/| | | | add --pull flag for podman create&run
| * | | | add --pull flag for podman create&runQi Wang2019-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Requirement from https://github.com/containers/libpod/issues/3575#issuecomment-512238393 Added --pull for podman create and pull to match the newly added flag in docker CLI. `missing`: default value, podman will pull the image if it does not exist in the local. `always`: podman will always pull the image. `never`: podman will never pull the image. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | | Merge pull request #3818 from chenzhiwei/hostnameOpenShift Merge Robot2019-08-15
|\ \ \ \ \ | |_|/ / / |/| | | | Set Pod hostname as Pod name
| * | | | Set Pod hostname as Pod nameChen Zhiwei2019-08-15
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Chen Zhiwei <zhiweik@gmail.com>
* | | | | Merge pull request #3812 from baude/perffix1OpenShift Merge Robot2019-08-15
|\ \ \ \ \ | |/ / / / |/| | | | performance fix for podman events with large journalds
| * | | | performance fix for podman events with large journaldsbaude2019-08-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the case where the host has a large journald, iterating the journal without using a Match is very poor performance. this might be a temporary fix while we figure out why the systemd library does not seem to behave properly. Signed-off-by: baude <bbaude@redhat.com>
* | | | | Merge pull request #3807 from QiWang19/inspect_mergeDirOpenShift Merge Robot2019-08-14
|\ \ \ \ \ | | | | | | | | | | | | removMergeDir from inspect result if not mounted
| * | | | | removMergeDir from inspect result if not mountedQi Wang2019-08-13
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | Remove GraphDriver.Data.MergedDir from the result of podman inspect if the container not mounte. Because the /var/lib/containers/.../merged directory is no longer created by default; it only exists during the scope of podman mount. Signed-off-by: Qi Wang <qiwan@redhat.com>
* / / / / pkg/cgroups: use DBUS session when rootlessGiuseppe Scrivano2019-08-14
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | use the DBUS user session when running in rootless mode. Closes: https://github.com/containers/libpod/issues/3801 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Small optimization - only store exit code when nonzeroMatthew Heon2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | JSON optimizes it out in that case anyways, so don't waste cycles doing an Itoa (and Atoi on the decode side). Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Fix container exit code with Journald backendMatthew Heon2019-08-12
| |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | We weren't actually storing this, so we'd lose the exit code for containers run with --rm or force-removed while running if the journald backend for events was in use. Fixes #3795 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | image: add user agent to Docker registry optionsStefan Becker2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Set the string to "libpod/VERSION" so that we don't use the unspecific default of "Go-http-client/xxx". Fixes #3788 Signed-off-by: Stefan Becker <chemobejk@gmail.com>
* | | Merge pull request #3786 from giuseppe/fix-rootless-checksOpenShift Merge Robot2019-08-12
|\ \ \ | | | | | | | | rootless: drop some superflous checks
| * | | oci: drop check for euid==0Giuseppe Scrivano2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | we are always running with euid==0 at this point. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | rootless: cherry-pick runtime from the system configurationGiuseppe Scrivano2019-08-12
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | when creating the default libpod.conf file, be sure the default OCI runtime is cherry picked from the system configuration. Closes: https://github.com/containers/libpod/issues/3781 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / / Fix up ConmonPidFile after restoreAdrian Reber2019-08-09
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After restoring a container with a different name (ID) the ConmonPidFile was still pointing to the path of the original container. This means that the last restored container will overwrite the ConmonPidFile of the original container. It was also not possible to restore a container with a new name (ID) if the original container was not running. The ConmonPidFile is only changed if the ConmonPidFile starts with the value of RunRoot. This assumes that if RunRoot is part of ConmonPidFile the user did not specify --conmon-pidfile' during run or create. Signed-off-by: Adrian Reber <areber@redhat.com>
* | Merge pull request #3721 from baude/rmifunsiesOpenShift Merge Robot2019-08-09
|\ \ | | | | | | make rmi messages more compatible with docker
| * | make rmi messages more compatible with dockerbaude2019-08-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the case where we rmi an image that has only one reponame, we print out an untagged reponame message. $ sudo podman rmi busybox Untagged: docker.io/library/busybox:latest Deleted: db8ee88ad75f6bdc74663f4992a185e2722fa29573abcc1a19186cc5ec09dceb Signed-off-by: baude <bbaude@redhat.com>
* | | Add conmon probe to runtime constructionPeter Hunt2019-08-08
|/ / | | | | | | | | | | Now, when a user's conmon is out of date, podman will tell them Signed-off-by: Peter Hunt <pehunt@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-30 10:45:14 +0000