summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Move Attach under the OCI Runtime interfaceMatthew Heon2022-06-14
| | | | | | | | | | | | | | | | | | | | | | | With conmon-rs on the horizon, we need to disentangle Libpod from legacy Conmon to the greatest extent possible. There are definitely opportunities for codesharing between the two, but we have to assume the implementations will be largely disjoint given the different architectures. Fortunately, most of the work has already been done in the past. The conmon-managed OCI runtime mostly sits behind an interface, with a few exceptions - the most notable of those being attach. This PR thus moves Attach behind the interface, to ensure that we can have attach implementations that don't use our existing unix socket streaming if necessary. Still to-do is conmon cleanup. There's a lot of code that removes Conmon-specific files, or kills the Conmon PID, and all of it will need to be refactored behind the interface. [NO NEW TESTS NEEDED] Just moving some things around. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* healthcheck: wait for systemd operationsValentin Rothberg2022-06-14
| | | | | | | | | | | | Make sure to wait for the systemd operations to finish when starting/stopping healtcheck timers and services. Also make sure to stop the timer before the service to avoid a race with the timer. [NO NEW TESTS NEEDED] since it is a non-functional change and existing tests are expected to pass. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* podman stats: work with network connect/disconnectPaul Holzinger2022-06-14
| | | | | | | | | | | | | | | | | Hardcoding the interface name is a bad idea. We have no control over the actual interface name since the user can change it. The correct thing is to read them from the network status. Since the contianer can have more than one interface we have to add the RX/TX values. The other values are currently not used. For podman 5.0 we should change it so that the API can return the statistics per interface and the client should sum the TX/RX for the command output. This is what docker is doing. Fixes #13824 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* fix podman container restore without CreateNetNSPaul Holzinger2022-06-14
| | | | | | | | | | | | | | | | When a container does not use the default podman netns, for example --network none or --network ns:/path a restore would fail because the specgen check validates that c.config.StaticMAC is nil but the unmarshaller sets it to an empty slice. While we could make the check use len() > 0 I feel like it is more common to check with != nil for ip and mac addresses. Adding omitempty tag makes the json marshal/unmarshal work correctly. This should not cause any issues. Fixes #14389 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fix swagger model of `InspectPodResponse`Jakob Ahrer2022-06-14
| | | | | | | | | `net.IP` gets marshalled as `string` and not `[]uint8` [NO TESTS NEEDED] [NO NEW TESTS NEEDED] Signed-off-by: Jakob Ahrer <jakob@ahrer.dev>
* Support running podman under a root v2 cgroupJason T. Greene2022-06-14
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Use containers/common/pkg/util.StringToSliceDaniel J Walsh2022-06-14
| | | | | | [NO NEW TESTS NEEDED] Just code cleanup for better reuse Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Instead of erroring, clean up after dangling IDs in DBMatthew Heon2022-06-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | For various (mostly legacy) reasons, Podman presently maintains a unified namespace for pods and containers - IE, we cannot have both a pod and a container named "test" at the same time. To implement this, we use a global database table of every pod and container ID (and another of every pod and container name). These entries should be added when containers/pods are added, and removed when containers/pods are removed, with the database's transactional integrity providing a guarantee that this is batched with the overall removal and that the DB should remain sane and consistent no matter what. As such, we treat a dangling ID as a hard error that stops the use of Podman. Unfortunately, we have someone run into this last Friday. I'm still not certain how exactly their DB got into this state, but without further clarification there, we can consider removing the error and making Podman instead clean up and remove any dangling IDs, which should restore Podman to a serviceable state. Drop an error message if we do this, though, because people should know that the DB is in a bad state. [NO NEW TESTS NEEDED] it is deliberately impossible to produce a configuration that would test this without hex-editing the DB file. Signed-off-by: Matthew Heon <mheon@redhat.com>
* auto update: create an eventValentin Rothberg2022-06-14
| | | | | | | | | Create an auto-update event for each invocation, independent if images and containers are updated or not. Those events will be indicated in the events already but users will now know why. Fixes: #14283 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* linter: enable unconvert linterValentin Rothberg2022-06-14
| | | | | | | Detects unneccessary type conversions and helps in keeping the code base cleaner. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Make errors on removing exec sessions nonfatalMatthew Heon2022-06-14
| | | | | | | | | | | | | | | | | Removing exec sessions is guaranteed to evict them from the DB, but in the case of a zombie process (or similar) it may error and block removal of the container. A subsequent run of `podman rm` would succeed (because the exec sessions have been purged from the DB), which is potentially confusing to users. So let's just continue, instead of erroring out, if removing exec sessions fails. [NO NEW TESTS NEEDED] I wouldn't want to spawn a zombie in our test VMs even if I could. Fixes #14252 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Don't complain about XDG_RUNTIME_DIR, Closes #1424Kevin Downey2022-06-14
| | | | | | | | | | | | | | Code is not directly reading XDG_RUNTIME_DIR, it is reading a value in the state that may initially be from XDG_RUNTIME_DIR, but then is overriden by a value from the boltdb that podman stores some state in. XDG_RUNTIME_DIR and the RunRoot path may not have the same value, so complaining about XDG_RUNTIME_DIR here may cause confusion when trying to debug things. [NO TESTS NEEDED] Signed-off-by: Kevin Downey <hiredman@thelastcitadel.com>
* Robust whitespace split of cpu utilization line from /proc/statSandroCasagrande2022-06-14
| | | | Signed-off-by: Sandro Casagrande <sc.casagrande@gmail.com>
* sdnotify: send MAINPID only onceValentin Rothberg2022-06-14
| | | | | | | | | Send the main PID only once. Previously, `(*Container).start()` and the conmon handler sent them ~simultaneously and went into a race. I noticed the issue while debugging a WIP PR. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* fix: Container.cGroupPath() skip empty line to avoid false error loggingttyS32022-06-14
| | | | | | Signed-off-by: ttyS3 <ttys3.rust@gmail.com> [NO NEW TESTS NEEDED]
* play kube log tag handlingcdoern2022-06-14
| | | | | | | | | currently tags cause a panic due to an uninitialized map. Initialize the map and add parsing to make sure we are only tagging with journald resolves #13356 Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
* pass networks to container clonecdoern2022-05-05
| | | | | | | | | since the network config is a string map, json.unmarshal does not recognize the config and spec as the same entity, need to map this option manually resolves #13713 Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
* libpod: treat ECONNRESET as EOFGiuseppe Scrivano2022-05-05
| | | | | | | | | | | when reading from the attach socket, treat ECONNRESET in the same way as EOF. [NO NEW TESTS NEEDED] Closes: https://github.com/containers/podman/issues/11446 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Report correct RemoteURIDaniel J Walsh2022-05-04
| | | | | | | | | | | | Rather than assuming a filesystem path, the API service URI is recorded in the libpod runtime configuration and then reported as requested. Note: All schemes other than "unix" are hard-coded to report URI exists. Fixes #12023 Signed-off-by: Jhon Honce <jhonce@redhat.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Add podman machine eventsJhon Honce2022-05-04
| | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Additional stats for podman infoBrent Baude2022-05-03
| | | | | | | | | | | | | | | In support of podman machine and its counterpart desktop, we have added new stats to podman info. For storage, we have added GraphRootAllocated and GraphRootUsed in bytes. For CPUs, we have added user, system, and idle percents based on /proc/stat. Fixes: #13876 Signed-off-by: Brent Baude <bbaude@redhat.com>
* libpod: unset networks before storing container confPaul Holzinger2022-05-03
| | | | | | | | | | | | Since networks must always be read from the db bucket directly we should unset them in config to avoid caller from accidentally using them. I already tried this but it didn't work because the networks were unset after the config was marshalled. [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* libpod: host netns keep same /etc/resolv.confPaul Holzinger2022-05-03
| | | | | | | | | | | | When a container is run in the host network namespace we have to keep the same resolv.conf content and not use the systemd-resolve detection logic. But also make sure we still allow --dns options. Fixes #14055 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* fix incorrect permissions for /etc/resolv.conf in usernsPaul Holzinger2022-05-03
| | | | | | | | | | | | | | The files /etc/hosts, /etc/hostname and /etc/resolv.conf should always be owned by the root user in the container. This worked correct for /etc/hostname and /etc/hosts but not for /etc/resolv.conf. A container run with --userns keep-id would have the reolv.conf file owned by the current container user which is wrong. Consolidate some common code in a new helper function to make the code more cleaner. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* enable errcheck linterPaul Holzinger2022-05-03
| | | | | | | | The errcheck linter makes sure that errors are always check and not ignored by accident. It spotted a lot of unchecked errors, mostly in the tests but also some real problem in the code. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* libpod: unlock containers when removing podGiuseppe Scrivano2022-05-03
| | | | | | | | | | | | | | | | | It solves a race where a container cleanup process launched because of the container process exiting normally would hang. It also solves a problem when running as rootless on cgroup v1 since it is not possible to force pids.max = 1 on conmon to limit spawning the cleanup process. Partially copied from https://github.com/containers/podman/pull/13403 Related to: https://github.com/containers/podman/issues/14057 [NO NEW TESTS NEEDED] it doesn't add any new functionality Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* remove unused codepath for creating/running ctr in a podcdoern2022-05-03
| | | | | | | | | | `pod.CgroupPath()` currently includes a codepath that is never accessed, which is supposed to start the infra ctr and obtain the cgroup path from there that is never necessary/safe because p.state.CgroupPath is never empty [NO NEW TESTS NEEDED] Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
* Report properly whether pod shares host networkDaniel J Walsh2022-05-03
| | | | | | Fixes: https://github.com/containers/podman/issues/14028 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* volume: add new option -o o=noquotaGiuseppe Scrivano2022-05-03
| | | | | | | | | | | | | | | | | add a new option to completely disable xfs quota usage for a volume. xfs quota set on a volume, even just for tracking disk usage, can cause weird errors if the volume is later re-used by a container with a different quota projid. More specifically, link(2) and rename(2) might fail with EXDEV if the source file has a projid that is different from the parent directory. To prevent such kind of issues, the volume should be created beforehand with `podman volume create -o o=noquota $ID` Closes: https://github.com/containers/podman/issues/14049 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #14023 from rhatdan/kubeOpenShift Merge Robot2022-04-27
|\ | | | | Truncate annotations when generating kubernetes yaml files
| * Truncate annotations when generating kubernetes yaml filesDaniel J Walsh2022-04-27
| | | | | | | | | | | | | | | | | | | | | | | | Kubernetes only allows 63 characters in an annotation. Make sure that we only add 63 or less charaters when generating kube. Warn if containers or pods have longer length and truncate. Discussion: https://github.com/containers/podman/discussions/13901 Fixes: https://github.com/containers/podman/issues/13962 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | enable gocritic linterPaul Holzinger2022-04-26
|/ | | | | | | | | | | | | | | | | | | | | | The linter ensures a common code style. - use switch/case instead of else if - use if instead of switch/case for single case statement - add space between comment and text - detect the use of defer with os.Exit() - use short form var += "..." instead of var = var + "..." - detect problems with append() ``` newSlice := append(orgSlice, val) ``` This could lead to nasty bugs because the orgSlice will be changed in place if it has enough capacity too hold the new elements. Thus we newSlice might not be a copy. Of course most of the changes are just cosmetic and do not cause any logic errors but I think it is a good idea to enforce a common style. This should help maintainability. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Implements Windows volume/mount supportJason T. Greene2022-04-25
| | | | | | | Based on WSL2 9p support: remaps windows paths to /mnt/<drive> locations for both podman and Docker API clients. Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Update to use new common machine APIJason T. Greene2022-04-25
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Merge pull request #13978 from Luap99/unparamOpenShift Merge Robot2022-04-25
|\ | | | | enable unparam linter
| * enable unparam linterPaul Holzinger2022-04-25
| | | | | | | | | | | | | | The unparam linter is useful to detect unused function parameters and return values. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #13995 from ashley-cui/revrootfulOpenShift Merge Robot2022-04-25
|\ \ | | | | | | Rootfull -> Rootful
| * | Revert "Switch all rootful to rootfull"Ashley Cui2022-04-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit cc3790f332d989440eb1720e24e3619fc97c74ee. We can't change rootful to rootfull because `rootful` is written into the machine config. Changing this will break json unmarshalling, which will break existing machines. [NO NEW TESTS NEEDED] Signed-off-by: Ashley Cui <acui@redhat.com>
* | | Modify the pod name suffix '_pod' to '-pod'aonoa2022-04-25
|/ / | | | | | | Signed-off-by: aonoa <1991849113@qq.com>
* | Merge pull request #13980 from lsm5/switch-sha256OpenShift Merge Robot2022-04-23
|\ \ | | | | | | libpod/networking_linux.go: switch to sha256 hash generation
| * | libpod/networking_linux.go: switch to sha256 hashesLokesh Mandvekar2022-04-22
| |/ | | | | | | | | | | | | | | | | | | | | | | | | SHA-1 is prone to collisions. This will likely break connectivity between old containers started before update and containers started after update. It will also fail to cleanup old netns. A reboot will fix this, so a reboot is recommended after update. [NO NEW TESTS NEEDED] Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
* | Merge pull request #13973 from Luap99/linter-reviveOpenShift Merge Robot2022-04-23
|\ \ | |/ |/| replace golint with revive linter
| * replace golint with revive linterPaul Holzinger2022-04-22
| | | | | | | | | | | | | | | | | | | | | | | | golint, scopelint and interfacer are deprecated. golint is replaced by revive. This linter is better because it will also check for our error style: `error strings should not be capitalized or end with punctuation or a newline` scopelint is replaced by exportloopref (already endabled) interfacer has no replacement but I do not think this linter is important. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #13918 from Luap99/hostsOpenShift Merge Robot2022-04-22
|\ \ | |/ |/| use etchosts package from c/common
| * network dis-/connect: update /etc/hostsPaul Holzinger2022-04-22
| | | | | | | | | | | | | | | | | | | | | | When we connect or disconnect from a network we also have to update /etc/hosts to ensure we only have valid entries in there. This also fixes problems with docker-compose since this makes use of network connect/disconnect. Fixes #12533 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * libpod: fix c.Hostname() to respect the utsNsCtrPaul Holzinger2022-04-22
| | | | | | | | | | | | | | | | | | | | When we lookup the hostname for a given container we have to check if the container is joined to another utsns and use this hostname then instead. This fixes a problem where the `hostname` command would use the correct name but /etc/hostname would contain a different name. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * use etchosts package from c/commonPaul Holzinger2022-04-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the new logic from c/common to create the hosts file. This will help to better allign the hosts files between buildah and podman. Also this fixes several bugs: - remove host entries when container is stopped and has a netNsCtr - add entries for containers in a pod - do not duplicate entries in the hosts file - use the correct slirp ip when an userns is used Features: - configure host.containers.internal entry in containers.conf - configure base hosts file in containers.conf Fixes #12003 Fixes #13224 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #13972 from Luap99/staticcheckOpenShift Merge Robot2022-04-22
|\ \ | | | | | | enable staticcheck linter
| * | enable staticcheck linterPaul Holzinger2022-04-22
| |/ | | | | | | | | | | | | Fix many problems reported by the staticcheck linter, including many real bugs! Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #13964 from rhatdan/rootfullOpenShift Merge Robot2022-04-22
|\ \ | |/ |/| Switch all rootful to rootfull
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-27 09:32:23 +0000