The backstory for this is that runc 1.2 (opencontainers/runc#3967)
fixed a long-standing bug in our mount flag handling (a bug that crun
still has). Before runc 1.2, when dealing with locked mount flags that
user namespaced containers cannot clear, trying to explicitly clearing
locked flags (like rw clearing MS_RDONLY) would silently ignore the rw
flag in most cases and would result in a read-only mount. This is
obviously not what the user expects.
What runc 1.2 did is that it made it so that passing clearing flags
like rw would always result in an attempt to clear the flag (which was
not the case before), and would (in all cases) explicitly return an
error if we try to clear locking flags. (This also let us finally fix a
bunch of other long-standing issues with locked mount flags causing
seemingly spurious errors).
The problem is that podman sets rw on all mounts by default (even if
the user doesn't specify anything). This is actually a no-op in
runc 1.1 and crun because of a bug in how clearing flags were handled
(rw is the absence of MS_RDONLY but until runc 1.2 we didn't correctly
track clearing flags like that, meaning that rw would literally be
handled as if it were not set at all by users) but in runc 1.2 leads to
unfortunate breakages and a subtle change in behaviour (before, a ro
mount being bind-mounted into a container would also be ro -- though
due to the above bug even setting rw explicitly would result in ro in
most cases -- but with runc 1.2 the mount will always be rw even if
the user didn't explicitly request it which most users would find
surprising). By the way, this "always set rw" behaviour is a departure
from Docker and it is not necesssary.
Signed-off-by: rcmadhankumar <madhankumar.chellamuthu@suse.com>
Add the inherit-labels option to the build API and tweak the go.mod
after some unhappiness in my sandbox.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Bumps to Buildah v1.40.0 and adds the `--inherits-labels` option to
build and farm build man pages.
Also turn off the inherit-labels option test for now as it seems to be
rathr unhappy.
Issue for inherit-labels test failure: https://github.com/containers/podman/issues/25938
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Instead of hardcoding gvisor version in different build files, we get gvisor version from go.mod file.
Signed-off-by: Yevhen Vydolob <yvydolob@redhat.com>
To have consistency with other podman commands like `ps` and `images`,
`volume ls` should output its headers even when there are no volumes.
Fixes: https://github.com/containers/podman/issues/25911
Signed-off-by: Brent Baude <bbaude@redhat.com>
The README.md in test/buildah-bud had the old directory name for the
apply-podman-deltas file. This change removes the `/` and adds a `-`
in that file name.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
in #25884, it was pointed out that the standard detection used to
determine the artifact's file type can be wrong. in those cases, it
would be handy for the user to be able to override the media type of the
layer. as such, added a new option called `--file-type`, which is
optional, and allows users to do just that.
`podman artifact add --file-type text/yaml
quay.io/artifact/config:latest ./config.yaml `
Fixes: #25884
Signed-off-by: Brent Baude <bbaude@redhat.com>
This commit removes the code to build a local pause
image from the Containerfile. It is replaced with
code to find the catatonit binary and include it in
the Rootfs.
This removes the need to build a local pause container
image.
The same logic is also applied to createServiceContainer
which is originally also based on the pause image.
Fixes: #23292
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
Table header in Pod units section was referring to podman container... instead of podman pod...
Signed-off-by: Andreas <43118918+eulores@users.noreply.github.com>
rcmadhankumar
Ricardo Branco
openshift-merge-bot[bot]
renovate[bot]
tomsweeneyredhat
Florent Benoit
Yevhen Vydolob
Paul Holzinger
Brent Baude
Inshal Khan
Ygal Blum
Jan Rodák
Jan Kaluza
Andreas