aboutsummaryrefslogtreecommitdiff
path: root/test
Commit message (Collapse)AuthorAge
* auto-update: validate container imageValentin Rothberg2022-09-26
| | | | | | | | | | | Auto updates using the "registry" policy require container to be created with a fully-qualified image reference. Short names are not supported due the ambiguity of their source registry. Initially, container creation errored out for non FQN images but it seems that Podman has regressed. Fixes: #15879 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Merge pull request #15900 from rhatdan/VENDOROpenShift Merge Robot2022-09-23
|\ | | | | Update vendor of containers(image, common, buildah, storage)
| * Fixup Buildah mergeEd Santiago2022-09-23
| | | | | | | | | | | | | | | | | | | | | | | | | | Changes since 2022-09-09: - man page: add --skip-unused-stages (buildah 4249) - man page: bring in new Note for --cache-ttl (4248) - system tests: de-stutter (4205) - (internal): in skip() applier: escape asterisk, otherwise the "bud with --dns* flags" sed expression never applies. Signed-off-by: Ed Santiago <santiago@redhat.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #15873 from ashley-cui/prettysecretsOpenShift Merge Robot2022-09-23
|\ \ | | | | | | Add --pretty to podman secret inspect
| * | Add --pretty to podman secret inspectAshley Cui2022-09-22
| | | | | | | | | | | | | | | | | | Pretty-print podman secret inspect output in a human-readable format Signed-off-by: Ashley Cui <acui@redhat.com>
* | | Merge pull request #15463 from mheon/fix_15408OpenShift Merge Robot2022-09-23
|\ \ \ | |_|/ |/| | Events for containers in pods now include the pod's ID
| * | Events for containers in pods now include the pod's IDMatthew Heon2022-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows tools like Cockpit to know that the pod in question has also been updated, so they can refresh the list of containers in the pod. Fixes #15408 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | Add support for 'image' volume driverMatthew Heon2022-09-22
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We added the concept of image volumes in 2.2.0, to support inspecting an image from within a container. However, this is a strictly read-only mount, with no modification allowed. By contrast, the new `image` volume driver creates a c/storage container as its underlying storage, so we have a read/write layer. This, in and of itself, is not especially interesting, but what it will enable in the future is. If we add a new command to allow these image volumes to be committed, we can now distribute volumes - and changes to them - via a standard OCI image registry (which is rather new and quite exciting). Future work in this area: - Add support for `podman volume push` (commit volume changes and push resulting image to OCI registry). - Add support for `podman volume pull` (currently, we require that the image a volume is created from be already pulled; it would be simpler if we had a dedicated command that did the pull and made a volume from it) - Add support for scratch images (make an empty image on demand to use as the base of the volume) - Add UOR support to `podman volume push` and `podman volume pull` to enable both with non-image volume drivers Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #15895 from dcermak/don-expose-dev-for-privilegedOpenShift Merge Robot2022-09-22
|\ \ | | | | | | Don't mount /dev/ inside privileged containers running systemd
| * | Don't mount /dev/tty* inside privileged containers running systemdDan Čermák2022-09-22
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | According to https://systemd.io/CONTAINER_INTERFACE/, systemd will try take control over /dev/ttyN if exported, which can cause conflicts with the host's tty in privileged containers. Thus we will not expose these to privileged containers in systemd mode, as this is a bad idea according to systemd's maintainers. Additionally, this commit adds a bats regression test to check that no /dev/ttyN are present in a privileged container in systemd mode This fixes https://github.com/containers/podman/issues/15878 Signed-off-by: Dan Čermák <dcermak@suse.com>
* | Merge pull request #15131 from boaz0/closes_14707OpenShift Merge Robot2022-09-22
|\ \ | |/ |/| Add support to sig-proxy for podman-remote
| * Add support to sig-proxy for podman-remoteBoaz Shuster2022-09-20
| | | | | | | | Signed-off-by: Boaz Shuster <boaz.shuster.github@gmail.com>
* | Merge pull request #15870 from idleroamer/podman-saveOpenShift Merge Robot2022-09-22
|\ \ | | | | | | podman-save: Add signature-policy flag
| * | cli: Add signature-policy flag to podman save😎Mostafa Emami2022-09-21
| |/ | | | | | | | | | | | | | | Allow overwrite of the signature-policy file by passing signature-policy flag to podman save command Closes: https://github.com/containers/podman/issues/15869 Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
* | System tests: reenable some skipped aarch64 testsEd Santiago2022-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Background: in order to add aarch64 tests, we had to add emergency skips to a lot of failing tests. No attempt was ever made to understand why they were failing. Fast forward to today, I filed #15888 just to see if tests are still failing. Looks like a number of them are fixed. (Yes, magically). Remove those skips. See: #15074, #15277 Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Fix a few missed io/ioutil -> os updatesChris Evich2022-09-21
| | | | | | | | | | | | Ref: https://github.com/containers/podman/pull/15871 Signed-off-by: Chris Evich <cevich@redhat.com>
* | Merge pull request #15871 from cevich/replace_ioutilOpenShift Merge Robot2022-09-21
|\ \ | | | | | | Replace deprecated ioutil
| * | Replace deprecated ioutilChris Evich2022-09-20
| |/ | | | | | | | | | | | | | | | | | | Package `io/ioutil` was deprecated in golang 1.16, preventing podman from building under Fedora 37. Fortunately, functionality identical replacements are provided by the packages `io` and `os`. Replace all usage of all `io/ioutil` symbols with appropriate substitutions according to the golang docs. Signed-off-by: Chris Evich <cevich@redhat.com>
* | Merge pull request #15837 from rhatdan/formatOpenShift Merge Robot2022-09-21
|\ \ | | | | | | Improve generate systemd format
| * | Improve generate systemd formatDaniel J Walsh2022-09-21
| |/ | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/14897 Followup to #13814 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #15842 from ashley-cui/seclabelsOpenShift Merge Robot2022-09-21
|\ \ | | | | | | Add labels to secrets
| * | Add labels to secretsAshley Cui2022-09-20
| | | | | | | | | | | | | | | | | | | | | Add --label/-l label flag to secret create, and show labels when inspecting secrets. Also allow labeling secrets via libpod/compat API. Signed-off-by: Ashley Cui <acui@redhat.com>
* | | Merge pull request #15866 from boaz0/closes_15746OpenShift Merge Robot2022-09-21
|\ \ \ | |_|/ |/| | Fix podman-remote run --attach stdin to show container ID
| * | Fix podman-remote run --attach stdin to show container IDBoaz Shuster2022-09-20
| | | | | | | | | | | | Signed-off-by: Boaz Shuster <boaz.shuster.github@gmail.com>
* | | Merge pull request #15072 from rhatdan/contextOpenShift Merge Robot2022-09-19
|\ \ \ | | | | | | | | Add support for podman context as alias to podman system connection
| * | | Add support for podman context as alias to podman system connectionDaniel J Walsh2022-09-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Alias podman --context -> podman --connection podman context use -> podman system connection default podman context rm -> podman system connection rm podman context create -> podman system connection add podman context ls ->podman system connection ls podman context inspect ->podman system connection ls --json (For specified connections) Podman context is a hidden command, but can be used for existing scripts that assume Docker under the covers. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | podman container clone env patchCharlie Doern2022-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman container clone was failing when env variables had multiple `=` in them. Switch split to splitn resolves #15836 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | | | Merge pull request #15823 from rhatdan/dns-optOpenShift Merge Robot2022-09-16
|\ \ \ \ | | | | | | | | | | Default to --dns-option to match Docker and Buildah
| * | | | Default to --dns-option to match Docker and BuildahDaniel J Walsh2022-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [NO NEW TESTS NEEDED] Existing tests cover this. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | Merge pull request #15812 from sstosh/checkpoint-export-rawinputOpenShift Merge Robot2022-09-16
|\ \ \ \ \ | |/ / / / |/| | | | remote: checkpoint --export prints a rawInput or an error on remote
| * | | | remote: checkpoint --export prints a rawInput or an error on remoteToshiki Sonoda2022-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes `container checkpoint --export` to print a rawInput or an error. Fixes: #15743 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | | | | Cleanup: fix problems reported by shell lintEd Santiago2022-09-15
| |_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | Followup to #15616, which is not usable as it is (way, way, way too much noise) but actually found a few real nits that should be fixed. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | | Merge pull request #15821 from ↵OpenShift Merge Robot2022-09-15
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | vrothberg/revert-c20abf12c714f359c7bbb291c444530f70cb1185 Revert "generate systemd: drop ExecStop"
| * | | | Revert "generate systemd: drop ExecStop"Valentin Rothberg2022-09-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit c20abf12c714f359c7bbb291c444530f70cb1185. In the absence of `ExecStop` step, systemd will send the stop/kill signals to the main PID while I asummed that systemd would jump directly to an ExecStopPost step instead. Hence revert the commit to let Podman take care of stopping rather than systemd. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | | | | Merge pull request #15757 from mheon/fix_15526OpenShift Merge Robot2022-09-15
|\ \ \ \ \ | |/ / / / |/| | | | Introduce graph-based pod container removal
| * | | | Introduce graph-based pod container removalMatthew Heon2022-09-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Originally, during pod removal, we locked every container in the pod at once, did a number of validity checks to ensure everything was safe, and then removed all the containers in the pod. A deadlock was recently discovered with this approach. In brief, we cannot lock the entire pod (or much more than a single container at a time) without causing a deadlock. As such, we converted to an approach where we just looped over each container in the pod, removing them individually. Unfortunately, this removed a lot of the validity checking of the earlier approach, allowing for a lot of unintended bad things. Infra containers could be removed while containers in the pod still depended on them, for example. There's no easy way to do validity checks while in a simple loop, so I implemented a version of our graph-traversal logic that currently handles pod start. This version acts in the reverse order of startup: startup starts from containers which depend on nothing and moves outwards, while removal acts on containers which have nothing depend on them and moves inwards. By doing graph traversal, we can guarantee that nothing is removed while something that depends on it still exists - so the infra container should be the last thing in a pod that is removed, for example. In the (unlikely) case that a graph of the pod's containers cannot be built (most likely impossible without database editing) the old method of pod removal has been retained to ensure that even misbehaving pods can be forcibly evicted from the state. I'm fairly confident that this resolves the problem, but there are a lot of assumptions around dependency structure built into the original pod removal code and I am not 100% sure I have captured all of them. Fixes #15526 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | | | | generate systemd: drop ExecStopValentin Rothberg2022-09-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Drop the ExecStop step to simplify the generated units a bit. The extra ExecStopPost step was added by commit e5c343294424. If the main PID (i.e., conmon) is killed, systemd will not execute ExecStop (since the main PID is already down) but only execute the *Post steps. Credits to the late Ulrich Obergfell for tracking this issue down; he is missed. The ExecStop step can safely be dropped since the Post step will take of stopping (and removing) in any case. Context: #15686 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | | | | stats: cap memory limit to the available memoryGiuseppe Scrivano2022-09-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Docker compatibility: cap the memory limit reported by the cgroup to the maximum available memory. Closes: https://github.com/containers/podman/issues/15765 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | | stats: map MaxUsage to the correct valueGiuseppe Scrivano2022-09-15
| |/ / / |/| | | | | | | | | | | | | | | | | | | and make sure it is not set for cgroup v2 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | | Merge pull request #15786 from edsantiago/format_test_fixesOpenShift Merge Robot2022-09-14
|\ \ \ \ | |_|/ / |/| | | System tests: cleanup in --format test
| * | | System tests: cleanup in --format testEd Santiago2022-09-14
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Followup to #15673 (--format with newlines). I cobbled up a test for it, but I was sloppy, so the test had issues that I kept having to band-aid. This is a cleaner way to handle podman-machine. ...and, another unexpected surprise with podman stats. It fails under rootless cgroupsv1. We can't sweep it under the rug via skip_if_ubuntu because tests will then fail on RHEL8. So, add a similar mechanism for testing podman stats. ...plus a non-surprise, the 'search' test flakes. Try minimizing that by searching only $IMAGE. If quay.io is down, other tests will certainly fail. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | Merge pull request #15794 from edsantiago/bats_racesOpenShift Merge Robot2022-09-14
|\ \ \ | | | | | | | | System tests: fix three races
| * | | System tests: fix three racesEd Santiago2022-09-14
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Three tests were running 'container rm' on 'start'ed containers that might not yet have exited. Fix. Also, tighten up the tests themselves, to make even more sure that they test what they're supposed to test. Discovered, in CI, that 'podman-remote logs --timestamps' was unimplemented. Thanks to @Luap99 for the fix to that. Fixes: #15783 Fixes: #15795 Signed-off-by: Ed Santiago <santiago@redhat.com>
* / / libpod: fix lookup for subpath in volumesGiuseppe Scrivano2022-09-14
|/ / | | | | | | | | | | | | | | | | a subdirectory that is below a mount destination is detected as a subpath. Closes: https://github.com/containers/podman/issues/15789 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #15788 from kolyshkin/non-crypto-idOpenShift Merge Robot2022-09-14
|\ \ | | | | | | all: stop using deprecated GenerateNonCryptoID
| * | all: stop using deprecated GenerateNonCryptoIDKir Kolyshkin2022-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In view of https://github.com/containers/storage/pull/1337, do this: for f in $(git grep -l stringid.GenerateNonCryptoID | grep -v '^vendor/'); do sed -i 's/stringid.GenerateNonCryptoID/stringid.GenerateRandomID/g' $f; done Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | | Merge pull request #15777 from vrothberg/fix-14546OpenShift Merge Robot2022-09-14
|\ \ \ | | | | | | | | generate systemd: fix pod dependencies
| * | | generate systemd: fix pod dependenciesValentin Rothberg2022-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change the dependencies from a pod unit to its associated container units from `Requires` to `Wants` to prevent the entire pod from transitioning to a failed state. Restart policies for individual containers can be configured separately. Also make sure that the pod's RunRoot is always set. Fixes: #14546 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | | | [systemd] Ensure that podCreateArgs appear last in ExecStartPre=Dan Čermák2022-09-14
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When creating a new pod without the `--name` flag, e.g.: `podman pod create foobar` it will get the name `foobar` implicitly and this will be recorded as the in the `podCreateArgs`. Unfortunately, the implicit name only works if it appears as the **last** argument of the startup command. With 6e2e3a78ed1d05ee5f23f65b814e8135021961dd we started appending the pod security policy to the startCommand, resulting in the following `ExecStartPre=` line: ``` /usr/bin/podman pod create --infra-conmon-pidfile %t/pod-foobar.pid --pod-id-file %t/pod-foobar.pod-id foobar --exit-policy=stop ``` This fails to launch, as the `pod create` command expects only a single non-flag parameter, but it assumes that `exit-policy=stop` is a second and terminates immediately instead. This fixes https://github.com/containers/podman/issues/15592 Signed-off-by: Dan Čermák <dcermak@suse.com>
* | | Merge pull request #15673 from Luap99/templateOpenShift Merge Robot2022-09-13
|\ \ \ | | | | | | | | Fix go template parsing with "\n" in it
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-27 11:16:30 +0000