summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Merge pull request #3876 from mheon/fix_mount_flagsOpenShift Merge Robot2019-09-04
|\ | | | | Allow suid, exec, dev mount options to cancel nosuid/noexec/nodev
| * Set base mount options for bind mounts from base systemMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If I mount, say, /usr/bin into my container - I expect to be able to run the executables in that mount. Unconditionally applying noexec would be a bad idea. Before my patches to change mount options and allow exec/dev/suid being set explicitly, we inferred the mount options from where on the base system the mount originated, and the options it had there. Implement the same functionality for the new option handling. There's a lot of performance left on the table here, but I don't know that this is ever going to take enough time to make it worth optimizing. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * Add support for 'exec', 'suid', 'dev' mount flagsMatthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we explicitly set noexec/nosuid/nodev on every mount, with no ability to disable them. The 'mount' command on Linux will accept their inverses without complaint, though - 'noexec' is counteracted by 'exec', 'nosuid' by 'suid', etc. Add support for passing these options at the command line to disable our explicit forcing of security options. This also cleans up mount option handling significantly. We are still parsing options in more than one place, which isn't good, but option parsing for bind and tmpfs mounts has been unified. Fixes: #3819 Fixes: #3803 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3933 from giuseppe/skip-polling-on-runOpenShift Merge Robot2019-09-04
|\ \ | | | | | | libpod: avoid polling container status
| * | libpod: avoid polling container statusGiuseppe Scrivano2019-09-04
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | use the inotify backend to be notified on the container exit instead of polling continuosly the runtime. Polling the runtime slowns significantly down the podman execution time for short lived processes: $ time bin/podman run --rm -ti fedora true real 0m0.324s user 0m0.088s sys 0m0.064s from: $ time podman run --rm -ti fedora true real 0m4.199s user 0m5.339s sys 0m0.344s Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / handle dns response from cnibaude2019-09-03
|/ | | | | | | | | | | | | when cni returns a list of dns servers, we should add them under the right conditions. the defined conditions are as follows: - if the user provides dns, it and only it are added. - if not above and you get a cni name server, it is added and a forwarding dns instance is created for what was in resolv.conf. - if not either above, the entries from the host's resolv.conf are used. Signed-off-by: baude <bbaude@redhat.com> Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #3893 from mheon/readd_volume_locksOpenShift Merge Robot2019-08-28
|\ | | | | Re-add volume locks
| * Re-add locks to volumes.Matthew Heon2019-08-28
| | | | | | | | | | | | | | | | | | | | This will require a 'podman system renumber' after being applied to get lock numbers for existing volumes. Add the DB backend code for rewriting volume configs and use it for updating lock numbers as part of 'system renumber'. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3728 from mheon/systemd_container_testOpenShift Merge Robot2019-08-28
|\ \ | | | | | | Add an integration test for systemd in a container
| * | Add an integration test for systemd in a containerMatthew Heon2019-08-28
| |/ | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* / image: remove unused Decompose methodDan Williams2019-08-28
|/ | | | | | | Decompose() returns an error defined in CNI which has been removed upstream because it had no in-tree (eg in CNI) users. Signed-off-by: Dan Williams <dcbw@redhat.com>
* Merge pull request #3800 from vrothberg/generate-podOpenShift Merge Robot2019-08-22
|\ | | | | generate systemd pod
| * generate systemd: support pods and geneartig filesValentin Rothberg2019-08-21
| | | | | | | | | | | | | | | | | | | | | | Support generating systemd unit files for a pod. Podman generates one unit file for the pod including the PID file for the infra container's conmon process and one unit file for each container (excluding the infra container). Note that this change implies refactorings in the `pkg/systemdgen` API. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #3863 from TomSweeneyRedHat/dev/tsweeney/digestfile2OpenShift Merge Robot2019-08-21
|\ \ | | | | | | Add --digestfile option to push
| * | Add --digestfile option to pushTomSweeneyRedHat2019-08-21
| |/ | | | | | | | | | | | | | | | | | | Add the digestfile option to the push command so the digest can be stored away in a file when requested by the user. Also have added a debug statement to show the completion of the push. Emulates Buildah's https://github.com/containers/buildah/pull/1799/files Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* | Merge pull request #2940 from giuseppe/drop-firewallOpenShift Merge Robot2019-08-21
|\ \ | |/ |/| networking: use firewall plugin
| * networking: use firewall pluginGiuseppe Scrivano2019-08-19
| | | | | | | | | | | | | | drop the pkg/firewall module and start using the firewall CNI plugin. It requires an updated package for CNI plugins. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3858 from haircommander/exec-userOpenShift Merge Robot2019-08-20
|\ \ | | | | | | exec: run with user specified on container start
| * | exec: run with user specified on container startPeter Hunt2019-08-20
| | | | | | | | | | | | | | | | | | | | | Before, if the container was run with a specified user that wasn't root, exec would fail because it always set to root unless respecified by user. instead, inherit the user from the container start. Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | Merge pull request #3569 from rhatdan/cgroupsv1OpenShift Merge Robot2019-08-20
|\ \ \ | |/ / |/| | Fix error message on podman stats on cgroups v1 rootless environments
| * | Fix error message on podman stats on cgroups v1 rootless environmentsDaniel J Walsh2019-08-19
| | | | | | | | | | | | | | | | | | | | | podman stats does not work in rootless environments with cgroups V1. Fix error message and document this fact. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #3760 from rhatdan/authOpenShift Merge Robot2019-08-19
|\ \ \ | | | | | | | | Use GetRuntimeDir to setup auth.json for login
| * | | Use GetRuntimeDir to setup auth.json for loginDaniel J Walsh2019-08-12
| | | | | | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #3849 from openSUSE/directory-pullOpenShift Merge Robot2019-08-19
|\ \ \ \ | | | | | | | | | | Fix directory pull image name for OCI images
| * | | | Fix directory pull image name for OCI imagesSascha Grunert2019-08-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a breaking change and modifies the resulting image name when pulling from an directory via `oci:...`. Without this patch, the image names pulled via a local directory got processed incorrectly, like this: ``` > podman pull oci:alpine > podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/oci alpine 4fa153a82426 5 weeks ago 5.85 MB ``` We now use the same approach as in the corresponding [buildah fix][1] to adapt the behavior for correct `localhost/` prefixing. [1]: https://github.com/containers/buildah/pull/1800 After applying the patch the same OCI image pull looks like this: ``` > ./bin/podman pull oci:alpine > podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/alpine latest 4fa153a82426 5 weeks ago 5.85 MB ``` End-to-end tests have been adapted as well to cover the added scenario. Relates to: https://github.com/containers/buildah/issues/1797 Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | | | | Merge pull request #3848 from giuseppe/enable-all-tests-crunOpenShift Merge Robot2019-08-19
|\ \ \ \ \ | |_|_|_|/ |/| | | | tests: enable all tests for crun
| * | | | libpod, pkg: lookup also for crun failuresGiuseppe Scrivano2019-08-19
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | libpod: still attempt to read the oci log file if not outputGiuseppe Scrivano2019-08-19
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | if we didn't receive any data on the pipe, still attempt to read the specified log file. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Merge pull request #3709 from mheon/volume_inspectOpenShift Merge Robot2019-08-19
|\ \ \ \ | |_|_|/ |/| | | Change backend code for 'volume inspect'
| * | | Fix typosMatthew Heon2019-08-02
| | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | Implement backend for 'volume inspect'Matthew Heon2019-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Begin to separate the internal structures and frontend for inspect on volumes. We can't rely on keeping internal data structures for external presentation - separating presentation and internal data format is good practice. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #3836 from chenzhiwei/hostnameOpenShift Merge Robot2019-08-19
|\ \ \ \ | |_|/ / |/| | | Allow customizing pod hostname
| * | | Allow customizing pod hostnameChen Zhiwei2019-08-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * set hostname in pod yaml file * set --hostname in pod create command Signed-off-by: Chen Zhiwei <zhiweik@gmail.com>
* | | | Merge pull request #3813 from baude/nofdsOpenShift Merge Robot2019-08-18
|\ \ \ \ | | | | | | | | | | do not activate sd_notify support when varlink
| * | | | do not activate sd_notify support when varlinkbaude2019-08-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add ability to not activate sd_notify when running under varlink as it causes deadlocks and hangs. Fixes: #3572 Signed-off-by: baude <bbaude@redhat.com>
* | | | | Merge pull request #3617 from QiWang19/create_pullOpenShift Merge Robot2019-08-17
|\ \ \ \ \ | |_|/ / / |/| | | | add --pull flag for podman create&run
| * | | | add --pull flag for podman create&runQi Wang2019-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Requirement from https://github.com/containers/libpod/issues/3575#issuecomment-512238393 Added --pull for podman create and pull to match the newly added flag in docker CLI. `missing`: default value, podman will pull the image if it does not exist in the local. `always`: podman will always pull the image. `never`: podman will never pull the image. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | | Merge pull request #3818 from chenzhiwei/hostnameOpenShift Merge Robot2019-08-15
|\ \ \ \ \ | |_|/ / / |/| | | | Set Pod hostname as Pod name
| * | | | Set Pod hostname as Pod nameChen Zhiwei2019-08-15
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Chen Zhiwei <zhiweik@gmail.com>
* | | | | Merge pull request #3812 from baude/perffix1OpenShift Merge Robot2019-08-15
|\ \ \ \ \ | |/ / / / |/| | | | performance fix for podman events with large journalds
| * | | | performance fix for podman events with large journaldsbaude2019-08-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the case where the host has a large journald, iterating the journal without using a Match is very poor performance. this might be a temporary fix while we figure out why the systemd library does not seem to behave properly. Signed-off-by: baude <bbaude@redhat.com>
* | | | | Merge pull request #3807 from QiWang19/inspect_mergeDirOpenShift Merge Robot2019-08-14
|\ \ \ \ \ | | | | | | | | | | | | removMergeDir from inspect result if not mounted
| * | | | | removMergeDir from inspect result if not mountedQi Wang2019-08-13
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | Remove GraphDriver.Data.MergedDir from the result of podman inspect if the container not mounte. Because the /var/lib/containers/.../merged directory is no longer created by default; it only exists during the scope of podman mount. Signed-off-by: Qi Wang <qiwan@redhat.com>
* / / / / pkg/cgroups: use DBUS session when rootlessGiuseppe Scrivano2019-08-14
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | use the DBUS user session when running in rootless mode. Closes: https://github.com/containers/libpod/issues/3801 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Small optimization - only store exit code when nonzeroMatthew Heon2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | JSON optimizes it out in that case anyways, so don't waste cycles doing an Itoa (and Atoi on the decode side). Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Fix container exit code with Journald backendMatthew Heon2019-08-12
| |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | We weren't actually storing this, so we'd lose the exit code for containers run with --rm or force-removed while running if the journald backend for events was in use. Fixes #3795 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | image: add user agent to Docker registry optionsStefan Becker2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Set the string to "libpod/VERSION" so that we don't use the unspecific default of "Go-http-client/xxx". Fixes #3788 Signed-off-by: Stefan Becker <chemobejk@gmail.com>
* | | Merge pull request #3786 from giuseppe/fix-rootless-checksOpenShift Merge Robot2019-08-12
|\ \ \ | | | | | | | | rootless: drop some superflous checks
| * | | oci: drop check for euid==0Giuseppe Scrivano2019-08-12
| | | | | | | | | | | | | | | | | | | | | | | | we are always running with euid==0 at this point. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | rootless: cherry-pick runtime from the system configurationGiuseppe Scrivano2019-08-12
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | when creating the default libpod.conf file, be sure the default OCI runtime is cherry picked from the system configuration. Closes: https://github.com/containers/libpod/issues/3781 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 22:53:28 +0000