summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Merge pull request #3233 from ↵OpenShift Merge Robot2019-07-29
|\ | | | | | | | | wking/fatal-requested-hook-directory-does-not-exist libpod/container_internal: Make all errors loading explicitly configured hook dirs fatal
| * libpod/container_internal: Make all errors loading explicitly configured ↵W. Trevor King2019-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | hook dirs fatal Remove this IsNotExist out which was added along with the rest of this block in f6a2b6bf2b (hooks: Add pre-create hooks for runtime-config manipulation, 2018-11-19, #1830). Besides the obvious "hook directory does not exist", it was swallowing the less-obvious "hook command does not exist". And either way, folks are likely going to want non-zero podman exits when we fail to load a hook directory they explicitly pointed us towards. Signed-off-by: W. Trevor King <wking@tremily.us>
* | Merge pull request #3639 from giuseppe/user-ns-containerOpenShift Merge Robot2019-07-26
|\ \ | | | | | | podman: support --userns=ns|container
| * | podman: support --userns=ns|containerGiuseppe Scrivano2019-07-25
| | | | | | | | | | | | | | | | | | | | | | | | allow to join the user namespace of another container. Closes: https://github.com/containers/libpod/issues/3629 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Fix possible runtime panic if image history len is zeroSascha Grunert2019-07-25
|/ / | | | | | | | | | | | | We now return an empty string for the `Comment` field if an OCI v1 image contains no history. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | When retrieving volumes, only use exact namesMatthew Heon2019-07-24
| | | | | | | | | | | | | | | | | | | | We should not be fuzzy matching on volume names. Docker doesn't do it, and it doesn't make much sense. Everything requires exact matches for names - only IDs allow partial matches. Fixes #3635 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3626 from mheon/fix_ps_segfaultOpenShift Merge Robot2019-07-24
|\ \ | | | | | | Fix a segfault on Podman no-store commands with refresh
| * | Fix a segfault on Podman no-store commands with refreshMatthew Heon2019-07-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a command (like `ps`) requests no store be created, but also requires a refresh be performed, we have to ignore its request and initialize the store anyways to prevent segfaults. This work was done in #3532, but that missed one thing - initializing a storage service. Without the storage service, Podman will still segfault. Fix that oversight here. Fixes #3625 Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | refactor to reduce duplicated error parsingPeter Hunt2019-07-23
| | | | | | | | | | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | move editing of exitCode to runtimePeter Hunt2019-07-23
|/ / | | | | | | | | | | | | | | | | There's no way to get the error if we successfully get an exit code (as it's just printed to stderr instead). instead of relying on the error to be passed to podman, and edit based on the error code, process it on the varlink side instead Also move error codes to define package Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | golangci-lint cleanupbaude2019-07-23
| | | | | | | | | | | | | | a PR slipped through without running the new linter. this cleans things up for the master branch. Signed-off-by: baude <bbaude@redhat.com>
* | Merge pull request #3621 from baude/golangcilint4OpenShift Merge Robot2019-07-23
|\ \ | | | | | | golangci-lint phase 4
| * | golangci-lint phase 4baude2019-07-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | clean up some final linter issues and add a make target for golangci-lint. in addition, begin running the tests are part of the gating tasks in cirrus ci. we cannot fully shift over to the new linter until we fix the image on the openshift side. for short term, we will use both Signed-off-by: baude <bbaude@redhat.com>
* | | Implement conmon execPeter Hunt2019-07-22
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes: Implement exec -i and fix some typos in description of -i docs pass failed runtime status to caller Add resize handling for a terminal connection Customize exec systemd-cgroup slice fix healthcheck fix top add --detach-keys Implement podman-remote exec (jhonce) * Cleanup some orphaned code (jhonce) adapt remote exec for conmon exec (pehunt) Fix healthcheck and exec to match docs Introduce two new OCIRuntime errors to more comprehensively describe situations in which the runtime can error Use these different errors in branching for exit code in healthcheck and exec Set conmon to use new api version Signed-off-by: Jhon Honce <jhonce@redhat.com> Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | golangci-lint round #3baude2019-07-21
| | | | | | | | | | | | | | this is the third round of preparing to use the golangci-lint on our code base. Signed-off-by: baude <bbaude@redhat.com>
* | Cleanup Pull MessageDaniel J Walsh2019-07-20
| | | | | | | | | | | | | | | | | | | | Currently the pull message on failure is UGLY. This patch removes a lot of the noice when pulling an image from multiple registries to make the user experience better. Our current messages are way too verbose and need to be dampened down. Still has verbose mode if you turn on log-level=debug. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Add support for listing read/only and read/write imagesDaniel J Walsh2019-07-19
| | | | | | | | | | | | | | When removing --all images prune images only attempt to remove read/write images, ignore read/only images Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #3443 from adrianreber/rootfs-changes-migrationOpenShift Merge Robot2019-07-19
|\ \ | | | | | | Include changes to the container's root file-system in the checkpoint archive
| * | Add --ignore-rootfs option for checkpoint/restoreAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The newly added functionality to include the container's root file-system changes into the checkpoint archive can now be explicitly disabled. Either during checkpoint or during restore. If a container changes a lot of files during its runtime it might be more effective to migrated the root file-system changes in some other way and to not needlessly increase the size of the checkpoint archive. If a checkpoint archive does not contain the root file-system changes information it will automatically be skipped. If the root file-system changes are part of the checkpoint archive it is also possible to tell Podman to ignore these changes. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Fix typo in checkpoint/restore related textsAdrian Reber2019-07-11
| | | | | | | | | | | | Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Include root file-system changes in container migrationAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One of the last limitations when migrating a container using Podman's 'podman container checkpoint --export=/path/to/archive.tar.gz' was that it was necessary to manually handle changes to the container's root file-system. The recommendation was to mount everything as --tmpfs where the root file-system was changed. This extends the checkpoint export functionality to also include all changes to the root file-system in the checkpoint archive. The checkpoint archive now includes a tarstream of the result from 'podman diff'. This tarstream will be applied to the restored container before restoring the container. With this any container can now be migrated, even it there are changes to the root file-system. There was some discussion before implementing this to base the root file-system migration on 'podman commit', but it seemed wrong to do a 'podman commit' before the migration as that would change the parent layer the restored container is referencing. Probably not really a problem, but it would have meant that a migrated container will always reference another storage top layer than it used to reference during initial creation. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Add function to get a filtered tarstream diffAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The newly added function GetDiffTarStream() mirrors the GetDiff() function. It tries to get the correct layer ID from getLayerID() and it filters out containerMounts from the tarstream. Thus the behavior is the same as GetDiff(), but it returns a tarstream. This also adds the function ApplyDiffTarStream() to apply the tarstream generated by GetDiffTarStream(). These functions are targeted to support container migration with root file-system changes. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | Merge pull request #3595 from mheon/fix_exec_leakOpenShift Merge Robot2019-07-18
|\ \ \ | | | | | | | | Remove exec PID files after use to prevent memory leaks
| * | | Remove exec PID files after use to prevent memory leaksMatthew Heon2019-07-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have another patch running to do the same for exit files, with a much more in-depth explanation of why it's necessary. Suffice to say that persistent files in tmpfs tied to container CGroups lead to significant memory allocations that last for the lifetime of the file. Based on a patch by Andrea Arcangeli (aarcange@redhat.com). Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | | Populate inspect with security-opt settingsMatthew Heon2019-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can infer no-new-privileges. For now, manually populate seccomp (can't infer what file we sourced from) and SELinux/Apparmor (hard to tell if they're enabled or not). Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | | Properly retrieve Conmon PIDMatthew Heon2019-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our previous method (just read the PID that we spawned) doesn't work - Conmon double-forks to daemonize, so we end up with a PID pointing to the first process, which dies almost immediately. Reading from the PID file gets us the real PID. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Move the HostConfig portion of Inspect inside libpodMatthew Heon2019-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we first began writing Podman, we ran into a major issue when implementing Inspect. Libpod deliberately does not tie its internal data structures to Docker, and stores most information about containers encoded within the OCI spec. However, Podman must present a CLI compatible with Docker, which means it must expose all the information in 'docker inspect' - most of which is not contained in the OCI spec or libpod's Config struct. Our solution at the time was the create artifact. We JSON'd the complete CreateConfig (a parsed form of the CLI arguments to 'podman run') and stored it with the container, restoring it when we needed to run commands that required the extra info. Over the past month, I've been looking more at Inspect, and refactored large portions of it into Libpod - generating them from what we know about the OCI config and libpod's (now much expanded, versus previously) container configuration. This path comes close to completing the process, moving the last part of inspect into libpod and removing the need for the create artifact. This improves libpod's compatability with non-Podman containers. We no longer require an arbitrarily-formatted JSON blob to be present to run inspect. Fixes: #3500 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | healthcheck: reject empty commandsStefan Becker2019-07-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An image with "HEALTHCHECK CMD ['']" is valid but as there is no command defined the healthcheck will fail. Reject such a configuration. Fixes #3507 Signed-off-by: Stefan Becker <chemobejk@gmail.com>
* | | | healthcheck: improve command list parserStefan Becker2019-07-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - remove duplicate check, already called in HealthCheck() - reject zero-length command list and empty command string as errorneous - support all Docker command list keywords: NONE, CMD or CMD-SHELL - use Docker default "/bin/sh -c" for CMD-SHELL Fixes #3507 Signed-off-by: Stefan Becker <chemobejk@gmail.com>
* | | | Merge pull request #3532 from mheon/ensure_store_on_refreshOpenShift Merge Robot2019-07-15
|\ \ \ \ | | | | | | | | | | Ensure we have a valid store when we refresh
| * | | | Ensure we have a valid store when we refreshMatthew Heon2019-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #3520 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | | Improves STD output/readability in combinationdom finn2019-07-14
| |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | with debug output. Added \n char to specific standard output Signed-off-by: dom finn <dom.finn00@gmail.com>
* | | | Merge pull request #3558 from mheon/fix_pod_removeOpenShift Merge Robot2019-07-11
|\ \ \ \ | | | | | | | | | | Fix a bug where ctrs could not be removed from pods
| * | | | Fix a bug where ctrs could not be removed from podsMatthew Heon2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using pod removal worked, but container removal was missing the most critical step - the actual removal. Must have been accidentally removed during a refactor. Fixes #3556 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | | Merge pull request #3552 from baude/golangcilint2OpenShift Merge Robot2019-07-11
|\ \ \ \ \ | |_|_|/ / |/| | | | golangci-lint pass number 2
| * | | | golangci-lint pass number 2baude2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | clean up and prepare to migrate to the golangci-linter Signed-off-by: baude <bbaude@redhat.com>
* | | | | Merge pull request #3527 from adrianreber/finishOpenShift Merge Robot2019-07-11
|\ \ \ \ \ | |/ / / / |/| | | | Correctly set FinishedTime for checkpointed container
| * | | | Correctly set FinishedTime for checkpointed containerAdrian Reber2019-07-11
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During 'podman container checkpoint' the finished time was not set. This resulted in a strange container status after checkpointing: Exited (0) 292 years ago During checkpointing FinishedTime is now set to time.now(). Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | Merge pull request #3521 from baude/golangcilint1OpenShift Merge Robot2019-07-11
|\ \ \ \ | |_|/ / |/| | | first pass of corrections for golangci-lint
| * | | first pass of corrections for golangci-lintbaude2019-07-10
| |/ / | | | | | | | | | Signed-off-by: baude <bbaude@redhat.com>
* / / runtime: drop spurious message logGiuseppe Scrivano2019-07-10
|/ / | | | | | | | | | | fix a regression introduced by 1d36501f961889f554daf3c696fe95443ef211b6 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3529 from giuseppe/healthcheck-rootlessOpenShift Merge Robot2019-07-09
|\ \ | | | | | | healthcheck: support rootless mode
| * | healthcheck: support rootless modeGiuseppe Scrivano2019-07-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | now that dbus authentication works fine from a user namespace (systemd 241 works fine), we can enable rootless healthchecks. It uses "systemd-run --user" for creating the healthcheck timer and communicates with the user instance of systemd listening at $XDG_RUNTIME_DIR/systemd/private. Closes: https://github.com/containers/libpod/issues/3523 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3497 from QazerLab/bugfix/systemd-generate-pidfileOpenShift Merge Robot2019-07-08
|\ \ \ | | | | | | | | Use conmon pidfile in generated systemd unit as PIDFile.
| * | | Use default conmon pidfile location for root containers.Danila Kiver2019-07-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The conmon pidfile is crucial for podman-generated systemd units, because these units rely on it for determining service's main process ID. With this change, every container has ConmonPidFile set (at least to default value). Signed-off-by: Danila Kiver <danila.kiver@mail.ru>
* | | | Merge pull request #3425 from adrianreber/restore-mount-labelOpenShift Merge Robot2019-07-08
|\ \ \ \ | | | | | | | | | | Set correct SELinux label on restored containers
| * | | | Provide correct SELinux mount-label for restored containerAdrian Reber2019-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restoring a container from a checkpoint archive creates a complete new root file-system. This file-system needs to have the correct SELinux label or most things in that restored container will fail. Running processes are not as problematic as newly exec()'d process (internally or via 'podman exec'). This patch tells the storage setup which label should be used to mount the container's root file-system. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | | | Track if a container is restored from an exported checkpointAdrian Reber2019-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of only tracking that a container is restored from a checkpoint locally in runtime_ctr.go this adds a flag to the Container structure. Upcoming patches to correctly label the root file-system mount-point need also to know if a container is restored from a checkpoint. Instead of passing a parameter around a lot of functions, this adds that information to the Container structure. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | | Merge pull request #3496 from baude/golandcodeinspectOpenShift Merge Robot2019-07-08
|\ \ \ \ \ | | | | | | | | | | | | code cleanup
| * | | | | code cleanupbaude2019-07-08
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | clean up code identified as problematic by golands inspection Signed-off-by: baude <bbaude@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-19 14:36:43 +0000