aboutsummaryrefslogtreecommitdiff
path: root/test
Commit message (Collapse)AuthorAge
* Don't relabel volumes if running in a privileged containerDaniel J Walsh2021-04-16
| | | | | | | | | Docker does not relabel this content, and openstack is running containers in this manner. There is a penalty for doing this on each container, that is not worth taking on a disable SELinux container. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Allow users to override default storage opts with --storage-optDaniel J Walsh2021-04-16
| | | | | | | | | | | | We define in the man page that this overrides the default storage options, but the code was appending to the existing options. This PR also makes a change to allow users to specify --storage-opt="". This will turn off all storage options. https://github.com/containers/podman/issues/9852 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Ensure that `--userns=keep-id` sets user in configMatthew Heon2021-04-16
| | | | | | | | | | | | | | | | | | | | | | | One of the side-effects of the `--userns=keep-id` command is switching the default user of the container to the UID of the user running Podman (though this can still be overridden by the `--user` flag). However, it did this by setting the UID and GID in the OCI spec, and not by informing Libpod of its intention to switch users via the `WithUser()` option. Because of this, a lot of the code that should have triggered when the container ran with a non-root user was not triggering. In the case of the issue that this fixed, the code to remove capabilities from non-root users was not triggering. Adjust the keep-id code to properly inform Libpod of our intention to use a non-root user to fix this. Also, fix an annoying race around short-running exec sessions where Podman would always print a warning that the exec session had already stopped. Fixes #9919 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Volumes prune endpoint should use only prune filtersJakub Guzik2021-04-16
| | | | | | | | | Volumes endpoints for HTTP compat and libpod APIs allowed usage of list HTTP endpoint filter funcs. Documentation in case of compat API does not allow that. This commit aligns code with the documentation and also ligns libpod with compat API. Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Add missing returnJhon Honce2021-04-16
| | | | | | | libpod df handler missing a return after writing error to client. This caused a null to be appended to JSON and crashed python decoder. Signed-off-by: Jhon Honce <jhonce@redhat.com>
* [CI:DOCS] Correct status code for /pods/createJhon Honce2021-04-16
| | | | | | | | | | Swagger documentation reported that the API endpoint /pods/create returned 200 while the as-built code returned 201. 201 is more correct so documentation updated. Tests already checked for 201 so no updated needed. Signed-off-by: Jhon Honce <jhonce@redhat.com>
* cgroup: do not set cgroup parent when rootless and cgroupfsGiuseppe Scrivano2021-04-16
| | | | | | | | | do not set the cgroup parent when running as rootless with cgroupfs, even if cgroup v2 is used. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1947999 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Test that we don't error out on advertised --log-level valuesNalin Dahyabhai2021-04-16
| | | | Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* Fix handling of $NAME and $IMAGE in runlabelDaniel J Walsh2021-04-16
| | | | | | | | Fixes: https://github.com/containers/podman/issues/9405 Add system runlabel tests. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fixes invalid expression in save commandzhangguanzhang2021-04-16
| | | | Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
* Fix testsMatthew Heon2021-03-29
| | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* Fix test failureMatthew Heon2021-03-29
| | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
* Fix containers list/prune http api filter behaviourJakub Guzik2021-03-29
| | | | | | | | | | The problem described in #9711 and followed by #9758 affects containers as well. When user provides wrong filter input, error message should occur, not fallback to full list/prune command. This change fixes the issue. Additionally, there are error message fixes for docker http api compat. Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Validate passed in timezone from tz optionTomSweeneyRedHat2021-03-29
| | | | | | | | | | | | | | | | | | | | | | | | Erik Sjolund reported an issue where a badly formated file could be passed into the `--tz` option and then the date in the container would be badly messed up: ``` erik@laptop:~$ echo Hello > file.txt erik@laptop:~$ podman run --tz=../../../home/erik/file.txt --rm -ti docker.io/library/alpine cat /etc/localtime Hello erik@laptop:~$ podman --version podman version 3.0.0-rc1 erik@laptop:~$ ``` This fix checks to make sure the TZ passed in is a valid value and then proceeds with the rest of the processing. This was first reported as a potential security issue, but it was thought not to be. However, I thought closing the hole sooner rather than later would be good. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
* Generate Kubernetes PersistentVolumeClaims from named volumesJordan Williams2021-03-29
| | | | | | | | | | | | Fixes #5788 This commit adds support for named volumes in podman-generate-kube. Named volumes are output in the YAML as PersistentVolumeClaims. To avoid naming conflicts, the volume name is suffixed with "-pvc". This commit adds a corresponding suffix for host path mounts. Host path volumes are suffixed with "-host". Signed-off-by: Jordan Williams <jordan@jwillikers.com>
* fix: build endpoint for compat APIMatej Vasek2021-03-29
| | | | Signed-off-by: Matej Vasek <mvasek@redhat.com>
* Check if stdin is a term in --interactive --tty modeDaniel J Walsh2021-03-29
| | | | | | | | | | | | | | | | If you are attempting to run a container in interactive mode, and want a --tty, then there must be a terminal in use. Docker exits right away when a user specifies to use a --interactive and --TTY but the stdin is not a tty. Currently podman will pull the image and then fail much later. Podman will continue to run but will print an warning message. Discussion in : https://github.com/containers/podman/issues/8916 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Ensure manually-created volumes have correct ownershipMatthew Heon2021-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | As part of a fix for an earlier bug (#5698) we added the ability for Podman to chown volumes to correctly match the user running in the container, even in adverse circumstances (where we don't know the right UID/GID until very late in the process). However, we only did this for volumes created automatically by a `podman run` or `podman create`. Volumes made by `podman volume create` do not get this chown, so their permissions may not be correct. I've looked, and I don't think there's a good reason not to do this chwon for all volumes the first time the container is started. I would prefer to do this as part of volume copy-up, but I don't think that's really possible (copy-up happens earlier in the process and we don't have a spec). There is a small chance, as things stand, that a copy-up happens for one container and then a chown for a second, unrelated container, but the odds of this are astronomically small (we'd need a very close race between two starting containers). Fixes #9608 Signed-off-by: Matthew Heon <mheon@redhat.com>
* Support multi doc yaml for generate/play kubeEduardo Vega2021-03-29
| | | | | | | | Signed-off-by: Eduardo Vega <edvegavalerio@gmail.com> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <mheon@redhat.com>
* Fix filters in image http compat/libpod api endpointsJakub Guzik2021-03-29
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Fix podman build --pull-neverDaniel J Walsh2021-03-29
| | | | | | | | | | | | | | | Currently pull policy is set incorrectly when users set --pull-never. Also pull-policy is not being translated correctly when using podman-remote. Fixes: #9573 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> <MH: Fixed cherry-pick conflict> Signed-off-by: Matthew Heon <mheon@redhat.com>
* Add problematic volume name to kube play error messagesJordan Christiansen2021-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When kube play fails to create a volume, it should say which volume had the problem so the user doesn't have to guess. For the following pod spec: apiVersion: v1 kind: Pod metadata: name: mypod spec: containers: - name: myfrontend image: nginx volumeMounts: - mountPath: "/var/www/html" name: mypd volumes: - name: mypd hostPath: path: /var/blah podman will now report: Error: failed to create volume "mypd": error in parsing HostPath in YAML: error checking path "/var/blah": stat /var/blah: no such file or directory Signed-off-by: Jordan Christiansen <xordspar0@gmail.com>
* Fix list pods filter handling in libpod apiJakub Guzik2021-03-29
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Merge pull request #9757 from jwhonce/wip/loadOpenShift Merge Robot2021-03-22
|\ | | | | Cleanup /libpod/images/load handler
| * Cleanup /libpod/images/load handlerJhon Honce2021-03-19
| | | | | | | | | | | | | | | | | | * Remove orphaned code * Add meaningful error from LoadImageFromSingleImageArchive() when heuristic fails to determine payload format * Correct swagger to output correct types and headers Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | System tests: reenable a bunch of skipped testsEd Santiago2021-03-20
|/ | | | | | | | Checking for 'skip.*[0-9]{4,5}', and checking status on said issues, finds several that have been closed. Let's see if they're really fixed. Signed-off-by: Ed Santiago <santiago@redhat.com>
* Fix volumes and networks list/prune filters in http apiJakub Guzik2021-03-19
| | | | | | | | | | | This is the continuation work started in #9711. It turns out that list/prune commands for volumes in libpod/compat api have very dangerous error handling when broken filter input is supplied. Problem also affects network list/prune in libpod. This commit unifies filter handling across libpod/compat api and adds sanity apiv2 testcases. Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Merge pull request #9710 from jmguzik/network-prune-filters-http-apiOpenShift Merge Robot2021-03-18
|\ | | | | Network prune filters for http api (compat and libpod)
| * network prune filters for http compat and libpod apiJakub Guzik2021-03-18
| | | | | | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* | test: check for io.stat existence on cgroup v2Giuseppe Scrivano2021-03-17
| | | | | | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | test: fix test for last crun/runcGiuseppe Scrivano2021-03-17
| | | | | | | | | | | | | | | | | | there was a documentation issue for the kernel that reported the range to be different than on cgroup v1. The issue has been fixed in crun/runc. Adapt the test. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | test: simplify cgroup pathGiuseppe Scrivano2021-03-17
| | | | | | | | | | | | with cgroup v2, the cgroupns is enabled by default. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Latest crun/runc should handle blkio-weight testDaniel J Walsh2021-03-17
| | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #9714 from rhatdan/buildOpenShift Merge Robot2021-03-17
|\ \ | | | | | | Switch all builds to pull-never
| * | Switch all builds to pull-neverDaniel J Walsh2021-03-16
| |/ | | | | | | | | | | Fixes: https://github.com/containers/buildah/issues/2779 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #9711 from jmguzik/volume-prune-fix-http-compatOpenShift Merge Robot2021-03-16
|\ \ | | | | | | Fix for volumes prune in http compat api when using filters
| * | Fix for volumes prune in http compat apiJakub Guzik2021-03-15
| |/ | | | | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* | Merge pull request #9695 from jmguzik/array-inspect-network-fixOpenShift Merge Robot2021-03-16
|\ \ | | | | | | Fix array instead of one elem network http api
| * | Fix array instead of one elem network http apiJakub Guzik2021-03-12
| | | | | | | | | | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* | | Merge pull request #9589 from troyready/add_compat_auth_endpointOpenShift Merge Robot2021-03-16
|\ \ \ | | | | | | | | add /auth for docker compatibility
| * | | fix use with localhost (testing)troyready2021-03-12
| | | | | | | | | | | | | | | | Signed-off-by: troyready <troy@troyready.com>
| * | | add /auth for docker compatibilitytroyready2021-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This endpoint just validates credentials: https://github.com/moby/moby/blob/v20.10.4/api/swagger.yaml#L7936-L7977 Fixes: #9564 Signed-off-by: troyready <troy@troyready.com>
* | | | System test cleanupEd Santiago2021-03-15
| |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - cp test: clean up stray image - build test: add workaround for #9567 (ultra-slow ubuntu). We're seeing CI flakes (timeouts) due to ubuntu 2004 being absurdly slow. Workaround: double our timeout on one specific test when ubuntu + remote. - build test: clean up new copy-from test (from #9275). The test was copy-pasted from buildah system tests, without really adapting for podman environment (e.g. it was using images that we don't use here, and would cause pulls, which will cause flakes). Rewrite test so it references only $IMAGE, remove some confusing/unnecessary stuff, selectively run parts of it even when rootless or remote, and add a test to confirm that copy-from succeeded. - load test: add error-message test to new load-invalid (#9672). Basically, make sure the command fails for the right reason. - play test (kube): use $IMAGE, not alpine; and add pause-image cleanup to teardown() - apiv2 mounts test: add a maintainability comment in a tricky section of code; and tighten up the mount point test. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | | Fix remote client timezone testPaul Holzinger2021-03-15
|/ / | | | | | | | | | | | | The New York timezone changes between summer and winter time. Make sure the test allows both timezones. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* | Merge pull request #9699 from jwhonce/wip/testsOpenShift Merge Robot2021-03-12
|\ \ | | | | | | Delete all containers and pods between tests
| * | Delete all containers and pods between testsJhon Honce2021-03-11
| | | | | | | | | | | | | | | | | | New tearDown() deletes all pods and containers between tests Signed-off-by: Jhon Honce <jhonce@redhat.com>
* | | Merge pull request #9697 from edsantiago/fedora_gating_test_hangOpenShift Merge Robot2021-03-12
|\ \ \ | |/ / |/| | sdnotify tests: try real hard to kill socat processes
| * | sdnotify tests: try real hard to kill socat processesEd Santiago2021-03-11
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman gating tests are hanging in the new Fedora CI setup; long and tedious investigation suggests that 'socat' processes are being left unkilled, which then causes BATS to hang when it (presumably) runs a final 'wait' in its end cleanup. The two principal changes are to exec socat in a subshell with fd3 closed, and to pkill its child processes before killing the process itself. I don't know if both are needed. The pkill definitely is; the exec may just be superstition. Since I've wasted more than a day of PTO time on this, I'm okay with a little superstition. What I do know is that with these two changes, my reproducer fails to reproduce in over one hour of trying (normally it fails within 5 minutes). AND, update: only rawhide (f35) leaves stray socat processes behind. f33 and ubuntu do not, so 'pkill -P' fails. I really have no idea what's going on. Signed-off-by: Ed Santiago <santiago@redhat.com>
* | Merge pull request #9686 from edsantiago/apiv2_jsonifyDaniel J Walsh2021-03-11
|\ \ | |/ |/| apiv2 tests: finally fix POST as originally intended
| * apiv2 tests: finally fix POST as originally intendedEd Santiago2021-03-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When I originally wrote this code I had no idea what POST would look like so I did a sloppy job, deferring making it usable. Now that we have some real-world examples in place, I have a better understanding of what params look like and how to make tests more readable/maintainable. (Deferring isn't always bad: one of my early ideas was to separate params using commas; that would've been a disaster because some JSON values, such as arrays, include commas). This commit implements a better way of dealing with POST: * The main concept is still 'key=value' * When value is a JSON object (dictionary, array), it can be quoted. * Multiple params are simply separated by spaces. The 3-digit HTTP code is a prominent, readable separator between POST params and expected results. The parsing code is a little uglier, but test developers need never see that. The important thing is that writing tests is now easier. * POST params can be empty (this removes the need for a useless '') I snuck in one unrelated change: one of the newly-added tests, .NetworkSettings, was failing when run rootless (which is how I test on my setup). I made it conditional. Signed-off-by: Ed Santiago <santiago@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 20:54:44 +0000