summaryrefslogtreecommitdiff
path: root/pkg/adapter/containers.go
Commit message (Collapse)AuthorAge
* generate systemd: support pods and geneartig filesValentin Rothberg2019-08-21
| | | | | | | | | | | Support generating systemd unit files for a pod. Podman generates one unit file for the pod including the PID file for the infra container's conmon process and one unit file for each container (excluding the infra container). Note that this change implies refactorings in the `pkg/systemdgen` API. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* libpod, pkg: lookup also for crun failuresGiuseppe Scrivano2019-08-19
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* containers, create: debug message on failed deletionGiuseppe Scrivano2019-08-19
| | | | | | | if the container failed to be created, don't assume it is still known to the OCI runtime. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* containers: look also for 'file not found' in the error messageGiuseppe Scrivano2019-08-12
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #3690 from adrianreber/ignore-static-ipOpenShift Merge Robot2019-08-05
|\ | | | | restore: added --ignore-static-ip option
| * restore: added --ignore-static-ip optionAdrian Reber2019-08-02
| | | | | | | | | | | | | | | | | | | | If a container is restored multiple times from an exported checkpoint with the help of '--import --name', the restore will fail if during 'podman run' a static container IP was set with '--ip'. The user can tell the restore process to ignore the static IP with '--ignore-static-ip'. Signed-off-by: Adrian Reber <areber@redhat.com>
* | Retrieve exit codes for containers via eventsMatthew Heon2019-07-31
| | | | | | | | | | | | | | | | As we previously removed our exit code retrieval code to stop a memory leak, we need a new way of doing this. Fortunately, events is able to do the job for us. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | podman: fix memleak caused by renaming and not deletingMatthew Heon2019-07-31
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the exit file If the container exit code needs to be retained, it cannot be retained in tmpfs, because libpod runs in a memcg itself so it can't leave traces with a daemon-less design. This wasn't a memleak detectable by kmemleak for example. The kernel never lost track of the memory and there was no erroneous refcounting either. The reference count dependencies however are not easy to track because when a refcount is increased, there's no way to tell who's still holding the reference. In this case it was a single page of tmpfs pagecache holding a refcount that kept pinned a whole hierarchy of dying memcg, slab kmem, cgropups, unrechable kernfs nodes and the respective dentries and inodes. Such a problem wouldn't happen if the exit file was stored in a regular filesystem because the pagecache could be reclaimed in such case under memory pressure. The tmpfs page can be swapped out, but that's not enough to release the memcg with CONFIG_MEMCG_SWAP_ENABLED=y. No amount of more aggressive kernel slab shrinking could have solved this. Not even assigning slab kmem of dying cgroups to alive cgroup would fully solve this. The only way to free the memory of a dying cgroup when a struct page still references it, would be to loop over all "struct page" in the kernel to find which one is associated with the dying cgroup which is a O(N) operation (where N is the number of pages and can reach billions). Linking all the tmpfs pages to the memcg would cost less during memcg offlining, but it would waste lots of memory and CPU globally. So this can't be optimized in the kernel. A cronjob running this command can act as workaround and will allow all slab cache to be released, not just the single tmpfs pages. rm -f /run/libpod/exits/* This patch solved the memleak with a reproducer, booting with cgroup.memory=nokmem and with selinux disabled. The reason memcg kmem and selinux were disabled for testing of this fix, is because kmem greatly decreases the kernel effectiveness in reusing partial slab objects. cgroup.memory=nokmem is strongly recommended at least for workstation usage. selinux needs to be further analyzed because it causes further slab allocations. The upstream podman commit used for testing is 1fe2965e4f672674f7b66648e9973a0ed5434bb4 (v1.4.4). The upstream kernel commit used for testing is f16fea666898dbdd7812ce94068c76da3e3fcf1e (v5.2-rc6). Reported-by: Michele Baldessari <michele@redhat.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> <Applied with small tweaks to comments> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* refactor to reduce duplicated error parsingPeter Hunt2019-07-23
| | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
* move editing of exitCode to runtimePeter Hunt2019-07-23
| | | | | | | | | There's no way to get the error if we successfully get an exit code (as it's just printed to stderr instead). instead of relying on the error to be passed to podman, and edit based on the error code, process it on the varlink side instead Also move error codes to define package Signed-off-by: Peter Hunt <pehunt@redhat.com>
* Implement conmon execPeter Hunt2019-07-22
| | | | | | | | | | | | | | | | | | | | | | This includes: Implement exec -i and fix some typos in description of -i docs pass failed runtime status to caller Add resize handling for a terminal connection Customize exec systemd-cgroup slice fix healthcheck fix top add --detach-keys Implement podman-remote exec (jhonce) * Cleanup some orphaned code (jhonce) adapt remote exec for conmon exec (pehunt) Fix healthcheck and exec to match docs Introduce two new OCIRuntime errors to more comprehensively describe situations in which the runtime can error Use these different errors in branching for exit code in healthcheck and exec Set conmon to use new api version Signed-off-by: Jhon Honce <jhonce@redhat.com> Signed-off-by: Peter Hunt <pehunt@redhat.com>
* golangci-lint round #3baude2019-07-21
| | | | | | | this is the third round of preparing to use the golangci-lint on our code base. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #3443 from adrianreber/rootfs-changes-migrationOpenShift Merge Robot2019-07-19
|\ | | | | Include changes to the container's root file-system in the checkpoint archive
| * Add --ignore-rootfs option for checkpoint/restoreAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The newly added functionality to include the container's root file-system changes into the checkpoint archive can now be explicitly disabled. Either during checkpoint or during restore. If a container changes a lot of files during its runtime it might be more effective to migrated the root file-system changes in some other way and to not needlessly increase the size of the checkpoint archive. If a checkpoint archive does not contain the root file-system changes information it will automatically be skipped. If the root file-system changes are part of the checkpoint archive it is also possible to tell Podman to ignore these changes. Signed-off-by: Adrian Reber <areber@redhat.com>
* | golangci-lint pass number 2baude2019-07-11
|/ | | | | | clean up and prepare to migrate to the golangci-linter Signed-off-by: baude <bbaude@redhat.com>
* first pass of corrections for golangci-lintbaude2019-07-10
| | | | Signed-off-by: baude <bbaude@redhat.com>
* Use conmon pidfile in generated systemd unit as PIDFile.Danila Kiver2019-07-04
| | | | | | | | | | | By default, podman points PIDFile in generated unit file to non-existent location. As a result, the unit file, generated by podman, is broken: an attempt to start this unit without prior modification results in a crash, because systemd can not find the pidfile of service's main process. Fix the value of "PIDFile" and add a system test for this case. Signed-off-by: Danila Kiver <danila.kiver@mail.ru>
* Merge pull request #3324 from marcov/detach-keys-configurableOpenShift Merge Robot2019-07-01
|\ | | | | libpod: specify a detach keys sequence in libpod.conf
| * libpod: specify a detach keys sequence in libpod.confMarco Vedovati2019-06-26
| | | | | | | | | | | | Add the ability of specifying a detach keys sequence in libpod.conf Signed-off-by: Marco Vedovati <mvedovati@suse.com>
* | libpod removal from main (phase 2)baude2019-06-27
|/ | | | | | this is phase 2 for the removal of libpod from main. Signed-off-by: baude <bbaude@redhat.com>
* remove libpod from mainbaude2019-06-25
| | | | | | | | | | | | | the compilation demands of having libpod in main is a burden for the remote client compilations. to combat this, we should move the use of libpod structs, vars, constants, and functions into the adapter code where it will only be compiled by the local client. this should result in cleaner code organization and smaller binaries. it should also help if we ever need to compile the remote client on non-Linux operating systems natively (not cross-compiled). Signed-off-by: baude <bbaude@redhat.com>
* Add --storage flag to 'podman rm' (local only)Matthew Heon2019-06-13
| | | | | | | | | | | | | | | | This flag switches to removing containers directly from c/storage and is mostly used to remove orphan containers. It's a superior solution to our former one, which attempted removal from storage under certain circumstances and could, under some conditions, not trigger. Also contains the beginning of support for storage in `ps` but wiring that in is going to be a much bigger pain. Fixes #3329. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* migration: add possibility to restore a container with a new nameAdrian Reber2019-06-04
| | | | | | | | | | | | | | | | | | | | The option to restore a container from an external checkpoint archive (podman container restore -i /tmp/checkpoint.tar.gz) restores a container with the same name and same ID as id had before checkpointing. This commit adds the option '--name,-n' to 'podman container restore'. With this option the restored container gets the name specified after '--name,-n' and a new ID. This way it is possible to restore one container multiple times. If a container is restored with a new name Podman will not try to request the same IP address for the container as it had during checkpointing. This implicitly assumes that if a container is restored from a checkpoint archive with a different name, that it will be restored multiple times and restoring a container multiple times with the same IP address will fail as each IP address can only be used once. Signed-off-by: Adrian Reber <areber@redhat.com>
* Added support to migrate containersAdrian Reber2019-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds an option to the checkpoint command to export a checkpoint into a tar.gz file as well as importing a checkpoint tar.gz file during restore. With all checkpoint artifacts in one file it is possible to easily transfer a checkpoint and thus enabling container migration in Podman. With the following steps it is possible to migrate a running container from one system (source) to another (destination). Source system: * podman container checkpoint -l -e /tmp/checkpoint.tar.gz * scp /tmp/checkpoint.tar.gz destination:/tmp Destination system: * podman pull 'container-image-as-on-source-system' * podman container restore -i /tmp/checkpoint.tar.gz The exported tar.gz file contains the checkpoint image as created by CRIU and a few additional JSON files describing the state of the checkpointed container. Now the container is running on the destination system with the same state just as during checkpointing. If the container is kept running on the source system with the checkpoint flag '-R', the result will be that the same container is running on two different hosts. Signed-off-by: Adrian Reber <areber@redhat.com>
* podman remote-client commitbaude2019-05-30
| | | | | | | add the ability to commit a container to an image using the remote client. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #3072 from mheon/no_rm_volumeOpenShift Merge Robot2019-05-08
|\ | | | | Do not remove volumes when --rm removes a container
| * Do not remove volumes when --rm removes a containerMatthew Heon2019-05-06
| | | | | | | | | | | | | | | | This duplicates Docker behavior for the `--rm` flag. Fixes #3071 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | fix podman-remote ps --nsbaude2019-05-07
|/ | | | | | | | | the namespace for the remote client was being incorrectly derived from the "remote" client. fixes: #2938 Signed-off-by: baude <bbaude@redhat.com>
* top: fallback to execing ps(1)Valentin Rothberg2019-05-03
| | | | | | | | | | Fallback to executing ps(1) in case we hit an unknown psgo descriptor. This ensures backwards compatibility with docker-top, which was purely ps(1) driven. Also support comma-separated descriptors as input. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Generate systemd unit files for containersbaude2019-05-02
| | | | | | | | | | | | the podman generate systemd command will generate a systemd unit file based on the attributes of an existing container and user inputs. the command outputs the unit file to stdout for the user to copy or redirect. it is enabled for the remote client as well. users can set a restart policy as well as define a stop timeout override for the container. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #3039 from mheon/podman_initOpenShift Merge Robot2019-05-02
|\ | | | | Add podman init command
| * Add basic structure of podman init commandMatthew Heon2019-05-01
| | | | | | | | | | | | | | | | | | | | | | | | | | As part of this, rework the number of workers used by various Podman tasks to match original behavior - need an explicit fallthrough in the switch statement for that block to work as expected. Also, trivial change to Podman cleanup to work on initialized containers - we need to reset to a different state after cleaning up the OCI runtime. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | podman-remote portbaude2019-05-01
|/ | | | | | | add the port command to the remote client. this allows users to displa port information about their host system from the remote client Signed-off-by: baude <bbaude@redhat.com>
* Refactor container cleanup to use latest functionsJhon Honce2019-04-30
| | | | Signed-off-by: Jhon Honce <jhonce@redhat.com>
* podman-remote prune containersbaude2019-04-26
| | | | | | | enable the ability to prune containers from the remote-command. this also includes the system prune command. Signed-off-by: baude <bbaude@redhat.com>
* enable podman remote topbaude2019-04-25
| | | | | | | add the ability for the remote client to display a container's running processes. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #2973 from baude/remoterestartOpenShift Merge Robot2019-04-24
|\ | | | | podman remote-client restart containers
| * podman remote-client restart containersbaude2019-04-24
| | | | | | | | | | | | add the ability to restart containers with the remote-client Signed-off-by: baude <bbaude@redhat.com>
* | Fix podman stop --all attempting to stop created ctrsMatthew Heon2019-04-24
|/ | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* podman-remote pause|unpausebaude2019-04-18
| | | | | | | | Add the ability to pause and unpause containers with the remote client. Also turned on the pause tests! Signed-off-by: baude <bbaude@redhat.com>
* podman-remote startbaude2019-04-17
| | | | | | | enable the ability to start containers from the remote-client. also, enable start integration tests for remote testing. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #2830 from baude/remotecheckpointOpenShift Merge Robot2019-04-13
|\ | | | | remote-client checkpoint/restore
| * remote-client checkpoint/restorebaude2019-04-11
| | | | | | | | | | | | | | add the ability for the remote client to be able to checkpoint and restore containers. Signed-off-by: baude <bbaude@redhat.com>
* | create: fix segfault if container name already existsGiuseppe Scrivano2019-04-12
| | | | | | | | | | | | | | | | | | do not try to use ctr if there was an error. It fixes a segfault when there is already a container with the same name. regression introduced by: ba65301c955454e47c3893ca548f18a845a4c4a9 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Fixes for podman-remote run and attachbaude2019-04-11
|/ | | | | | | | Fixes the ability to run (create,start) a container and attach to its console correctly. We can now also exit from the console without hanging the remote client. Signed-off-by: baude <bbaude@redhat.com>
* Add the ability to attach remotely to a containerbaude2019-04-10
| | | | | | | | | | | | | | | | | | | | | Also, you can now podman-remote run -it. There are some bugs that need to be ironed out but I would prefer to merge this so we can make both progress on start and exec as well as the bugs. * when doing podman-remote run -it foo /bin/bash, you have to press enter to get the prompt to display. with the localized podman, we had to teach it connect to the console first and then start the container so we did not miss anything. * when executing "exit" in the console, we get a hard lockup likely because nobody knows what to do. * custom detach keys are not supported * podman-remote run -it alpine ls does not currently work. only dropping to a shell works. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #2882 from baude/remotepsOpenShift Merge Robot2019-04-10
|\ | | | | podman-remote ps
| * podman-remote psbaude2019-04-09
| | | | | | | | | | | | add the ability to run ps on containers using the remote client. Signed-off-by: baude <bbaude@redhat.com>
* | Implement podman-remote rmJhon Honce2019-04-09
|/ | | | | | | | | * refactor command output to use one function * Add new worker pool parallel operations * Implement podman-remote umount * Refactored podman wait to use printCmdOutput() Signed-off-by: Jhon Honce <jhonce@redhat.com>
* podman-remote create|runbaude2019-04-08
| | | | | | | | | | | | | | add the ability to create and run containers via the podman-remote client. we now create an intermediate layer from the the create/run cli flags. the intermediate layer can be converted into a createconfig or into a varlink struct. Once transported, the varlink struct can be converted back to an intermediate layer and then to a createconfig. remote terminals are not supported yet. Signed-off-by: baude <bbaude@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-28 16:46:10 +0000