As part of our database init, we perform a check of the current
values for a few fields (graph driver, graph root, static dir,
and a few more) to validate that Libpod is being started with a
sane & sensible config, and the user's containers can actually be
expected to work. Basically, we take the current runtime config
and compare against values cached in the database from the first
time Podman was run.
We've had some issues with this logic before this year around
symlink resolution, but this is a new edge case. Somehow, the
database is being loaded with the empty string for some fields
(at least graph driver) which is causing comparisons to fail
because we will never compare against "" for those fields - we
insert the default value instead, assuming we have one.
Having a value of "" in the database largely invalidates the
check so arguably we could just drop it, but what BoltDB did -
and what SQLite does after this patch - is to use the default
value for comparison instead of "". This should still catch some
edge cases, and shouldn't be too harmful.
What this does not do is identify or solve the reason that we are
seeing the empty string in the database at all. From my read on
the logic, it must mean that the graph driver is explicitly set
to "" in the c/storage config at the time Podman is first run and
I'm not precisely sure how that happens.
Fixes#24738
Signed-off-by: Matt Heon <mheon@redhat.com>
I'm not sure if there is an equivalent to CAP_SYS_RESOURCE on FreeBSD
but for now, I have added a no-op stub which returns false.
Signed-off-by: Doug Rabson <dfr@rabson.org>
In our CI env we use a special registries.conf file
(test/registries.conf) to redirect some parts but it also defines:
[[registry]]
location="localhost:5000"
insecure=true
That means that port 5000 is trusted by default so the
/v1.40/images/localhost:5000/myrepo/push?tag=mytag test in 12-imagesMore
fails when the test registry uses port 5000.
Example failure:
not ok 360 [12-imagesMore] POST /v1.40/images/localhost:5000/myrepo/push?tag=mytag [-d {}] : status
# expected: 500
# actual: 200
# response: {"status":"The push refers to repository [localhost:5000/myrepo:mytag]"}
{"status":"mytag: digest: sha256:d40f8191d6dae366339e318d1004258022f56bd8c649720a72060fad20019c9d size: 758"}
To avoid using port 5000 simply start at 5001.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
For Copr builds, it will mention the Copr info from where the rpm is
installed.
For non-copr builds, it will mention the value of the packager macro
if set, and skip this field altogether if not.
On local rpm builds, this shows:
```
Build Origin: Lokesh Mandvekar <lsm5@fedoraproject.org>
```
On koji rpm builds, this shows:
```
Build Origin: Fedora Project
```
On copr rpm builds (for eg. rhcontainerbot/playground), this shows:
```
Build Origin: Copr: rhcontainerbot/playground
```
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
The Windows installer was able to automatically enable the
Windows features for WSL or HyperV when they were not
already enabled. This PR removes this capability.
Having the installer to automatically install the right prerequiste
(WSL or HyperV) was helpful as users won't have to do it manually to
use Podman after the installation. But it also made the code of
installer more complicated as it needed to manage the installation
of these OS features and a reboot. And we weren't able to automatically
test these scenarios that required a reboot.
In other words the Windows installer, that merely just extracted
some files in a folder, required, to support the installation of
WSL and HyperV, an advanced knowledge of WiX toolkit and of the
Windows Installer SDK, plus contributors-time to manually test
the scenarios that require a reboot.
We decided to remove this capability based on the following reasons:
- We had a couple of regressions in the last month that were hard to
analyse and fix (#24624 and #24735)
- Podman maintainers currently have a scarce knowledge of the Windows Installer
and there is no plan to invest in that
- Manually installing WSL or HyperV is not hard (e.g. run `wsl --install`) and
are features that admins can manage on their fleet of Windows machines
- Competitors such as Docker Desktop don't automatically install these
components
- Podman `machine init` currently verifies if WSL and HyperV are installed and
guide the user to install them when they are not
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
When trying to pass a string with spaces that broke the go command cli
parsing, the full argument must be put in quotes to avoid escaping
issues.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The default `gobuild` macro on CentOS Stream 9 now includes support for
`BUILDTAGS`.
CentOS Stream envs now also define `_user_tmpfilesdir` macro by default.
Both these definitions are no longer needed here.
`libtrust_openssl` buildtag is also set in spec wherever relevant.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
First, refactor our existing graph traversal code to improve code
sharing. There still isn't much sharing between inward traversal
(stop, remove) and outward traversal (start) but stop and remove
are sharing most of their code, which seems a positive.
Second, add a new graph-traversal function to stop containers.
We already had start and remove; stop uses the newly-refactored
inward-traversal code which it shares with removal.
Third, rework the shared stop/removal inward-traversal code to
add locking. This allows parallel execution of stop and removal,
which should improve the performance of `podman pod rm` and
retain the performance of `podman pod stop` at about what it is
right now.
Fourth and finally, use the new graph-based stop when possible
to solve unordered stop problems with pods - specifically, the
infra container stopping before application containers, leaving
those containers without a working network.
Fixes https://issues.redhat.com/browse/RHEL-76827
Signed-off-by: Matt Heon <mheon@redhat.com>
commit c6fe5e5395 rearranged the code so
that it accesses the store before checking if the current process has
CAP_SYS_ADMIN.
Restore the check and augment it to also check for CAP_SYS_ADMIN.
Closes: https://github.com/containers/podman/issues/25241
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
avoid using the glibc fork() function after using directly the clone()
syscall, as it confuses glibc causing the fork() to hang in some
cases.
The issue has been observed only on s390x, and the fix was confirmed
in the issue discussion.
Closes: https://github.com/containers/podman/issues/25184
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
... because (podman system reset) will delete all of it,
interfering with the test storing other data in the directory.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Jan Rodák
openshift-merge-bot[bot]
renovate[bot]
Matt Heon
Paul Holzinger
Doug Rabson
Lokesh Mandvekar
Lokesh Mandvekar
Mario Loriedo
Giuseppe Scrivano
Miloslav Trmač