summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Implement conmon execPeter Hunt2019-07-22
| | | | | | | | | | | | | | | | | | | | | | This includes: Implement exec -i and fix some typos in description of -i docs pass failed runtime status to caller Add resize handling for a terminal connection Customize exec systemd-cgroup slice fix healthcheck fix top add --detach-keys Implement podman-remote exec (jhonce) * Cleanup some orphaned code (jhonce) adapt remote exec for conmon exec (pehunt) Fix healthcheck and exec to match docs Introduce two new OCIRuntime errors to more comprehensively describe situations in which the runtime can error Use these different errors in branching for exit code in healthcheck and exec Set conmon to use new api version Signed-off-by: Jhon Honce <jhonce@redhat.com> Signed-off-by: Peter Hunt <pehunt@redhat.com>
* Merge pull request #3562 from baude/golangcilint3OpenShift Merge Robot2019-07-22
|\ | | | | golangci-lint round #3
| * golangci-lint round #3baude2019-07-21
| | | | | | | | | | | | | | this is the third round of preparing to use the golangci-lint on our code base. Signed-off-by: baude <bbaude@redhat.com>
* | Remove debug messageDaniel J Walsh2019-07-20
|/ | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Add support for listing read/only and read/write imagesDaniel J Walsh2019-07-19
| | | | | | | When removing --all images prune images only attempt to remove read/write images, ignore read/only images Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #3443 from adrianreber/rootfs-changes-migrationOpenShift Merge Robot2019-07-19
|\ | | | | Include changes to the container's root file-system in the checkpoint archive
| * Add --ignore-rootfs option for checkpoint/restoreAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The newly added functionality to include the container's root file-system changes into the checkpoint archive can now be explicitly disabled. Either during checkpoint or during restore. If a container changes a lot of files during its runtime it might be more effective to migrated the root file-system changes in some other way and to not needlessly increase the size of the checkpoint archive. If a checkpoint archive does not contain the root file-system changes information it will automatically be skipped. If the root file-system changes are part of the checkpoint archive it is also possible to tell Podman to ignore these changes. Signed-off-by: Adrian Reber <areber@redhat.com>
| * Include root file-system changes in container migrationAdrian Reber2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One of the last limitations when migrating a container using Podman's 'podman container checkpoint --export=/path/to/archive.tar.gz' was that it was necessary to manually handle changes to the container's root file-system. The recommendation was to mount everything as --tmpfs where the root file-system was changed. This extends the checkpoint export functionality to also include all changes to the root file-system in the checkpoint archive. The checkpoint archive now includes a tarstream of the result from 'podman diff'. This tarstream will be applied to the restored container before restoring the container. With this any container can now be migrated, even it there are changes to the root file-system. There was some discussion before implementing this to base the root file-system migration on 'podman commit', but it seemed wrong to do a 'podman commit' before the migration as that would change the parent layer the restored container is referencing. Probably not really a problem, but it would have meant that a migrated container will always reference another storage top layer than it used to reference during initial creation. Signed-off-by: Adrian Reber <areber@redhat.com>
* | Merge pull request #3593 from giuseppe/rootless-privileged-devicesOpenShift Merge Robot2019-07-18
|\ \ | | | | | | rootless: add host devices with --privileged
| * | rootless: add rw devices with --privilegedGiuseppe Scrivano2019-07-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | when --privileged is specified, add all the devices that are usable by the user. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1730773 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3584 from QiWang19/pssizeOpenShift Merge Robot2019-07-18
|\ \ \ | | | | | | | | podman-remote make --size optional in ps
| * | | podman-remote make --size optional in psQi Wang2019-07-18
| | | | | | | | | | | | | | | | | | | | | | | | Close #3578 Add `size` field to PsOpts in podman remote to receive size as an option. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | | Merge pull request #3509 from giuseppe/cgroup-namespaceOpenShift Merge Robot2019-07-18
|\ \ \ \ | | | | | | | | | | libpod: support for cgroup namespace
| * | | | libpod: support for cgroup namespaceGiuseppe Scrivano2019-07-18
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | allow a container to run in a new cgroup namespace. When running in a new cgroup namespace, the current cgroup appears to be the root, so that there is no way for the container to access cgroups outside of its own subtree. By default it uses --cgroup=host to keep the previous behavior. To create a new namespace, --cgroup=private must be provided. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / | | Add DefaultContent API to retrieve apparmor profile contentSascha Grunert2019-07-18
|/ / / | | | | | | | | | | | | | | | | | | | | | The default apparmor profile is not stored on disk which causes confusion when debugging the content of the profile. To solve this, we now add an additional API which returns the profile as byte slice. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* | | Merge pull request #3522 from mheon/nix_the_artifactOpenShift Merge Robot2019-07-18
|\ \ \ | | | | | | | | Move the HostConfig portion of Inspect inside libpod
| * | | Populate inspect with security-opt settingsMatthew Heon2019-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can infer no-new-privileges. For now, manually populate seccomp (can't infer what file we sourced from) and SELinux/Apparmor (hard to tell if they're enabled or not). Signed-off-by: Matthew Heon <mheon@redhat.com>
| * | | Move the HostConfig portion of Inspect inside libpodMatthew Heon2019-07-17
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we first began writing Podman, we ran into a major issue when implementing Inspect. Libpod deliberately does not tie its internal data structures to Docker, and stores most information about containers encoded within the OCI spec. However, Podman must present a CLI compatible with Docker, which means it must expose all the information in 'docker inspect' - most of which is not contained in the OCI spec or libpod's Config struct. Our solution at the time was the create artifact. We JSON'd the complete CreateConfig (a parsed form of the CLI arguments to 'podman run') and stored it with the container, restoring it when we needed to run commands that required the extra info. Over the past month, I've been looking more at Inspect, and refactored large portions of it into Libpod - generating them from what we know about the OCI config and libpod's (now much expanded, versus previously) container configuration. This path comes close to completing the process, moving the last part of inspect into libpod and removing the need for the create artifact. This improves libpod's compatability with non-Podman containers. We no longer require an arbitrarily-formatted JSON blob to be present to run inspect. Fixes: #3500 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Merge pull request #3588 from haircommander/play-kube-commandOpenShift Merge Robot2019-07-18
|\ \ \ | |/ / |/| | Fix play kube command
| * | Fix play kube commandPeter Hunt2019-07-17
| | | | | | | | | | | | | | | | | | | | | Before, play kube wasn't properly setting the command. Fix this Also, begin a dedicated test suite for play kube to catch regressions like this in the future Signed-off-by: Peter Hunt <pehunt@redhat.com>
* | | spec: rework --ulimit hostGiuseppe Scrivano2019-07-17
|/ / | | | | | | | | | | | | it seems enough to not specify any ulimit block to maintain the host limits. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3531 from haraldh/fix_ReplySendFileOpenShift Merge Robot2019-07-15
|\ \ | | | | | | Fix the double replySendFile()
| * | Fix the double replySendFile()Harald Hoyer2019-07-12
| | | | | | | | | | | | Signed-off-by: Harald Hoyer <harald@redhat.com>
* | | Merge pull request #3564 from giuseppe/cgroupsv2-no-controllers-last-pathOpenShift Merge Robot2019-07-13
|\ \ \ | | | | | | | | cgroupsv2: do not enable controllers for the last component
| * | | cgroupsv2: do not enable controllers for the last componentGiuseppe Scrivano2019-07-12
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | do not automatically enable the controllers for the last path component. It is necessary as once there are enabled controllers in a cgroup, it won't possible to add processes to it. Fix conmon being moved to the correct cgroup path when using --cgroup-manager cgroupfs. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3563 from giuseppe/fix-single-mapping-rootlessOpenShift Merge Robot2019-07-12
|\ \ \ | | | | | | | | spec: fix userns with less than 5 gids
| * | | spec: fix userns with less than 5 gidsGiuseppe Scrivano2019-07-12
| |/ / | | | | | | | | | | | | | | | | | | when the container is running in a user namespace, check if gid=5 is available, otherwise drop the option gid=5 for /dev/pts. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3537 from QiWang19/volumeabsOpenShift Merge Robot2019-07-12
|\ \ \ | |_|/ |/| | fix bug convert volume host path to absolute
| * | fix bug convert volume host path to absoluteQi Wang2019-07-10
| | | | | | | | | | | | | | | | | | fix #3504 If --volume host:dest host is not a named volume, convert the host to a absolute directory path. Signed-off-by: Qi Wang <qiwan@redhat.com>
* | | Merge pull request #3552 from baude/golangcilint2OpenShift Merge Robot2019-07-11
|\ \ \ | | | | | | | | golangci-lint pass number 2
| * | | golangci-lint pass number 2baude2019-07-11
| | |/ | |/| | | | | | | | | | | | | clean up and prepare to migrate to the golangci-linter Signed-off-by: baude <bbaude@redhat.com>
* | | Merge pull request #3491 from giuseppe/rlimit-hostOpenShift Merge Robot2019-07-11
|\ \ \ | | | | | | | | podman: add --ulimit host
| * | | podman: add --ulimit hostGiuseppe Scrivano2019-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add a simple way to copy ulimit values from the host. if --ulimit host is used then the current ulimits in place are copied to the container. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | cgroups: fix a leak when using cgroupfsGiuseppe Scrivano2019-07-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | be sure to load all the existing handlers, so that they can also be freed in addition to the handlers we treat differently. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | cgroups: attempt a recursive rmdirGiuseppe Scrivano2019-07-11
| |/ / |/| | | | | | | | | | | | | | | | | if the cgroup cannot be deleted, then attempt to delete all its subdirectories and try again. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #3521 from baude/golangcilint1OpenShift Merge Robot2019-07-11
|\ \ \ | | | | | | | | first pass of corrections for golangci-lint
| * | | first pass of corrections for golangci-lintbaude2019-07-10
| | |/ | |/| | | | | | | Signed-off-by: baude <bbaude@redhat.com>
* / | account for varlink calls that dont use morebaude2019-07-10
|/ / | | | | | | | | | | | | | | | | | | | | the commit and pull varlink endpoints were not working correctly when 'more' was not being specified. Fixes: #3317 Fixes: #3318 Fixes: #3526 Signed-off-by: baude <bbaude@redhat.com>
* | cgroups: skip not existing cpuacct filesGiuseppe Scrivano2019-07-10
| | | | | | | | | | | | | | | | if the cpuacct file doesn't exist, ignore it instead of erroring out. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1728242 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | cgroups: support creating cgroupsv2 pathsGiuseppe Scrivano2019-07-10
| | | | | | | | | | | | | | | | | | drop the limitation of not supporting creating new cgroups v2 paths. Every controller enabled /sys/fs/cgroup will be propagated down to the created path. This won't work for rootless cgroupsv2, but it is not an issue for now, as this code is used only by CRI-O. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3497 from QazerLab/bugfix/systemd-generate-pidfileOpenShift Merge Robot2019-07-08
|\ \ | |/ |/| Use conmon pidfile in generated systemd unit as PIDFile.
| * Do not hardcode podman binary location in generate systemd.Danila Kiver2019-07-07
| | | | | | | | | | | | | | | | It is not correct to rely on specific location of the podman binary. In most cases it is /usr/bin/podman, but sometimes is not (e.g. in system tests). Use /proc/self/exe instead of hardcoded path. Signed-off-by: Danila Kiver <danila.kiver@mail.ru>
| * Use conmon pidfile in generated systemd unit as PIDFile.Danila Kiver2019-07-04
| | | | | | | | | | | | | | | | | | | | | | By default, podman points PIDFile in generated unit file to non-existent location. As a result, the unit file, generated by podman, is broken: an attempt to start this unit without prior modification results in a crash, because systemd can not find the pidfile of service's main process. Fix the value of "PIDFile" and add a system test for this case. Signed-off-by: Danila Kiver <danila.kiver@mail.ru>
* | trivial cleanups from golangbaude2019-07-03
|/ | | | | | the results of a code cleanup performed by the goland IDE. Signed-off-by: baude <bbaude@redhat.com>
* Merge pull request #3437 from giuseppe/fix-nocgoOpenShift Merge Robot2019-07-03
|\ | | | | build: allow to build without cgo on RISC-V
| * spec: move cgo stuff to their own fileGiuseppe Scrivano2019-07-02
| | | | | | | | | | | | so it can build without cgo since seccomp requires it. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * rootless: allow to build without cgoGiuseppe Scrivano2019-07-02
| | | | | | | | | | | | | | unfortunately rootless won't work without cgo, as most of the implementation is in C, but at least allow to build libpod. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #3465 from baude/nostoreOpenShift Merge Robot2019-07-03
|\ \ | | | | | | configure runtime without store
| * | configure runtime without storebaude2019-07-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | some podman commands do not require the use of a container/image store. in those cases, it is more effecient to not open the store, because that results in having to also close the store which can be costly when the system is under heavy write I/O loads. Signed-off-by: baude <bbaude@redhat.com>
* | | cgroups: fix times conversionGiuseppe Scrivano2019-07-02
| |/ |/| | | | | | | | | convert the time we read in microseconds to nanoseconds. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-29 15:43:20 +0000