summaryrefslogtreecommitdiff
path: root/libpod
Commit message (Collapse)AuthorAge
* Add conmon probe to runtime constructionPeter Hunt2019-08-08
| | | | | | Now, when a user's conmon is out of date, podman will tell them Signed-off-by: Peter Hunt <pehunt@redhat.com>
* Merge pull request #3745 from baude/eventsjournaldremovematchOpenShift Merge Robot2019-08-08
|\ | | | | systemd library conflict with seektail and addmatch
| * systemd library conflict with seektail and addmatchbaude2019-08-06
| | | | | | | | | | | | | | | | | | it looks like the core-os systemd library has some issue when using seektail and add match. this patch works around that shortcoming for the time being. Fixes: #3616 Signed-off-by: baude <bbaude@redhat.com>
* | cgroup: fix regression when running systemdGiuseppe Scrivano2019-08-06
|/ | | | | | | | | | | | | | | commit 223fe64dc0a592fd44e0c9fde9f9e0ca087d566f introduced the regression. When running on cgroups v1, bind mount only /sys/fs/cgroup/systemd as rw, as the code did earlier. Also, simplify the rootless code as it doesn't require any special handling when using --systemd. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1737554 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #3736 from baude/revertOpenShift Merge Robot2019-08-06
|\ | | | | Revert "rootless: Rearrange setup of rootless containers"
| * Revert "rootless: Rearrange setup of rootless containers"baude2019-08-06
| | | | | | | | | | | | This reverts commit 80dcd4bebcdc8e280f6b43228561d09c194c328b. Signed-off-by: baude <bbaude@redhat.com>
* | Merge pull request #3466 from TomSweeneyRedHat/dev/tsweeney/myhomeOpenShift Merge Robot2019-08-06
|\ \ | |/ |/| Touch up XDG, add rootless links
| * Touch up XDG, add rootless linksTomSweeneyRedHat2019-07-29
| | | | | | | | | | | | | | | | | | | | | | Touch up a number of formating issues for XDG_RUNTIME_DIRS in a number of man pages. Make use of the XDG_CONFIG_HOME environment variable in a rootless environment if available, or set it if not. Also added a number of links to the Rootless Podman config page and added the location of the auth.json files to that doc. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* | Merge pull request #3698 from adrianreber/StartedTimeOpenShift Merge Robot2019-08-05
|\ \ | | | | | | restore: correctly set StartedTime
| * | restore: correctly set StartedTimeAdrian Reber2019-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A container restored from an exported checkpoint did not have its StartedTime set. Which resulted in a status like 'Up 292 years ago' after the restore. This just sets the StartedTime to time.Now() if a container is restored from an exported checkpoint. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | Merge pull request #3701 from vrothberg/fix-3696OpenShift Merge Robot2019-08-05
|\ \ \ | | | | | | | | container stop: kill conmon
| * | | container stop: kill conmonValentin Rothberg2019-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Old versions of conmon have a bug where they create the exit file before closing open file descriptors causing a race condition when restarting containers with open ports since we cannot bind the ports as they're not yet closed by conmon. Killing the old conmon PID is ~okay since it forces the FDs of old conmons to be closed, while it's a NOP for newer versions which should have exited already. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | Merge pull request #3690 from adrianreber/ignore-static-ipOpenShift Merge Robot2019-08-05
|\ \ \ \ | | | | | | | | | | restore: added --ignore-static-ip option
| * | | | restore: added --ignore-static-ip optionAdrian Reber2019-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a container is restored multiple times from an exported checkpoint with the help of '--import --name', the restore will fail if during 'podman run' a static container IP was set with '--ip'. The user can tell the restore process to ignore the static IP with '--ignore-static-ip'. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | | Merge pull request #3171 from QiWang19/events_jsonOpenShift Merge Robot2019-08-05
|\ \ \ \ \ | | | | | | | | | | | | podman events format json
| * | | | | podman events format jsonQi Wang2019-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enable podman events to format the output as jsonline Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | | | Merge pull request #3691 from baude/infoeventloggerOpenShift Merge Robot2019-08-05
|\ \ \ \ \ \ | | | | | | | | | | | | | | add eventlogger to info
| * | | | | | add eventlogger to infobaude2019-08-02
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to help with future debugging, we now display the type of event logger being used inside podman info -> host. Signed-off-by: baude <bbaude@redhat.com>
* | | | | | Merge pull request #3310 from gabibeyer/rootlessKataOpenShift Merge Robot2019-08-05
|\ \ \ \ \ \ | |_|_|/ / / |/| | | | | rootless: Rearrange setup of rootless containers ***CIRRUS: TEST IMAGES***
| * | | | | rootless: Rearrange setup of rootless containersGabi Beyer2019-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to run Podman with VM-based runtimes unprivileged, the network must be set up prior to the container creation. Therefore this commit modifies Podman to run rootless containers by: 1. create a network namespace 2. pass the netns persistent mount path to the slirp4netns to create the tap inferface 3. pass the netns path to the OCI spec, so the runtime can enter the netns Closes #2897 Signed-off-by: Gabi Beyer <gabrielle.n.beyer@intel.com>
| * | | | | Add comment to describe postConfigureNetNSGabi Beyer2019-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Provide information stating what the postConfigureNetNS option is used for. Signed-off-by: Gabi Beyer <gabrielle.n.beyer@intel.com>
* | | | | | honor libpod.conf in /usr/share/containersbaude2019-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | we should be looking for the libpod.conf file in /usr/share/containers and not in /usr/local. packages of podman should drop the default libpod.conf in /usr/share. the override remains /etc/containers/ as well. Fixes: #3702 Signed-off-by: baude <bbaude@redhat.com>
* | | | | | Add handling for empty LogDriverPeter Hunt2019-08-02
| |/ / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two cases logdriver can be empty, if it wasn't set by libpod, or if the user did --log-driver "" The latter case is an odd one, and the former is very possible and already handled for LogPath. Instead of printing an error for an entirely reasonable codepath, let's supress the error Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | | | Merge pull request #3692 from haircommander/play-capsOpenShift Merge Robot2019-08-02
|\ \ \ \ \ | |_|_|/ / |/| | | | Add Capability support to play kube
| * | | | Add capability functionality to play kubePeter Hunt2019-08-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Take capabilities written in a kube and add to a container adapt test suite and write cap-add/drop tests Signed-off-by: Peter Hunt <pehunt@redhat.com>
| * | | | Deduplicate capabilities in generate kubePeter Hunt2019-08-01
| | |/ / | |/| | | | | | | | | | | | | | | | | | capabilities that were added and dropped were several times duplicated. Fix this Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | | Merge pull request #3551 from mheon/fix_memory_leakOpenShift Merge Robot2019-08-02
|\ \ \ \ | | | | | | | | | | Fix memory leak with exit files
| * | | | Use "none" instead of "null" for the null eventerMatthew Heon2019-08-01
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | Ensure we generate a 'stopped' event on force-removeMatthew Heon2019-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When forcibly removing a container, we are initiating an explicit stop of the container, which is not reflected in 'podman events'. Swap to using our standard 'stop()' function instead of a custom one for force-remove, and move the event into the internal stop function (so internal calls also register it). This does add one more database save() to `podman remove`. This should not be a terribly serious performance hit, and does have the desirable side effect of making things generally safer. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | System events are valid, don't error on themMatthew Heon2019-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logfile driver was not aware that system events existed. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | Expose Null eventer and allow its use in the Podman CLIMatthew Heon2019-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need this specifically for tests, but others may find it useful if they don't explicitly need events and don't want the performance implications of using them. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | Add a flag to set events logger typeMatthew Heon2019-07-31
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
| * | | | podman: fix memleak caused by renaming and not deletingMatthew Heon2019-07-31
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the exit file If the container exit code needs to be retained, it cannot be retained in tmpfs, because libpod runs in a memcg itself so it can't leave traces with a daemon-less design. This wasn't a memleak detectable by kmemleak for example. The kernel never lost track of the memory and there was no erroneous refcounting either. The reference count dependencies however are not easy to track because when a refcount is increased, there's no way to tell who's still holding the reference. In this case it was a single page of tmpfs pagecache holding a refcount that kept pinned a whole hierarchy of dying memcg, slab kmem, cgropups, unrechable kernfs nodes and the respective dentries and inodes. Such a problem wouldn't happen if the exit file was stored in a regular filesystem because the pagecache could be reclaimed in such case under memory pressure. The tmpfs page can be swapped out, but that's not enough to release the memcg with CONFIG_MEMCG_SWAP_ENABLED=y. No amount of more aggressive kernel slab shrinking could have solved this. Not even assigning slab kmem of dying cgroups to alive cgroup would fully solve this. The only way to free the memory of a dying cgroup when a struct page still references it, would be to loop over all "struct page" in the kernel to find which one is associated with the dying cgroup which is a O(N) operation (where N is the number of pages and can reach billions). Linking all the tmpfs pages to the memcg would cost less during memcg offlining, but it would waste lots of memory and CPU globally. So this can't be optimized in the kernel. A cronjob running this command can act as workaround and will allow all slab cache to be released, not just the single tmpfs pages. rm -f /run/libpod/exits/* This patch solved the memleak with a reproducer, booting with cgroup.memory=nokmem and with selinux disabled. The reason memcg kmem and selinux were disabled for testing of this fix, is because kmem greatly decreases the kernel effectiveness in reusing partial slab objects. cgroup.memory=nokmem is strongly recommended at least for workstation usage. selinux needs to be further analyzed because it causes further slab allocations. The upstream podman commit used for testing is 1fe2965e4f672674f7b66648e9973a0ed5434bb4 (v1.4.4). The upstream kernel commit used for testing is f16fea666898dbdd7812ce94068c76da3e3fcf1e (v5.2-rc6). Reported-by: Michele Baldessari <michele@redhat.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> <Applied with small tweaks to comments> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | Merge pull request #3693 from QiWang19/searchOpenShift Merge Robot2019-08-02
|\ \ \ \ | | | | | | | | | | fix search output limit
| * | | | fix search output limitQi Wang2019-08-01
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | close https://bugzilla.redhat.com/show_bug.cgi?id=1732280 From the bug Podman search returns 25 results even when limit option `--limit` is larger than 25(maxQueries). They want Podman to return `--limit` results. This PR fixes the number of output result. if --limit not set, return MIN(maxQueries, len(res)) if --limit is set, return MIN(option, len(res)) Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | Merge pull request #3688 from mheon/print_podOpenShift Merge Robot2019-08-01
|\ \ \ \ | |_|/ / |/| | | Print Pod ID in `podman inspect` output
| * | | Print Pod ID in `podman inspect` outputMatthew Heon2019-08-01
| |/ / | | | | | | | | | | | | | | | | | | Somehow this managed to slip through the cracks, but this is definitely something inspect should print. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #3677 from giuseppe/systemd-cgroupsv2OpenShift Merge Robot2019-08-01
|\ \ \ | | | | | | | | systemd, cgroupsv2: not bind mount /sys/fs/cgroup/systemd
| * | | systemd, cgroupsv2: not bind mount /sys/fs/cgroup/systemdGiuseppe Scrivano2019-08-01
| |/ / | | | | | | | | | | | | | | | | | | | | | when running on a cgroups v2 system, do not bind mount the named hierarchy /sys/fs/cgroup/systemd as it doesn't exist anymore. Instead bind mount the entire /sys/fs/cgroup. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3671 from openSUSE/runtime-path-discoveryOpenShift Merge Robot2019-08-01
|\ \ \ | | | | | | | | Add runtime and conmon path discovery
| * | | Add runtime and conmon path discoverySascha Grunert2019-08-01
| |/ / | | | | | | | | | | | | | | | | | | | | | The `$PATH` environment variable will now used as fallback if no valid runtime or conmon path matches. The debug logs has been updated to state the used executable. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* / / Vendor in buildah 1.9.2Daniel J Walsh2019-07-30
|/ / | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #3672 from petejohanson/32bit-build-fixesOpenShift Merge Robot2019-07-30
|\ \ | | | | | | Build fix for 32-bit systems.
| * | Build fix for 32-bit systems.Pete Johanson2019-07-30
| | | | | | | | | | | | | | | | | | * Fixes #3664. Signed-off-by: Pete Johanson <peter@peterjohanson.com>
* | | Merge pull request #3661 from openSUSE/nixos-friendly-configOpenShift Merge Robot2019-07-30
|\ \ \ | |/ / |/| | Update libpod.conf to be more friendly to NixOS
| * | Update libpod.conf to be NixOS friendlySascha Grunert2019-07-30
| | | | | | | | | | | | | | | | | | | | | | | | NixOS links the current system state to `/run/current-system`, so we have to add these paths to the configuration files as well to work out of the box. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | | Merge pull request #3656 from jwhonce/wip/envOpenShift Merge Robot2019-07-29
|\ \ \ | |_|/ |/| | Fix commit --changes env=X=Y
| * | Fix commit --changes env=X=YJhon Honce2019-07-26
| |/ | | | | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | Merge pull request #3233 from ↵OpenShift Merge Robot2019-07-29
|\ \ | |/ |/| | | | | wking/fatal-requested-hook-directory-does-not-exist libpod/container_internal: Make all errors loading explicitly configured hook dirs fatal
| * libpod/container_internal: Make all errors loading explicitly configured ↵W. Trevor King2019-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | hook dirs fatal Remove this IsNotExist out which was added along with the rest of this block in f6a2b6bf2b (hooks: Add pre-create hooks for runtime-config manipulation, 2018-11-19, #1830). Besides the obvious "hook directory does not exist", it was swallowing the less-obvious "hook command does not exist". And either way, folks are likely going to want non-zero podman exits when we fail to load a hook directory they explicitly pointed us towards. Signed-off-by: W. Trevor King <wking@tremily.us>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-24 03:25:31 +0000