summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Use file-based eventer for integration testsMatthew Heon2019-08-05
| | | | | | | | This adds several top-level Podman flags for specifying different events backend types, which are then used in CI. It resolves a number of serious issues with events-based testing. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Retrieve exit codes for containers via eventsMatthew Heon2019-08-05
| | | | | | | | | | | As we previously removed our exit code retrieval code to stop a memory leak, we need a new way of doing this. Fortunately, events is able to do the job for us. Signed-off-by: Matthew Heon <matthew.heon@pm.me> <Cherry-pick into 1.4.2> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* podman: fix memleak caused by renaming and not deletingMatthew Heon2019-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the exit file If the container exit code needs to be retained, it cannot be retained in tmpfs, because libpod runs in a memcg itself so it can't leave traces with a daemon-less design. This wasn't a memleak detectable by kmemleak for example. The kernel never lost track of the memory and there was no erroneous refcounting either. The reference count dependencies however are not easy to track because when a refcount is increased, there's no way to tell who's still holding the reference. In this case it was a single page of tmpfs pagecache holding a refcount that kept pinned a whole hierarchy of dying memcg, slab kmem, cgropups, unrechable kernfs nodes and the respective dentries and inodes. Such a problem wouldn't happen if the exit file was stored in a regular filesystem because the pagecache could be reclaimed in such case under memory pressure. The tmpfs page can be swapped out, but that's not enough to release the memcg with CONFIG_MEMCG_SWAP_ENABLED=y. No amount of more aggressive kernel slab shrinking could have solved this. Not even assigning slab kmem of dying cgroups to alive cgroup would fully solve this. The only way to free the memory of a dying cgroup when a struct page still references it, would be to loop over all "struct page" in the kernel to find which one is associated with the dying cgroup which is a O(N) operation (where N is the number of pages and can reach billions). Linking all the tmpfs pages to the memcg would cost less during memcg offlining, but it would waste lots of memory and CPU globally. So this can't be optimized in the kernel. A cronjob running this command can act as workaround and will allow all slab cache to be released, not just the single tmpfs pages. rm -f /run/libpod/exits/* This patch solved the memleak with a reproducer, booting with cgroup.memory=nokmem and with selinux disabled. The reason memcg kmem and selinux were disabled for testing of this fix, is because kmem greatly decreases the kernel effectiveness in reusing partial slab objects. cgroup.memory=nokmem is strongly recommended at least for workstation usage. selinux needs to be further analyzed because it causes further slab allocations. The upstream podman commit used for testing is 1fe2965e4f672674f7b66648e9973a0ed5434bb4 (v1.4.4). The upstream kernel commit used for testing is f16fea666898dbdd7812ce94068c76da3e3fcf1e (v5.2-rc6). Reported-by: Michele Baldessari <michele@redhat.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> <Applied with small tweaks to comments> Signed-off-by: Matthew Heon <matthew.heon@pm.me> <Further tweaks to cherry pick into 1.4.2> Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Merge pull request #3328 from mheon/storage_opts_for_cleanupOpenShift Merge Robot2019-06-15
|\ | | | | When creating exit command, pass storage options on
| * When creating exit command, pass storage options onMatthew Heon2019-06-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We made changes earlier that empty storage options when setting storage driver explicitly. Unfortunately, this breaks rootless cleanup commands, as they lose the fuse-overlayfs mount program path. Fix this by passing along the storage options to the cleanup process. Also, fix --syslog, which was broken a while ago (probably when we broke up main to add main_remote). Fixes #3326 Signed-off-by: Matthew Heon <mheon@redhat.com>
* | Merge pull request #3330 from mheon/remote_storageOpenShift Merge Robot2019-06-14
|\ \ | | | | | | Add --storage flag to 'podman rm' (local only)
| * | Add --storage flag to 'podman rm' (local only)Matthew Heon2019-06-13
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This flag switches to removing containers directly from c/storage and is mostly used to remove orphan containers. It's a superior solution to our former one, which attempted removal from storage under certain circumstances and could, under some conditions, not trigger. Also contains the beginning of support for storage in `ps` but wiring that in is going to be a much bigger pain. Fixes #3329. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3334 from vrothberg/fix-3331OpenShift Merge Robot2019-06-14
|\ \ | | | | | | pkg/apparmor: fix when AA is disabled
| * | pkg/apparmor: fix when AA is disabledValentin Rothberg2019-06-14
| | | | | | | | | | | | | | | | | | | | | | | | Do not try to load the default profile when AppArmor is disabled on the host. Fixes: #3331 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #3333 from jordemort/podman-commit-env-fixOpenShift Merge Robot2019-06-14
|\ \ \ | | | | | | | | Fix ENV parsing on `podman import`
| * | | Fix ENV parsing on `podman import`Jordan Webb2019-06-14
| |/ / | | | | | | | | | Signed-off-by: Jordan Webb <jordemort@github.com>
* | | Merge pull request #3252 from mtrmac/registries.conf-mirrorsOpenShift Merge Robot2019-06-14
|\ \ \ | |/ / |/| | Update containers/image to v2.0.0, and buildah to v1.8.4
| * | Use the logical registry location instead of the physical one in (podman info)Miloslav Trmač2019-06-14
| | | | | | | | | | | | Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Update containers/image to v2.0.0, and buildah to v1.8.4Miloslav Trmač2019-06-14
| |/ | | | | | | | | | | | | | | | | In c/image, this adds the the mirror-by-digest-only option to mirrors, and moves the search order to an independent list. A synchronized buildah update is necessary to deal with the c/image API change. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* | storage: support --mount type=bind,bind-nonrecursiveGiuseppe Scrivano2019-06-13
| | | | | | | | | | | | | | | | add support for not recursive bind mounts. Closes: https://github.com/containers/libpod/issues/3314 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | storage: fix typoGiuseppe Scrivano2019-06-13
|/ | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Merge pull request #3283 from haircommander/logging-play-kube-hotfixOpenShift Merge Robot2019-06-10
|\ | | | | Set a default log driver if none is specified
| * only set log driver if it isn't emptyPeter Hunt2019-06-08
| | | | | | | | | | | | Now, not setting a log driver in a create config correctly takes the default (k8s-logging) Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | Fix cgo includes for muslCameron Nemo2019-06-08
| | | | | | | | | | | | closes #3284 Signed-off-by: Cameron Nemo <cnemo@tutanota.com>
* | Merge pull request #3180 from mheon/inspect_volumesOpenShift Merge Robot2019-06-08
|\ \ | |/ |/| Begin to break up pkg/inspect
| * Begin to break up pkg/inspectMatthew Heon2019-06-03
| | | | | | | | | | | | | | | | | | | | Let's put inspect structs where they're actually being used. We originally made pkg/inspect to solve circular import issues. There are no more circular import issues. Image structs remain for now, I'm focusing on container inspect. Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #3271 from ↵OpenShift Merge Robot2019-06-07
|\ \ | | | | | | | | | | | | giuseppe/rootless-skip-ns-resolution-on-old-kernels rootless: skip NS_GET_PARENT on old kernels
| * | rootless: skip NS_GET_PARENT on old kernelsGiuseppe Scrivano2019-06-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on old kernels the ioctl NS_GET_PARENT is not available. Handle the error code and immediately return the same fd. It should be fine now that we use the namespace resolution using the conmon pid, so the namespace parent resolution is just a safety measure. Closes: https://github.com/containers/libpod/issues/2968 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #2272 from adrianreber/migrationOpenShift Merge Robot2019-06-07
|\ \ \ | |/ / |/| | Add support to migrate containers
| * | migration: add possibility to restore a container with a new nameAdrian Reber2019-06-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The option to restore a container from an external checkpoint archive (podman container restore -i /tmp/checkpoint.tar.gz) restores a container with the same name and same ID as id had before checkpointing. This commit adds the option '--name,-n' to 'podman container restore'. With this option the restored container gets the name specified after '--name,-n' and a new ID. This way it is possible to restore one container multiple times. If a container is restored with a new name Podman will not try to request the same IP address for the container as it had during checkpointing. This implicitly assumes that if a container is restored from a checkpoint archive with a different name, that it will be restored multiple times and restoring a container multiple times with the same IP address will fail as each IP address can only be used once. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Also download container images during restoreAdrian Reber2019-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If restoring a container from a checkpoint it was necessary that the image the container is based was already available (podman pull). This commit adds the image download to podman container restore if it does not exist. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | Added support to migrate containersAdrian Reber2019-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds an option to the checkpoint command to export a checkpoint into a tar.gz file as well as importing a checkpoint tar.gz file during restore. With all checkpoint artifacts in one file it is possible to easily transfer a checkpoint and thus enabling container migration in Podman. With the following steps it is possible to migrate a running container from one system (source) to another (destination). Source system: * podman container checkpoint -l -e /tmp/checkpoint.tar.gz * scp /tmp/checkpoint.tar.gz destination:/tmp Destination system: * podman pull 'container-image-as-on-source-system' * podman container restore -i /tmp/checkpoint.tar.gz The exported tar.gz file contains the checkpoint image as created by CRIU and a few additional JSON files describing the state of the checkpointed container. Now the container is running on the destination system with the same state just as during checkpointing. If the container is kept running on the source system with the checkpoint flag '-R', the result will be that the same container is running on two different hosts. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | Merge pull request #3231 from baude/remoteclientconfOpenShift Merge Robot2019-06-04
|\ \ \ | | | | | | | | podman-remote.conf enablement
| * | | podman-remote.conf enablementbaude2019-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add the ability for the podman remote client to use a configuration file which describes its connections. users can now define a connection the configuration and then call it by name like: podman-remote -c connection1 and the destination and user will be derived from the configuration file. if no -c is provided, we look for a connection in the configuration file designated as 'default'. If the configuration file has only one connection, it will be deemed the 'default'. Signed-off-by: baude <bbaude@redhat.com>
* | | | Merge pull request #3225 from haraldh/virtwriterOpenShift Merge Robot2019-06-04
|\ \ \ \ | | | | | | | | | | pkg/varlinkapi/virtwriter/virtwriter.go: simplify func Reader
| * | | | pkg/varlinkapi/virtwriter/virtwriter.go: simplify func ReaderHarald Hoyer2019-06-03
| | |_|/ | |/| | | | | | | | | | Signed-off-by: Harald Hoyer <harald@redhat.com>
* | | | Merge pull request #3251 from giuseppe/join-block-signalsOpenShift Merge Robot2019-06-04
|\ \ \ \ | |_|_|/ |/| | | rootless: block signals on re-exec
| * | | rootless: block signals on re-execGiuseppe Scrivano2019-06-03
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | we are allowed to use only signal safe functions between a fork of a multithreaded application and the next execve. Since setenv(3) is not signal safe, block signals. We are already doing it for creating a new namespace. This is mostly a cleanup since reexec_in_user_namespace_wait is used only only to join existing namespaces when we have not a pause.pid file. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3081 from baude/remotecommitOpenShift Merge Robot2019-06-03
|\ \ \ | |/ / |/| | podman remote-client commit
| * | podman remote-client commitbaude2019-05-30
| |/ | | | | | | | | | | | | add the ability to commit a container to an image using the remote client. Signed-off-by: baude <bbaude@redhat.com>
* | rootless: use TEMP_FAILURE_RETRY macroGiuseppe Scrivano2019-05-31
| | | | | | | | | | | | avoid checking for EINTR for every syscall that could block. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: fix return typeGiuseppe Scrivano2019-05-31
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: make sure the buffer is NUL terminatedGiuseppe Scrivano2019-05-31
| | | | | | | | | | | | | | after we read from the pause PID file, NUL terminate the buffer to avoid reading garbage from the stack. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3224 from haraldh/varlink_upgradeOpenShift Merge Robot2019-05-31
|\ \ | | | | | | Fix for varlink upgrade connections
| * | Fix the varlink upgraded callsHarald Hoyer2019-05-29
| | | | | | | | | | | | | | | | | | | | | | | | Although an upgraded call is requested, the server has to send at least one reply (can be an error) and the client has to check the reply, before assuming an upgraded connection. Signed-off-by: Harald Hoyer <harald@redhat.com>
* | | Merge pull request #3238 from mheon/no_tmpcopyup_devOpenShift Merge Robot2019-05-31
|\ \ \ | |_|/ |/| | Do not set tmpcopyup on /dev
| * | Do not set tmpcopyup on /devMatthew Heon2019-05-30
| |/ | | | | | | | | | | Fixes #3229 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #2709 from haircommander/journaldOpenShift Merge Robot2019-05-29
|\ \ | | | | | | Add libpod journald logging
| * | Added --log-driver and journald loggingPeter Hunt2019-05-28
| |/ | | | | | | Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | rootless: make JoinUserAndMountNS privateGiuseppe Scrivano2019-05-25
| | | | | | | | | | | | as it is used only by the rootless package now. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: enable loginctl lingerGiuseppe Scrivano2019-05-25
| | | | | | | | | | | | | | otherwise the processes we leave around will be killed once the session terminates. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: new function to join existing conmon processesGiuseppe Scrivano2019-05-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | move the logic for joining existing namespaces down to the rootless package. In main_local we still retrieve the list of conmon pid files and use it from the rootless package. In addition, create a temporary user namespace for reading these files, as the unprivileged user might not have enough privileges for reading the conmon pid file, for example when running with a different uidmap and root in the container is different than the rootless user. Closes: https://github.com/containers/libpod/issues/3187 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: block signals for pauseGiuseppe Scrivano2019-05-25
|/ | | | | | | block signals for the pause process, so it can't be killed by mistake. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* userns: add new option --userns=keep-idGiuseppe Scrivano2019-05-24
| | | | | | | it creates a namespace where the current UID:GID on the host is mapped to the same UID:GID in the container. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: store also the original GID in the hostGiuseppe Scrivano2019-05-23
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 16:41:37 +0000