summaryrefslogtreecommitdiff
path: root/test/system
Commit message (Collapse)AuthorAge
* remote build: EvalSymlinks() the context directoryNalin Dahyabhai2021-09-27
| | | | | | | Use EvalSymlinks() to find the context directory, in case there's shenanigans. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* Merge pull request #11654 from Luap99/health-dockerOpenShift Merge Robot2021-09-23
|\ | | | | podman inspect add State.Health field for docker compat
| * podman inspect add State.Health field for docker compatPaul Holzinger2021-09-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | podman inspect shows the healthcheck status in `.State.Healthcheck`, docker uses `.State.Health`. To make sure docker scripts work we should add the `Health` key. Because we do not want to display both keys by default we only use the new `Health` key. This is a breaking change for podman users but matches what docker does. To provide some form of compatibility users can still use `--format {{.State.Healthcheck}}`. IT is just not shown by default. Fixes #11645 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | shell completion: do not show images without tagPaul Holzinger2021-09-23
|/ | | | | | | | | | | The shell completion should only suggest arguments that work. Using a image without tag does not work in many cases. Having both the version with and without tag also forces users to press one key more because tab completion will always stop at the colon. Fixes #11673 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* podman save: add `--uncompressed`Valentin Rothberg2021-09-22
| | | | | | | | | | Add an option to `podman save` to allow uncompressed layers when copying OCI images. Do the neccessary plumbing for the remote client, add tests and vendor in the latest commit from c/common to fetch the neccessary changes in libimage. Closes: #11613 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* remote untag: support digestsValentin Rothberg2021-09-20
| | | | | | | | | Fix a bug when remotely untagging an image via tag@digest. The digest has been lost in the remote client and hence led to a wrong behaviour on the server. Fixes: #11557 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* System tests: cleanup, and remove obsolete skipsEd Santiago2021-09-17
| | | | | | | | | | | | | | | | * 070-build: - remove workaround for #9567, which is closed. - add many more cases to the ignorefile test, to test complicated special cases of Buildah PR 3486. * 160-volumes: - remove a skip_if_remote, volumes now work on remote - use a random name for tarball, and clean up when done using it. This fixes a gating-test failure (test runs as root, then rootless, and rootless can't clobber root's file). Signed-off-by: Ed Santiago <santiago@redhat.com>
* Add no-trunc support to podman-eventsDaniel J Walsh2021-09-16
| | | | | | | | | | | Standardize on no-trunc through the code. Alias notruncate where necessary. Standardize on the man page display of no-trunc. Fixes: https://github.com/containers/podman/issues/8941 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Wire network interface into libpodPaul Holzinger2021-09-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make use of the new network interface in libpod. This commit contains several breaking changes: - podman network create only outputs the new network name and not file path. - podman network ls shows the network driver instead of the cni version and plugins. - podman network inspect outputs the new network struct and not the cni conflist. - The bindings and libpod api endpoints have been changed to use the new network structure. The container network status is stored in a new field in the state. The status should be received with the new `c.getNetworkStatus`. This will migrate the old status to the new format. Therefore old containers should contine to work correctly in all cases even when network connect/ disconnect is used. New features: - podman network reload keeps the ip and mac for more than one network. - podman container restore keeps the ip and mac for more than one network. - The network create compat endpoint can now use more than one ipam config. The man pages and the swagger doc are updated to reflect the latest changes. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* build.bats: fix copy tests after containers/buildah#3486Aditya Rajan2021-09-15
| | | | | | | | Fix copy tests after https://github.com/containers/buildah/pull/3486 [NO TESTS NEEDED] Signed-off-by: Aditya Rajan <arajan@gmail.com>
* fix restart always with rootlessportPaul Holzinger2021-09-13
| | | | | | | | When a container is automatically restarted due its restart policy and the container uses rootless cni networking with ports forwarded we have to start a new rootlessport process since it exits with conmon. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Stop outputting 'healthy' on healthcheckDaniel J Walsh2021-09-10
| | | | | | | | | We should only print unhealthy if the check fails. Currently this is filling logs when users are running lots of healthchecks. Improves: https://github.com/containers/podman/issues/11157 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Merge pull request #11426 from fj-tsubasa/system-test-scenarioOpenShift Merge Robot2021-09-09
|\ | | | | Add a system test to modify and import an exported container
| * Add a system test to modify and import an exported container.Tsubasa Watanabe2021-09-10
| | | | | | | | | | | | | | This test has completed one of TODO items in test/system/TODO.md. The item is "Implied pull, build, export, modify, import, tag, run, kill" Signed-off-by: Tsubasa Watanabe <w.tsubasa@fujitsu.com>
* | Fix conmon attach socket buffer sizePaul Holzinger2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The conmon buffer size is 8192, however the attach socket needs two extra bytes. The first byte of each message will be the STREAM type. The last byte is a null byte. So when we want to read 8192 message bytes we need to read 8193 bytes since the first one is special. check https://github.com/containers/conmon/blob/1ef246896b4f6566964ed861b98cd32d0e7bf7a2/src/ctr_stdio.c#L101-L107 This problem can be seen in podman-remote run/exec when it prints output with 8192 or more bytes. The output will miss the 8192 byte. Fixes #11496 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Add logDriver to podman infoDaniel J Walsh2021-09-08
| | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | system tests: new random_free_port helperEd Santiago2021-09-08
| | | | | | | | | | | | | | Picks a pseudorandom open port within a range. Refactor existing instances of such code. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #11468 from Luap99/play-kube-slirpOpenShift Merge Robot2021-09-08
|\ \ | | | | | | fix play kube --network options
| * | fix play kube --network optionsPaul Holzinger2021-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 092902b45555 introduced advanced network options for podman play kube. However this never worked because it unconditionally set the network mode to bridge after it parsed the network option. Added a test to ensure the correct mode is set. Truly fixes #10807 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | | pkg/bindings/images.nTar(): set ownership of build context to 0:0Nalin Dahyabhai2021-09-07
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When attempting to run remote builds, users with UID/GID values that were high enough that they wouldn't be mapped into their default user namespace configurations would see their builds fail when the server attempted to extract the build contexts that they supplied, and failed to set ownership of the build context content to the UID/GID that were originally assigned to them. When archiving the build context at the client, set ownership of everything to 0:0, which we know is always mapped. Both ADD and COPY require that we set the ownership of newly-added content to 0:0 (unless the --chown flag is used), so throwing away the original ownership information doesn't hurt, anyway. As usual, tarballs that we extract as part of ADD aren't going to be affected. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* | Merge pull request #11459 from vrothberg/fix-11438OpenShift Merge Robot2021-09-07
|\ \ | | | | | | generate systemd: handle --restart
| * | generate systemd: handle --restartValentin Rothberg2021-09-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | Handle custom restart policies of containers when generating the unit files; those should be set on the unit level and removed from ExecStart flags. Fixes: #11438 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | | logs -f: file: fix dead lockValentin Rothberg2021-09-07
|/ / | | | | | | | | | | | | | | Fix a dead lock in the file log driver where one goroutine would wait on the tail to hit EOF but reading is blocked for the function to return. Fixes: 11461 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* / auto-update systemd test: skip on RHELEd Santiago2021-09-02
|/ | | | | | | | | | | | The "auto-update using systemd" test is failing on RHEL rootless. Reason: it uses journalctl, which does not work on RHEL rootless. Solution: add skip_if_journald_unavailable. ALSO: add debugging info to test failure. Signed-off-by: Ed Santiago <santiago@redhat.com>
* System tests: add cleanup & debugging outputEd Santiago2021-09-01
| | | | | | | | | | | | Cleanup: the final 'play' test wasn't cleaning up after itself, leading to angry warning messages when rerunning tests (in my environment; never in CI) Debug: I'm seeing a lot of "Could not parse READY=1 as MAINPID=nnn" flakes in the sdnotify:container test (nine in the past month). Add debug traces to help diagnose in future flakes. Signed-off-by: Ed Santiago <santiago@redhat.com>
* pass LISTEN_* environment into containerValentin Rothberg2021-08-31
| | | | | | | | | | | | | | | Make sure that Podman passes the LISTEN_* environment into containers. Similar to runc, LISTEN_PID is set to 1. Also remove conditionally passing the LISTEN_FDS as extra files. The condition was wrong (inverted) and introduced to fix #3572 which related to running under varlink which has been dropped entirely with Podman 3.0. Note that the NOTIFY_SOCKET and LISTEN_* variables are cleared when running `system service`. Fixes: #10443 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* auto-update: fix authfile labelValentin Rothberg2021-08-30
| | | | | | | | | | | | Make sure that the container's authfile label is used when pulling down a new image. [NO TESTS NEEDED] since it would require some larger rewrite of the auto-update system tests that I currently have no time for. I added a reminder to have some breadcrumbs when there is more time. Fixes: #11171 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* volumes: Add volume import to allow importing contents on tar into volumeflouthoc2021-08-26
| | | | | | | Following feature makes sure that users can load contents of external tarball into the podman volumes. Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* Merge pull request #11263 from nalind/journal-readOpenShift Merge Robot2021-08-24
|\ | | | | libpod/Container.readFromJournal(): don't skip the first entry
| * 130-kill.bats: increase timeouts from 10s to 60sNalin Dahyabhai2021-08-23
| | | | | | | | | | | | | | | | | | | | Increase the amount of time we're willing to wait for a log message that a container should be printing to show up in the output of `logs -f`, since on at least one CI configuration we're seeing a turnaround as high as 46s, but it's not something we can directly control, so that's not a hard maximum. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
| * 330-corrupt-images: don't try to tag with a canonical nameNalin Dahyabhai2021-08-23
| | | | | | | | | | | | | | In these tests, don't try to tag an image using a canonical ("with digest") image name. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* | generate systemd: use --cidfile againValentin Rothberg2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 9ac5267 changed the type of the generated systemd units from `forking` to `notify`. It further stopped using `--cidfile` and instead intended systemd to take care of stopping the container, which turned out to be a bad idea. Systemd will send the stop/kill signals to conmon which in turn may exit non-zero, depending on the signal, and ultimately breaking container cleanup. Hence, we need to use --cidfile again and let podman stop and remove the container to make sure that everything's in order. Fixes: #11304 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | Revert "generate systemd: custom stop signal"Valentin Rothberg2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 70801b3d714b067d64744697433c5841926dad4d. It turns out that letting systemd handle stopping the container is not working as I thought it will. Conmon is receiving the stop/kill signals and may exit non-zero, which in turn lets the systemd service transition into the `failed` state. We need to get back to letting Podman stop the containers and do a partial revert of commit 9ac5267 which removed using --cidfile. Happening in a following commit. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* | generate systemd: custom stop signalValentin Rothberg2021-08-24
|/ | | | | | | | | | | | | | | | | | | Commit 9ac5267598c3 changed the type of the generated systemd units from forking to notify. Parts of these changes was also removing the need to pass any information via the file system (e.g., PIDFILE, container ID). That in turn implies that systemd takes care of stopping the container. By default, systemd first sends a SIGTERM and after a certain timeout, it'll send a SIGKILL. That's pretty much what Podman is doing, unless the container was created with a custom stop signal which is the case when the --stop-signal flag was used or systemd is mounted. Account for that by using systemd's KillSignal option which allows for changing SIGTERM to another signal. Also make sure that we're using the correct timeout for units generated with --new. Fixes: #11304 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Implement SD-NOTIFY proxy in conmonDaniel J Walsh2021-08-20
| | | | | | | | | | | | | | | | This leverages conmon's ability to proxy the SD-NOTIFY socket. This prevents locking caused by OCI runtime blocking, waiting for SD-NOTIFY messages, and instead passes the messages directly up to the host. NOTE: Also re-enable the auto-update tests which has been disabled due to flakiness. With this change, Podman properly integrates into systemd. Fixes: #7316 Signed-off-by: Joseph Gooch <mrwizard@dok.org> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Fix rootless cni dns without systemd stub resolverPaul Holzinger2021-08-16
| | | | | | | | | | | | | | | | | When a host uses systemd-resolved but not the resolved stub resolver the following symlinks are created: `/etc/resolv.conf` -> `/run/systemd/resolve/stub-resolv.conf` -> `/run/systemd/resolve/resolv.conf`. Because the code uses filepath.EvalSymlinks we put the new resolv.conf to `/run/systemd/resolve/resolv.conf` but the `/run/systemd/resolve/stub-resolv.conf` link does not exists in the mount ns. To fix this we will walk the symlinks manually until we reach the first one under `/run` and use this for the resolv.conf file destination. This fixes a regression which was introduced in e73d4829900c. Fixes #11222 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Run codespell to fix spellingDaniel J Walsh2021-08-11
| | | | | | [NO TESTS NEEDED] Just fixing spelling. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* skip flaking auto-update testPaul Holzinger2021-08-10
| | | | | | | This test flakes on almost every PR, so skip it for now until someone can fix it, see #11175. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #11134 from rhatdan/buildxopenshift-ci[bot]2021-08-09
|\ | | | | Alias build to buildx, so it won't fail
| * Alias build to buildx, so it won't failDaniel J Walsh2021-08-09
| | | | | | | | | | | | Add hidden --load and --progress flag as well. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | podman info show correct slirp4netns pathPaul Holzinger2021-08-09
|/ | | | | | | | | The slirp4netns path can be set in the config file or with --network-cmd-path. Podman info should read the version information correctly and not use PATH in this case. Also show the slirp4netns version information to root users. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* auto-update: simple rollbackValentin Rothberg2021-08-05
| | | | | | | | | | | | | | | | | | | Add support for simple rollbacks during `podman auto-update`. Rollbacks are enabled by default. If a systemd unit cannot be restarted after an update, the previous image will be retagged and the unit will be restarted a second time. Add system tests for rollbacks. Also fix a bug in the restart sequence; we have to use the channel to actually know whether the restart was successful or not. NOTE: To make rollbacks really useful, users must run their containers with `--sdnotify=container` such that the containers send the ready message over the (mounted) socket. This way, restarting the systemd units during auto update will block until the message has been received (or a timeout kicked in). Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Fix podman unpause,pause,kill --all to work like podman stop --allDaniel J Walsh2021-08-04
| | | | | | | | | | | | | | | | | | | Currently if you execute podman unpause --all, podman pause --all Podman shows attempts to unpause containers that are not paused and prints an error. This PR catches this error and only prints errors if a paused container was not able to be unpaused. Currently if you execute podman pause --all or podman kill --all, Podman Podman shows attempts to pause or kill containers that are not running and prints an error. This PR catches this error and only prints errors if a running container was not able to be paused or killed. Also change printing of multiple errors to go to stderr and to prefix "Error: " in front to match the output of the last error. Fixes: https://github.com/containers/podman/issues/11098 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* podman info: try qfile before equeryEd Santiago2021-08-03
| | | | | | | | | | | | | | | | | | podman info takes >20s on Gentoo, because equery is s..l..o..w. qfile is much faster and, I suspect, present in most Gentoo installations, so let's try it first. And, because packageVersion() was scarily unmaintainable, refactor it. Define a simple (string) list of packaging tools to query (rpm, dpkg, ...) and iterate until we find one that works. IMPORTANT NOTE: the Debian (and, presumably, Ubuntu) query does not include version number! There is no standard way on Debian to get a package version from a file path, you can only do it via pipes of chained commands, and I have no desire to implement that. Signed-off-by: Ed Santiago <santiago@redhat.com>
* Merge pull request #11091 from Luap99/connect-disconnectopenshift-ci[bot]2021-08-03
|\ | | | | fix rootless port forwarding with network dis-/connect
| * fix rootless port forwarding with network dis-/connectPaul Holzinger2021-08-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The rootlessport forwarder requires a child IP to be set. This must be a valid ip in the container network namespace. The problem is that after a network disconnect and connect the eth0 ip changed. Therefore the packages are dropped since the source ip does no longer exists in the netns. One solution is to set the child IP to 127.0.0.1, however this is a security problem. [1] To fix this we have to recreate the ports after network connect and disconnect. To make this work the rootlessport process exposes a socket where podman network connect/disconnect connect to and send to new child IP to rootlessport. The rootlessport process will remove all ports and recreate them with the new correct child IP. Also bump rootlesskit to v0.14.3 to fix a race with RemovePort(). Fixes #10052 [1] https://nvd.nist.gov/vuln/detail/CVE-2021-20199 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Fix handling of user specified container labelsDaniel J Walsh2021-08-02
|/ | | | | | | | | | | Currently we override the SELinux labels specified by the user if the container is runing a kata container or systemd container. This PR fixes to use the label specified by the user. Fixes: https://github.com/containers/podman/issues/11100 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix auto-update system test for older systemdHironori Shiina2021-07-30
| | | | | | | | | | | If the systemd version is older than v245, the systemd uses 'Started' when a oneshot service finishes. In systemd, the change was done at: https://github.com/systemd/systemd/pull/14851 commit-id: eda0cbf07186d16a160bd1d810613586fdbdf587 Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
* system tests: fix race in stop testEd Santiago2021-07-29
| | | | | | | | | | | | | In the unlock/timeout test, on slow systems, 'podman ps' could catch the container before the just-backgrounded 'podman stop' sends the signal. Wait for signal ack from container before we inspect it. Also: If I understand the test correctly, it wasn't actually checking that 'ps' could grab the lock while the container was exiting. Add a check. Signed-off-by: Ed Santiago <santiago@redhat.com>
* remote build: fix streaming and error handlingValentin Rothberg2021-07-28
| | | | | | | | | | | | | | | | | | | | Address a number of issues in the streaming logic in remote build, most importantly an error in using buffered channels on the server side. The pattern below does not guarantee that the channel is entirely read before the context fires. for { select { case <- bufferedChannel: ... case <- ctx.Done(): ... } } Fixes: #10154 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-08 15:49:54 +0000