summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Fix race conditions in rootless cni setupPaul Holzinger2021-07-15
| | | | | | | | | | | | | | | | | | | | There was an race condition when calling `GetRootlessCNINetNs()`. It created the rootless cni directory before it got locked. Therefore another process could have called cleanup and removed this directory before it was used resulting in errors. The lockfile got moved into the XDG_RUNTIME_DIR directory to prevent a panic when the parent dir was removed by cleanup. Fixes #10930 Fixes #10922 To make this even more robust `GetRootlessCNINetNs()` will now return locked. This guarantees that we can run `Do()` after `GetRootlessCNINetNs()` before another process could have called `Cleanup()` in between. [NO TESTS NEEDED] CI is flaking, hopefully this will fix it. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Support uid,gid,mode options for secretsAshley Cui2021-07-12
| | | | | | | Support UID, GID, Mode options for mount type secrets. Also, change default secret permissions to 444 so all users can read secret. Signed-off-by: Ashley Cui <acui@redhat.com>
* Fix volumes with uid and gid optionsPaul Holzinger2021-06-25
| | | | | | | | | | | | | | | | Podman uses the volume option map to check if it has to mount the volume or not when the container is started. Commit 28138dafcc39 added to uid and gid options to this map, however when only uid/gid is set we cannot mount this volume because there is no filesystem or device specified. Make sure we do not try to mount the volume when only the uid/gid option is set since this is a simple chown operation. Also when a uid/gid is explicity set, do not chown the volume based on the container user when the volume is used for the first time. Fixes #10620 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fix handling of podman-remote build --deviceDaniel J Walsh2021-06-24
| | | | | | Fixes: https://github.com/containers/podman/issues/10614 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Add support for podman remote build -f - .Daniel J Walsh2021-06-24
| | | | | | Fixes: https://github.com/containers/podman/issues/10621 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix panic condition in cgroups.getAvailableControllerszhangguanzhang2021-06-24
| | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
* Fix resize race with podman exec -itPaul Holzinger2021-06-24
| | | | | | | | | | | When starting a process with `podman exec -it` the terminal is resized after the process is started. To fix this allow exec start to accept the terminal height and width as parameter and let it resize right before the process is started. Fixes #10560 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fix documentation of the --format option of podman pushMiloslav Trmač2021-06-24
| | | | | | | | It affects all transports; and without --format, we try several manifest formats. [NO TESTS NEEDED] Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Health Check is not handled in the compat LibpodToContainerJSONcdoern2021-06-24
| | | | | | | | | | | | Added parsing and handling for the healthCheck status within containers.go. Also modified tests fixes #10457 Signed-off-by: cdoern <cbdoer23@g.holycross.edu> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <mheon@redhat.com>
* create: support images with invalid platformValentin Rothberg2021-06-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Much to my regret, there is a number of images in the wild with invalid platforms breaking the platform checks in libimage that want to make sure that a local image is matching the expected platform. Imagine a `podman run --arch=arm64 fedora` with a local amd64 fedora image. We really shouldn't use the local one in this case and pull down the arm64 one. The strict platform checks in libimage in combination with invalid platforms in images surfaced in Podman being able to pull an image but failing to look it up in subsequent presence checks. A `podman run` would hence pull such an image but fail to create the container. Support images with invalid platforms by vendoring the latest HEAD from containers/common. Also remove the partially implemented pull-policy logic from Podman and let libimage handle that entirely. However, whenever --arch, --os or --platform are specified, the pull policy will be forced to "newer". This way, we pessimistically assume that the local image has an invalid platform and we reach out to the registry. If there's a newer image (i.e., one with a different digest), we'll pull it down. Please note that most of the logic has either already been implemented in libimage or been moved down which allows for removing some clutter from Podman. [NO TESTS NEEDED] since c/common has new tests. Podman can rely on the existing tests. Fixes: #10648 Fixes: #10682 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Fall back to string for dockerfile parameterAlex Schultz2021-06-14
| | | | | | | | | | | a9cb824981db3fee6b8445b29e513c89e9b9b00b changed the expectations of the dockerfile parameter to be json data however it's a string. In order to support both, let's attempt json and fall back to a string if the json parsing fails. Closes #10660 Signed-off-by: Alex Schultz <aschultz@redhat.com>
* remote events: fix --stream=falseValentin Rothberg2021-06-11
| | | | | | | | | | | Fix a bug in remote events where only one event would be sent if when streaming is turned off. The source of the bug was that the handler attempted to implement the streaming logic and did it wrong. The fix is rather simple by removing this logic from the handler and let the events backend handle streaming. Fixes: #10529 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* [CI:DOCS] fix incorrect network remove api docPaul Holzinger2021-06-11
| | | | | | | | The endpoint returns an array and not a single entry. Fixes #10494 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* remote: always send resize before the container startsPaul Holzinger2021-06-11
| | | | | | | | | | | | | | | | | There is race condition in the remote client attach logic. Because the resize api call was handled in an extra goroutine the container was started before the resize call happend. To fix this we have to call resize in the same goroutine as attach. When the first resize is done start a goroutine to listen on SIGWINCH in the background and resize again if the signal is received. Fixes #9859 Signed-off-by: Paul Holzinger <pholzing@redhat.com> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <mheon@redhat.com>
* remote events: support labelsValentin Rothberg2021-06-11
| | | | | | | | Certain event meta data was lost when converting the remote events to libpod events and vice versa. Enable the skipped system tests for remote. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* remote pull: cancel pull when connection is closedPaul Holzinger2021-06-11
| | | | | | | | | | | If a client closes the http connection during image pull, the service should cancel the pull operation. [NO TESTS NEEDED] I have no idea how we could test this reliable. Fixes: #7558 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Fix network prune api docsPaul Holzinger2021-06-11
| | | | | | | | | | | | | The api doc used wrong response examples for both the compat and libpod network prune endpoints. Change the doc so that it matches the actual return values. Also fix the endpoints to return an empty array instead of null when no networks are removed. [NO TESTS NEEDED] Fixes: #10564 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* podman-remote build should handle -f option properlyDaniel J Walsh2021-06-11
| | | | | | | | | | podman-remote build has to handle multiple different locations for the Containerfile. Currently this works in local mode but not when using podman-remote. Fixes: https://github.com/containers/podman/issues/9871 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix build tags for pkg/machine...Paul Holzinger2021-06-11
| | | | | | | | | | | | Podman machine is only intended for amd64 and arm64 architectures, set the correct buildtags so that the `pkg/machine`, `pkg/machine/qemu` and `pkg/machine/libvirt` packages compile correctly. [NO TESTS NEEDED] Fixes #10625 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* rootless: fix fast join userns pathGiuseppe Scrivano2021-06-10
| | | | | | | | | | | | | | | commit ab886328357184cd0a8375a5dedf816ba91789f9 changed the path for the pause.pid file but didn't update the same path in the C code. This prevented Podman to take the fast path when the userns is already created and to join it without re-execing itself. Fix the path in the C code as well so we can join the rootless user+mount namespace without having to re-exec Podman. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> (cherry picked from commit 11badab046d32c0dce40b28707ee3bb72678e36e)
* Correct qemu options for Intel macsBrent Baude2021-06-08
| | | | | | | | | | On intel macs, we need to accel=hvf to work correctly. Fixes: #10555 [NO TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* Use request context instead of backgroundMatej Vasek2021-06-03
| | | | | | | | | | This prevents goroutine leak: If background context were used then push operation would continue even if client aborted request by closing connection. [NO TESTS NEEDED] Signed-off-by: Matej Vasek <mvasek@redhat.com>
* generate systemd: make mounts portableValentin Rothberg2021-05-31
| | | | | | | | | | | | | | | | | | | Commit 748826fc88fc fixed a bug where slow mounting of the runroot was causing issues when the units are started at boot. The fix was to add the container's runroot to the required mounts; the graph root has been added as well. Hard-coding the run- and graphroot to the required mounts, however, breaks the portability of units generated with --now. Those units are intended to be running on any machine as, theoreticaly, any user. Make the mounts portable by using the `%t` macro for the run root. Since the graphroot's location varies across root and ordinary users, drop it from the list of required mounts. The graphroot was not causing issues. Fixes: #10493 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Handle hard links in different directoriesDaniel J Walsh2021-05-25
| | | | | | Fixes: https://github.com/containers/podman/issues/10444 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Handle hard links in remote buildsDaniel J Walsh2021-05-25
| | | | | | Fixes: https://github.com/containers/podman/issues/9893 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Podman info add support for status of cgroup controllersflouthoc2021-05-25
| | | | Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* Drop container does not exist on removal to debugfDaniel J Walsh2021-05-25
| | | | | | | | | | | | | | | | We have race conditions where a container can be removed by two different processes when running podman --remove rm. It can be cleaned up in the API or by the conmon executing podman container cleanup. When we fail to remove a container that does not exists we should not be printing errors or warnings, we should just debug the fact. [NO TESTS NEEDED] Since this is a race condition it is difficult to test. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Downgrade API service routing table loggingJhon Honce2021-05-25
| | | | | | | | | | | [NO TESTS NEEDED] * Log the routing table output at Trace vs. Debug level. Reduce noise in debugging output. * Tweak SDNotify message to report Warn when it fails. Previously failures were silent. Signed-off-by: Jhon Honce <jhonce@redhat.com>
* update c/commonValentin Rothberg2021-05-20
| | | | | | | | | | | | | | | | | | | Update containers common to the latest HEAD. Some bug fixes in libimage forced us to have a clearer separation between ordinary images and manifest lists. Hence, when looking up manifest lists without recursing into any of their instances, we need to use `LookupManifestList()`. Also account for some other changes in c/common (e.g., the changed order in the security labels). Further vendor the latest HEAD from Buildah which is required to get the bud tests to pass. Signed-off-by: Valentin Rothberg <rothberg@redhat.com> <MH: Stripped out vendor bits - just left remaining changes> Signed-off-by: Matthew Heon <mheon@redhat.com>
* Merge pull request #10363 from vrothberg/fix-10350OpenShift Merge Robot2021-05-17
|\ | | | | image prune: remove unused images only with `--all`
| * image prune: remove unused images only with `--all`Valentin Rothberg2021-05-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a regression in `podman image prune` where unused images were accidentally removed even when `--all=false`. Extend and partially rewrite the e2e tests to make sure we're not regressing again in the future. Fixing the aforementioned issue revealed another issue in the default prune filter. While prune should remove all "dangling" images (i.e., those without tag), it removed only "intermediate" ones; dangling images without children. Remove the mistaken comment from the libimage migration. Also clarify the help message and man page. Fixes: #10350 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | podman network reload add rootless supportPaul Holzinger2021-05-17
|/ | | | | | | | | | Allow podman network reload to be run as rootless user. While it is unlikely that the iptable rules are flushed inside the rootless cni namespace, it could still happen. Also fix podman network reload --all to ignore errors when a container does not have the bridge network mode, e.g. slirp4netns. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* Merge pull request #10324 from containers/uncompressingOpenShift Merge Robot2021-05-12
|\ | | | | [NO TESTS NEEDED] Print "extracting" only on compressed file
| * Print "extracting" only on compressed fileAshley Cui2021-05-12
| | | | | | | | | | | | | | We should only print "extracting compressed file" when the file is actually compressed Signed-off-by: Ashley Cui <acui@redhat.com>
* | Merge pull request #10271 from matejvasek/fix-wait-next-exitOpenShift Merge Robot2021-05-10
|\ \ | | | | | | fix: improved "containers/{name}/wait" endpoint
| * | fix: improved "containers/{name}/wait" endpointMatej Vasek2021-05-10
| |/ | | | | | | | | | | | | | | Using event API to detect changes to container instead of polling. Polling was unreliable, sometime change of a state might have been missed. Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | Add client disconnect to build handler loopJhon Honce2021-05-10
| | | | | | | | | | | | | | | | | | [NO TESTS NEEDED] In process of debugging added request channel check and logging message to build loop. Unable to recreate build drop issue after this. 68k build iterations without fail. Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | Merge pull request #10236 from Luap99/generate-systemd-envOpenShift Merge Robot2021-05-10
|\ \ | | | | | | Add envars to the generated systemd unit
| * | Add envars to the generated systemd unitPaul Holzinger2021-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The with --new generated systemd unit loses the environment variables when the create command only contains the key without the value. Since podman tries to lookup those values from the environment the unit can fail. This commits ensures that we will add the environment variables to the unit file when this is the case. The container environment variables are looked up in the container spec. Fixes #10101 Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | | Merge pull request #10292 from rhatdan/buildahOpenShift Merge Robot2021-05-10
|\ \ \ | | | | | | | | Fix podman-remote build --rm=false ...
| * | | Fix podman-remote build --rm=false ...Daniel J Walsh2021-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/9869 [NO TESTS NEEDED] Since the podman-remote buildah tests will test this, and this is clearly correct. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #10268 from flouthoc/kube-default-shared-namespaceOpenShift Merge Robot2021-05-10
|\ \ \ \ | |/ / / |/| | | Kube like pods should share ipc,net,uts by default
| * | | Kube like pods should share ipc,net,uts by defaultflouthoc2021-05-10
| |/ / | | | | | | | | | Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* / / fix: use UTC Time Stamps in response JSONMatej Vasek2021-05-10
|/ / | | | | | | Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | Merge pull request #10265 from matejvasek/fix-get-multiple-imgs-compatOpenShift Merge Robot2021-05-08
|\ \ | | | | | | fix: compat API "images/get" for multiple images
| * | fix: compat API "images/get" for multiple imagesMatej Vasek2021-05-07
| |/ | | | | | | Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | Merge pull request #10259 from rhatdan/pullOpenShift Merge Robot2021-05-07
|\ \ | |/ |/| Report Download complete in Compatibility mode
| * Report Download complete in Compatibility modeDaniel J Walsh2021-05-07
| | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/10258 [NO TESTS NEEDED] Difficult to create tests for this. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #10230 from matejvasek/fix-compat-img-getOpenShift Merge Robot2021-05-07
|\ \ | |/ |/| fix: docker APIv2 `images/get`
| * fix pre review requestMatej Vasek2021-05-06
| | | | | | | | Signed-off-by: Matej Vasek <mvasek@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 08:30:54 +0000