summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Add support for pod inside of user namespace.Daniel J Walsh2021-08-09
| | | | | | | | | | | | | Add the --userns flag to podman pod create and keep track of the userns setting that pod was created with so that all containers created within the pod will inherit that userns setting. Specifically we need to be able to launch a pod with --userns=keep-id Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* Merge pull request #11074 from vrothberg/auto-update-rollbackopenshift-ci[bot]2021-08-06
|\ | | | | auto-update: simple rollback
| * auto-update: simple rollbackValentin Rothberg2021-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for simple rollbacks during `podman auto-update`. Rollbacks are enabled by default. If a systemd unit cannot be restarted after an update, the previous image will be retagged and the unit will be restarted a second time. Add system tests for rollbacks. Also fix a bug in the restart sequence; we have to use the channel to actually know whether the restart was successful or not. NOTE: To make rollbacks really useful, users must run their containers with `--sdnotify=container` such that the containers send the ready message over the (mounted) socket. This way, restarting the systemd units during auto update will block until the message has been received (or a timeout kicked in). Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Merge pull request #11141 from flouthoc/support-linux-execution-domainopenshift-ci[bot]2021-08-06
|\ \ | | | | | | personality: Add support for setting execution domain.
| * | personality: Add support for setting execution domain.flouthoc2021-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Execution domains tell Linux how to map signal numbers into signal actions. The execution domain system allows Linux to provide limited support for binaries compiled under other UNIX-like operating systems. Reference: https://man7.org/linux/man-pages/man2/personality.2.html Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* | | Merge pull request #11136 from baude/machinelogsshopenshift-ci[bot]2021-08-05
|\ \ \ | | | | | | | | show podman machine ssh command line
| * | | show podman machine ssh command lineBrent Baude2021-08-05
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A user contributed a one line PR that enabled logging the podman machine ssh command for debug. The user was not able to complete the submission so this PR replaces that. [NO TESTS NEEDED] Replaces #10798 Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | Merge pull request #11135 from matejvasek/fix_tsopenshift-ci[bot]2021-08-05
|\ \ \ | |/ / |/| | Fix TS parsing for fractional values
| * | Fix TS parsing for fractional valuesMatej Vasek2021-08-04
| | | | | | | | | | | | | | | | | | Parse Unix timestamps that contains fractional part. Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | | Merge pull request #11011 from baude/initcontainersopenshift-ci[bot]2021-08-05
|\ \ \ | |_|/ |/| | implement init containers in podman
| * | implement init containers in podmanBrent Baude2021-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this is the first pass at implementing init containers for podman pods. init containersare made popular by k8s as a way to run setup for pods before the pods standard containers run. unlike k8s, we support two styles of init containers: always and oneshot. always means the container stays in the pod and starts whenever a pod is started. this does not apply to pods restarting. oneshot means the container runs onetime when the pod starts and then is removed. Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | Merge pull request #11132 from rhatdan/VENDORopenshift-ci[bot]2021-08-04
|\ \ \ | | | | | | | | Bump Buildah to v1.22.0 [NO TESTS NEEDED]
| * | | Bump Buildah to v1.22.0 [NO TESTS NEEDED]TomSweeneyRedHat2021-08-04
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | Bump Buildah to v1.22.0 in preparation for RHEL 8.5 and RHEL 9.0beta. Also bump c/common to v0.42.1 [NO TESTS NEEDED] Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* / | Fix podman unpause,pause,kill --all to work like podman stop --allDaniel J Walsh2021-08-04
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently if you execute podman unpause --all, podman pause --all Podman shows attempts to unpause containers that are not paused and prints an error. This PR catches this error and only prints errors if a paused container was not able to be unpaused. Currently if you execute podman pause --all or podman kill --all, Podman Podman shows attempts to pause or kill containers that are not running and prints an error. This PR catches this error and only prints errors if a running container was not able to be paused or killed. Also change printing of multiple errors to go to stderr and to prefix "Error: " in front to match the output of the last error. Fixes: https://github.com/containers/podman/issues/11098 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #11096 from baude/gvproxystaticpathopenshift-ci[bot]2021-08-04
|\ \ | | | | | | Use static path for gvproxy
| * | Use static path for gvproxyBrent Baude2021-08-03
| |/ | | | | | | | | | | | | | | | | | | Given that we do not want to support gvproxy for anything other than podman machine, we have decided to use a static path of /usr/lib/podman/gvproxy instead of a lookpath. [NO TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* | Merge pull request #10973 from rhatdan/quotaopenshift-ci[bot]2021-08-04
|\ \ | | | | | | Support size options on builtin volumes
| * | Support size and inode options on builtin volumesDaniel J Walsh2021-08-02
| | | | | | | | | | | | | | | | | | | | | | | | [NO TESTS NEEDED] Since it is difficult to setup xfs quota Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1982164 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #11003 from pascomnet/f_statsopenshift-ci[bot]2021-08-04
|\ \ \ | | | | | | | | stats: add a interval parameter to cli and api stats streaming
| * | | e2e tests: re-enable and fix podman stats testsThomas Weber2021-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Renamed podman pod stats test specs to distinguish them from podman stats tests. podman stats tests where disabled by a +build flag. Fix podman stats format test, add negative test. Fix podman stats cli command, exit non-zero on invalid format string. Add tests for podman stats interval flag. Signed-off-by: Thomas Weber <towe75@googlemail.com>
| * | | stats: add a interval parameter to cli and api stream modeThomas Weber2021-07-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman stats polled by default in a 1 sec period. This can put quite some load on a machine if you run many containers. The default value is now 5 seconds. You can change this interval with a new, optional, --interval, -i cli flag. The api request got also a interval query parameter for the same purpose. Additionally a unused const was removed. Api and cli will fail the request if a 0 or negative value is passed in. Signed-off-by: Thomas Weber <towe75@googlemail.com>
* | | | Merge pull request #11104 from jwhonce/bz/1988252openshift-ci[bot]2021-08-04
|\ \ \ \ | | | | | | | | | | Only support containers stats using cgroups v2
| * | | | Only support containers stats using cgroups v2Jhon Honce2021-08-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1988252 Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | | | | Merge pull request #11114 from mlegenovic/masteropenshift-ci[bot]2021-08-03
|\ \ \ \ \ | |/ / / / |/| | | | Compat API: Fix healthcheck status and healthcheck config
| * | | | Compat API: Fix healthcheck status and healthcheck configMilivoje Legenovic2021-08-03
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: - Do not show healthcheck status if not available or if container status is "created" (Docker behaviour) - Show healthcheck configuration if present (Config.Healthcheck) Tests: - Ensure State.Health is not present if container status is "created" - Ensure Config.Healthcheck is present and values correct - Ensure State.Health is present if container started Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com>
* / | | fix rootless port forwarding with network dis-/connectPaul Holzinger2021-08-03
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The rootlessport forwarder requires a child IP to be set. This must be a valid ip in the container network namespace. The problem is that after a network disconnect and connect the eth0 ip changed. Therefore the packages are dropped since the source ip does no longer exists in the netns. One solution is to set the child IP to 127.0.0.1, however this is a security problem. [1] To fix this we have to recreate the ports after network connect and disconnect. To make this work the rootlessport process exposes a socket where podman network connect/disconnect connect to and send to new child IP to rootlessport. The rootlessport process will remove all ports and recreate them with the new correct child IP. Also bump rootlesskit to v0.14.3 to fix a race with RemovePort(). Fixes #10052 [1] https://nvd.nist.gov/vuln/detail/CVE-2021-20199 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | Merge pull request #10828 from cdoern/scpopenshift-ci[bot]2021-08-02
|\ \ \ | |_|/ |/| | Created image scp feature
| * | Created scp.go image_scp_test.go and podman-image-scp.1.mdcdoern2021-07-30
| | | | | | | | | | | | | | | | | | | | | | | | added functionality for image secure copying from local to remote. Also moved system connection add code around a bit so functions within that file can be used by scp. Signed-off-by: cdoern <cdoern@redhat.com>
* | | Merge pull request #11072 from matejvasek/header-timeoutopenshift-ci[bot]2021-08-02
|\ \ \ | | | | | | | | Remove ReadHeaderTimeout
| * | | Remove ReadHeaderTimeoutMatej Vasek2021-07-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Effectively sets timeout to infinity. This is needed in order to make `podman` work with `pack`. The `pack` CLI is keeping one connection for prolonged time. Closing the connection breaks `pack`'s functionality. [NO TESTS NEEDED] Signed-off-by: Matej Vasek <mvasek@redhat.com>
* | | | ps: support the container notation for ps --filter network=...flouthoc2021-07-30
| | | | | | | | | | | | | | | | Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* | | | Merge pull request #11073 from giuseppe/fix-zombie-process-first-runOpenShift Merge Robot2021-07-29
|\ \ \ \ | | | | | | | | | | rootless: avoid zombie process on first launch
| * | | | rootless: avoid zombie process on first launchGiuseppe Scrivano2021-07-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | avoid a zombie process if on the first launch Podman creates a long living process, such as "podman system service -t 0". The `r` variable was overriden thus causing the waitpid to fail and not clean up the intermediate process. Closes: https://github.com/containers/podman/issues/10575 [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | Merge pull request #11067 from vrothberg/fix-10154-2OpenShift Merge Robot2021-07-28
|\ \ \ \ \ | |/ / / / |/| | | | remote build: fix streaming and error handling
| * | | | remote build: fix streaming and error handlingValentin Rothberg2021-07-28
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Address a number of issues in the streaming logic in remote build, most importantly an error in using buffered channels on the server side. The pattern below does not guarantee that the channel is entirely read before the context fires. for { select { case <- bufferedChannel: ... case <- ctx.Done(): ... } } Fixes: #10154 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | Merge pull request #11056 from giuseppe/warning-root-no-sharedOpenShift Merge Robot2021-07-28
|\ \ \ \ | | | | | | | | | | rootless: check that / is mounted as shared
| * | | | rootless: check that / is mounted as sharedGiuseppe Scrivano2021-07-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if the root mount '/' is not mounted as MS_SHARED, print a warning, otherwise new mounts that are created in the host won't be propagated to the rootless mount namespace. Closes: https://github.com/containers/podman/issues/10946 [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | Merge pull request #10910 from ↵OpenShift Merge Robot2021-07-28
|\ \ \ \ \ | |_|/ / / |/| | | | | | | | | | | | | | adrianreber/2021-07-12-checkpoint-restore-into-pod Add support for checkpoint/restore into and out of pods
| * | | | Support checkpoint/restore with podsAdrian Reber2021-07-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds support to checkpoint containers out of pods and restore container into pods. It is only possible to restore a container into a pod if it has been checkpointed out of pod. It is also not possible to restore a non pod container into a pod. The main reason this does not work is the PID namespace. If a non pod container is being restored in a pod with a shared PID namespace, at least one process in the restored container uses PID 1 which is already in use by the infrastructure container. If someone tries to restore container from a pod with a shared PID namespace without a shared PID namespace it will also fail because the resulting PID namespace will not have a PID 1. Signed-off-by: Adrian Reber <areber@redhat.com>
| * | | | Vendor in go-criu v5.1.0 for Pod checkpoint/restore supportAdrian Reber2021-07-27
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Adrian Reber <areber@redhat.com>
| * | | | Prepare CRIU version check to work with multiple versionsAdrian Reber2021-07-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The upcoming commit to support checkpointing out of Pods requires CRIU 3.16. This changes the CRIU version check to support checking for different versions. Signed-off-by: Adrian Reber <areber@redhat.com>
* | | | | Merge pull request #11049 from vrothberg/fix-7370OpenShift Merge Robot2021-07-27
|\ \ \ \ \ | | | | | | | | | | | | support container to container copy
| * | | | | support container to container copyMehul Arora2021-07-27
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement container to container copy. Previously data could only be copied from/to the host. Fixes: #7370 Co-authored-by: Mehul Arora <aroram18@mcmaster.ca> Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | | Merge pull request #11061 from giuseppe/migrate-no-move-to-cgroupOpenShift Merge Robot2021-07-27
|\ \ \ \ \ | |/ / / / |/| | | | command: migrate doesn't move process to cgroup
| * | | | command: migrate doesn't move process to cgroupGiuseppe Scrivano2021-07-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add a new annotation for the "system migrate" command to not move the pause process to a separate cgroup. The operation is not needed since "system migrate" destroys the pause process, so there won't be any process left to move to a cgroup. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * | | | rootless: do not overwrite err variableGiuseppe Scrivano2021-07-27
| |/ / / | | | | | | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* / / / exec: fix cleanupValentin Rothberg2021-07-27
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 341e6a1 made sure that all exec sessions are getting cleaned up. But it also came with a peformance penalty. Fix that penalty by spawning the cleanup process to really only cleanup the exec session without attempting to remove the container. [NO TESTS NEEDED] since we have no means to test such performance issues in CI. Fixes: #10701 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | Merge pull request #10983 from vrothberg/fix-danglingOpenShift Merge Robot2021-07-27
|\ \ \ | | | | | | | | refine dangling checks
| * | | refine dangling checksValentin Rothberg2021-07-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By proxy by vendoring containers/common. Previously, a "dangling" image was an untagged image; just a described in the Docker docs. The definition of dangling has now been refined to an untagged image without children to be compatible with Docker. Further update a redundant image-prune test. Fixes: #10998 Fixes: #10832 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | | Merge pull request #11036 from caarlos0/fix-podman-manifest-pushOpenShift Merge Robot2021-07-26
|\ \ \ \ | | | | | | | | | | fix: podman manifest push respect --tls-verify flag
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-18 14:22:06 +0000