Commit Graph

217 Commits

Author SHA1 Message Date
Divyansh Kamboj ef1a025356 Add warning while untagging an image podman-load
Signed-off-by: Divyansh Kamboj <kambojdivyansh2000@gmail.com>
2019-06-04 17:54:07 +05:30
Matthew Heon 1be345bd9d Begin to break up pkg/inspect
Let's put inspect structs where they're actually being used. We
originally made pkg/inspect to solve circular import issues.
There are no more circular import issues.

Image structs remain for now, I'm focusing on container inspect.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-06-03 15:54:53 -04:00
Daniel J Walsh d1a7378aa0
change from sysregistries to sysregistriesv2
We want to start supporting the registries.conf format.
Also start showing blocked registries in podman info
Fix sorting so all registries are listed together in podman info.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-05-03 10:38:51 -04:00
OpenShift Merge Robot 01e79477ca
Merge pull request #2850 from baude/eventsjournald
journald event logging
2019-04-25 12:20:39 -07:00
Nalin Dahyabhai 4daac4736e image: rework parent/child/history matching
Rework our expectations of how images that are derived from each other
look, so that we don't assume that an image that's derived from a base
image always adds layers relative to that base image.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2019-04-25 08:57:58 -04:00
Nalin Dahyabhai 5c81a117f1 images: add context to GetParent/IsParent/Remove/Prune...
Add a context.Context parameter to Image.GetParent(), Image.IsParent(),
Image.GetChildren(), Image.Remove(), and Runtime.PruneImages().

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2019-04-25 08:57:58 -04:00
baude 7bf7c177ab journald event logging
add the ability for podman to read and write events to journald instead
of just a logfile.  This can be controlled in libpod.conf with the
`events_logger` attribute of `journald` or `file`.  The default will be
set to `journald`.

Signed-off-by: baude <bbaude@redhat.com>
2019-04-24 16:00:04 -05:00
baude 35e46d8d6b add image rmi event
when deleting a commited image, the path for deletion has an early exit
and the image remove event was not being triggered.

Signed-off-by: baude <bbaude@redhat.com>
2019-04-08 08:36:40 -05:00
baude dc94dbd3c1 podman-remote image tree
add the ability for the podman-remote client to be able to print an
image tree.

Signed-off-by: baude <bbaude@redhat.com>
2019-04-04 14:41:50 -05:00
Matthew Heon c6255537d9 Fix a potential segfault in podman search
When generating headers for search, we unconditionally
access element 0 of an array, and I saw this segfault in our CI.
There's no reason we have to do this, we're just going through it
to get field names with reflect, so just make a new copy of the
struct in question.

Also, move this code, which is only for CLI display, into
cmd/podman from libpod/image.

Signed-off-by: Matthew Heon <mheon@redhat.com>
2019-04-03 15:11:08 -04:00
Daniel J Walsh c37589f503
Set blob cache directory based on GraphDriver
Currently in rootless containers, we end up not using the blob cache.
We also don't store the blob cache based on the users specified graph
storage.  This change will cause the cache directory to be stored with
the rest of the containe images.

While doing this patch, I found that we had duplicated GetSystemContext in
two places in libpod. I cleaned this up.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-03-29 08:27:33 -04:00
Qi Wang a6af746a94 fix Bug 1688041-podman image save removes existing image
Signed-off-by: Qi Wang <qiwan@redhat.com>
2019-03-20 22:37:58 -04:00
Kunal Kushwaha a4b3b9ffbb Tree implementation for podman images
Signed-off-by: Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp>
2019-03-14 11:22:06 +09:00
baude ca1e76ff63 Add event logging to libpod, even display to podman
In lipod, we now log major events that occurr.  These events
can be displayed using the `podman events` command. Each
event contains:

* Type (container, image, volume, pod...)
* Status (create, rm, stop, kill, ....)
* Timestamp in RFC3339Nano format
* Name (if applicable)
* Image (if applicable)

The format of the event and the varlink endpoint are to not
be considered stable until cockpit has done its enablement.

Signed-off-by: baude <bbaude@redhat.com>
2019-03-11 15:08:59 -05:00
Giuseppe Scrivano ddcdc0c172
pull: promote debug statement to error
print an error if there is any failure pulling an image.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-03-11 09:25:40 +01:00
baude 598bde52d0 podman healthcheck run (phase 1)
Add the ability to manually run a container's healthcheck command.
This is only the first phase of implementing the healthcheck.
Subsequent pull requests will deal with the exposing the results and
history of healthchecks as well as the scheduling.

Signed-off-by: baude <bbaude@redhat.com>
2019-03-05 14:03:55 -06:00
baude 71db80ddb1 podman-remote load image
enable the ability to load an image into remote storage
using the remote client.

Signed-off-by: baude <bbaude@redhat.com>
2019-02-21 10:11:19 -06:00
baude 711ac93051 podman-remote save [image]
Add the ability to save an image from the remote-host to the
remote-client.

Signed-off-by: baude <bbaude@redhat.com>
2019-02-20 12:58:05 -06:00
Valentin Rothberg 8a49b59ed4 image.SearchImages: use SearchFilter type
Use an `image.SearchFilter` instead of a `[]string` in the SearchImages
API.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-02-20 10:25:25 +01:00
Valentin Rothberg 87c9f4cc22 podman-search: refactor code to libpod/image/search.go
Refactor the image-search logic from cmd/podman/search.go to
libpod/image/search.go and update podman-search and the Varlink API to
use it.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-02-20 10:25:25 +01:00
Sebastian Jug 7141f97270 OpenTracing support added to start, stop, run, create, pull, and ps
Drop context.Context field from cli.Context

Signed-off-by: Sebastian Jug <sejug@redhat.com>
2019-02-18 09:57:08 -05:00
baude f29a11c201 Parse fq name correctly for images
When parsing a string name for repo and tag (for images output), we
should be using parsenormalizedname and reference.Canonical to
get the proper output.

Resolves: #2175

Signed-off-by: baude <bbaude@redhat.com>
2019-02-13 11:05:20 -06:00
Daniel J Walsh 3554bfce98
Merge pull request #2196 from baude/toolbox
Changes to container runlabel for toolbox project
2019-02-05 10:34:40 -05:00
W. Trevor King 40943586d2 libpod/image: Use RepoDigests() in Inspect()
To get the more-robust handling from 0f6535cf (libpod/image: Use
ParseNormalizedNamed in RepoDigests, 2019-01-08, #2106) here too.

Signed-off-by: W. Trevor King <wking@tremily.us>
2019-01-31 11:01:19 -08:00
baude 735f0de633 Changes to container runlabel for toolbox project
The toolbox project would benefit from a few changes to more closely
resembe the original atomic cli project.  Changes made are:

* only pull image for container runlabel if the label exists in the image
* if a container image does not have the desired label, exit with non-zero

Signed-off-by: baude <bbaude@redhat.com>
2019-01-30 08:44:58 -06:00
baude 656033ca96 podman image prune -- implement all flag
we now, by default, only prune dangling images.  if --all is passed, we
prune dangling images AND images that do not have an associated containers.

also went ahead and enabled the podman-remote image prune side of things.

Fixes: #2192

Signed-off-by: baude <bbaude@redhat.com>
2019-01-29 16:51:48 -06:00
Miloslav Trmač 449116af19 Remove imageParts.{isTagged,registry,name,tag}
Finally, these members no longer have any users.

Future users should usually call referenceWithRegistry / normalizedReference,
and work with the returned value, instead of reintroducing these variables.
Similarly, direct uses of unnormalizedRef should be rare (only for cases
where the registry and/or path truly does not matter).

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:24 +01:00
Miloslav Trmač 797d194050 Clarify comments about isRegistry a bit.
Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:24 +01:00
Miloslav Trmač ad90c44f8d Use imageParts.unnormalizedRef in GetImageBaseName
... to remove the last user of imageParts.name.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:24 +01:00
Miloslav Trmač fa42f97507 FIXME? Introduce imageParts.suspiciousRefNameTagValuesForSearch
Image.MatchRepoTag and findImageInRepoTags do some kind of
heuristic search; the motivation and design of both, and how they
should deal with digests, is not obvious to me.

Instead of figuring that out now, just factor it out into a
scary-named method and leave the "tag" value (with its "latest"/"none"
value) alone.

Similarly, the .registry and .name fields should typically not be used;
users should use either hasRegistry or normalized reference types;
so, isolate the difficult-to-understand search code, and computation
of these values, into this new search-specific helper.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:24 +01:00
Miloslav Trmač cf40b71614 Use imageParts.referenceWithRegistry in Image.getLocalImage
... to make sure everything uses the same code path.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač d559365d7a Don't try to look up local images with an explicit :latest suffix
imageruntime.getImage, through ParseStoreReference, already uses
reference.TagNameOnly on the input, so this extra lookup is completely
redundant to the lookup that has already happened.

Should not change behavior, apart from speeding up the code a bit.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač f92c3ce350 Return a reference.Named from normalizedTag
Instead of returning a string, return a native value and convert it
into the string in the caller, to make it that small bit more
common to use reference types.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač b9c0f2c987 Use reference.TagNameOnly instead of manually adding imageParts.tag in normalizeTag
Again, rely on the official API, instead of the suprising "suspiciousTagValueForSearch"
value (set to :latest on untagged images, and :none on digested ones!)

CHANGES BEHAVIOR, but the previous output of normalization of digested values was
not even syntatically valid, so this can't really be worse.

Still, maybe we should refuse to tag with digested references in the first place.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač e060a19c87 Use imageParts.normalizedReference in normalizeTag
This is another step to using reference values instead of strings here.

CHANGES BEHAVIOR: docker.io/busybox is now normalized to docker.io/library/busybox.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 1c19d19c6e Add imageParts.normalizedReference()
This will be used in normalizeTag to work with references instead of strings.

Not used anywhere yet, should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač e58aa74766 Use imageparts.referenceWithRegistry in normalizeTag
... instead of open-coding something similar.  Eventually
we will use the reference type further in here.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač e5c764ec3c Remove no longer used imageParts.assemble()
Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 633501b1b7 Use getPullRefPair / getSinglePullRefPairGoal in pullGoalFromPossiblyUnqualifiedName
This shortens the code a bit, but most importantly ensures that all pulls from
docker.Transport are processed exactly the same way, and there is only a single
store.ParseStoreReference in the pull code.

It's a bit wasteful to call decompose() in getPullRefPair just after
pullGoalFromPossiblyUnqualifiedName has qualified the name, but on balance
only having exactly one code path seems worth it.  Alternatively we could
split getPullRefPairToQualifiedDestination from getPullRefPair.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 81204487db Use imageParts.referenceWithRegistry in pullGoalFromPossiblyUnqualifiedName
CHANGES BEHAVIOR.

This bypasses .assemble, and preserves the original
lack of tag / original digest instead of adding :latest/:none
(still subject to ParseStoreReference normalization).

Using the original digest seems clearly correct; dropping the :latest
suffix from .image strings, and adding /library to docker.io/shortname,
 only affects user-visible input; later uses of the return value of
pullImageFrom... use ParseStoreReference, which calls reference.ParseNormalizedNamed
and reference.TagNameOnly, so the image name should be processed
the same way whether it contains a tag, or libray/, or not.

This also allows us to drop the problematic hasShaInInputName heuristic/condition/helper.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 2171a39390 Use imageParts.referenceWithRegistry in getPullRefPair
CHANGES BEHAVIOR.

This bypasses .assemble, and preserves the original
lack of tag / original digest instead of adding :latest/:none
(still subject to ParseStoreReference normalization).

Using the original digest seems clearly correct; dropping the :latest
suffix from .image strings only affects user-visible input; later
uses of the return value of pullImageFrom... use ParseStoreReference,
which calls reference.TagNameOnly, so the image name should be processed
the same way whether it contains a tag or not.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 72777b7fee Add imageParts.referenceWithRegistry
This is the primary goal of decompose()+assemble(), to support
qualifying an image name.

Does not have any users yet, so does not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač ae2a95196e Don't use imageParts.assemble when pulling from a qualified name
CHANGES BEHAVIOR.

If the name is qualified, instead of decomposing it into components and
re-assembling, just use the input name unmodified:
- For name:tag values, .assemble() just recreates the input.
- For untagged values, .assemble() adds ":latest"; we keep
  the input as is, but both docker.ParseReference and storage.Transport.ParseStoreReference
  use reference.TagNameOnly() already.
- For digested references, .assemble() adds ":none", but
  the code was already bypassing .assemble() on that path
  already - for the source reference.  For the destination,
  this replaces a :none destination with a the @digest reference,
  as expected.

Note that while decompose() has already parsed the input,
it (intentionally) bypassed the docker.io/library normalization;
therefore we parse the input again (via docker.ParseReference) to ensure
that the reference is normalized.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 035c732ded Reorganize normalizeTag
Move the registry defaulting before tag defaulting.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 788bc36021 Simplify pullGoalFromPossiblyUnqualifiedName
Both imageParts and this function implicitly assume docker.Transport
troughout, so instead of pretending to be flexible about DefaultTransport,
just hard-code docker.ParseReference directly.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač e9721b757a Remove imageParts.transport
It is only ever set to DefaulTransport, and all of the code
is docker/reference-specific anyway, so there's no point in
making this a variable.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 99d2259f8a Simplify pullGoalFromPossiblyUnqualifiedName
After inlining assembleWithTransport, we have two branches with
the same prepending of decomposedImage.transport; move that out of
the branches.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač 3d98c42a3f Inline imageParts.assembleWithTransport into callers
imageParts.transport is a constant, and the design of imageParts
is not transport-independent in any sense; we will want to eliminate
the transport member entirely.

As a first step, drop assembleWithTransport and inline an exact
equivalent into all callers.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:23 +01:00
Miloslav Trmač c19294c011 Record the original reference.Named in imageParts
We will eventually want to eliminate most members of imageParts
in favor of using the c/image/docker/reference API directly.

For now, just record the reference.Named value, and we will
replace uses of the other members before removing them.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:07:22 +01:00
Miloslav Trmač 6486e2c41b Drop image.DecomposeString, make image.Parts private imageParts again
Now that DecomposeString has no users, make the type private again.
Any new users of it should come with a rationale - and new users
of the "none"/"latest" handling of untagged/digested names that is
currently implemented should have an exceptionaly unusual rationale.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-01-14 04:06:58 +01:00
baude c8e3dd8a9c remote-client support for images
Signed-off-by: baude <bbaude@redhat.com>
2019-01-10 13:18:08 -06:00
W. Trevor King 0f6535cf6b libpod/image: Use ParseNormalizedNamed in RepoDigests
Avoid generating
quay.io/openshift-release-dev/ocp-release@sha256@sha256:239... and
similar when the image name is already digest-based [1].  It's not
clear exactly how we get into this state, but as shown by the unit
tests, the new code handles this case correctly (while the previous
code does not).

[1]: https://github.com/containers/libpod/issues/2086

Signed-off-by: W. Trevor King <wking@tremily.us>

Closes: #2106
Approved by: rhatdan
2019-01-09 22:29:18 +00:00
baude 10a62d60a9 container runlabel NAME implementation
when using container runlabel, if a --name is not provided, we must
deduce the container name from the base name of the image to maintain
parity with the atomic cli.

fixed small bug where we split the cmd on " " rather than using fields could
lead to extra spaces in command output.

Signed-off-by: baude <bbaude@redhat.com>
2019-01-04 12:57:55 -06:00
Daniel J Walsh c657dc4fdb
Switch all referencs to image.ContainerConfig to image.Config
This will more closely match what Docker is doing.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2018-12-21 15:59:34 -05:00
Qi Wang 31edf47285 Support podman image trust command
Display the trust policy of the host system. The trust policy is stored in the /etc/containers/policy.json file and defines a scope of registries or repositories.

Signed-off-by: Qi Wang <qiwan@redhat.com>
2018-12-19 13:36:11 -05:00
Miloslav Trmač 99d9626d71 Fix reporting the registries.conf path on error
i.e. actually reflect the environment variable and/or rootless mode
instead of always using the default path.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
Miloslav Trmač e885311641 Remove manual handling of insecure registries in doPullImage
Instead, just set SystemRegistriesConfPath and let the transport do it.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
Miloslav Trmač 93e14b6198 Remove the forceSecure parameter on the pull call stack
DockerRegistryOptions.DockerInsecureSkipTLSVerify as an types.OptionalBool
can now represent that value, so forceSecure is redundant.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
Miloslav Trmač 1b893be71c Remove manual handling of insecure registries in PushImageToReference
Instead, just set SystemRegistriesConfPath and let the transport do it.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
Miloslav Trmač 7407d6621c Remove the forceSecure parameter of Image.PushImageTo*
DockerRegistryOptions.DockerInsecureSkipTLSVerify as an types.OptionalBool
can now represent that value, so forceSecure is redundant.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
Miloslav Trmač b134951d14 Minimally update for the DockerInsecureSkipTLSVerify type change
Following SystemContext.DockerInsecureSkipTLSVerify, make the
DockerRegistryOne also an OptionalBool, and update callers.

Explicitly document that --tls-verify=true and --tls-verify unset
have different behavior in those commands where the behavior changed
(or where it hasn't changed but the documentation needed updating).

Also make the --tls-verify man page sections a tiny bit more consistent
throughout.

This is a minimal fix, without changing the existing "--tls-verify=true"
paths nor existing manual insecure registry lookups.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2018-12-06 23:34:59 +01:00
baude e037427035 Add ability to prune containers and images
Allow user to prune unused/unnamed images, the layer images from building,
via podman rmi --prune.

Allow user to prune stopped/exiuted containers via podman rm --prune.

This should resolve #1910

Signed-off-by: baude <bbaude@redhat.com>
2018-12-05 19:57:54 -06:00
OpenShift Merge Robot 39560500fc
Merge pull request #1868 from QiWang19/issue860
Add history field to image inspect
2018-11-26 16:46:22 -08:00
Qi Wang 5438ec1918 Add history and namespaceoptions to image inspect
Signed-off-by: Qi Wang <qiwan@redhat.com>
2018-11-26 10:56:55 -05:00
baude 9d883d2032 add podman container|image exists
Add an exists subcommand to podman container and podman image that allows
users to verify the existence of a container or image by ID or name.  The return
code can be 0 (success), 1 (failed to find), or 125 (failed to work with runtime).

Issue #1845

Signed-off-by: baude <bbaude@redhat.com>
2018-11-26 09:19:39 -06:00
baude bfc473f982 Vendor in new new buildah/ci
libpod requires new buildah and container image versions to resolve
bug #1640298

Signed-off-by: baude <bbaude@redhat.com>
2018-10-17 17:04:19 -05:00
baude 4f825f2e07 Add container runlabel command
Execute the command as described by a container image.  The value of the label is processed
into a command by:

1. Ensuring the first argument of the command is podman.
2. Substituting any variables with those defined by the environment or otherwise.

If no label exists in the container image, nothing is done.

podman container runlabel LABEL IMAGE extra_args
Signed-off-by: baude <bbaude@redhat.com>
2018-09-28 14:14:13 -05:00
baude a931c44104 run complex image names with short names
In cases where the image name is more complex like:

quay/baude/alpine_nginx:latest  and is not from the docker
registry, we need to be able to run the image by its shortname
such as baude/alpine_nginx.  The same goes when the image is
not from a registry but instead has the localhost repository.

This resolves buildah issue #1034

Signed-off-by: baude <bbaude@redhat.com>
2018-09-28 12:48:54 -05:00
W. Trevor King 2188d8f7ad libpod/image/pull: Return image-pulling errors from doPullImage
We were already writing these to our debug logs.  But collecting them
and including them in the error message will make it easier for
callers who don't have debugging enabled to figure out what's going
wrong.

Using multierror gives us both pretty formatting (when we print this
for the user) and programmatic access (for any callers that need to
inspect the constituent errors).  With this commit and a config like:

  $ cat /etc/containers/registries.conf
  [registries.search]
  registries = ['registry.access.redhat.com', 'quay.io', 'docker.io']

pulling an unqualified missing image looks like:

  $ podman pull does-not/exist
  Trying to pull registry.access.redhat.com/does-not/exist:latest...Failed
  Trying to pull quay.io/does-not/exist:latest...Failed
  Trying to pull docker.io/does-not/exist:latest...Failed
  error pulling image "does-not/exist": unable to pull does-not/exist: 3 errors occurred:

  * Error determining manifest MIME type for docker://registry.access.redhat.com/does-not/exist:latest: Error reading manifest latest in registry.access.redhat.com/does-not/exist: unknown: Not Found
  * Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: Error reading manifest latest in quay.io/does-not/exist: unauthorized: access to the requested resource is not authorized
  * Error determining manifest MIME type for docker://does-not/exist:latest: Error reading manifest latest in docker.io/does-not/exist: errors:
  denied: requested access to the resource is denied
  unauthorized: authentication required

A qualified image looks like:

  $ podman pull quay.io/does-not/exist
  Trying to pull quay.io/does-not/exist...Failed
  error pulling image "quay.io/does-not/exist": unable to pull quay.io/does-not/exist: unable to pull image: Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: Error reading manifest latest in quay.io/does-not/exist: unauthorized: access to the requested resource is not authorized

If one of the searched repositories was offline, you'd get a more
useful routing error for that specific registry.  For example:

  $ cat /etc/hosts
  127.0.0.1   quay.io
  $ podman pull does-not/exist
  Trying to pull registry.access.redhat.com/does-not/exist:latest...Failed
  Trying to pull quay.io/does-not/exist:latest...Failed
  Trying to pull docker.io/does-not/exist:latest...Failed
  error pulling image "does-not/exist": unable to pull does-not/exist: 3 errors occurred:

  * Error determining manifest MIME type for docker://registry.access.redhat.com/does-not/exist:latest: Error reading manifest latest in registry.access.redhat.com/does-not/exist: unknown: Not Found
  * Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: pinging docker registry returned: Get https://quay.io/v2/: dial tcp 127.0.0.1:443: connect: connection refused
  * Error determining manifest MIME type for docker://does-not/exist:latest: Error reading manifest latest in docker.io/does-not/exist: errors:
  denied: requested access to the resource is denied
  unauthorized: authentication required

This is our first direct dependency on multierror, but we've been
vendoring it for a while now because opencontainers/runtime-tools uses
it for config validation.

Signed-off-by: W. Trevor King <wking@tremily.us>

Closes: #1456
Approved by: rhatdan
2018-09-14 15:01:43 +00:00
Matthew Heon 490cc82d0b Print errors from individual pull attempts
Right now, we don't print errors from c/image while trying to
pull images. This prints the errors when log-level=debug is set
so we can debug errors while pulling.

Signed-off-by: Matthew Heon <mheon@redhat.com>

Closes: #1409
Approved by: baude
2018-09-05 23:38:28 +00:00
Daniel J Walsh a917f8fa2a We are mistakenly seeing repos as registries.
Currently `podman pull rhel7/rhel-tools` is failing because it
sees rhel7 as a registry.  This change will verify that the returned
registry from the parser is actually a registry and not a repo,
if a repo it will return the correct content, and we will pull the image.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1387
Approved by: mtrmac
2018-08-31 18:02:14 +00:00
Daniel J Walsh d20f3a5146 switch projectatomic to containers
Need to get some small changes into libpod to pull back into buildah
to complete buildah transition.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1270
Approved by: mheon
2018-08-16 17:12:36 +00:00
haircommander 879453eaf1 Fix ambiguity in adding localhost to podman save
...and some naming decisions.

This change ensures podman save doesn't incorrectly prepend localhost when saving an image.

Signed-off-by: haircommander <pehunt@redhat.com>

Closes: #1140
Approved by: rhatdan
2018-08-08 21:04:11 +00:00
baude b1de943eea Better pull error for fully-qualified images
When pulling a fully-qualified image that fails, we should not be talking about
registries/search registries in the the error message as it is not applicable.  If
a image that is fq'd and fails to pull, the error should be simplified.

```
$ sudo podman pull this-does-not-exist.example.com/foo
Trying to pull this-does-not-exist.example.com/foo...Failed
error pulling image "this-does-not-exist.example.com/foo": unable to pull this-does-not-exist.example.com/foo: unable to pull image, or you do not have pull access
$
```

Resolves: #1212
Signed-off-by: baude <bbaude@redhat.com>

Closes: #1216
Approved by: mheon
2018-08-06 20:34:29 +00:00
baude 20155657ec clarify pull error message
when pulling, we can fail to find an image (i.e. it doesn't exist) or we
can not have authority/access to pull it.  the registries don't tell us
one way or another so the error message needs to cover both.

Resolves #1194

Signed-off-by: baude <bbaude@redhat.com>

Closes: #1195
Approved by: rhatdan
2018-08-02 19:53:50 +00:00
Miloslav Trmač 126a97af82 Inline pullGoalNamesFromPossiblyUnqualifiedName into Runtime.pullGoalFromPossibly...
Again, we only needed them split for tests; so, integrate them back.
Then drop all remaining references to pullRefName and pullGoalNames,
which are not used for anything.

Should not change behavior

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač 5334d9ab5e Replace getPullRefName by Runtime.getPullRefPair
This more or less reverts 9c9401a96c
"Replace getPullRefPair with getPullRefName"; now that tests don't require
us to use pullRefName, move creation of storage references deeper into the
calls stack to reduce string use.

ir.getSinglePullRefNameGoal is accordingly updated to ir.getSinglePullRefPairGoal,
and we need to add a ~duplicate singlePullRefPairGoal; that duplication
of singlePullRefNameGoal will soon be resolved by dropping singlePullRefNameGoal.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač 682076e58f Inline pullGoalNamesFromImageReference back into Runtime.pullGoalFromImageReference
Now that we don't need a separate pullGoalNamesFromImageReference for
running tests, inline it back.

This forces us to add some glue code to getSinglePullRefNameGoal
and to convert between pullGoal and *pullGoal; that is temporary
and will be cleaned up soon.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač 4cf9308bf2 Introduce getSinglePullRefNameGoal
This merely wraps the
> return singlePullRefNameGoal(getPullRefName(... reference)), nil
pattern which is used for almost all getPullRefName uses.  For now
it seems not really worth it, but it will result in shorter code
(and smaller migration) after we replace getPullRefName with
getPullRefPair, which can fail, again - the pullGoalNamesFromImageReference
will not have to add any error handling.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač 48763b14ae Test Runtime.pullGoalFromPossiblyUnqualifiedName instead of pullGoalNameFrom...
Similarly to pullGoalNamesFromImageReference, use a storage.Store and
test the actually created references; that is more representative,
and clearly shows the impact of further normalization in
storageReference (like defaulting to :latest on NameOnly references).

Only modifies tests, so does not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač be101dee8a Test Runtime.pullGoalFromImageReference instead of pullGoalNamesFromImageReference
pullGoalNamesFromImageReference has been added only to allow testing without
a storage.Store, because I thought that a storage.Store can only be created
by root.

It turns out that non-root stores, at least good enough for reference
parsing and formatting, are possible (and have existed in c/image/storage
tests), so this creates such a store, and modifies the existing
test to test the created c/image/storage.storageReference values
instead of strings; that is more representative, and clearly shows
the impact of further normalization in storageReference (like
defaulting to :latest on NameOnly references).

Eventually we will want to get rid of pullGoalNames / pullRefName.

Only modifies tests, so does not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1198
Approved by: mheon
2018-08-02 13:17:17 +00:00
Miloslav Trmač 3d1449b2cc RFC: Rename runtime.pullImage to runtime.pullImageFromHeuristicSource
This is similar to the PushImageToHeuristicDestination RFC.

The goal is to be very explicit about which functions try to heuristically
guess what is the expected format of the string.  Not quite "shaming"
the users, but making sure they stand out.

RFC:
- Is this at all acceptable? Desirable?

Should not change behavior (but does not add unit tests).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 1c2d245c47 Introduce Runtime.pullImageFromReference, call it in Runtime.FromImageReference
FINALLY, (podman load) can pass through an ImageReference directly from
loadCmd all the way to pullGoalNamesFromImageReference, making sure not
to trigger the docker-like reference parsing heuristics.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 5507f15ba5 Replace Runtime.LoadFromArchive with Runtime.LoadFromArchiveReference
All callers of LoadFromArchive expect the input to be in the
transport:name format, or create it that way.  So, pass a
types.ImageReference instead of a string.

That requires us to add an explicit parse step in (podman pull);
in (podman load) we can, instead of pasting strings, create
native objects directly.

Changes the error behavior of (podman pull), we no longer
try heuristically parsing docker-archive:... inputs as
Docker references.

Also changes the string reported by (podman load) if all parsing
attempts fail, to be only the path instead of dir:path.  The error
message itself is likely to be the same (from directory.Transport).

(While at it, update a mismatched comment.)

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 558a1bd776 Split doPullImage from pullImage
Now that we have a pullGoal, separate determination of the goal from
performing it; we will then introduce another entry point with
a supplied types.ImageReference.

Also remove or correct some misleading comments.

Should not change behavior (but does not add unit tests).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 7f5efd8d04 Remove the forceCompress parameter from getCopyOptions and DRO.GetSystemContext
Use the parent types.SystemContext data instead.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač b63b84ea5e Remove the authFile parameter from getCopyOptions and DRO.GetSystemContext
Use the parent types.SystemContext data instead.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 444142c7c1 Remove the signaturePolicyPath parameter from getCopyOptions and DRO.GetSystemContext
Use the parent types.SystemContext data instead.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 1054b8d2c5 Add a *types.SystemContext parameter to getCopyOptions and DRO.GetSystemContext
All callers of getCopyOptions also call GetSystemContext with the same three parameters;
we will want to simplify this by passing the first SystemContext to getCopyOptions,
which can then inherit this data instead of so many parameters everywhere.

For now, just add a *types.SystemContext parameter without using it.

Should not change behavior (but does not add unit tests).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 2d5410d349 Move pullImage from Image to Runtime
pullImage (now) only uses Image.InputName; it is really used to _create_
an Image object, based on the pull results (as is most visible in the
LoadFromArchive caller), so it should not be a method on it.

This also simplifies a bit the number of different kids of uses of
Image.InputName; still apparently not enough to clearly document
the field, though.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač dbe2395769 Do not re-parse the list of search registries just for an error message
... when we even only count them.

This eliminates a rare error case, and saves time re-reading and re-parsing
the input.

(We still compute registryPath redundantly, and it may get out of sync.)

Should not change behavior (but does not add unit tests).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 8d73e45663 Eliminate duplicate determination whether to use search registries
Instead of duplicating the hasRegistry logic, just record whether we
did use search or not.

Should not change behavior (but does not add unit tests for all of it).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 5eac0740c3 Eliminate the "DockerArchive means pull all refPairs" special case
Instead, encode it explicitly in pullGoal.pullAllPairs.

Should not change behavior (but does not add unit tests for
all of it).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 86491efea0 Introduce struct pullGoalNames
This is an intermediate version of pullGoal, which exists basically
only for easier testing without containers-storage: (i.e. root access)
in unit tests.

Like pullGoal, we will add more members to make it useful in the future.

RFC: Unlike pullGoal, the return value is *pullGoalNames, because there are
quite a few (return nil, err) cases which would be more difficult to read
when returning a value.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač fadb143399 Introduce struct pullGoal
The eventual goal is to cleanly capture semantics like "pull all images
for DockerArchive" and "did a search through $registries" without
hard-coding it through; and to allow a pullImage variant where
the caller can pass an imageReference directly.

For now, this just wraps []pullRefPair and should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač bf0ab88eac Use []pullRefPair instead of []*pullRefPair
We are passing the values, don't really need the pointer sharing semantics,
and the structures are small enough, and the arrays short enough,
that we very likely lose on the indirect accesses more than we save on
quicker copying of the slices when extending them.  Value semantics
is safer anyway.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač dae6200662 Use []pullRefName instead of []*pullRefName
We are passing the values, don't really need the pointer sharing semantics,
and the structures are small enough, and the arrays short enough,
that we very likely lose on the indirect accesses more than we save on
quicker copying of the slices when extending them.  Value semantics
is safer anyway.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 83f40de965 Introduce singlePullRefNameGoal
All but two cases returning a []*pullRefName only return a single
item.  Introduce a helper for that case, which seems not
worth it now, but the return value will get a bit more complex
and introducing the helper now will minimize code changes in future
commits.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 1efbc40999 Use an early return from refNamesFromPossiblyUnqualifiedName
We will introduce helpers for the "single image" case, and having a separate
return statement will make them applicable here.

(Also allows us to reduce the scope of some variables a bit.)

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00
Miloslav Trmač 4dab4d97de RFC: Rename Image.PushImage to Image.PushImageToHeuristicDestination
The goal is to be very explicit about which functions try to heuristically
guess what is the expected format of the string.  Not quite "shaming"
the users, but making sure they stand out.

RFC:
- Is this at all acceptable? Desirable?
- varlink ExportImage says "destination must have transport type";
  should it be using alltransports.ParseImageReference
  + PushImageToReference, then?

(While touching the call in cmd/podman, also remove a commented-out
older version of the call.)

Should not change behavior (but does not add unit tests).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Closes: #1176
Approved by: rhatdan
2018-08-01 18:22:59 +00:00