summaryrefslogtreecommitdiff
path: root/pkg/specgen
Commit message (Collapse)AuthorAge
* Merge pull request #13587 from giuseppe/clone-to-podOpenShift Merge Robot2022-03-24
|\ | | | | container: allow clone to an existing pod
| * specgen: fix typoGiuseppe Scrivano2022-03-24
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request from GHSA-qvf8-p83w-v58jGiuseppe Scrivano2022-03-24
|\ \ | |/ |/| do not set the inheritable capabilities
| * do not set the inheritable capabilitiesGiuseppe Scrivano2022-03-23
| | | | | | | | | | | | | | | | | | The kernel never sets the inheritable capabilities for a process, they are only set by userspace. Emulate the same behavior. Closes: CVE-2022-27649 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | fix a number of errcheck issuesValentin Rothberg2022-03-22
| | | | | | | | | | | | Numerous issues remain, especially in tests/e2e. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | linter: enable wastedassignValentin Rothberg2022-03-22
| | | | | | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | go fmt: use go 1.18 conditional-build syntaxValentin Rothberg2022-03-18
| | | | | | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | podman create: building local pause image: do not read ignore filesValentin Rothberg2022-03-17
| | | | | | | | | | | | | | | | | | Make sure to ignore local {container,docker}ignore files when building a local pause image. Otherwise, we may mistakenly not be able to copy catatonit into the build container. Fixes: #13529 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | move k8s deps into podmanPaul Holzinger2022-03-15
| | | | | | | | | | | | | | | | We only need a small part of the k8s dependencies but they are the biggest dependencies in podman by far. Moving them into podman allows us to remove the unnecessary parts. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Add support for --chrootdirsLStandman2022-03-14
| | | | | | | | Signed-off-by: LStandman <65296484+LStandman@users.noreply.github.com>
* | Add podman play kube --annotationDaniel J Walsh2022-03-09
| | | | | | | | | | | | | | | | | | | | Allow users to add annotions in the podman play kube command. This PR Also fixes the fact that annotations in the pod spec were not being passed down to containers. Fixes: https://github.com/containers/podman/issues/12968 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Set default rule at the head of device configurationHironori Shiina2022-03-07
|/ | | | | | | | The default rule should be set at the head of device configuration. Otherwise, rules for user devices are overridden by the default rule so that any access to the user devices are denied. Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
* Merge pull request #13157 from ydayagi/mainOpenShift Merge Robot2022-02-23
|\ | | | | play kube: set defaults to container resources
| * play kube: set defaults to container resourcesYaron Dayagi2022-02-23
| | | | | | | | | | | | | | | | | | | | this fixes https://github.com/containers/podman/issues/13115 the change tries to immitate k8s behavior. when limits are not set the container's limits are all CPU and all RAM when requests are missing then they are equal to limits Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | kube: honor mount propagation modeGiuseppe Scrivano2022-02-23
|/ | | | | | | convert the propagation mode specified for the mount to the expected Linux mount option. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Implement Podman Container Clonecdoern2022-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman container clone takes the id of an existing continer and creates a specgen from the given container's config recreating all proper namespaces and overriding spec options like resource limits and the container name if given in the cli options this command utilizes the common function DefineCreateFlags meaning that we can funnel as many create options as we want into clone over time allowing the user to clone with as much or as little of the original config as they want. container clone takes a second argument which is a new name and a third argument which is an image name to use instead of the original container's the current supported flags are: --destroy (remove the original container) --name (new ctr name) --cpus (sets cpu period and quota) --cpuset-cpus --cpu-period --cpu-rt-period --cpu-rt-runtime --cpu-shares --cpuset-mems --memory --run resolves #10875 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
* Merge pull request #12930 from cdoern/podCgroupOpenShift Merge Robot2022-02-04
|\ | | | | Podman pod create --share-parent vs --share=cgroup
| * Podman pod create --share-parent vs --share=cgroupcdoern2022-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | separated cgroupNS sharing from setting the pod as the cgroup parent, made a new flag --share-parent which sets the pod as the cgroup parent for all containers entering the pod remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent. resolves #12765 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
* | play kube envVar.valueFrom.resourceFieldRefYaron Dayagi2022-02-02
| | | | | | | | | | | | | | | | | | add support for env vars values from container resources see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core relates to issue https://github.com/containers/podman/issues/12756 Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | Merge pull request #13085 from ydayagi/mainOpenShift Merge Robot2022-02-01
|\ \ | | | | | | play kube envVar.valueFrom.fieldRef
| * | play kube envVar.valueFrom.fieldRefYaron Dayagi2022-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | add support for env vars values from pod spec fields see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core relates to issue https://github.com/containers/podman/issues/12756 Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | | Fix use of infra image to clarify defaultDaniel J Walsh2022-01-31
| | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | rootless: drop permission check for devicesGiuseppe Scrivano2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 350ede1eeb6ab33bce2918d7768b940c255e63c6 added the feature. Do not check whether the device is usable by the rootless user before adding to the container. Closes: https://github.com/containers/podman/issues/12704 [NO NEW TESTS NEEDED] it requires changes on the host to test it Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | pkg/specgen/generate/security: fix error messageKir Kolyshkin2022-01-24
|/ / | | | | | | | | | | | | | | | | This should be Network Namespace, not Host Namespace. [NO NEW TESTS NEEDED] Fixes: 0d70df11 Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | Merge pull request #12961 from rhatdan/codespellOpenShift Merge Robot2022-01-21
|\ \ | | | | | | Run codespell
| * | Run codespell on codeDaniel J Walsh2022-01-21
| | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12948 from Luap99/rootless-networkingOpenShift Merge Robot2022-01-21
|\ \ \ | |/ / |/| | Remove rootless_networking option from containers.conf
| * | Remove rootless_networking option from containers.confPaul Holzinger2022-01-20
| |/ | | | | | | | | | | | | | | | | | | | | | | This field was only needed for machine to force cni, however you can set netns="bridge" in the config to have the same effect. This is already done in the machine setup. see https://github.com/containers/common/pull/895 [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* / Fix nil pointer dereference for configmap optionalOndra Machacek2022-01-21
|/ | | | | | | | This PR fixes nil pointer dereference for configmap optional parameter. When optional parameter is not passed, the code tried to acces the parameter which caused nil pointer dereference. Signed-off-by: Ondra Machacek <omachace@redhat.com>
* bump go module to version 4Valentin Rothberg2022-01-18
| | | | | | | | | | | | | Automated for .go files via gomove [1]: `gomove github.com/containers/podman/v3 github.com/containers/podman/v4` Remaining files via vgrep [2]: `vgrep github.com/containers/podman/v3` [1] https://github.com/KSubedi/gomove [2] https://github.com/vrothberg/vgrep Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Fix cgroup mode handling in api serverDaniel J Walsh2022-01-14
| | | | | | | | | Also change code to globably be consistent when refering to capatilized Cgroup. Fixed: https://github.com/containers/podman/issues/12550 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Standardize on capatalized CgroupsDaniel J Walsh2022-01-14
| | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #12825 from elezar/update-cdiOpenShift Merge Robot2022-01-14
|\ | | | | Update use of CDI API
| * Use new CDI APIEvan Lezar2022-01-14
| | | | | | | | | | | | | | This change updates the CDI API to commit 46367ec063fda9da931d050b308ccd768e824364 which addresses some inconistencies in the previous implementation. Signed-off-by: Evan Lezar <elezar@nvidia.com>
* | Merge pull request #12849 from cdoern/podProhibitOpenShift Merge Robot2022-01-14
|\ \ | |/ |/| Prohibit --uid/gid map and --pod for container create/run
| * Prohibit --uid/gid map and --pod for container create/runcdoern2022-01-13
| | | | | | | | | | | | | | | | | | add a check in namespaceOptions() that ensures the user is not setting a new uid/gid map if entering or creating a pod that has an infra container resolves #12669 Signed-off-by: cdoern <cdoern@redhat.com>
* | Merge pull request #12642 from Luap99/libnetworkOpenShift Merge Robot2022-01-13
|\ \ | | | | | | use libnetwork from c/common
| * | use libnetwork from c/commonPaul Holzinger2022-01-12
| |/ | | | | | | | | | | | | | | The libpod/network packages were moved to c/common so that buildah can use it as well. To prevent duplication use it in podman as well and remove it from here. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #12836 from cdoern/podSysCtlOpenShift Merge Robot2022-01-13
|\ \ | |/ |/| Podman Pod Create --sysctl support
| * Podman Pod Create --sysctl supportcdoern2022-01-12
| | | | | | | | | | | | | | | | | | | | added support for pod wide sysctls. The sysctls supported are the same as the continer run controls. These controls are only valid if the proper namespaces are shared within the pod, otherwise only the infra ctr gets the sysctl resolves #12747 Signed-off-by: cdoern <cdoern@redhat.com>
* | Add podman rm --dependDaniel J Walsh2022-01-11
| | | | | | | | | | | | | | | | | | | | | | This option causes Podman to not only remove the specified containers but all of the containers that depend on the specified containers. Fixes: https://github.com/containers/podman/issues/10360 Also ran codespell on the code Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | pkg: use PROXY_VARS from c/commonAditya Rajan2022-01-11
| | | | | | | | Signed-off-by: Aditya Rajan <arajan@redhat.com>
* | Don't add env if optional and not foundUrvashi Mohnani2022-01-10
|/ | | | | | | | If the pod yaml has env from secret and condifg map but they are optional and the secret cannot be found, don't add the env key as well as the env value will not be found. Matches behavior with k8s. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* fix healthcheck timeouts and ut8 coercionBrent Baude2022-01-06
| | | | | | | | | | | | | | | | | this commit fixes two bugs and adds regression tests. when getting healthcheck values from an image, if the image does not have a timeout defined, this resulted in a 0 value for timeout. The default as described in the man pages is 30s. when inspecting a container with a healthcheck command, a customer observed that the &, <, and > characters were being converted into a unicode escape value. It turns out json marshalling will by default coerce string values to ut8. Fixes: bz2028408 Signed-off-by: Brent Baude <bbaude@redhat.com>
* Pod Security Option supportcdoern2021-12-27
| | | | | | | | | | | | | Added support for pod security options. These are applied to infra and passed down to the containers as added (unless overridden). Modified the inheritance process from infra, creating a new function Inherit() which reads the config, and marshals the compatible options into an intermediate struct `InfraInherit` This is then unmarshaled into a container config and all of this is added to the CtrCreateOptions. Removes the need (mostly) for special additons which complicate the Container_create code and pod creation. resolves #12173 Signed-off-by: cdoern <cdoern@redhat.com>
* Merge pull request #12627 from rhatdan/passwdOpenShift Merge Robot2021-12-23
|\ | | | | Allow users to add host user accounts to /etc/passwd
| * Allow users to add host user accounts to /etc/passwdDaniel J Walsh2021-12-23
| | | | | | | | | | | | | | | | | | | | | | Some containers require certain user account(s) to exist within the container when they are run. This option will allow callers to add a bunch of passwd entries from the host to the container even if the entries are not in the local /etc/passwd file on the host. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935831 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | container creation: don't apply reserved annotations from imageValentin Rothberg2021-12-23
|/ | | | | | | | | | Do not apply reserved annotations from the image to the container. Reserved annotations are applied during container creation to retrieve certain information (e.g., custom seccomp profile or autoremoval) once a container has been created. Context: #12671 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Warn on use of --kernel-memoryDaniel J Walsh2021-12-22
| | | | | | | | | It has been deprecated and is no longer supported. Fully remove it and only print a warning if a user uses it. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2011695 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #12664 from cdoern/noManagePasswdOpenShift Merge Robot2021-12-22
|\ | | | | Podman run --passwd
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-28 14:32:34 +0000