summaryrefslogtreecommitdiff
path: root/pkg/machine/ignition.go
Commit message (Collapse)AuthorAge
* MacOS improvementsBrent Baude2022-03-07
| | | | | | | | * Enable support of virtfs in Podman and darwin. At the time of this writing, it requires a special patch not yet included in upstream qemu. * Prefer to use a specially built qemu to support virtfs. The qemu is installed under libexec/podman. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* ignition: propagate proxy settings from a host into a vmesendjer2022-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Set proxy settings (such as `HTTP_PROXY`, and others) for the whole guest OS with setting up `DefaultEnvironment` with a `systemd` configuration file `default-env.conf`, a `profile.d` scenario file - `default-env.sh` and a `environment.d` configuration file `default-env.conf` The **actual** environment variables are read by podman at a start, then they are encrypted with base64 into a single string and after are provided into a VM through QEMU Firmware Configuration (fw_cfg) Device Inside a VM a systemd service `envset-fwcfg.service` reads the providead encrypted string from fw_cfg, decrypts and then adds to the files - `/etc/systemd/system.conf.d/default-env.conf` - `/etc/profile.d/default-env.sh` - `/etc/environment.d/default-env.conf` At the end this service execute `systemctl daemon-reload` to propagate new variables for systemd manager [NO NEW TESTS NEEDED] Closes #13168 Signed-off-by: esendjer <esendjer@gmail.com>
* ignition, machine: delegate cpu,io cgroup controllers to machine's default usersAditya R2022-01-28
| | | | | | | | | | | | | | | | Makes sure that ignition setups up systemd config so cgroup controllers like `cpu, io` are also delegated to `non-root` along with `memory, pid`. This allows general users of `podman` on `macOS` and `podman-remote` to do operations which are dependent on `cpu, io` cgroup controllers. [NO TESTS NEEDED] [NO NEW TESTS NEEDED] We don't have a CI infra to test this, please pull the tree and run `podman info` inside the machine to confirm. Signed-off-by: Aditya R <arajan@redhat.com>
* Remove rootless_networking option from containers.confPaul Holzinger2022-01-20
| | | | | | | | | | | | This field was only needed for machine to force cni, however you can set netns="bridge" in the config to have the same effect. This is already done in the machine setup. see https://github.com/containers/common/pull/895 [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Recursively copy cert files.Andrzej Klajnert2022-01-15
| | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Andrzej Klajnert <github@aklajnert.pl>
* pkg: use PROXY_VARS from c/commonAditya Rajan2022-01-11
| | | | Signed-off-by: Aditya Rajan <arajan@redhat.com>
* ignition: add support from setting SSL_CERT_FILEAditya Rajan2022-01-11
| | | | | | | | | | | | | Podman often has to run behind an http/https proxy, often in corporate environments. This proxy may or may not include SSL inspection capabilities, requiring a trusted SSL CA certificate to be added to a system's trust store. Copy the file referred to by SSL_CERT_FILE on the host into the podman machine's OS trust store, overriding the built-in single-file trust store certificate. Also set the `SSL_FILE_CERT` on remote machine [NO NEW TESTS NEEDED] Signed-off-by: Aditya Rajan <arajan@redhat.com>
* ignition: propogate HTTP proxy variables from host to remoteAditya Rajan2022-01-11
| | | | | | | | | | | Podman often has to run behind an http/https proxy, often in corporate environments. This proxy may or may not include SSL inspection capabilities, requiring a trusted SSL CA certificate to be added to a system's trust store. Solve this by reading standard proxy variables (HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy) and injecting them into the machine at init. [NO NEW TESTS NEEDED] Signed-off-by: Aditya Rajan <arajan@redhat.com>
* ignition: add certs from current user into the machine while initAditya Rajan2021-12-27
| | | | | | | | | | | | | Following PR ensures that certs from `~/.config/containers/certs.d` or `~/.config/docker/certs.d` are copied into the remote machine at `/etc/containers/certs.d/` As a result on platforms like `macOS` where podman works with a remote machine setup. User's local certs must be transferd to VM without any plumbing needed by user. [NO-NEW-TESTS-NEEDED] Signed-off-by: Aditya Rajan <arajan@redhat.com>
* Introduce Windows WSL implementation of podman machineJason T. Greene2021-12-24
| | | | | | [NO NEW TESTS NEEDED] for now Signed-off-by: Jason Greene <jason.greene@redhat.com>
* Set machine timezoneBrent Baude2021-12-16
| | | | | | | | | | | | | | Added an option to podman machine init to declare the timezone of the resulting machine. the default is to use the value of the host name or else a given timezone name like America/Chicago. Fixes: #11895 Signed-off-by: Brent Baude <bbaude@redhat.com> [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* systemd: replace multi-user with default.targetValentin Rothberg2021-11-30
| | | | | | | | | | Replace `multi-user.target` with `default.target` across the code base. It seems like the multi-user one is not available for (rootless) users on F35 anymore is causing issues in all kinds of ways, for instance, enabling the podman.service or generated systemd units. Fixes: #12438 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* podman machine start wait for sshPaul Holzinger2021-11-16
| | | | | | | | | | | | Wait for sshd to be ready before we return from start. This should make podman machine ssh immediately available without any race conditions. Fixes #11532 [NO NEW TESTS NEEDED] I could not reproduce the issue so I am not sure if this fixes it. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Set DOCKER_HOST in the VMMatej Vasek2021-10-23
| | | | | | [NO TESTS NEEDED] Signed-off-by: Matej Vasek <mvasek@redhat.com>
* Disable docker and alias to podman in FCOS ignitionJason T. Greene2021-09-24
| | | | | Signed-off-by: Jason Greene <jason.greene@redhat.com> Co-authored-by: Dusty Mabe <dusty@dustymabe.com>
* machine: set filemodes in octalValentin Rothberg2021-09-10
| | | | | | | | | By popular request, turn decimals to octal. Most eyes are trained to parse file permissions in octal. [NO TESTS NEEDED] since machine isn't tested yet. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* podman machine: enforce a single search registryValentin Rothberg2021-09-10
| | | | | | | | | | Enforce "docker.io" to be the only search registry. Short-name resolution for remote clients is not fully supported since there is no means to prompt. Enforcing a single registry works around the problem since prompting only fires with more than one search registry. Fixes: #11489 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Spell "build linux darwin" as "build !windows".Maya Rashish2021-09-03
| | | | | | | | | Equivalent for supported platforms, and makes it easier to support additional unix-like OSes. [NO TESTS NEEDED] Signed-off-by: Maya Rashish <maya@NetBSD.org>
* Fix build tags for pkg/machine...Paul Holzinger2021-06-10
| | | | | | | | | | | | Podman machine is only intended for amd64 and arm64 architectures, set the correct buildtags so that the `pkg/machine`, `pkg/machine/qemu` and `pkg/machine/libvirt` packages compile correctly. [NO TESTS NEEDED] Fixes #10625 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Enable port forwarding on hostBrent Baude2021-06-01
| | | | | | | | | | | Using the gvproxy application on the host, we can now port forward from the machine vm on the host. It requires that 'gvproxy' be installed in an executable location. gvproxy can be found in the containers/gvisor-tap-vsock github repo. [NO TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* Add machine-enabled to containers.conf for machineAshley Cui2021-04-23
| | | | | | | | | | | Add machine-enabled=true into /etc/containers/containers.conf when initing a VM. This field should tell Podman it's being run in a podman-machine and it will be used in future to tell podman to set up other necessary machine stuff such as networking [NO TESTS NEEDED] Signed-off-by: Ashley Cui <acui@redhat.com>
* Add ssh connection to root userAshley Cui2021-04-01
| | | | | | | | | | When initing a VM, create two add connections - one to user, one to root. podman machine remove removes both connections as well. [NO TESTS NEEDED] Signed-off-by: Ashley Cui <acui@redhat.com>
* Podman machine enhancementsbaude2021-03-27
| | | | | | | | | | | | | | | | | | | Podman machine remove is now called `rm`. Podman machine create now supports resizing the image to the value of --disk-size as provided. The default is to 10G. Added systemd unit file on guest via ignition that sends a Ready message to the host over a virtio-socket so that we know when the VM is booted and ready for use. Podman machine commands no longer require a VM name as an argument. A default VM name is defined and if no VM name is provided as a arg, the default will be used. [NO TESTS NEEDED] Signed-off-by: baude <bbaude@redhat.com>
* introduce podman machinebaude2021-03-25
podman machine allows podman to create, manage, and interact with a vm running some form of linux (default is fcos). podman is then configured to be able to interact with the vm automatically. while this is usable on linux, the real push is to get this working on both current apple architectures in macos. Ashley Cui contributed to this PR and was a great help. [NO TESTS NEEDED] Signed-off-by: baude <bbaude@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-04 14:25:21 +0000