From 5e50ba3ecbdd738679849d7a86fef0c4ab7f109d Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@redhat.com>
Date: Fri, 14 Aug 2020 11:19:02 +0200
Subject: podman support for IPv6 networks

podman containers using IPv6 were missing the default route, breaking
deployments trying to use them.

The problem is that the default route was hardcoded to IPv4, this
takes into consideration the podman subnet IP family to generate
the corresponding default route.

Signed-off-by: Antonio Ojea <aojea@redhat.com>
---
 test/e2e/network_create_test.go | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

(limited to 'test')

diff --git a/test/e2e/network_create_test.go b/test/e2e/network_create_test.go
index a69004208..f635f3c6c 100644
--- a/test/e2e/network_create_test.go
+++ b/test/e2e/network_create_test.go
@@ -179,6 +179,47 @@ var _ = Describe("Podman network create", func() {
 		Expect(subnet.Contains(containerIP)).To(BeTrue())
 	})
 
+	It("podman network create with name and IPv6 subnet", func() {
+		SkipIfRemote()
+		var (
+			results []network.NcList
+		)
+		nc := podmanTest.Podman([]string{"network", "create", "--subnet", "fd00:1:2:3:4::/64", "newIPv6network"})
+		nc.WaitWithDefaultTimeout()
+		Expect(nc.ExitCode()).To(BeZero())
+
+		defer podmanTest.removeCNINetwork("newIPv6network")
+
+		// Inspect the network configuration
+		inspect := podmanTest.Podman([]string{"network", "inspect", "newIPv6network"})
+		inspect.WaitWithDefaultTimeout()
+
+		// JSON the network configuration into something usable
+		err := json.Unmarshal([]byte(inspect.OutputToString()), &results)
+		Expect(err).To(BeNil())
+		result := results[0]
+		Expect(result["name"]).To(Equal("newIPv6network"))
+
+		// JSON the bridge info
+		bridgePlugin, err := genericPluginsToBridge(result["plugins"], "bridge")
+		Expect(err).To(BeNil())
+		Expect(bridgePlugin.IPAM.Routes[0].Dest).To(Equal("::/0"))
+
+		// Once a container executes a new network, the nic will be created. We should clean those up
+		// best we can
+		defer removeNetworkDevice(bridgePlugin.BrName)
+
+		try := podmanTest.Podman([]string{"run", "-it", "--rm", "--network", "newIPv6network", ALPINE, "sh", "-c", "ip addr show eth0 |  grep global | awk ' /inet6 / {print $2}'"})
+		try.WaitWithDefaultTimeout()
+
+		_, subnet, err := net.ParseCIDR("fd00:1:2:3:4::/64")
+		Expect(err).To(BeNil())
+		containerIP, _, err := net.ParseCIDR(try.OutputToString())
+		Expect(err).To(BeNil())
+		// Ensure that the IP the container got is within the subnet the user asked for
+		Expect(subnet.Contains(containerIP)).To(BeTrue())
+	})
+
 	It("podman network create with invalid subnet", func() {
 		nc := podmanTest.Podman([]string{"network", "create", "--subnet", "10.11.12.0/17000", "fail"})
 		nc.WaitWithDefaultTimeout()
-- 
cgit v1.2.3-54-g00ecf


From 34f4a892e4056dd660db85db6ee8baa0470dd6f2 Mon Sep 17 00:00:00 2001
From: Qi Wang <qiwan@redhat.com>
Date: Thu, 23 Jul 2020 15:54:12 -0400
Subject: podman save use named pipe

podman save uses named pipe as output path, not directly using /dev/stdout.
fix #7017

Signed-off-by: Qi Wang <qiwan@redhat.com>

<MH: Corrected imports during cherry-pick>

Signed-off-by: Matt Heon <matthew.heon@pm.me>
---
 cmd/podman/images/save.go              | 31 +++++++++++++++++-----
 cmd/podman/images/utils_linux.go       | 47 ++++++++++++++++++++++++++++++++++
 cmd/podman/images/utils_unsupported.go |  7 +++++
 test/system/120-load.bats              | 10 ++++++++
 4 files changed, 89 insertions(+), 6 deletions(-)
 create mode 100644 cmd/podman/images/utils_linux.go
 create mode 100644 cmd/podman/images/utils_unsupported.go

(limited to 'test')

diff --git a/cmd/podman/images/save.go b/cmd/podman/images/save.go
index f84d97b17..00eb9f1e6 100644
--- a/cmd/podman/images/save.go
+++ b/cmd/podman/images/save.go
@@ -5,10 +5,9 @@ import (
 	"os"
 	"strings"
 
-	"github.com/containers/libpod/v2/libpod/define"
-
 	"github.com/containers/libpod/v2/cmd/podman/parse"
 	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/libpod/define"
 	"github.com/containers/libpod/v2/pkg/domain/entities"
 	"github.com/containers/libpod/v2/pkg/util"
 	"github.com/pkg/errors"
@@ -83,9 +82,10 @@ func saveFlags(flags *pflag.FlagSet) {
 
 }
 
-func save(cmd *cobra.Command, args []string) error {
+func save(cmd *cobra.Command, args []string) (finalErr error) {
 	var (
-		tags []string
+		tags      []string
+		succeeded = false
 	)
 	if cmd.Flag("compress").Changed && (saveOpts.Format != define.OCIManifestDir && saveOpts.Format != define.V2s2ManifestDir && saveOpts.Format == "") {
 		return errors.Errorf("--compress can only be set when --format is either 'oci-dir' or 'docker-dir'")
@@ -95,7 +95,22 @@ func save(cmd *cobra.Command, args []string) error {
 		if terminal.IsTerminal(int(fi.Fd())) {
 			return errors.Errorf("refusing to save to terminal. Use -o flag or redirect")
 		}
-		saveOpts.Output = "/dev/stdout"
+		pipePath, cleanup, err := setupPipe()
+		if err != nil {
+			return err
+		}
+		if cleanup != nil {
+			defer func() {
+				errc := cleanup()
+				if succeeded {
+					writeErr := <-errc
+					if writeErr != nil && finalErr == nil {
+						finalErr = writeErr
+					}
+				}
+			}()
+		}
+		saveOpts.Output = pipePath
 	}
 	if err := parse.ValidateFileName(saveOpts.Output); err != nil {
 		return err
@@ -103,5 +118,9 @@ func save(cmd *cobra.Command, args []string) error {
 	if len(args) > 1 {
 		tags = args[1:]
 	}
-	return registry.ImageEngine().Save(context.Background(), args[0], tags, saveOpts)
+	err := registry.ImageEngine().Save(context.Background(), args[0], tags, saveOpts)
+	if err == nil {
+		succeeded = true
+	}
+	return err
 }
diff --git a/cmd/podman/images/utils_linux.go b/cmd/podman/images/utils_linux.go
new file mode 100644
index 000000000..5521abab4
--- /dev/null
+++ b/cmd/podman/images/utils_linux.go
@@ -0,0 +1,47 @@
+package images
+
+import (
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+)
+
+// setupPipe for fixing https://github.com/containers/podman/issues/7017
+// uses named pipe since containers/image EvalSymlinks fails with /dev/stdout
+// the caller should use the returned function to clean up the pipeDir
+func setupPipe() (string, func() <-chan error, error) {
+	errc := make(chan error)
+	pipeDir, err := ioutil.TempDir(os.TempDir(), "pipeDir")
+	if err != nil {
+		return "", nil, err
+	}
+	pipePath := filepath.Join(pipeDir, "saveio")
+	err = unix.Mkfifo(pipePath, 0600)
+	if err != nil {
+		if e := os.RemoveAll(pipeDir); e != nil {
+			logrus.Errorf("error removing named pipe: %q", e)
+		}
+		return "", nil, errors.Wrapf(err, "error creating named pipe")
+	}
+	go func() {
+		fpipe, err := os.Open(pipePath)
+		if err != nil {
+			errc <- err
+			return
+		}
+		_, err = io.Copy(os.Stdout, fpipe)
+		fpipe.Close()
+		errc <- err
+	}()
+	return pipePath, func() <-chan error {
+		if e := os.RemoveAll(pipeDir); e != nil {
+			logrus.Errorf("error removing named pipe: %q", e)
+		}
+		return errc
+	}, nil
+}
diff --git a/cmd/podman/images/utils_unsupported.go b/cmd/podman/images/utils_unsupported.go
new file mode 100644
index 000000000..69d1df786
--- /dev/null
+++ b/cmd/podman/images/utils_unsupported.go
@@ -0,0 +1,7 @@
+// +build !linux
+
+package images
+
+func setupPipe() (string, func() <-chan error, error) {
+	return "/dev/stdout", nil, nil
+}
diff --git a/test/system/120-load.bats b/test/system/120-load.bats
index 611799f8d..ec959ca73 100644
--- a/test/system/120-load.bats
+++ b/test/system/120-load.bats
@@ -26,6 +26,16 @@ verify_iid_and_name() {
     is "$new_img_name" "$1"   "Name & tag of restored image"
 }
 
+@test "podman save to pipe and load" {
+    # We can't use run_podman because that uses the BATS 'run' function
+    # which redirects stdout and stderr. Here we need to guarantee
+    # that podman's stdout is a pipe, not any other form of redirection
+    $PODMAN save --format oci-archive $IMAGE | cat >$PODMAN_TMPDIR/test.tar
+    [ $status -eq 0 ]
+
+    run_podman load -i $PODMAN_TMPDIR/test.tar
+}
+
 
 @test "podman load - by image ID" {
     skip_if_remote "FIXME: pending #7123"
-- 
cgit v1.2.3-54-g00ecf


From 09bd563e2bc544aa987e90c5d831f146198eebb5 Mon Sep 17 00:00:00 2001
From: zhangguanzhang <zhangguanzhang@qq.com>
Date: Sun, 9 Aug 2020 22:05:26 +0800
Subject: Add parameter verification for api creation network

Signed-off-by: zhangguanzhang <zhangguanzhang@qq.com>
---
 pkg/network/network.go    |  9 +++++++++
 test/apiv2/35-networks.at | 28 +++++++++++++++++++++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

(limited to 'test')

diff --git a/pkg/network/network.go b/pkg/network/network.go
index 37f3f721a..4da6bc969 100644
--- a/pkg/network/network.go
+++ b/pkg/network/network.go
@@ -137,6 +137,15 @@ func networkIntersect(n1, n2 *net.IPNet) bool {
 // ValidateUserNetworkIsAvailable returns via an error if a network is available
 // to be used
 func ValidateUserNetworkIsAvailable(config *config.Config, userNet *net.IPNet) error {
+	if len(userNet.IP) == 0 || len(userNet.Mask) == 0 {
+		return errors.Errorf("network %s's ip or mask cannot be empty", userNet.String())
+	}
+
+	ones, bit := userNet.Mask.Size()
+	if ones == 0 || bit == 0 {
+		return errors.Errorf("network %s's mask is invalid", userNet.String())
+	}
+
 	networks, err := GetNetworksFromFilesystem(config)
 	if err != nil {
 		return err
diff --git a/test/apiv2/35-networks.at b/test/apiv2/35-networks.at
index fff3f3b1f..4c032c072 100644
--- a/test/apiv2/35-networks.at
+++ b/test/apiv2/35-networks.at
@@ -3,6 +3,32 @@
 # network-related tests
 #
 
-t GET /networks/non-existing-network 404
+t GET networks/non-existing-network 404 \
+  .cause='network not found'
+
+if root; then
+  t POST libpod/networks/create?name=network1 '' 200 \
+    .Filename~.*/network1\\.conflist
+
+  # --data '{"Subnet":{"IP":"10.10.254.0","Mask":[255,255,255,0]}}'
+  t POST libpod/networks/create?name=network2 '"Subnet":{"IP":"10.10.254.0","Mask":[255,255,255,0]}' 200 \
+    .Filename~.*/network2\\.conflist
+
+  # test for empty mask
+  t POST libpod/networks/create '"Subnet":{"IP":"10.10.1.0","Mask":[]}' 500 \
+    .cause~'.*cannot be empty'
+  # test for invalid mask
+  t POST libpod/networks/create '"Subnet":{"IP":"10.10.1.0","Mask":[0,255,255,0]}' 500 \
+    .cause~'.*mask is invalid'
+
+  # clean the network
+  t DELETE libpod/networks/network1 200 \
+    .[0].Name~network1 \
+    .[0].Err=null
+  t DELETE libpod/networks/network2 200 \
+    .[0].Name~network2 \
+    .[0].Err=null
+
+fi
 
 # vim: filetype=sh
-- 
cgit v1.2.3-54-g00ecf


From c539091bb0346cca036f0b7c4c4fe4423dcc66ee Mon Sep 17 00:00:00 2001
From: Brent Baude <bbaude@redhat.com>
Date: Thu, 6 Aug 2020 14:24:09 -0500
Subject: Replace deepcopy on history results

the deepcopy in the remote history code path was throwing an uncaught error on a type mismatch.  we now manually do the conversion and fix the type mismatch on the fly.

Fixes: #7122

Signed-off-by: Brent Baude <bbaude@redhat.com>
---
 pkg/domain/infra/tunnel/images.go | 13 +++++++++++--
 test/system/110-history.bats      |  2 --
 2 files changed, 11 insertions(+), 4 deletions(-)

(limited to 'test')

diff --git a/pkg/domain/infra/tunnel/images.go b/pkg/domain/infra/tunnel/images.go
index 2e30621c5..2e027a6e1 100644
--- a/pkg/domain/infra/tunnel/images.go
+++ b/pkg/domain/infra/tunnel/images.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/containers/common/pkg/config"
 	"github.com/containers/image/v5/docker/reference"
@@ -65,8 +66,16 @@ func (ir *ImageEngine) History(ctx context.Context, nameOrID string, opts entiti
 	}
 
 	for i, layer := range results {
-		hold := entities.ImageHistoryLayer{}
-		_ = utils.DeepCopy(&hold, layer)
+		// Created time comes over as an int64 so needs conversion to time.time
+		t := time.Unix(layer.Created, 0)
+		hold := entities.ImageHistoryLayer{
+			ID:        layer.ID,
+			Created:   t.UTC(),
+			CreatedBy: layer.CreatedBy,
+			Tags:      layer.Tags,
+			Size:      layer.Size,
+			Comment:   layer.Comment,
+		}
 		history.Layers[i] = hold
 	}
 	return &history, nil
diff --git a/test/system/110-history.bats b/test/system/110-history.bats
index b83e90fe4..5dc221d61 100644
--- a/test/system/110-history.bats
+++ b/test/system/110-history.bats
@@ -3,8 +3,6 @@
 load helpers
 
 @test "podman history - basic tests" {
-    skip_if_remote "FIXME: pending #7122"
-
     tests="
                                  | .*[0-9a-f]\\\{12\\\} .* CMD .* LABEL
 --format '{{.ID}} {{.Created}}'  | .*[0-9a-f]\\\{12\\\} .* ago
-- 
cgit v1.2.3-54-g00ecf


From 66fcafa4d45a26b59ad3662419cd3c778e23c39c Mon Sep 17 00:00:00 2001
From: Sascha Grunert <sgrunert@suse.com>
Date: Mon, 10 Aug 2020 10:16:28 +0200
Subject: Allow specifying seccomp profiles for privileged containers

To sync the behavior between AppArmor and seccomp it is now possible to
also specify seccomp profiles for privileged containers.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
---
 pkg/specgen/generate/security.go |  5 +++--
 test/e2e/run_test.go             | 30 +++++++++++++++++++++++++++---
 2 files changed, 30 insertions(+), 5 deletions(-)

(limited to 'test')

diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index fcd1622f9..840dcb72d 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -158,8 +158,9 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
 		configSpec.Linux.Seccomp = seccompConfig
 	}
 
-	// Clear default Seccomp profile from Generator for privileged containers
-	if s.SeccompProfilePath == "unconfined" || s.Privileged {
+	// Clear default Seccomp profile from Generator for unconfined containers
+	// and privileged containers which do not specify a seccomp profile.
+	if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
 		configSpec.Linux.Seccomp = nil
 	}
 
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 95eecd042..13f0db550 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -183,22 +183,46 @@ var _ = Describe("Podman run", func() {
 		Expect(conData[0].Config.Annotations["io.podman.annotations.init"]).To(Equal("FALSE"))
 	})
 
-	It("podman run seccomp test", func() {
-
+	forbidGetCWDSeccompProfile := func() string {
 		in := []byte(`{"defaultAction":"SCMP_ACT_ALLOW","syscalls":[{"name":"getcwd","action":"SCMP_ACT_ERRNO"}]}`)
 		jsonFile, err := podmanTest.CreateSeccompJson(in)
 		if err != nil {
 			fmt.Println(err)
 			Skip("Failed to prepare seccomp.json for test.")
 		}
+		return jsonFile
+	}
+
+	It("podman run seccomp test", func() {
+		session := podmanTest.Podman([]string{"run", "-it", "--security-opt", strings.Join([]string{"seccomp=", forbidGetCWDSeccompProfile()}, ""), ALPINE, "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).To(ExitWithError())
+		match, _ := session.GrepString("Operation not permitted")
+		Expect(match).Should(BeTrue())
+	})
 
-		session := podmanTest.Podman([]string{"run", "-it", "--security-opt", strings.Join([]string{"seccomp=", jsonFile}, ""), ALPINE, "pwd"})
+	It("podman run seccomp test --privileged", func() {
+		session := podmanTest.Podman([]string{"run", "-it", "--privileged", "--security-opt", strings.Join([]string{"seccomp=", forbidGetCWDSeccompProfile()}, ""), ALPINE, "pwd"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).To(ExitWithError())
 		match, _ := session.GrepString("Operation not permitted")
 		Expect(match).Should(BeTrue())
 	})
 
+	It("podman run seccomp test --privileged no profile should be unconfined", func() {
+		session := podmanTest.Podman([]string{"run", "-it", "--privileged", ALPINE, "grep", "Seccomp", "/proc/self/status"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.OutputToString()).To(ContainSubstring("0"))
+		Expect(session.ExitCode()).To(Equal(0))
+	})
+
+	It("podman run seccomp test no profile should be default", func() {
+		session := podmanTest.Podman([]string{"run", "-it", ALPINE, "grep", "Seccomp", "/proc/self/status"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.OutputToString()).To(ContainSubstring("2"))
+		Expect(session.ExitCode()).To(Equal(0))
+	})
+
 	It("podman run capabilities test", func() {
 		session := podmanTest.Podman([]string{"run", "--rm", "--cap-add", "all", ALPINE, "cat", "/proc/self/status"})
 		session.WaitWithDefaultTimeout()
-- 
cgit v1.2.3-54-g00ecf


From d4c3365454d903077ece3c1a31367f639ee24900 Mon Sep 17 00:00:00 2001
From: Matthew Heon <matthew.heon@pm.me>
Date: Fri, 31 Jul 2020 17:08:06 -0400
Subject: Ensure WORKDIR from images is created

A recent crun change stopped the creation of the container's
working directory if it does not exist. This is arguably correct
for user-specified directories, to protect against typos; it is
definitely not correct for image WORKDIR, where the image author
definitely intended for the directory to be used.

This makes Podman create the working directory and chown it to
container root, if it does not already exist, and only if it was
specified by an image, not the user.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
---
 libpod/container.go                      |  4 ++++
 libpod/container_internal_linux.go       | 27 ++++++++++++++++++++++++++-
 libpod/options.go                        | 13 +++++++++++++
 pkg/specgen/generate/container_create.go | 11 +++++++++++
 test/e2e/run_test.go                     | 10 ++++++++++
 5 files changed, 64 insertions(+), 1 deletion(-)

(limited to 'test')

diff --git a/libpod/container.go b/libpod/container.go
index 9ad938a5c..644647bc9 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -261,6 +261,10 @@ type ContainerConfig struct {
 	Mounts []string `json:"mounts,omitempty"`
 	// NamedVolumes lists the named volumes to mount into the container.
 	NamedVolumes []*ContainerNamedVolume `json:"namedVolumes,omitempty"`
+	// CreateWorkingDir indicates that Libpod should create the container's
+	// working directory if it does not exist. Some OCI runtimes do this by
+	// default, but others do not.
+	CreateWorkingDir bool `json:"createWorkingDir,omitempty"`
 
 	// Security Config
 
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index b9e4f9a93..0d9a1c824 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -157,7 +157,32 @@ func (c *Container) prepare() error {
 	}
 
 	// Save changes to container state
-	return c.save()
+	if err := c.save(); err != nil {
+		return err
+	}
+
+	// Ensure container entrypoint is created (if required)
+	if c.config.CreateWorkingDir {
+		workdir, err := securejoin.SecureJoin(c.state.Mountpoint, c.WorkingDir())
+		if err != nil {
+			return errors.Wrapf(err, "error creating path to container %s working dir", c.ID())
+		}
+		rootUID := c.RootUID()
+		rootGID := c.RootGID()
+
+		if err := os.MkdirAll(workdir, 0755); err != nil {
+			if os.IsExist(err) {
+				return nil
+			}
+			return errors.Wrapf(err, "error creating container %s working dir", c.ID())
+		}
+
+		if err := os.Chown(workdir, rootUID, rootGID); err != nil {
+			return errors.Wrapf(err, "error chowning container %s working directory to container root", c.ID())
+		}
+	}
+
+	return nil
 }
 
 // cleanupNetwork unmounts and cleans up the container's network
diff --git a/libpod/options.go b/libpod/options.go
index 560b406e2..a4e4b99e9 100644
--- a/libpod/options.go
+++ b/libpod/options.go
@@ -1395,6 +1395,19 @@ func WithCreateCommand(cmd []string) CtrCreateOption {
 	}
 }
 
+// WithCreateWorkingDir tells Podman to create the container's working directory
+// if it does not exist.
+func WithCreateWorkingDir() CtrCreateOption {
+	return func(ctr *Container) error {
+		if ctr.valid {
+			return define.ErrCtrFinalized
+		}
+
+		ctr.config.CreateWorkingDir = true
+		return nil
+	}
+}
+
 // Volume Creation Options
 
 // WithVolumeName sets the name of the volume.
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index b31bc91e0..42be5e812 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -215,6 +215,17 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
 	if s.Entrypoint != nil {
 		options = append(options, libpod.WithEntrypoint(s.Entrypoint))
 	}
+	// If the user did not set an workdir but the image did, ensure it is
+	// created.
+	if s.WorkDir == "" && img != nil {
+		newWD, err := img.WorkingDir(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if newWD != "" {
+			options = append(options, libpod.WithCreateWorkingDir())
+		}
+	}
 	if s.StopSignal != nil {
 		options = append(options, libpod.WithStopSignal(*s.StopSignal))
 	}
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 13f0db550..ef275b32e 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -1060,4 +1060,14 @@ USER mail`
 		Expect(session.ExitCode()).To(Equal(0))
 		Expect(session.OutputToString()).To(ContainSubstring(limit))
 	})
+
+	It("podman run makes entrypoint from image", func() {
+		dockerfile := `FROM busybox
+WORKDIR /madethis`
+		podmanTest.BuildImage(dockerfile, "test", "false")
+		session := podmanTest.Podman([]string{"run", "--rm", "test", "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(ContainSubstring("/madethis"))
+	})
 })
-- 
cgit v1.2.3-54-g00ecf


From 32f0c8f624e0400a6decf219d6fe889f12272729 Mon Sep 17 00:00:00 2001
From: Matthew Heon <mheon@redhat.com>
Date: Fri, 7 Aug 2020 13:57:02 -0400
Subject: Do not use image CMD if user gave ENTRYPOINT

This matches Docker behavior, and seems to make sense - the CMD
may have been specific to the original entrypoint and probably
does not make sense if it was changed.

While we're in here, greatly simplify the logic for populating
the SpecGen's Command. We create the full command when making the
OCI spec, so the client should not be doing any more than setting
it to the Command the user passed in, and completely ignoring
ENTRYPOINT.

Fixes #7115

Signed-off-by: Matthew Heon <mheon@redhat.com>
---
 cmd/podman/common/specgen.go | 18 +-----------------
 pkg/specgen/generate/oci.go  |  4 +++-
 test/e2e/run_test.go         | 11 +++++------
 3 files changed, 9 insertions(+), 24 deletions(-)

(limited to 'test')

diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go
index 2333f2f7e..48a2069ff 100644
--- a/cmd/podman/common/specgen.go
+++ b/cmd/podman/common/specgen.go
@@ -387,8 +387,6 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
 	s.Annotations = annotations
 
 	s.WorkDir = c.Workdir
-	userCommand := []string{}
-	var command []string
 	if c.Entrypoint != nil {
 		entrypoint := []string{}
 		if ep := *c.Entrypoint; len(ep) > 0 {
@@ -398,27 +396,13 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
 			}
 		}
 		s.Entrypoint = entrypoint
-		// Build the command
-		// If we have an entry point, it goes first
-		command = entrypoint
 	}
 
 	// Include the command used to create the container.
 	s.ContainerCreateCommand = os.Args
 
 	if len(inputCommand) > 0 {
-		// User command overrides data CMD
-		command = append(command, inputCommand...)
-		userCommand = append(userCommand, inputCommand...)
-	}
-
-	switch {
-	case len(inputCommand) > 0:
-		s.Command = userCommand
-	case c.Entrypoint != nil:
-		s.Command = []string{}
-	default:
-		s.Command = command
+		s.Command = inputCommand
 	}
 
 	// SHM Size
diff --git a/pkg/specgen/generate/oci.go b/pkg/specgen/generate/oci.go
index f279aac1c..f1c9f2a1a 100644
--- a/pkg/specgen/generate/oci.go
+++ b/pkg/specgen/generate/oci.go
@@ -96,8 +96,10 @@ func makeCommand(ctx context.Context, s *specgen.SpecGenerator, img *image.Image
 
 	finalCommand = append(finalCommand, entrypoint...)
 
+	// Only use image command if the user did not manually set an
+	// entrypoint.
 	command := s.Command
-	if command == nil && img != nil {
+	if command == nil && img != nil && s.Entrypoint == nil {
 		newCmd, err := img.Cmd(ctx)
 		if err != nil {
 			return nil, err
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index ef275b32e..681498ea1 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -1061,13 +1061,12 @@ USER mail`
 		Expect(session.OutputToString()).To(ContainSubstring(limit))
 	})
 
-	It("podman run makes entrypoint from image", func() {
-		dockerfile := `FROM busybox
-WORKDIR /madethis`
-		podmanTest.BuildImage(dockerfile, "test", "false")
-		session := podmanTest.Podman([]string{"run", "--rm", "test", "pwd"})
+	It("podman run --entrypoint does not use image command", func() {
+		session := podmanTest.Podman([]string{"run", "--entrypoint", "/bin/echo", ALPINE})
 		session.WaitWithDefaultTimeout()
 		Expect(session.ExitCode()).To(Equal(0))
-		Expect(session.OutputToString()).To(ContainSubstring("/madethis"))
+		// We can't guarantee the output is completely empty, some
+		// nonprintables seem to work their way in.
+		Expect(session.OutputToString()).To(Not(ContainSubstring("/bin/sh")))
 	})
 })
-- 
cgit v1.2.3-54-g00ecf


From fc24c0cc102de911387ed6b768173604fecb1eee Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Wed, 5 Aug 2020 16:28:47 -0400
Subject: Fix handling of working dir

Buildah and podman build can create images without a working dir.

FROM fedora
WORKDIR /test

If you build this image with caching twice, the second time the image
will not have a working dir.

Similarly if you execute

podman run --workdir /foobar fedora

It blows up since the workingdir is not created automatically.

Finally there was duplicated code for getting the workingdir
out of an image, that this PR removes.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 pkg/specgen/container_validate.go        |  5 ---
 pkg/specgen/generate/container.go        | 15 ++++---
 pkg/specgen/generate/container_create.go |  8 +---
 test/e2e/run_working_dir.go              | 69 ++++++++++++++++++++++++++++++++
 4 files changed, 79 insertions(+), 18 deletions(-)
 create mode 100644 test/e2e/run_working_dir.go

(limited to 'test')

diff --git a/pkg/specgen/container_validate.go b/pkg/specgen/container_validate.go
index 57dd2aba7..a979a7f4a 100644
--- a/pkg/specgen/container_validate.go
+++ b/pkg/specgen/container_validate.go
@@ -135,11 +135,6 @@ func (s *SpecGenerator) Validate() error {
 		return err
 	}
 
-	// The following are defaults as needed by container creation
-	if len(s.WorkDir) < 1 {
-		s.WorkDir = "/"
-	}
-
 	// Set defaults if network info is not provided
 	if s.NetNS.NSMode == "" {
 		s.NetNS.NSMode = Bridge
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index f0d52d0c3..59fee80f1 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -135,15 +135,18 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 	s.Annotations = annotations
 
 	// workdir
-	if newImage != nil {
-		workingDir, err := newImage.WorkingDir(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if len(s.WorkDir) < 1 && len(workingDir) > 1 {
+	if s.WorkDir == "" {
+		if newImage != nil {
+			workingDir, err := newImage.WorkingDir(ctx)
+			if err != nil {
+				return nil, err
+			}
 			s.WorkDir = workingDir
 		}
 	}
+	if s.WorkDir == "" {
+		s.WorkDir = "/"
+	}
 
 	if len(s.SeccompProfilePath) < 1 {
 		p, err := libpod.DefaultSeccompPath()
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 42be5e812..6c0a702d6 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -218,13 +218,7 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
 	// If the user did not set an workdir but the image did, ensure it is
 	// created.
 	if s.WorkDir == "" && img != nil {
-		newWD, err := img.WorkingDir(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if newWD != "" {
-			options = append(options, libpod.WithCreateWorkingDir())
-		}
+		options = append(options, libpod.WithCreateWorkingDir())
 	}
 	if s.StopSignal != nil {
 		options = append(options, libpod.WithStopSignal(*s.StopSignal))
diff --git a/test/e2e/run_working_dir.go b/test/e2e/run_working_dir.go
new file mode 100644
index 000000000..93330deba
--- /dev/null
+++ b/test/e2e/run_working_dir.go
@@ -0,0 +1,69 @@
+package integration
+
+import (
+	"os"
+	"strings"
+
+	. "github.com/containers/podman/v2/test/utils"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Podman run", func() {
+	var (
+		tempdir    string
+		err        error
+		podmanTest *PodmanTestIntegration
+	)
+
+	BeforeEach(func() {
+		tempdir, err = CreateTempDirInTempDir()
+		if err != nil {
+			os.Exit(1)
+		}
+		podmanTest = PodmanTestCreate(tempdir)
+		podmanTest.Setup()
+		podmanTest.SeedImages()
+	})
+
+	AfterEach(func() {
+		podmanTest.Cleanup()
+		f := CurrentGinkgoTestDescription()
+		processTestResult(f)
+
+	})
+
+	It("podman run a container without workdir", func() {
+		session := podmanTest.Podman([]string{"run", ALPINE, "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(Equal("/"))
+	})
+
+	It("podman run a container using non existing --workdir", func() {
+		if !strings.Contains(podmanTest.OCIRuntime, "crun") {
+			Skip("Test only works on crun")
+		}
+		session := podmanTest.Podman([]string{"run", "--workdir", "/home/foobar", ALPINE, "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(127))
+	})
+
+	It("podman run a container on an image with a workdir", func() {
+		SkipIfRemote()
+		dockerfile := `FROM alpine
+RUN  mkdir -p /home/foobar
+WORKDIR  /etc/foobar`
+		podmanTest.BuildImage(dockerfile, "test", "false")
+
+		session := podmanTest.Podman([]string{"run", "test", "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(Equal("/etc/foobar"))
+
+		session = podmanTest.Podman([]string{"run", "--workdir", "/home/foobar", "test", "pwd"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(Equal("/home/foobar"))
+	})
+})
-- 
cgit v1.2.3-54-g00ecf


From 35d2db807239eb193edd0d775a95aadb3279f01f Mon Sep 17 00:00:00 2001
From: Jhon Honce <jhonce@redhat.com>
Date: Wed, 5 Aug 2020 15:10:12 -0700
Subject: Default .Repository and .Tag values to <none>

Refactor the processing of Repository and Tag fields to default to <none>
when printing via --format flag. Previously, the default format would
print <none> but --format {{.Tag}} would not in some cases.

Fixes #7123

Signed-off-by: Jhon Honce <jhonce@redhat.com>
---
 cmd/podman/images/list.go | 18 +++++++++++++-----
 test/system/120-load.bats |  2 --
 2 files changed, 13 insertions(+), 7 deletions(-)

(limited to 'test')

diff --git a/cmd/podman/images/list.go b/cmd/podman/images/list.go
index ea88b519b..60af5c847 100644
--- a/cmd/podman/images/list.go
+++ b/cmd/podman/images/list.go
@@ -195,6 +195,7 @@ func sortImages(imageS []*entities.ImageSummary) ([]imageReporter, error) {
 		} else {
 			h.ImageSummary = *e
 			h.Repository = "<none>"
+			h.Tag = "<none>"
 			imgs = append(imgs, h)
 		}
 		listFlag.readOnly = e.IsReadOnly()
@@ -205,27 +206,34 @@ func sortImages(imageS []*entities.ImageSummary) ([]imageReporter, error) {
 }
 
 func tokenRepoTag(ref string) (string, string, error) {
-
 	if ref == "<none>:<none>" {
 		return "<none>", "<none>", nil
 	}
 
 	repo, err := reference.Parse(ref)
 	if err != nil {
-		return "", "", err
+		return "<none>", "<none>", err
 	}
 
 	named, ok := repo.(reference.Named)
 	if !ok {
-		return ref, "", nil
+		return ref, "<none>", nil
+	}
+	name := named.Name()
+	if name == "" {
+		name = "<none>"
 	}
 
 	tagged, ok := repo.(reference.Tagged)
 	if !ok {
-		return named.Name(), "", nil
+		return name, "<none>", nil
+	}
+	tag := tagged.Tag()
+	if tag == "" {
+		tag = "<none>"
 	}
 
-	return named.Name(), tagged.Tag(), nil
+	return name, tag, nil
 
 }
 
diff --git a/test/system/120-load.bats b/test/system/120-load.bats
index ec959ca73..310ee55de 100644
--- a/test/system/120-load.bats
+++ b/test/system/120-load.bats
@@ -38,8 +38,6 @@ verify_iid_and_name() {
 
 
 @test "podman load - by image ID" {
-    skip_if_remote "FIXME: pending #7123"
-
     # FIXME: how to build a simple archive instead?
     get_iid_and_name
 
-- 
cgit v1.2.3-54-g00ecf


From e2a1242cee2589aee7dbdcb535d6e51ec3fb3a45 Mon Sep 17 00:00:00 2001
From: Matthew Heon <matthew.heon@pm.me>
Date: Tue, 18 Aug 2020 15:55:44 -0400
Subject: Fix one import path pointing to containers/podman

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
---
 test/e2e/run_working_dir.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/e2e/run_working_dir.go b/test/e2e/run_working_dir.go
index 93330deba..64f1dc247 100644
--- a/test/e2e/run_working_dir.go
+++ b/test/e2e/run_working_dir.go
@@ -4,7 +4,7 @@ import (
 	"os"
 	"strings"
 
-	. "github.com/containers/podman/v2/test/utils"
+	. "github.com/containers/libpod/v2/test/utils"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 )
-- 
cgit v1.2.3-54-g00ecf


From ee956b04b05eed25d3aec967d8c68e7d1418fa09 Mon Sep 17 00:00:00 2001
From: Jhon Honce <jhonce@redhat.com>
Date: Tue, 21 Jul 2020 10:36:44 -0700
Subject: [WIP] Refactor podman system connection

* Add support to manage multiple connections
  * Add connection
  * Remove connection
  * Rename connection
  * Set connection as default
  * Add markdown/man pages
* Fix recursion in hack/xref-helpmsgs-manpages

Signed-off-by: Jhon Honce <jhonce@redhat.com>

<MH: Fixed build after rebase>

Signed-off-by: Matt Heon <matthew.heon@pm.me>
---
 cmd/podman/main.go                                 |   1 +
 cmd/podman/root.go                                 |  31 ++-
 cmd/podman/system/connection.go                    | 201 ++-----------------
 cmd/podman/system/connection/add.go                | 223 +++++++++++++++++++++
 cmd/podman/system/connection/default.go            |  46 +++++
 cmd/podman/system/connection/list.go               |  84 ++++++++
 cmd/podman/system/connection/remove.go             |  49 +++++
 cmd/podman/system/connection/rename.go             |  54 +++++
 .../markdown/podman-system-connection-add.1.md     |  46 +++++
 .../markdown/podman-system-connection-default.1.md |  20 ++
 .../markdown/podman-system-connection-list.1.md    |  24 +++
 .../markdown/podman-system-connection-remove.1.md  |  20 ++
 .../markdown/podman-system-connection-rename.1.md  |  20 ++
 docs/source/markdown/podman-system-connection.1.md |  43 ++--
 docs/source/markdown/podman-system.1.md            |  21 +-
 hack/xref-helpmsgs-manpages                        |  11 +-
 test/e2e/system_connection_test.go                 | 176 ++++++++++++++++
 17 files changed, 836 insertions(+), 234 deletions(-)
 create mode 100644 cmd/podman/system/connection/add.go
 create mode 100644 cmd/podman/system/connection/default.go
 create mode 100644 cmd/podman/system/connection/list.go
 create mode 100644 cmd/podman/system/connection/remove.go
 create mode 100644 cmd/podman/system/connection/rename.go
 create mode 100644 docs/source/markdown/podman-system-connection-add.1.md
 create mode 100644 docs/source/markdown/podman-system-connection-default.1.md
 create mode 100644 docs/source/markdown/podman-system-connection-list.1.md
 create mode 100644 docs/source/markdown/podman-system-connection-remove.1.md
 create mode 100644 docs/source/markdown/podman-system-connection-rename.1.md
 create mode 100644 test/e2e/system_connection_test.go

(limited to 'test')

diff --git a/cmd/podman/main.go b/cmd/podman/main.go
index 5f740a006..f46f74547 100644
--- a/cmd/podman/main.go
+++ b/cmd/podman/main.go
@@ -14,6 +14,7 @@ import (
 	_ "github.com/containers/libpod/v2/cmd/podman/pods"
 	"github.com/containers/libpod/v2/cmd/podman/registry"
 	_ "github.com/containers/libpod/v2/cmd/podman/system"
+	_ "github.com/containers/libpod/v2/cmd/podman/system/connection"
 	_ "github.com/containers/libpod/v2/cmd/podman/volumes"
 	"github.com/containers/libpod/v2/pkg/rootless"
 	"github.com/containers/libpod/v2/pkg/terminal"
diff --git a/cmd/podman/root.go b/cmd/podman/root.go
index b2c9f9c2c..7895a5f64 100644
--- a/cmd/podman/root.go
+++ b/cmd/podman/root.go
@@ -221,16 +221,12 @@ func loggingHook() {
 
 func rootFlags(cmd *cobra.Command, opts *entities.PodmanConfig) {
 	cfg := opts.Config
+	uri, ident := resolveDestination()
 
 	lFlags := cmd.Flags()
-	custom, _ := config.ReadCustomConfig()
-	defaultURI := custom.Engine.RemoteURI
-	if defaultURI == "" {
-		defaultURI = registry.DefaultAPIAddress()
-	}
 	lFlags.BoolVarP(&opts.Remote, "remote", "r", false, "Access remote Podman service (default false)")
-	lFlags.StringVar(&opts.URI, "url", defaultURI, "URL to access Podman service (CONTAINER_HOST)")
-	lFlags.StringVar(&opts.Identity, "identity", custom.Engine.RemoteIdentity, "path to SSH identity file, (CONTAINER_SSHKEY)")
+	lFlags.StringVar(&opts.URI, "url", uri, "URL to access Podman service (CONTAINER_HOST)")
+	lFlags.StringVar(&opts.Identity, "identity", ident, "path to SSH identity file, (CONTAINER_SSHKEY)")
 
 	pFlags := cmd.PersistentFlags()
 	pFlags.StringVar(&cfg.Engine.CgroupManager, "cgroup-manager", cfg.Engine.CgroupManager, "Cgroup manager to use (\"cgroupfs\"|\"systemd\")")
@@ -277,3 +273,24 @@ func rootFlags(cmd *cobra.Command, opts *entities.PodmanConfig) {
 		pFlags.BoolVar(&useSyslog, "syslog", false, "Output logging information to syslog as well as the console (default false)")
 	}
 }
+
+func resolveDestination() (string, string) {
+	if uri, found := os.LookupEnv("CONTAINER_HOST"); found {
+		var ident string
+		if v, found := os.LookupEnv("CONTAINER_SSHKEY"); found {
+			ident = v
+		}
+		return uri, ident
+	}
+
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return registry.DefaultAPIAddress(), ""
+	}
+
+	uri, ident, err := cfg.ActiveDestination()
+	if err != nil {
+		return registry.DefaultAPIAddress(), ""
+	}
+	return uri, ident
+}
diff --git a/cmd/podman/system/connection.go b/cmd/podman/system/connection.go
index bf015191f..b1c538803 100644
--- a/cmd/podman/system/connection.go
+++ b/cmd/podman/system/connection.go
@@ -1,209 +1,34 @@
 package system
 
 import (
-	"bytes"
-	"fmt"
-	"net"
-	"net/url"
-	"os"
-	"os/user"
-	"regexp"
-
-	"github.com/containers/common/pkg/config"
 	"github.com/containers/libpod/v2/cmd/podman/registry"
-	"github.com/containers/libpod/v2/libpod/define"
+	"github.com/containers/libpod/v2/cmd/podman/validate"
 	"github.com/containers/libpod/v2/pkg/domain/entities"
-	"github.com/containers/libpod/v2/pkg/terminal"
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/agent"
 )
 
-const schemaPattern = "^[A-Za-z][A-Za-z0-9+.-]*:"
-
 var (
-	// Skip creating engines since this command will obtain connection information to engine
+	// Skip creating engines since this command will obtain connection information to said engines
 	noOp = func(cmd *cobra.Command, args []string) error {
 		return nil
 	}
-	connectionCmd = &cobra.Command{
-		Use:  "connection [flags] destination",
-		Args: cobra.ExactArgs(1),
-		Long: `Store ssh destination information in podman configuration.
-  "destination" is of the form [user@]hostname or
-  an URI of the form ssh://[user@]hostname[:port]
-`,
-		Short:              "Record remote ssh destination",
-		PersistentPreRunE:  noOp,
-		PersistentPostRunE: noOp,
-		TraverseChildren:   false,
-		RunE:               connection,
-		Example: `podman system connection server.fubar.com
-  podman system connection --identity ~/.ssh/dev_rsa ssh://root@server.fubar.com:2222
-  podman system connection --identity ~/.ssh/dev_rsa --port 22 root@server.fubar.com`,
-	}
 
-	cOpts = struct {
-		Identity string
-		Port     int
-		UDSPath  string
-	}{}
+	ConnectionCmd = &cobra.Command{
+		Use:                   "connection",
+		Short:                 "Manage remote ssh destinations",
+		Long:                  `Manage ssh destination information in podman configuration`,
+		DisableFlagsInUseLine: true,
+		PersistentPreRunE:     noOp,
+		RunE:                  validate.SubCommandExists,
+		PersistentPostRunE:    noOp,
+		TraverseChildren:      false,
+	}
 )
 
 func init() {
 	registry.Commands = append(registry.Commands, registry.CliCommand{
 		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
-		Command: connectionCmd,
+		Command: ConnectionCmd,
 		Parent:  systemCmd,
 	})
-
-	flags := connectionCmd.Flags()
-	flags.IntVarP(&cOpts.Port, "port", "p", 22, "SSH port number for destination")
-	flags.StringVar(&cOpts.Identity, "identity", "", "path to SSH identity file")
-	flags.StringVar(&cOpts.UDSPath, "socket-path", "", "path to podman socket on remote host. (default '/run/podman/podman.sock' or '/run/user/{uid}/podman/podman.sock)")
-}
-
-func connection(cmd *cobra.Command, args []string) error {
-	// Default to ssh: schema if none given
-	dest := []byte(args[0])
-	if match, err := regexp.Match(schemaPattern, dest); err != nil {
-		return errors.Wrapf(err, "internal regex error %q", schemaPattern)
-	} else if !match {
-		dest = append([]byte("ssh://"), dest...)
-	}
-
-	uri, err := url.Parse(string(dest))
-	if err != nil {
-		return errors.Wrapf(err, "failed to parse %q", string(dest))
-	}
-
-	if uri.User.Username() == "" {
-		if uri.User, err = getUserInfo(uri); err != nil {
-			return err
-		}
-	}
-
-	if cmd.Flag("socket-path").Changed {
-		uri.Path = cmd.Flag("socket-path").Value.String()
-	}
-
-	if cmd.Flag("port").Changed {
-		uri.Host = net.JoinHostPort(uri.Hostname(), cmd.Flag("port").Value.String())
-	}
-
-	if uri.Port() == "" {
-		uri.Host = net.JoinHostPort(uri.Hostname(), cmd.Flag("port").DefValue)
-	}
-
-	if uri.Path == "" {
-		if uri.Path, err = getUDS(cmd, uri); err != nil {
-			return errors.Wrapf(err, "failed to connect to  %q", uri.String())
-		}
-	}
-
-	custom, err := config.ReadCustomConfig()
-	if err != nil {
-		return err
-	}
-
-	if cmd.Flag("identity").Changed {
-		custom.Engine.RemoteIdentity = cOpts.Identity
-	}
-
-	custom.Engine.RemoteURI = uri.String()
-	return custom.Write()
-}
-
-func getUserInfo(uri *url.URL) (*url.Userinfo, error) {
-	var (
-		usr *user.User
-		err error
-	)
-	if u, found := os.LookupEnv("_CONTAINERS_ROOTLESS_UID"); found {
-		usr, err = user.LookupId(u)
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to find user %q", u)
-		}
-	} else {
-		usr, err = user.Current()
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to obtain current user")
-		}
-	}
-
-	pw, set := uri.User.Password()
-	if set {
-		return url.UserPassword(usr.Username, pw), nil
-	}
-	return url.User(usr.Username), nil
-}
-
-func getUDS(cmd *cobra.Command, uri *url.URL) (string, error) {
-	var authMethods []ssh.AuthMethod
-	passwd, set := uri.User.Password()
-	if set {
-		authMethods = append(authMethods, ssh.Password(passwd))
-	}
-
-	ident := cmd.Flag("identity")
-	if ident.Changed {
-		auth, err := terminal.PublicKey(ident.Value.String(), []byte(passwd))
-		if err != nil {
-			return "", errors.Wrapf(err, "Failed to read identity %q", ident.Value.String())
-		}
-		authMethods = append(authMethods, auth)
-	}
-
-	if sock, found := os.LookupEnv("SSH_AUTH_SOCK"); found {
-		logrus.Debugf("Found SSH_AUTH_SOCK %q, ssh-agent signer enabled", sock)
-
-		c, err := net.Dial("unix", sock)
-		if err != nil {
-			return "", err
-		}
-		a := agent.NewClient(c)
-		authMethods = append(authMethods, ssh.PublicKeysCallback(a.Signers))
-	}
-
-	config := &ssh.ClientConfig{
-		User:            uri.User.Username(),
-		Auth:            authMethods,
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-	}
-	dial, err := ssh.Dial("tcp", uri.Host, config)
-	if err != nil {
-		return "", errors.Wrapf(err, "failed to connect to %q", uri.Host)
-	}
-	defer dial.Close()
-
-	session, err := dial.NewSession()
-	if err != nil {
-		return "", errors.Wrapf(err, "failed to create new ssh session on %q", uri.Host)
-	}
-	defer session.Close()
-
-	// Override podman binary for testing etc
-	podman := "podman"
-	if v, found := os.LookupEnv("PODMAN_BINARY"); found {
-		podman = v
-	}
-	run := podman + " info --format=json"
-
-	var buffer bytes.Buffer
-	session.Stdout = &buffer
-	if err := session.Run(run); err != nil {
-		return "", errors.Wrapf(err, "failed to run %q", run)
-	}
-
-	var info define.Info
-	if err := json.Unmarshal(buffer.Bytes(), &info); err != nil {
-		return "", errors.Wrapf(err, "failed to parse 'podman info' results")
-	}
-
-	if info.Host.RemoteSocket == nil || len(info.Host.RemoteSocket.Path) == 0 {
-		return "", fmt.Errorf("remote podman %q failed to report its UDS socket", uri.Host)
-	}
-	return info.Host.RemoteSocket.Path, nil
 }
diff --git a/cmd/podman/system/connection/add.go b/cmd/podman/system/connection/add.go
new file mode 100644
index 000000000..7522eb190
--- /dev/null
+++ b/cmd/podman/system/connection/add.go
@@ -0,0 +1,223 @@
+package connection
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"os/user"
+	"regexp"
+
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/cmd/podman/system"
+	"github.com/containers/libpod/v2/libpod/define"
+	"github.com/containers/libpod/v2/pkg/domain/entities"
+	"github.com/containers/libpod/v2/pkg/terminal"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
+)
+
+const schemaPattern = "^[A-Za-z][A-Za-z0-9+.-]*:"
+
+var (
+	addCmd = &cobra.Command{
+		Use:   "add [flags] NAME DESTINATION",
+		Args:  cobra.ExactArgs(2),
+		Short: "Record destination for the Podman service",
+		Long: `Add destination to podman configuration.
+  "destination" is of the form [user@]hostname or
+  an URI of the form ssh://[user@]hostname[:port]
+`,
+		RunE: add,
+		Example: `podman system connection add laptop server.fubar.com
+  podman system connection add --identity ~/.ssh/dev_rsa testing ssh://root@server.fubar.com:2222
+  podman system connection add --identity ~/.ssh/dev_rsa --port 22 production root@server.fubar.com
+  `,
+	}
+
+	cOpts = struct {
+		Identity string
+		Port     int
+		UDSPath  string
+		Default  bool
+	}{}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: addCmd,
+		Parent:  system.ConnectionCmd,
+	})
+
+	flags := addCmd.Flags()
+	flags.IntVarP(&cOpts.Port, "port", "p", 22, "SSH port number for destination")
+	flags.StringVar(&cOpts.Identity, "identity", "", "path to SSH identity file")
+	flags.StringVar(&cOpts.UDSPath, "socket-path", "", "path to podman socket on remote host. (default '/run/podman/podman.sock' or '/run/user/{uid}/podman/podman.sock)")
+	flags.BoolVarP(&cOpts.Default, "default", "d", false, "Set connection to be default")
+}
+
+func add(cmd *cobra.Command, args []string) error {
+	// Default to ssh: schema if none given
+	dest := args[1]
+	if match, err := regexp.Match(schemaPattern, []byte(dest)); err != nil {
+		return errors.Wrapf(err, "internal regex error %q", schemaPattern)
+	} else if !match {
+		dest = "ssh://" + dest
+	}
+
+	uri, err := url.Parse(dest)
+	if err != nil {
+		return errors.Wrapf(err, "failed to parse %q", dest)
+	}
+
+	if uri.User.Username() == "" {
+		if uri.User, err = getUserInfo(uri); err != nil {
+			return err
+		}
+	}
+
+	if cmd.Flags().Changed("socket-path") {
+		uri.Path = cmd.Flag("socket-path").Value.String()
+	}
+
+	if cmd.Flags().Changed("port") {
+		uri.Host = net.JoinHostPort(uri.Hostname(), cmd.Flag("port").Value.String())
+	}
+
+	if uri.Port() == "" {
+		uri.Host = net.JoinHostPort(uri.Hostname(), cmd.Flag("port").DefValue)
+	}
+
+	if uri.Path == "" {
+		if uri.Path, err = getUDS(cmd, uri); err != nil {
+			return errors.Wrapf(err, "failed to connect to  %q", uri.String())
+		}
+	}
+
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return err
+	}
+
+	if cmd.Flags().Changed("default") {
+		if cOpts.Default {
+			cfg.Engine.ActiveService = args[0]
+		}
+	}
+
+	dst := config.Destination{
+		URI: uri.String(),
+	}
+
+	if cmd.Flags().Changed("identity") {
+		dst.Identity = cOpts.Identity
+	}
+
+	if cfg.Engine.ServiceDestinations == nil {
+		cfg.Engine.ServiceDestinations = map[string]config.Destination{
+			args[0]: dst,
+		}
+	} else {
+		cfg.Engine.ServiceDestinations[args[0]] = dst
+	}
+	return cfg.Write()
+}
+
+func getUserInfo(uri *url.URL) (*url.Userinfo, error) {
+	var (
+		usr *user.User
+		err error
+	)
+	if u, found := os.LookupEnv("_CONTAINERS_ROOTLESS_UID"); found {
+		usr, err = user.LookupId(u)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to find user %q", u)
+		}
+	} else {
+		usr, err = user.Current()
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to obtain current user")
+		}
+	}
+
+	pw, set := uri.User.Password()
+	if set {
+		return url.UserPassword(usr.Username, pw), nil
+	}
+	return url.User(usr.Username), nil
+}
+
+func getUDS(cmd *cobra.Command, uri *url.URL) (string, error) {
+	var authMethods []ssh.AuthMethod
+	passwd, set := uri.User.Password()
+	if set {
+		authMethods = append(authMethods, ssh.Password(passwd))
+	}
+
+	if cmd.Flags().Changed("identity") {
+		value := cmd.Flag("identity").Value.String()
+		auth, err := terminal.PublicKey(value, []byte(passwd))
+		if err != nil {
+			return "", errors.Wrapf(err, "Failed to read identity %q", value)
+		}
+		authMethods = append(authMethods, auth)
+	}
+
+	if sock, found := os.LookupEnv("SSH_AUTH_SOCK"); found {
+		logrus.Debugf("Found SSH_AUTH_SOCK %q, ssh-agent signer enabled", sock)
+
+		c, err := net.Dial("unix", sock)
+		if err != nil {
+			return "", err
+		}
+		a := agent.NewClient(c)
+		authMethods = append(authMethods, ssh.PublicKeysCallback(a.Signers))
+	}
+
+	config := &ssh.ClientConfig{
+		User:            uri.User.Username(),
+		Auth:            authMethods,
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
+	dial, err := ssh.Dial("tcp", uri.Host, config)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to connect to %q", uri.Host)
+	}
+	defer dial.Close()
+
+	session, err := dial.NewSession()
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to create new ssh session on %q", uri.Host)
+	}
+	defer session.Close()
+
+	// Override podman binary for testing etc
+	podman := "podman"
+	if v, found := os.LookupEnv("PODMAN_BINARY"); found {
+		podman = v
+	}
+	run := podman + " info --format=json"
+
+	var buffer bytes.Buffer
+	session.Stdout = &buffer
+	if err := session.Run(run); err != nil {
+		return "", errors.Wrapf(err, "failed to run %q", run)
+	}
+
+	var info define.Info
+	if err := json.Unmarshal(buffer.Bytes(), &info); err != nil {
+		return "", errors.Wrapf(err, "failed to parse 'podman info' results")
+	}
+
+	if info.Host.RemoteSocket == nil || len(info.Host.RemoteSocket.Path) == 0 {
+		return "", fmt.Errorf("remote podman %q failed to report its UDS socket", uri.Host)
+	}
+	return info.Host.RemoteSocket.Path, nil
+}
diff --git a/cmd/podman/system/connection/default.go b/cmd/podman/system/connection/default.go
new file mode 100644
index 000000000..b85343dc2
--- /dev/null
+++ b/cmd/podman/system/connection/default.go
@@ -0,0 +1,46 @@
+package connection
+
+import (
+	"fmt"
+
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/cmd/podman/system"
+	"github.com/containers/libpod/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// Skip creating engines since this command will obtain connection information to said engines
+	dfltCmd = &cobra.Command{
+		Use:                   "default NAME",
+		Args:                  cobra.ExactArgs(1),
+		Short:                 "Set named destination as default",
+		Long:                  `Set named destination as default for the Podman service`,
+		DisableFlagsInUseLine: true,
+		RunE:                  defaultRunE,
+		Example:               `podman system connection default testing`,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: dfltCmd,
+		Parent:  system.ConnectionCmd,
+	})
+}
+
+func defaultRunE(cmd *cobra.Command, args []string) error {
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return err
+	}
+
+	if _, found := cfg.Engine.ServiceDestinations[args[0]]; !found {
+		return fmt.Errorf("%q destination is not defined. See \"podman system connection add ...\" to create a connection", args[0])
+	}
+
+	cfg.Engine.ActiveService = args[0]
+	return cfg.Write()
+}
diff --git a/cmd/podman/system/connection/list.go b/cmd/podman/system/connection/list.go
new file mode 100644
index 000000000..c0a9087f5
--- /dev/null
+++ b/cmd/podman/system/connection/list.go
@@ -0,0 +1,84 @@
+package connection
+
+import (
+	"os"
+	"text/tabwriter"
+	"text/template"
+
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/cmd/podman/system"
+	"github.com/containers/libpod/v2/cmd/podman/validate"
+	"github.com/containers/libpod/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	listCmd = &cobra.Command{
+		Use:                   "list",
+		Aliases:               []string{"ls"},
+		Args:                  validate.NoArgs,
+		Short:                 "List destination for the Podman service(s)",
+		Long:                  `List destination information for the Podman service(s) in podman configuration`,
+		DisableFlagsInUseLine: true,
+		Example: `podman system connection list
+  podman system connection ls`,
+		RunE:             list,
+		TraverseChildren: false,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: listCmd,
+		Parent:  system.ConnectionCmd,
+	})
+}
+
+type namedDestination struct {
+	Name string
+	config.Destination
+}
+
+func list(_ *cobra.Command, _ []string) error {
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return err
+	}
+
+	if len(cfg.Engine.ServiceDestinations) == 0 {
+		return nil
+	}
+
+	hdrs := []map[string]string{{
+		"Identity": "Identity",
+		"Name":     "Name",
+		"URI":      "URI",
+	}}
+
+	rows := make([]namedDestination, 0)
+	for k, v := range cfg.Engine.ServiceDestinations {
+		if k == cfg.Engine.ActiveService {
+			k += "*"
+		}
+
+		r := namedDestination{
+			Name: k,
+			Destination: config.Destination{
+				Identity: v.Identity,
+				URI:      v.URI,
+			},
+		}
+		rows = append(rows, r)
+	}
+
+	// TODO: Allow user to override format
+	format := "{{range . }}{{.Name}}\t{{.Identity}}\t{{.URI}}\n{{end}}"
+	tmpl := template.Must(template.New("connection").Parse(format))
+	w := tabwriter.NewWriter(os.Stdout, 8, 2, 2, ' ', 0)
+	defer w.Flush()
+
+	_ = tmpl.Execute(w, hdrs)
+	return tmpl.Execute(w, rows)
+}
diff --git a/cmd/podman/system/connection/remove.go b/cmd/podman/system/connection/remove.go
new file mode 100644
index 000000000..a2ca66c8d
--- /dev/null
+++ b/cmd/podman/system/connection/remove.go
@@ -0,0 +1,49 @@
+package connection
+
+import (
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/cmd/podman/system"
+	"github.com/containers/libpod/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// Skip creating engines since this command will obtain connection information to said engines
+	rmCmd = &cobra.Command{
+		Use:                   "remove NAME",
+		Args:                  cobra.ExactArgs(1),
+		Aliases:               []string{"rm"},
+		Long:                  `Delete named destination from podman configuration`,
+		Short:                 "Delete named destination",
+		DisableFlagsInUseLine: true,
+		RunE:                  rm,
+		Example: `podman system connection remove devl
+  podman system connection rm devl`,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: rmCmd,
+		Parent:  system.ConnectionCmd,
+	})
+}
+
+func rm(_ *cobra.Command, args []string) error {
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return err
+	}
+
+	if cfg.Engine.ServiceDestinations != nil {
+		delete(cfg.Engine.ServiceDestinations, args[0])
+	}
+
+	if cfg.Engine.ActiveService == args[0] {
+		cfg.Engine.ActiveService = ""
+	}
+
+	return cfg.Write()
+}
diff --git a/cmd/podman/system/connection/rename.go b/cmd/podman/system/connection/rename.go
new file mode 100644
index 000000000..d6cd55c31
--- /dev/null
+++ b/cmd/podman/system/connection/rename.go
@@ -0,0 +1,54 @@
+package connection
+
+import (
+	"fmt"
+
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/libpod/v2/cmd/podman/registry"
+	"github.com/containers/libpod/v2/cmd/podman/system"
+	"github.com/containers/libpod/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// Skip creating engines since this command will obtain connection information to said engines
+	renameCmd = &cobra.Command{
+		Use:                   "rename OLD NEW",
+		Aliases:               []string{"mv"},
+		Args:                  cobra.ExactArgs(2),
+		Short:                 "Rename \"old\" to \"new\"",
+		Long:                  `Rename destination for the Podman service from "old" to "new"`,
+		DisableFlagsInUseLine: true,
+		RunE:                  rename,
+		Example: `podman system connection rename laptop devl,
+  podman system connection mv laptop devl`,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: renameCmd,
+		Parent:  system.ConnectionCmd,
+	})
+}
+
+func rename(cmd *cobra.Command, args []string) error {
+	cfg, err := config.ReadCustomConfig()
+	if err != nil {
+		return err
+	}
+
+	if _, found := cfg.Engine.ServiceDestinations[args[0]]; !found {
+		return fmt.Errorf("%q destination is not defined. See \"podman system connection add ...\" to create a connection", args[0])
+	}
+
+	cfg.Engine.ServiceDestinations[args[1]] = cfg.Engine.ServiceDestinations[args[0]]
+	delete(cfg.Engine.ServiceDestinations, args[0])
+
+	if cfg.Engine.ActiveService == args[0] {
+		cfg.Engine.ActiveService = args[1]
+	}
+
+	return cfg.Write()
+}
diff --git a/docs/source/markdown/podman-system-connection-add.1.md b/docs/source/markdown/podman-system-connection-add.1.md
new file mode 100644
index 000000000..5059803a2
--- /dev/null
+++ b/docs/source/markdown/podman-system-connection-add.1.md
@@ -0,0 +1,46 @@
+% podman-system-connection-add(1)
+
+## NAME
+podman\-system\-connection\-add - Record destination for the Podman service
+
+## SYNOPSIS
+**podman system connection add** [*options*] *name* *destination*
+
+## DESCRIPTION
+Record ssh destination for remote podman service(s). The ssh destination is given as one of:
+ - [user@]hostname[:port]
+ - ssh://[user@]hostname[:port]
+
+The user will be prompted for the remote ssh login password or key file pass phrase as required. The `ssh-agent` is supported if it is running.
+
+## OPTIONS
+
+**-d**, **--default**=*false*
+
+Make the new destination the default for this user.
+
+**--identity**=*path*
+
+Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase.
+If no identity file is provided and no user is given, Podman defaults to the user running the podman command.
+Podman prompts for the login password on the remote server.
+
+**-p**, **--port**=*port*
+
+Port for ssh destination. The default value is `22`.
+
+**--socket-path**=*path*
+
+Path to the Podman service unix domain socket on the ssh destination host
+
+## EXAMPLE
+```
+$ podman system connection add QA podman.example.com
+
+$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222
+```
+## SEE ALSO
+podman-system(1) , podman-system-connection(1) , containers.conf(5)
+
+## HISTORY
+June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system-connection-default.1.md b/docs/source/markdown/podman-system-connection-default.1.md
new file mode 100644
index 000000000..f324f8c01
--- /dev/null
+++ b/docs/source/markdown/podman-system-connection-default.1.md
@@ -0,0 +1,20 @@
+% podman-system-connection-default(1)
+
+## NAME
+podman\-system\-connection\-default - Set named destination as default for the Podman service
+
+## SYNOPSIS
+**podman system connection default** *name*
+
+## DESCRIPTION
+Set named ssh destination as default destination for the Podman service.
+
+## EXAMPLE
+```
+$ podman system connection default production
+```
+## SEE ALSO
+podman-system(1) , podman-system-connection(1) , containers.conf(5)
+
+## HISTORY
+July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system-connection-list.1.md b/docs/source/markdown/podman-system-connection-list.1.md
new file mode 100644
index 000000000..f5fb5c8e3
--- /dev/null
+++ b/docs/source/markdown/podman-system-connection-list.1.md
@@ -0,0 +1,24 @@
+% podman-system-connection-list(1)
+
+## NAME
+podman\-system\-connection\-list - List the destination for the Podman service(s)
+
+## SYNOPSIS
+**podman system connection list**
+
+**podman system connection ls**
+
+## DESCRIPTION
+List ssh destination(s) for podman service(s).
+
+## EXAMPLE
+```
+$ podman system connection list
+Name URI                                           Identity
+devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa
+```
+## SEE ALSO
+podman-system(1) , containers.conf(5)
+
+## HISTORY
+July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system-connection-remove.1.md b/docs/source/markdown/podman-system-connection-remove.1.md
new file mode 100644
index 000000000..faa767176
--- /dev/null
+++ b/docs/source/markdown/podman-system-connection-remove.1.md
@@ -0,0 +1,20 @@
+% podman-system-connection-remove(1)
+
+## NAME
+podman\-system\-connection\-remove - Delete named destination
+
+## SYNOPSIS
+**podman system connection remove** *name*
+
+## DESCRIPTION
+Delete named ssh destination.
+
+## EXAMPLE
+```
+$ podman system connection remove production
+```
+## SEE ALSO
+podman-system(1) , podman-system-connection(1) , containers.conf(5)
+
+## HISTORY
+July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system-connection-rename.1.md b/docs/source/markdown/podman-system-connection-rename.1.md
new file mode 100644
index 000000000..819cb697f
--- /dev/null
+++ b/docs/source/markdown/podman-system-connection-rename.1.md
@@ -0,0 +1,20 @@
+% podman-system-connection-rename(1)
+
+## NAME
+podman\-system\-connection\-rename - Rename the destination for Podman service
+
+## SYNOPSIS
+**podman system connection rename** *old* *new*
+
+## DESCRIPTION
+Rename ssh destination from *old* to *new*.
+
+## EXAMPLE
+```
+$ podman system connection rename laptop devel
+```
+## SEE ALSO
+podman-system(1) , podman-system-connection(1) , containers.conf(5)
+
+## HISTORY
+July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system-connection.1.md b/docs/source/markdown/podman-system-connection.1.md
index 66cb656ae..86199c6b9 100644
--- a/docs/source/markdown/podman-system-connection.1.md
+++ b/docs/source/markdown/podman-system-connection.1.md
@@ -1,43 +1,34 @@
 % podman-system-connection(1)
 
 ## NAME
-podman\-system\-connection - Record ssh destination for remote podman service
+podman\-system\-connection - Manage the destination(s) for Podman service(s)
 
-## SYNOPSIS
-**podman system connection** [*options*] [*ssh destination*]
+## SYNOPSISManage the destination(s) for Podman service(s)
+**podman system connection** *subcommand*
 
 ## DESCRIPTION
-Record ssh destination for remote podman service(s). The ssh destination is given as one of:
- - [user@]hostname[:port]
- - ssh://[user@]hostname[:port]
+Manage the destination(s) for Podman service(s).
 
-The user will be prompted for the remote ssh login password or key file pass phrase as required. `ssh-agent` is supported if it is running.
+The user will be prompted for the ssh login password or key file pass phrase as required. The `ssh-agent` is supported if it is running.
 
-## OPTIONS
+## COMMANDS
 
-**--identity**=*path*
-
-Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase.
-If no identity file is provided and no user is given, Podman defaults to the user running the podman command.
-Podman prompts for the login password on the remote server.
-
-**-p**, **--port**=*port*
-
-Port for ssh destination. The default value is `22`.
-
-**--socket-path**=*path*
-
-Path to podman service unix domain socket on the ssh destination host
+| Command  | Man Page                                                                     | Description                                                |
+| -------  | ---------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| add      | [podman-system-connection-add(1)](podman-system-connection-add.1.md)         | Record destination for the Podman service |
+| default  | [podman-system-connection-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service |
+| list     | [podman-system-connection-list(1)](podman-system-connection-list.1.md)       | List the destination for the Podman service(s) |
+| remove   | [podman-system-connection-remove(1)](podman-system-connection-remove.1.md)   | Delete named destination |
+| rename   | [podman-system-connection-rename(1)](podman-system-connection-rename.1.md)   | Rename the destination for Podman service |
 
 ## EXAMPLE
 ```
-$ podman system connection podman.fubar.com
-
-$ podman system connection --identity ~/.ssh/dev_rsa ssh://root@server.fubar.com:2222
-
+$ podman system connection list
+Name URI                                           Identity
+devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa
 ```
 ## SEE ALSO
-podman-system(1) , containers.conf(5) , connections.conf(5)
+podman-system(1) , containers.conf(5)
 
 ## HISTORY
 June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
diff --git a/docs/source/markdown/podman-system.1.md b/docs/source/markdown/podman-system.1.md
index 1f19fd0b6..9ac73237e 100644
--- a/docs/source/markdown/podman-system.1.md
+++ b/docs/source/markdown/podman-system.1.md
@@ -11,17 +11,16 @@ The system command allows you to manage the podman systems
 
 ## COMMANDS
 
-| Command    | Man Page                                                     | Description                                                                  |
-| -------    | ---------------------------------------------------          | ---------------------------------------------------------------------------- |
-| df         | [podman-system-df(1)](podman-system-df.1.md)                 | Show podman disk usage.                                                      |
-| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Record ssh destination for remote podman service.                            |
-| info       | [podman-system-info(1)](podman-info.1.md)                    | Displays Podman related system information.                                  |
-| migrate    | [podman-system-migrate(1)](podman-system-migrate.1.md)       | Migrate existing containers to a new podman version.                         |
-| prune      | [podman-system-prune(1)](podman-system-prune.1.md)           | Remove all unused container, image and volume data.                          |
-| renumber   | [podman-system-renumber(1)](podman-system-renumber.1.md)     | Migrate lock numbers to handle a change in maximum number of locks.          |
-| reset      | [podman-system-reset(1)](podman-system-reset.1.md)           | Reset storage back to initial state.                                         |
-| service    | [podman-service(1)](podman-system-service.1.md)              | Run an API service                                                           |
-
+| Command    | Man Page                                                     | Description                                                          |
+| -------    | ------------------------------------------------------------ | -------------------------------------------------------------------- |
+| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s)                      |
+| df         | [podman-system-df(1)](podman-system-df.1.md)                 | Show podman disk usage.                                              |
+| info       | [podman-system-info(1)](podman-info.1.md)                    | Displays Podman related system information.                          |
+| migrate    | [podman-system-migrate(1)](podman-system-migrate.1.md)       | Migrate existing containers to a new podman version.                 |
+| prune      | [podman-system-prune(1)](podman-system-prune.1.md)           | Remove all unused container, image and volume data.                  |
+| renumber   | [podman-system-renumber(1)](podman-system-renumber.1.md)     | Migrate lock numbers to handle a change in maximum number of locks.  |
+| reset      | [podman-system-reset(1)](podman-system-reset.1.md)           | Reset storage back to initial state.                                 |
+| service    | [podman-system-service(1)](podman-system-service.1.md)       | Run an API service                                                   |
 
 ## SEE ALSO
 podman(1)
diff --git a/hack/xref-helpmsgs-manpages b/hack/xref-helpmsgs-manpages
index c1e9dffc4..16b596589 100755
--- a/hack/xref-helpmsgs-manpages
+++ b/hack/xref-helpmsgs-manpages
@@ -16,6 +16,9 @@ our $VERSION = '0.1';
 # For debugging, show data structures using DumpTree($var)
 #use Data::TreeDumper; $Data::TreeDumper::Displayaddress = 0;
 
+# unbuffer output
+$| = 1;
+
 ###############################################################################
 # BEGIN user-customizable section
 
@@ -266,12 +269,16 @@ sub podman_man {
         elsif ($section eq 'commands') {
             # In podman.1.md
             if ($line =~ /^\|\s*\[podman-(\S+?)\(\d\)\]/) {
-                $man{$1} = podman_man("podman-$1");
+                # $1 will be changed by recursion _*BEFORE*_ left-hand assignment
+                my $subcmd = $1;
+                $man{$subcmd} = podman_man("podman-$1");
             }
 
             # In podman-<subcommand>.1.md
             elsif ($line =~ /^\|\s+(\S+)\s+\|\s+\[\S+\]\((\S+)\.1\.md\)/) {
-                $man{$1} = podman_man($2);
+                # $1 will be changed by recursion _*BEFORE*_ left-hand assignment
+                my $subcmd = $1;
+                $man{$subcmd} = podman_man($2);
             }
         }
 
diff --git a/test/e2e/system_connection_test.go b/test/e2e/system_connection_test.go
new file mode 100644
index 000000000..4c750ee7f
--- /dev/null
+++ b/test/e2e/system_connection_test.go
@@ -0,0 +1,176 @@
+package integration
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/containers/common/pkg/config"
+	. "github.com/containers/libpod/v2/test/utils"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega/gbytes"
+	. "github.com/onsi/gomega/gexec"
+)
+
+var _ = Describe("podman system connection", func() {
+	ConfPath := struct {
+		Value string
+		IsSet bool
+	}{}
+
+	var (
+		podmanTest *PodmanTestIntegration
+	)
+
+	BeforeEach(func() {
+		ConfPath.Value, ConfPath.IsSet = os.LookupEnv("CONTAINERS_CONF")
+		conf, err := ioutil.TempFile("", "containersconf")
+		if err != nil {
+			panic(err)
+		}
+		os.Setenv("CONTAINERS_CONF", conf.Name())
+
+		tempdir, err := CreateTempDirInTempDir()
+		if err != nil {
+			panic(err)
+		}
+		podmanTest = PodmanTestCreate(tempdir)
+		podmanTest.Setup()
+	})
+
+	AfterEach(func() {
+		podmanTest.Cleanup()
+		os.Remove(os.Getenv("CONTAINERS_CONF"))
+		if ConfPath.IsSet {
+			os.Setenv("CONTAINERS_CONF", ConfPath.Value)
+		} else {
+			os.Unsetenv("CONTAINERS_CONF")
+		}
+
+		f := CurrentGinkgoTestDescription()
+		timedResult := fmt.Sprintf("Test: %s completed in %f seconds", f.TestText, f.Duration.Seconds())
+		GinkgoWriter.Write([]byte(timedResult))
+	})
+
+	It("add", func() {
+		cmd := []string{"system", "connection", "add",
+			"--default",
+			"--identity", "~/.ssh/id_rsa",
+			"QA",
+			"ssh://root@server.fubar.com:2222/run/podman/podman.sock",
+		}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.Out).Should(Say(""))
+
+		cfg, err := config.ReadCustomConfig()
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(cfg.Engine.ActiveService).To(Equal("QA"))
+		Expect(cfg.Engine.ServiceDestinations["QA"]).To(Equal(
+			config.Destination{
+				URI:      "ssh://root@server.fubar.com:2222/run/podman/podman.sock",
+				Identity: "~/.ssh/id_rsa",
+			},
+		))
+
+		cmd = []string{"system", "connection", "rename",
+			"QA",
+			"QE",
+		}
+		session = podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+
+		cfg, err = config.ReadCustomConfig()
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(cfg.Engine.ActiveService).To(Equal("QE"))
+		Expect(cfg.Engine.ServiceDestinations["QE"]).To(Equal(
+			config.Destination{
+				URI:      "ssh://root@server.fubar.com:2222/run/podman/podman.sock",
+				Identity: "~/.ssh/id_rsa",
+			},
+		))
+	})
+
+	It("remove", func() {
+		cmd := []string{"system", "connection", "add",
+			"--default",
+			"--identity", "~/.ssh/id_rsa",
+			"QA",
+			"ssh://root@server.fubar.com:2222/run/podman/podman.sock",
+		}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+
+		for i := 0; i < 2; i++ {
+			cmd = []string{"system", "connection", "remove", "QA"}
+			session = podmanTest.Podman(cmd)
+			session.WaitWithDefaultTimeout()
+			Expect(session).Should(Exit(0))
+			Expect(session.Out).Should(Say(""))
+
+			cfg, err := config.ReadCustomConfig()
+			Expect(err).ShouldNot(HaveOccurred())
+			Expect(cfg.Engine.ActiveService).To(BeEmpty())
+			Expect(cfg.Engine.ServiceDestinations).To(BeEmpty())
+		}
+	})
+
+	It("default", func() {
+		for _, name := range []string{"devl", "qe"} {
+			cmd := []string{"system", "connection", "add",
+				"--default",
+				"--identity", "~/.ssh/id_rsa",
+				name,
+				"ssh://root@server.fubar.com:2222/run/podman/podman.sock",
+			}
+			session := podmanTest.Podman(cmd)
+			session.WaitWithDefaultTimeout()
+			Expect(session).Should(Exit(0))
+		}
+
+		cmd := []string{"system", "connection", "default", "devl"}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.Out).Should(Say(""))
+
+		cfg, err := config.ReadCustomConfig()
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(cfg.Engine.ActiveService).To(Equal("devl"))
+
+		cmd = []string{"system", "connection", "list"}
+		session = podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.Out).Should(Say("Name *Identity *URI"))
+	})
+
+	It("failed default", func() {
+		cmd := []string{"system", "connection", "default", "devl"}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).ShouldNot(Exit(0))
+		Expect(session.Err).Should(Say("destination is not defined"))
+	})
+
+	It("failed rename", func() {
+		cmd := []string{"system", "connection", "rename", "devl", "QE"}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).ShouldNot(Exit(0))
+		Expect(session.Err).Should(Say("destination is not defined"))
+	})
+
+	It("empty list", func() {
+		cmd := []string{"system", "connection", "list"}
+		session := podmanTest.Podman(cmd)
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(Exit(0))
+		Expect(session.Out).Should(Say(""))
+		Expect(session.Err).Should(Say(""))
+	})
+})
-- 
cgit v1.2.3-54-g00ecf


From d3ef4770d4e33f3f6c12895b726320b9c9f311c2 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Tue, 18 Aug 2020 19:37:05 +0200
Subject: fix podman version output to include git commit and builttime

Add the go module version v2 to the libpod path.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 Makefile                   | 2 +-
 test/system/001-basic.bats | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

(limited to 'test')

diff --git a/Makefile b/Makefile
index bef7fe2a2..da8997ea3 100644
--- a/Makefile
+++ b/Makefile
@@ -66,7 +66,7 @@ else
 	BUILD_INFO ?= $(shell date "+$(DATE_FMT)")
 	ISODATE ?= $(shell date --iso-8601)
 endif
-LIBPOD := ${PROJECT}/libpod
+LIBPOD := ${PROJECT}/v2/libpod
 GCFLAGS ?= all=-trimpath=${PWD}
 ASMFLAGS ?= all=-trimpath=${PWD}
 LDFLAGS_PODMAN ?= \
diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats
index 71595f419..b12836b9e 100644
--- a/test/system/001-basic.bats
+++ b/test/system/001-basic.bats
@@ -24,6 +24,13 @@ function setup() {
     is "${lines[0]}" "Version:[ ]\+[1-9][0-9.]\+" "Version line 1"
     is "$output" ".*Go Version: \+"               "'Go Version' in output"
     is "$output" ".*API Version: \+"		  "API version in output"
+
+    # Test that build date is reasonable, e.g. after 2019-01-01
+    local built=$(expr "$output" : ".*Built: \+\(.*\)" | head -n1)
+    local built_t=$(date --date="$built" +%s)
+    if [ $built_t -lt 1546300800 ]; then
+        die "Preposterous 'Built' time in podman version: '$built'"
+    fi
 }
 
 
-- 
cgit v1.2.3-54-g00ecf


From 7fc0fbfb657f9a1620e76ea0d48a30b1ee4af4b8 Mon Sep 17 00:00:00 2001
From: Matthew Heon <matthew.heon@pm.me>
Date: Thu, 20 Aug 2020 14:17:48 -0400
Subject: Fix a system test failure

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
---
 test/system/015-help.bats | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/system/015-help.bats b/test/system/015-help.bats
index 42d3bd3ec..201b23b5e 100644
--- a/test/system/015-help.bats
+++ b/test/system/015-help.bats
@@ -40,7 +40,9 @@ function check_help() {
         [ -n "$usage" ] || die "podman $cmd: no Usage message found"
 
         # e.g. 'podman ps' should not show 'podman container ps' in usage
-        is "$usage" "  $command_string .*" "Usage string matches command"
+        # Trailing space in usage handles 'podman system renumber' which
+        # has no ' [flags]'
+        is "$usage " "  $command_string .*" "Usage string matches command"
 
         # If usage ends in '[command]', recurse into subcommands
         if expr "$usage" : '.*\[command\]$' >/dev/null; then
-- 
cgit v1.2.3-54-g00ecf


From 7fc3c25410bd5ee053473ffd5df2209f41840ec0 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Thu, 20 Aug 2020 11:07:36 +0200
Subject: fix pod creation with "new:" syntax followup + allow hostname

Fixes: 4c75fe3f70ed ("fix pod creation with "new:" syntax")

Commit 4c75fe3f70ed passes all net options to the pod but forgot
to unset the options for the container creation. This leads to
erros when using flags like `--ip` since we tried setting
the ip on the pod and container which obviously fails.

I didn't notice the bug because we don't throw an error when
specifing port bindings on a container which joins the pods
network namespace. (#7373)

Also allow the use of `--hostname` and pass that option to the
pod and unset it for the container. The container has to use
the pods hostname anyway. This would error otherwise.

Added tests to prevent regression.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 cmd/podman/containers/create.go |  5 +++++
 test/e2e/run_networking_test.go | 32 ++++++++++++++++++++++++++++++--
 test/e2e/run_test.go            |  8 ++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)

(limited to 'test')

diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 0cd56f540..04a6ff9ba 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -292,7 +292,12 @@ func createPodIfNecessary(s *specgen.SpecGenerator, netOpts *entities.NetOptions
 		Infra:         true,
 		Net:           netOpts,
 		CreateCommand: os.Args,
+		Hostname:      s.ContainerBasicConfig.Hostname,
 	}
+	// Unset config values we passed to the pod to prevent them being used twice for the container and pod.
+	s.ContainerBasicConfig.Hostname = ""
+	s.ContainerNetworkConfig = specgen.ContainerNetworkConfig{}
+
 	s.Pod = podName
 	return registry.ContainerEngine().PodCreate(context.Background(), createOptions)
 }
diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go
index 88e289f1f..a33b23fab 100644
--- a/test/e2e/run_networking_test.go
+++ b/test/e2e/run_networking_test.go
@@ -437,8 +437,8 @@ var _ = Describe("Podman run networking", func() {
 	It("podman run in custom CNI network with --static-ip", func() {
 		SkipIfRootless()
 		netName := "podmantestnetwork"
-		ipAddr := "10.20.30.128"
-		create := podmanTest.Podman([]string{"network", "create", "--subnet", "10.20.30.0/24", netName})
+		ipAddr := "10.25.30.128"
+		create := podmanTest.Podman([]string{"network", "create", "--subnet", "10.25.30.0/24", netName})
 		create.WaitWithDefaultTimeout()
 		Expect(create.ExitCode()).To(BeZero())
 
@@ -446,5 +446,33 @@ var _ = Describe("Podman run networking", func() {
 		run.WaitWithDefaultTimeout()
 		Expect(run.ExitCode()).To(BeZero())
 		Expect(run.OutputToString()).To(ContainSubstring(ipAddr))
+
+		netrm := podmanTest.Podman([]string{"network", "rm", netName})
+		netrm.WaitWithDefaultTimeout()
+		Expect(netrm.ExitCode()).To(BeZero())
+	})
+
+	It("podman run with new:pod and static-ip", func() {
+		SkipIfRemote()
+		SkipIfRootless()
+		netName := "podmantestnetwork2"
+		ipAddr := "10.25.40.128"
+		podname := "testpod"
+		create := podmanTest.Podman([]string{"network", "create", "--subnet", "10.25.40.0/24", netName})
+		create.WaitWithDefaultTimeout()
+		Expect(create.ExitCode()).To(BeZero())
+
+		run := podmanTest.Podman([]string{"run", "-t", "-i", "--rm", "--pod", "new:" + podname, "--net", netName, "--ip", ipAddr, ALPINE, "ip", "addr"})
+		run.WaitWithDefaultTimeout()
+		Expect(run.ExitCode()).To(BeZero())
+		Expect(run.OutputToString()).To(ContainSubstring(ipAddr))
+
+		podrm := podmanTest.Podman([]string{"pod", "rm", "-f", podname})
+		podrm.WaitWithDefaultTimeout()
+		Expect(podrm.ExitCode()).To(BeZero())
+
+		netrm := podmanTest.Podman([]string{"network", "rm", netName})
+		netrm.WaitWithDefaultTimeout()
+		Expect(netrm.ExitCode()).To(BeZero())
 	})
 })
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 681498ea1..6064be122 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -835,6 +835,14 @@ USER mail`
 		Expect(match).To(BeTrue())
 	})
 
+	It("podman run --pod new with hostname", func() {
+		hostname := "abc"
+		session := podmanTest.Podman([]string{"run", "--pod", "new:foobar", "--hostname", hostname, ALPINE, "cat", "/etc/hostname"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(ContainSubstring(hostname))
+	})
+
 	It("podman run --rm should work", func() {
 		session := podmanTest.Podman([]string{"run", "--rm", ALPINE, "ls"})
 		session.WaitWithDefaultTimeout()
-- 
cgit v1.2.3-54-g00ecf