Commit Graph

113 Commits

Author SHA1 Message Date
baude 735f0de633 Changes to container runlabel for toolbox project
The toolbox project would benefit from a few changes to more closely
resembe the original atomic cli project.  Changes made are:

* only pull image for container runlabel if the label exists in the image
* if a container image does not have the desired label, exit with non-zero

Signed-off-by: baude <bbaude@redhat.com>
2019-01-30 08:44:58 -06:00
Daniel J Walsh 097b0eaa9a
Make --quiet work in podman create/run
The --queit option is supposed to suppress the pulling messages
when a new image is being pulled down.

This patch fixes this issue.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-01-29 16:12:56 +00:00
Daniel J Walsh 8cf929c095
Vendor in latest opencontainers/selinux
This will now verify labels passed in by the user.
Will also prevent users from accidently relabeling their homedir.

podman run -ti -v ~/home/user:Z fedora sh

Is not a good idea.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-01-18 17:08:46 -05:00
OpenShift Merge Robot a08da37682
Merge pull request #2145 from baude/playcontainerintopod
podman play kube: add containers to pod
2019-01-12 07:20:36 -08:00
baude e10baba326 podman play kube: add containers to pod
when defining containers, we missed the conditional logic to allow
the container to be defined with "WithPod" and so forth.  I had to
slightly modify the createcontainer process to pass a libpod.Pod
that could override things; use nil as no pod.

Signed-off-by: baude <bbaude@redhat.com>
2019-01-11 14:01:57 -06:00
Giuseppe Scrivano 04a4ba9b73
rootless: create the userns immediately when creating a new pod
Closes: https://github.com/containers/libpod/issues/2124

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-01-11 11:52:12 +01:00
Giuseppe Scrivano c4f054f102
rootless: join both userns and mount namespace with --pod
When --pod is specified then join both the user and mount namespace
for the pod so we can initialize the storage.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-01-11 11:52:11 +01:00
Valentin Rothberg edb285d176 apparmor: apply default profile at container initialization
Apply the default AppArmor profile at container initialization to cover
all possible code paths (i.e., podman-{start,run}) before executing the
runtime.  This allows moving most of the logic into pkg/apparmor.

Also make the loading and application of the default AppArmor profile
versio-indepenent by checking for the `libpod-default-` prefix and
over-writing the profile in the run-time spec if needed.

The intitial run-time spec of the container differs a bit from the
applied one when having started the container, which results in
displaying a potentially outdated AppArmor profile when inspecting
a container.  To fix that, load the container config from the file
system if present and use it to display the data.

Fixes: #2107
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-01-09 22:18:11 +01:00
Valentin Rothberg 75578aad61 add container-init support
Add support for executing an init binary as PID 1 in a container to
forward signals and reap processes.  When the `--init` flag is set for
podman-create or podman-run, the init binary is bind-mounted to
`/dev/init` in the container and "/dev/init --" is prepended to the
container's command.

The default base path of the container-init binary is `/usr/libexec/podman`
while the default binary is catatonit [1].  This default can be changed
permanently via the `init_path` field in the `libpod.conf` configuration
file (which is recommended for packaging) or temporarily via the
`--init-path` flag of podman-create and podman-run.

[1] https://github.com/openSUSE/catatonit

Fixes: #1670
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-01-04 11:42:03 +01:00
Daniel J Walsh c657dc4fdb
Switch all referencs to image.ContainerConfig to image.Config
This will more closely match what Docker is doing.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-12-21 15:59:34 -05:00
Daniel J Walsh 4d13262405
Change all 'can not' to 'cannot' for proper usage
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-12-21 10:27:54 -05:00
baude 9b03cacc87 Add Play
podman play kube adds the ability for the user to recreate pods and containers
from a Kubernetes YAML file in libpod.

Signed-off-by: baude <bbaude@redhat.com>
2018-12-19 14:20:55 -06:00
Daniel J Walsh 59635cd186
Add information on --restart
We need to recommend that users use Systemd unit files if they want
the container to restart automatically.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-12-18 12:50:50 -05:00
Miloslav Trmač 93e14b6198 Remove the forceSecure parameter on the pull call stack
DockerRegistryOptions.DockerInsecureSkipTLSVerify as an types.OptionalBool
can now represent that value, so forceSecure is redundant.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
OpenShift Merge Robot 50e754cd57
Merge pull request #1918 from mheon/use_db_paths
Use paths written in DB instead if they differ from our defaults
2018-12-05 00:55:48 -08:00
baude 9c359a31d5 create pod on the fly
when a user specifies --pod to podman create|run, we should create that pod
automatically.  the port bindings from the container are then inherited by
the infra container.  this signicantly improves the workflow of running
containers inside pods with podman.  the user is still encouraged to use
podman pod create to have more granular control of the pod create options.

Signed-off-by: baude <bbaude@redhat.com>
2018-12-03 15:49:17 -06:00
Matthew Heon 562fa57dc9 Move rootless storage config into libpod
Previous commits ensured that we would use database-configured
paths if not explicitly overridden.

However, our runtime generation did unconditionally override
storage config, which made this useless.

Move rootless storage configuration setup to libpod, and change
storage setup so we only override if a setting is explicitly
set, so we can still override what we want.

Signed-off-by: Matthew Heon <mheon@redhat.com>
2018-12-02 15:21:35 -05:00
Daniel J Walsh bb6c1cf8d1
libpod should know if the network is disabled
/etc/resolv.conf and /etc/hosts should not be created and mounted when the
network is disabled.

We should not be calling the network setup and cleanup functions when it is
disabled either.

In doing this patch, I found that all of the bind mounts were particular to
Linux along with the generate functions, so I moved them to
container_internal_linux.go

Since we are checking if we are using a network namespace, we need to check
after the network namespaces has been created in the spec.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-11-13 06:33:10 -05:00
Giuseppe Scrivano dfc689efc9
create: fix writing cidfile when using rootless
prevent opening the same file twice, since we re-exec podman in
rootless mode.  While at it, also solve a possible race between the
check for the file and writing to it.  Another process could have
created the file in the meanwhile and we would just end up overwriting
it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2018-10-23 22:13:17 +02:00
OpenShift Merge Robot 5f6e4cc830
Merge pull request #1605 from mheon/syslog_cleanup
Pass along syslog variable to podman cleanup processes
2018-10-11 11:49:45 -07:00
Matthew Heon f87f0abb77 Pass along syslog variable to podman cleanup processes
As of now, there is no way to debug podman clean up processes.
They are started by conmon with no stdout/stderr and log nowhere.
This allows us to actually figure out what is going on when a
cleanup process runs.

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
2018-10-11 13:19:39 -04:00
Qi Wang d73600626d Sort all command flags
Signed-off-by: Qi Wang <qiwan@redhat.com>
2018-10-11 13:17:14 -04:00
Daniel J Walsh 86d435f32f
Disable SELinux labeling if --privileged
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-10-02 03:44:46 -04:00
Daniel J Walsh 52c1365f32 Add --mount option for `create` & `run` command
Signed-off-by: Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1524
Approved by: mheon
2018-09-21 21:33:41 +00:00
Daniel J Walsh 09f506930c Don't mount /dev/shm if the user told you --ipc=none
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1466
Approved by: mheon
2018-09-21 19:06:12 +00:00
Giuseppe Scrivano c4b15ce46b rootless: fix create with images not in the storage
This chunk was mistakenly removed with ecec1a5430

Introduce it back as it solves the pull of an image that is not yet in
the storage when using create/run.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1521
Approved by: baude
2018-09-21 13:04:36 +00:00
Giuseppe Scrivano 6d1eecf7cf create, rootless: join the userns of ns:PATH
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1507
Approved by: rhatdan
2018-09-21 10:13:39 +00:00
Giuseppe Scrivano 1c73404fe1 create, rootless: join the userns of container:CONTAINER
so that we can also join the requested namespace.

Closes: https://github.com/containers/libpod/issues/1453

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1507
Approved by: rhatdan
2018-09-21 10:13:39 +00:00
Daniel J Walsh fbfcc7842e Add new field to libpod to indicate whether or not to use labelling
Also update some missing fields libpod.conf obtions in man pages.

Fix sort order of security options and add a note about disabling
labeling.

When a process requests a new label.  libpod needs to reserve all
labels to make sure that their are no conflicts.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1406
Approved by: mheon
2018-09-20 16:01:29 +00:00
Daniel J Walsh c3a0874222 Don't crash if an image has no names
When image is not tagged, we should just set the imageName to the
image.ID.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1501
Approved by: mheon
2018-09-18 13:29:20 +00:00
Matthew Heon b471904175
Merge pull request #1472 from giuseppe/rootless-fix-entrypoint
rootless: do not raise an error if the entrypoint is specified
2018-09-14 17:53:34 -04:00
Giuseppe Scrivano 1c26d81394
rootless: do not raise an error if the entrypoint is specified
do not error out when the storage is not initialized and the
entrypoint command is not available for the specified image.  Check it
when we re-exec in an user namespace and can access the storage.

Closes: https://github.com/containers/libpod/issues/1452

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2018-09-14 13:22:55 +02:00
Daniel J Walsh ecec1a5430
Remove duplicate code between create.go and run.go
Create two new createInit for checking if the cotnainer is initialized
correctly.
createContainer which creates the actual container and containerConfig

Also added libpodruntime.GetContainerRuntime to put common runtime code
into separate function.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-09-13 12:16:14 -04:00
Daniel J Walsh d9580ec62b Pass on securityOpts from podInfraContainer to container added to pod.
This is an incomplete fix, as it would be best for the libpod library to be in charge of coordinating the container's dependencies on the infra container. A TODO was left as such. UTS is a special case, because the docker library that namespace handling is based off of doesn't recognize a UTS based on another container as valid, despite the library being able to handle it correctly. Thus, it is left in the old way.

Signed-off-by: haircommander <pehunt@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1347
Approved by: mheon
2018-09-11 13:31:55 +00:00
Daniel J Walsh 87f90ce14a Fix pod sharing for utsmode
We should be sharing cgroups namespace by default in pods
uts namespace sharing was broken in pods.

Create a new libpod/pkg/namespaces for handling of namespace fields
in containers

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1418
Approved by: mheon
2018-09-07 18:18:54 +00:00
Giuseppe Scrivano 807f6f8d8f rootless: check uid with Geteuid() instead of Getuid()
change the tests to use chroot to set a numeric UID/GID.

Go syscall.Credential doesn't change the effective UID/GID of the
process.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1372
Approved by: mheon
2018-09-04 14:36:57 +00:00
Giuseppe Scrivano 1ac1c54027 rootless, create: support --pod
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1372
Approved by: mheon
2018-09-04 14:36:57 +00:00
Giuseppe Scrivano 8ca67d2794 rootless, run: support --pod
move re-exec later on, so that we can check whether we need to join
the infra container user namespace or we need to create another one.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1372
Approved by: mheon
2018-09-04 14:36:57 +00:00
Daniel J Walsh 27ca091c08
Add proper support for systemd inside of podman
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-08-31 14:42:32 -04:00
Valentin Rothberg 3839c00ae2 don't print help message for usage errors
Don't print potentially verbose help messages in case of usage errors,
but print only the usage error followed by a pointer to the command's
help.  This aligns with Docker.

```
$ podman run -h
flag needs an argument: -h
See 'podman run --help'.
```

Signed-off-by: Valentin Rothberg <vrothberg@suse.com>

Closes: #1379
Approved by: rhatdan
2018-08-31 10:19:11 +00:00
Valentin Rothberg 6751b2c350 run/create: reserve `-h` flag for hostname
Move the `-h` short flag from `--help` to `--hostname` for podman-run,
podman-create and podman-pod-create to be compatible with Docker.

Fixes: #1367
Signed-off-by: Valentin Rothberg <vrothberg@suse.com>

Closes: #1373
Approved by: rhatdan
2018-08-30 15:45:13 +00:00
Daniel J Walsh 1a90b2fd36 allow specification of entrypoint in the form of a slice
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1352
Approved by: mheon
2018-08-28 14:29:12 +00:00
Marco Vedovati 72e41c81aa Do not try to enable AppArmor in rootless mode
When in rootless mode it's not possible to load profiles or
check which profiles are loaded.
Added a few baseline tests to check all possible cases.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>

Closes: #1250
Approved by: mheon
2018-08-24 17:08:11 +00:00
haircommander 0e6266858a Fixing network ns segfault
As well as small style corrections, update pod_top_test to use CreatePod, and move handling of adding a container to the pod's namespace from container_internal_linux to libpod/option.

Signed-off-by: haircommander <pehunt@redhat.com>

Closes: #1187
Approved by: mheon
2018-08-23 18:16:28 +00:00
haircommander d5e690914d Added option to share kernel namespaces in libpod and podman
A pause container is added to the pod if the user opts in. The default pause image and command can be overridden. Pause containers are ignored in ps unless the -a option is present. Pod inspect and pod ps show shared namespaces and pause container. A pause container can't be removed with podman rm, and a pod can be removed if it only has a pause container.

Signed-off-by: haircommander <pehunt@redhat.com>

Closes: #1187
Approved by: mheon
2018-08-23 18:16:28 +00:00
Daniel J Walsh d20f3a5146 switch projectatomic to containers
Need to get some small changes into libpod to pull back into buildah
to complete buildah transition.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1270
Approved by: mheon
2018-08-16 17:12:36 +00:00
Valentin Rothberg 4c63fcc59a apparmor: respect "unconfined" setting
The "unconfined" profile must be treated specially to turn off apparmor
confinement and to avoid applying any other profile.

Signed-off-by: Valentin Rothberg <vrothberg@suse.com>

Closes: #1241
Approved by: mheon
2018-08-09 12:25:15 +00:00
Daniel J Walsh f9152d075a Cleanup descriptions and help information
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1167
Approved by: baude
2018-07-27 02:17:29 +00:00
Giuseppe Scrivano e43270fc5e podman: allow to specify the IPC namespace to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
Giuseppe Scrivano 977c8a9cd6 podman: allow to specify the UTS namespace to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00