summaryrefslogtreecommitdiff
path: root/pkg/specgen
Commit message (Collapse)AuthorAge
* Add podman play kube --annotationDaniel J Walsh2022-03-09
| | | | | | | | | | Allow users to add annotions in the podman play kube command. This PR Also fixes the fact that annotations in the pod spec were not being passed down to containers. Fixes: https://github.com/containers/podman/issues/12968 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Set default rule at the head of device configurationHironori Shiina2022-03-07
| | | | | | | | The default rule should be set at the head of device configuration. Otherwise, rules for user devices are overridden by the default rule so that any access to the user devices are denied. Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
* Merge pull request #13157 from ydayagi/mainOpenShift Merge Robot2022-02-23
|\ | | | | play kube: set defaults to container resources
| * play kube: set defaults to container resourcesYaron Dayagi2022-02-23
| | | | | | | | | | | | | | | | | | | | this fixes https://github.com/containers/podman/issues/13115 the change tries to immitate k8s behavior. when limits are not set the container's limits are all CPU and all RAM when requests are missing then they are equal to limits Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | kube: honor mount propagation modeGiuseppe Scrivano2022-02-23
|/ | | | | | | convert the propagation mode specified for the mount to the expected Linux mount option. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Implement Podman Container Clonecdoern2022-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman container clone takes the id of an existing continer and creates a specgen from the given container's config recreating all proper namespaces and overriding spec options like resource limits and the container name if given in the cli options this command utilizes the common function DefineCreateFlags meaning that we can funnel as many create options as we want into clone over time allowing the user to clone with as much or as little of the original config as they want. container clone takes a second argument which is a new name and a third argument which is an image name to use instead of the original container's the current supported flags are: --destroy (remove the original container) --name (new ctr name) --cpus (sets cpu period and quota) --cpuset-cpus --cpu-period --cpu-rt-period --cpu-rt-runtime --cpu-shares --cpuset-mems --memory --run resolves #10875 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
* Merge pull request #12930 from cdoern/podCgroupOpenShift Merge Robot2022-02-04
|\ | | | | Podman pod create --share-parent vs --share=cgroup
| * Podman pod create --share-parent vs --share=cgroupcdoern2022-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | separated cgroupNS sharing from setting the pod as the cgroup parent, made a new flag --share-parent which sets the pod as the cgroup parent for all containers entering the pod remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent. resolves #12765 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
* | play kube envVar.valueFrom.resourceFieldRefYaron Dayagi2022-02-02
| | | | | | | | | | | | | | | | | | add support for env vars values from container resources see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core relates to issue https://github.com/containers/podman/issues/12756 Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | Merge pull request #13085 from ydayagi/mainOpenShift Merge Robot2022-02-01
|\ \ | | | | | | play kube envVar.valueFrom.fieldRef
| * | play kube envVar.valueFrom.fieldRefYaron Dayagi2022-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | add support for env vars values from pod spec fields see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core relates to issue https://github.com/containers/podman/issues/12756 Signed-off-by: Yaron Dayagi <ydayagi@redhat.com>
* | | Fix use of infra image to clarify defaultDaniel J Walsh2022-01-31
| | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | rootless: drop permission check for devicesGiuseppe Scrivano2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 350ede1eeb6ab33bce2918d7768b940c255e63c6 added the feature. Do not check whether the device is usable by the rootless user before adding to the container. Closes: https://github.com/containers/podman/issues/12704 [NO NEW TESTS NEEDED] it requires changes on the host to test it Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | pkg/specgen/generate/security: fix error messageKir Kolyshkin2022-01-24
|/ / | | | | | | | | | | | | | | | | This should be Network Namespace, not Host Namespace. [NO NEW TESTS NEEDED] Fixes: 0d70df11 Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | Merge pull request #12961 from rhatdan/codespellOpenShift Merge Robot2022-01-21
|\ \ | | | | | | Run codespell
| * | Run codespell on codeDaniel J Walsh2022-01-21
| | | | | | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #12948 from Luap99/rootless-networkingOpenShift Merge Robot2022-01-21
|\ \ \ | |/ / |/| | Remove rootless_networking option from containers.conf
| * | Remove rootless_networking option from containers.confPaul Holzinger2022-01-20
| |/ | | | | | | | | | | | | | | | | | | | | | | This field was only needed for machine to force cni, however you can set netns="bridge" in the config to have the same effect. This is already done in the machine setup. see https://github.com/containers/common/pull/895 [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* / Fix nil pointer dereference for configmap optionalOndra Machacek2022-01-21
|/ | | | | | | | This PR fixes nil pointer dereference for configmap optional parameter. When optional parameter is not passed, the code tried to acces the parameter which caused nil pointer dereference. Signed-off-by: Ondra Machacek <omachace@redhat.com>
* bump go module to version 4Valentin Rothberg2022-01-18
| | | | | | | | | | | | | Automated for .go files via gomove [1]: `gomove github.com/containers/podman/v3 github.com/containers/podman/v4` Remaining files via vgrep [2]: `vgrep github.com/containers/podman/v3` [1] https://github.com/KSubedi/gomove [2] https://github.com/vrothberg/vgrep Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Fix cgroup mode handling in api serverDaniel J Walsh2022-01-14
| | | | | | | | | Also change code to globably be consistent when refering to capatilized Cgroup. Fixed: https://github.com/containers/podman/issues/12550 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Standardize on capatalized CgroupsDaniel J Walsh2022-01-14
| | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #12825 from elezar/update-cdiOpenShift Merge Robot2022-01-14
|\ | | | | Update use of CDI API
| * Use new CDI APIEvan Lezar2022-01-14
| | | | | | | | | | | | | | This change updates the CDI API to commit 46367ec063fda9da931d050b308ccd768e824364 which addresses some inconistencies in the previous implementation. Signed-off-by: Evan Lezar <elezar@nvidia.com>
* | Merge pull request #12849 from cdoern/podProhibitOpenShift Merge Robot2022-01-14
|\ \ | |/ |/| Prohibit --uid/gid map and --pod for container create/run
| * Prohibit --uid/gid map and --pod for container create/runcdoern2022-01-13
| | | | | | | | | | | | | | | | | | add a check in namespaceOptions() that ensures the user is not setting a new uid/gid map if entering or creating a pod that has an infra container resolves #12669 Signed-off-by: cdoern <cdoern@redhat.com>
* | Merge pull request #12642 from Luap99/libnetworkOpenShift Merge Robot2022-01-13
|\ \ | | | | | | use libnetwork from c/common
| * | use libnetwork from c/commonPaul Holzinger2022-01-12
| |/ | | | | | | | | | | | | | | The libpod/network packages were moved to c/common so that buildah can use it as well. To prevent duplication use it in podman as well and remove it from here. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #12836 from cdoern/podSysCtlOpenShift Merge Robot2022-01-13
|\ \ | |/ |/| Podman Pod Create --sysctl support
| * Podman Pod Create --sysctl supportcdoern2022-01-12
| | | | | | | | | | | | | | | | | | | | added support for pod wide sysctls. The sysctls supported are the same as the continer run controls. These controls are only valid if the proper namespaces are shared within the pod, otherwise only the infra ctr gets the sysctl resolves #12747 Signed-off-by: cdoern <cdoern@redhat.com>
* | Add podman rm --dependDaniel J Walsh2022-01-11
| | | | | | | | | | | | | | | | | | | | | | This option causes Podman to not only remove the specified containers but all of the containers that depend on the specified containers. Fixes: https://github.com/containers/podman/issues/10360 Also ran codespell on the code Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | pkg: use PROXY_VARS from c/commonAditya Rajan2022-01-11
| | | | | | | | Signed-off-by: Aditya Rajan <arajan@redhat.com>
* | Don't add env if optional and not foundUrvashi Mohnani2022-01-10
|/ | | | | | | | If the pod yaml has env from secret and condifg map but they are optional and the secret cannot be found, don't add the env key as well as the env value will not be found. Matches behavior with k8s. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* fix healthcheck timeouts and ut8 coercionBrent Baude2022-01-06
| | | | | | | | | | | | | | | | | this commit fixes two bugs and adds regression tests. when getting healthcheck values from an image, if the image does not have a timeout defined, this resulted in a 0 value for timeout. The default as described in the man pages is 30s. when inspecting a container with a healthcheck command, a customer observed that the &, <, and > characters were being converted into a unicode escape value. It turns out json marshalling will by default coerce string values to ut8. Fixes: bz2028408 Signed-off-by: Brent Baude <bbaude@redhat.com>
* Pod Security Option supportcdoern2021-12-27
| | | | | | | | | | | | | Added support for pod security options. These are applied to infra and passed down to the containers as added (unless overridden). Modified the inheritance process from infra, creating a new function Inherit() which reads the config, and marshals the compatible options into an intermediate struct `InfraInherit` This is then unmarshaled into a container config and all of this is added to the CtrCreateOptions. Removes the need (mostly) for special additons which complicate the Container_create code and pod creation. resolves #12173 Signed-off-by: cdoern <cdoern@redhat.com>
* Merge pull request #12627 from rhatdan/passwdOpenShift Merge Robot2021-12-23
|\ | | | | Allow users to add host user accounts to /etc/passwd
| * Allow users to add host user accounts to /etc/passwdDaniel J Walsh2021-12-23
| | | | | | | | | | | | | | | | | | | | | | Some containers require certain user account(s) to exist within the container when they are run. This option will allow callers to add a bunch of passwd entries from the host to the container even if the entries are not in the local /etc/passwd file on the host. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935831 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | container creation: don't apply reserved annotations from imageValentin Rothberg2021-12-23
|/ | | | | | | | | | Do not apply reserved annotations from the image to the container. Reserved annotations are applied during container creation to retrieve certain information (e.g., custom seccomp profile or autoremoval) once a container has been created. Context: #12671 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Warn on use of --kernel-memoryDaniel J Walsh2021-12-22
| | | | | | | | | It has been deprecated and is no longer supported. Fully remove it and only print a warning if a user uses it. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2011695 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #12664 from cdoern/noManagePasswdOpenShift Merge Robot2021-12-22
|\ | | | | Podman run --passwd
| * Podman run --passwdcdoern2021-12-21
| | | | | | | | | | | | | | | | | | added support for a new flag --passwd which, when false prohibits podman from creating entries in /etc/passwd and /etc/groups allowing users to modify those files in the container entrypoint resolves #11805 Signed-off-by: cdoern <cdoern@redhat.com>
* | specgen: honor userns=auto from containers.confGiuseppe Scrivano2021-12-20
|/ | | | | | | | | when using the default userns value, make sure its value is parsed so that userns=auto is parsed and the options for the storage are filled. Closes: https://github.com/containers/podman/issues/12615 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* oci: configure the devices cgroup with default devicesGiuseppe Scrivano2021-12-16
| | | | | | | always set the default devices to the devices cgroup when not running in a user namespace. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* specgen: check that networks are only set with bridgePaul Holzinger2021-12-14
| | | | | | | | | | Because we cannot reqad the networking mode in the frontent because we should always use the server default we have to parse the mac and ip address to the server via a default network. Now when the server reads the default nsmode it has to reject the provided networks when the mode is not set to bridge. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* support advanced network configuration via cliPaul Holzinger2021-12-14
| | | | | | | | | | | | | | | | | | | | | | | | | | Rework the --network parse logic to support multiple networks with specific network configuration settings. --network can now be set multiple times. For bridge network mode the following options have been added: - **alias=name**: Add network-scoped alias for the container. - **ip=IPv4**: Specify a static ipv4 address for this container. - **ip=IPv6**: Specify a static ipv6 address for this container. - **mac=MAC**: Specify a static mac address address for this container. - **interface_name**: Specify a name for the created network interface inside the container. So now you can set --network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99 for the default bridge network as well as for network names. This is better than using --ip because we can set the ip per network without any confusion which network the ip address should be assigned to. The --ip, --mac-address and --network-alias options are still supported but --ip or --mac-address can only be set when only one network is set. This limitation already existed previously. The ability to specify a custom network interface name is new Fixes #11534 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Add new networks format to spegecenPaul Holzinger2021-12-14
| | | | | | | | Add the new networks format to specgen. For api users cni_networks is still supported to make migration easier however the static ip and mac fields are removed. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* network db: add new strucutre to container createPaul Holzinger2021-12-14
| | | | | | | | | | Make sure we create new containers in the db with the correct structure. Also remove some unneeded code for alias handling. We no longer need this functions. The specgen format has not been changed for now. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* --hostname should be set when using --pod new:foobarDaniel J Walsh2021-12-09
| | | | | | | | | | | | Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2030599 When you create pod, it shares the UTS namespace with Containers. Currently the --hostname is not passed to the pod created when you create a container and pod in the same command. Also fix error message on supported --share flags Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Update vendor or containers/common moving pkg/cgroups thereDaniel J Walsh2021-12-07
| | | | | | | [NO NEW TESTS NEEDED] This is just moving pkg/cgroups out so existing tests should be fine. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #12440 from umohnani8/cmOpenShift Merge Robot2021-12-03
|\ | | | | Add support for configmap volumes to play kube
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-26 18:29:38 +0000