summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* libpod: change mountpoint ownership c.Root when using overlay on top of ↵Aditya Rajan2021-10-19
| | | | | | | | | | external rootfs Allow chainging ownership of mountpoint created on top external overlay rootfs to support use-cases when custom --uidmap and --gidmap are specified. Signed-off-by: Aditya Rajan <arajan@redhat.com>
* Merge pull request #11959 from rhatdan/selinuxOpenShift Merge Robot2021-10-18
|\ | | | | We should only be relabeling when on first run
| * We should only be relabeling when on first runDaniel J Walsh2021-10-15
| | | | | | | | | | | | | | | | | | On the second runs, the labels should be the same so no need to relabel. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2013548 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | rootfs-overlay: fix overlaybase path for cleanupsAditya Rajan2021-10-18
|/ | | | | | | | Following commit ensures not dandling mounts are left behind when we are creating an overlay on top of external rootfs. Co-authored-by: Valentin Rothberg <rothberg@redhat.com> Signed-off-by: Aditya Rajan <arajan@redhat.com>
* Merge pull request #11982 from umohnani8/targetPortOpenShift Merge Robot2021-10-15
|\ | | | | Set targetPort to the port value in the kube yaml
| * Set targetPort to the port value in the kube yamlUrvashi Mohnani2021-10-14
| | | | | | | | | | | | | | | | | | | | When the targetPort is not defined, it is supposed to be set to the port value according to the k8s docs. Add tests for targetPort. Update tests to be able to check the Service yaml that is generated. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* | Merge pull request #11977 from rhatdan/logOpenShift Merge Robot2021-10-15
|\ \ | | | | | | Don't include ctr.log if not using file logging
| * | Don't include ctr.log if not using file loggingDaniel J Walsh2021-10-14
| |/ | | | | | | | | | | | | | | | | | | Checkpoint is blowing up when you use --log-driver=none [NO NEW TESTS NEEDED] No way currently to test checkpoint restore. Fixes: https://github.com/containers/podman/issues/11974 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* / Do not add TCP to protocol in generated kube yamlUrvashi Mohnani2021-10-14
|/ | | | | | | | | | As the default protocol in k8s is TCP, don't add it to the generate yaml when using protocol. Add UDP to the protocol of the generated yaml when udp is being used. Add tests for this as well. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* Don't use docker/pkg/archive, use containers/storage/pkg/archiveDaniel J Walsh2021-10-14
| | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Don't add image entrypoint to the generate kube yamlUrvashi Mohnani2021-10-13
| | | | | | | | | | | | If no entrypoint or command is set in the podman create command, and the image command or entrypoint is being used as the default, then do not add the image command or entrypoint to the generated kube yaml. Kubernetes knows to default to the image command and/or entrypoint settings when not defined in the kube yaml. Add and modify tests for this case. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* Merge pull request #11944 from cdoern/kubeEmitOpenShift Merge Robot2021-10-13
|\ | | | | Kube Gen run as user/group issues
| * Kube Gen run as user/group issuescdoern2021-10-12
| | | | | | | | | | | | | | | | | | Removed the inclusion of RunAsUser or RunAsGroup unless a container is run with the --user flag. When building from an image the user will be pulled from there anyway resolves #11914 Signed-off-by: cdoern <cdoern@redhat.com>
* | Merge pull request #11949 from Luap99/net-rangeOpenShift Merge Robot2021-10-13
|\ \ | | | | | | CNI: fix network create --ip-range
| * | CNI: fix network create --ip-rangePaul Holzinger2021-10-12
| | | | | | | | | | | | | | | | | | | | | The --ip-range option did not work correctly. The endIP was accidentally assigned to the start IP. New tests are added to make sure it works. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | Merge pull request #11948 from rhatdan/codespellOpenShift Merge Robot2021-10-13
|\ \ \ | | | | | | | | codespell code
| * | | codespell codeDaniel J Walsh2021-10-12
| |/ / | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #11565 from Luap99/rootlessport-binOpenShift Merge Robot2021-10-13
|\ \ \ | | | | | | | | rootlessport: reduce memory usage of the process
| * | | rootlessport: reduce memory usage of the processPaul Holzinger2021-10-12
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use reexec for the rootlessport process, instead make it a separate binary to reduce the memory usage. The problem with reexec is that it will import all packages that podman uses and therefore loads a lot of stuff into the heap. The rootlessport process however only needs the rootlesskit library. The memory usage is a concern since the rootlessport process will spawn two process per container which has ports forwarded. The processes stay until the container dies. On my laptop the current reexec version uses 47800 KB RSS. The new separate binary only uses 4540 KB RSS. This is more than a 90% improvement. The Makefile has been updated to compile the new binary and install it to the libexec directory. Fixes #10790 [NO TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | Merge pull request #11943 from baude/issue11929OpenShift Merge Robot2021-10-13
|\ \ \ | |/ / |/| | No space in kube annotations for bind mounts
| * | No space in kube annotations for bind mountsBrent Baude2021-10-12
| |/ | | | | | | | | | | | | | | | | | | | | Kubernetes fails to deal with an annotation that has a space in it. Trim these strings to remove spaces. Fixes: #11929 Signed-off-by: Brent Baude <bbaude@redhat.com> [NO TESTS NEEDED]
* | Merge pull request #11925 from rhatdan/volumeOpenShift Merge Robot2021-10-12
|\ \ | | | | | | Remove a volume with --force if container is running
| * | Remove a volume with --force if container is runningDaniel J Walsh2021-10-11
| |/ | | | | | | | | | | | | | | Currently we are not passing the force flag down to the removal of the running container. If the container is running, and we set --force when removing the volume, the container should be stopped. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* / Fix CI flake on time of shutdown for API serviceJhon Honce2021-10-12
|/ | | | | | | | | | | | | | | | | | | * Increase timeout for tests to 10s * To aid in debugging add PID to shutdown package logging * Added new message for forced service shutdown * Always wait for HTTP server to shutdown, duration of 0 not friendly to clients Note: The log event "IdleTracker: StateClosed transition by connection marked un-managed" denotes a TCP connection has been initiated but no HTTP request was sent. And is expected during these tests. Fixes #11921 Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Merge pull request #11869 from jwhonce/wip/pprofOpenShift Merge Robot2021-10-10
|\ | | | | Enable /debug/pprof API service endpoints
| * Enable /debug/pprof API service endpointsJhon Honce2021-10-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactor sidecar HTTP service for /debug/pprof endpoints to use a TCP address given via new podman system service --pprof-address flag * Allow same URL parsing in "system service" as bindings/connection.go * Refactor NewServerWithSettings() to use entities.ServiceOptions in place of deleted server.Options * Updated godoc for impacted functions and types * Fixed API service Shutdown() to do an orderly shutdown when terminated and running with --time=0 Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | Merge pull request #11880 from rhatdan/stoptimeoutOpenShift Merge Robot2021-10-10
|\ \ | | | | | | Warn if podman stop timeout expires that sigkill was sent
| * | Warn if podman stop timeout expires that sigkill was sentDaniel J Walsh2021-10-08
| |/ | | | | | | | | | | | | | | | | Note: the Warning message will not come to podman-remote. It would be difficult to plumb, and not really worth the effort. Fixes: https://github.com/containers/podman/issues/11854 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* / faster image inspectionValentin Rothberg2021-10-08
|/ | | | | | | | | | | | | | Vendor the latest HEAD in c/common to pull in changes for a faster inspection of images. Previously, only the size computation was optional, now the one for the parent image is as well. In many cases, the parent image is not needed but it takes around 10ms on my local machine. With this change, we cut off 10ms from many code paths, most importantly, container creation. [NO NEW TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #11878 from mheon/stop_stoppingOpenShift Merge Robot2021-10-06
|\ | | | | Allow `podman stop` to be run on Stopping containers
| * Ensure `podman ps --sync` functionsMatthew Heon2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | The backend for `ps --sync` has been nonfunctional for a long while now - probably since v2.0. It's questionable how useful the flag is in modern Podman (the original case it was intended to catch, Conmon gone via SIGKILL, should be handled now via pinging the process with a signal to ensure it's still alive) but having the ability to force a refresh of container state from the OCI runtime is still useful. Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Allow `podman stop` to be run on Stopping containersMatthew Heon2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows you to stop a container after a `podman stop` process started, but did not finish, stopping the container (probably an ignored stop signal, with no time to SIGKILL?). This is a very narrow case, but once you're in it the only way to recover is a `podman rm -f` of the container or extensive manual remediation (you'd have to kill the container yourself, manually, and then force a `podman ps --all --sync` to update its status from the OCI runtime). [NO NEW TESTS NEEDED] I have no idea how to verify this one - we need to test that it actually started *during* the other stop command, and that's nontrivial. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | libpod: fix race when closing STDINPaul Holzinger2021-10-06
|/ | | | | | | | | | | | | | | | There is a race where `conn.Close()` was called before `conn.CloseWrite()`. In this case `CloseWrite` will fail and an useless error is printed. To fix this we move the the `CloseWrite()` call to the same goroutine to remove the race. This ensures that `CloseWrite()` is called before `Close()` and never afterwards. Also fixed podman-remote run where the STDIN was never was closed. This is causing flakes in CI testing. [NO TESTS NEEDED] Fixes #11856 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #11763 from rhatdan/timeoutOpenShift Merge Robot2021-10-04
|\ | | | | Add --time option for podman * rm -f flag
| * Add --time out for podman * rm -f commandsDaniel J Walsh2021-10-04
| | | | | | | | | | | | | | | | | | Add --time flag to podman container rm Add --time flag to podman pod rm Add --time flag to podman volume rm Add --time flag to podman network rm Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | CNI networks: reload networks if neededPaul Holzinger2021-10-04
|/ | | | | | | | | | | | | | | | | | | | The current implementation of the CNI network interface only loads the networks on the first call and saves them in a map. This is done to safe performance and not having to reload all configs every time which will be costly for many networks. The problem with this approach is that if a network is created by another process it will not be picked up by the already running podman process. This is not a problem for the short lived podman commands but it is problematic for the podman service. To make sure we always have the actual networks store the mtime of the config directory. If it changed since the last read we have to read again. Fixes #11828 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Pod Volumes From Supportcdoern2021-10-01
| | | | | | | added support for a volumes from container. this flag just required movement of the volumes-from flag declaration out of the !IsInfra block, and minor modificaions to container_create.go Signed-off-by: cdoern <cdoern@redhat.com>
* Merge pull request #11686 from cdoern/podDeviceOptionsOpenShift Merge Robot2021-10-01
|\ | | | | Pod Device-Read-BPS support
| * Pod Device-Read-BPS supportcdoern2021-09-28
| | | | | | | | | | | | | | | | | | added the option for the user to specify a rate, in bytes, at which they would like to be able to read from the device being added to the pod. This is the first in a line of pod device options. WARNING: changed pod name json tag to pod_name to avoid confusion when marshaling with the containerspec's name Signed-off-by: cdoern <cdoern@redhat.com>
* | Merge pull request #11807 from emsoucy/mainDaniel J Walsh2021-09-30
|\ \ | | | | | | Fix typo in storage.conf file exists message
| * | [NO TESTS NEEDED] Fix typo in storage.conf file exists messageEthan Soucy2021-09-30
| | | | | | | | | | | | Signed-off-by: Ethan Soucy <ethan.soucy@gmail.com>
* | | Support selinux options with bind mounts play/genBrent Baude2021-09-30
|/ / | | | | | | | | | | | | | | | | | | | | | | When using play kube and generate kube, we need to support if bind mounts have selinux options. As kubernetes does not support selinux in this way, we tuck the selinux values into a pod annotation for generation of the kube yaml. Then on play, we check annotations to see if a value for the mount exists and apply it. Fixes BZ #1984081 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | Merge pull request #11787 from rhatdan/deleteContainerOpenShift Merge Robot2021-09-30
|\ \ | | | | | | Storage can remove ErrNotAContainer as well
| * | Storage can remove ErrNotAContainer as wellDaniel J Walsh2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/11775 [NO TESTS NEEDED] No easy way to cause this problem in CI. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #11390 from giuseppe/logging-passthroughOpenShift Merge Robot2021-09-29
|\ \ \ | | | | | | | | logging: new mode -l passthrough
| * | | logging: new mode -l passthroughGiuseppe Scrivano2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | it allows to pass the current std streams down to the container. conmon support: https://github.com/containers/conmon/pull/289 [NO TESTS NEEDED] it needs a new conmon. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Merge pull request #11781 from vrothberg/specOpenShift Merge Robot2021-09-29
|\ \ \ \ | | | | | | | | | | podman run - avoid calls to JSONDeepCopy
| * | | | libpod: container create: init variable: do not deep copy specValentin Rothberg2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not create an expensive deep copy for the provided spec.Spec when creating a container. No API should be expected to create deep copies of arguments unless explicitly documented. This removes the last call to JSONDeepCopy in a simple `podman run --rm -d busybox true`. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | libpod: add GetConfigNoCopy()Valentin Rothberg2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new function to libpod to directly access the runtime configuration without creating an expensive deep copy. Further migrate a number of callers to this new function. This drops the number of calls to JSONDeepCopy from 4 to 1 in a simple `podman run --rm -d busybox top`. Future work: Please note that there are more callers of GetConfig() that can me migrated to GetConfigNoCopy(). [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| * | | | libpod: add execSessionNoCopyValentin Rothberg2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid creating an expensive deep copy, create an internal function to access the exec session. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-05 05:19:42 +0000