On MacOS, mount /Users, /private/, /var/folders by default for better docker compat. The homedir on MacOS is /Users/<username>, so that will be mounted automatically anyway with this change.
Docker also mounts /Volumes and /tmp, /Volumes fails with a Too many levels of symbolic links, as Volumes on Mac is just a symlink to / which seems like a bad idea to mount anyway.
/tmp fails because the Podman machine uses the tmp directory inside the machine and writes content to it on boot, causing the mount to fail. However, on Mac, /tmp is symlinked to /private/tmp anyway, so those files are accessible from there.
Signed-off-by: Ashley Cui <acui@redhat.com>
I want to switch podman over to only using strings for the netns path.
So we no longer pass this interface around. Buildah doesn't use this so
we only need to fix it in Podman. I have a WIP PR[1] for that.
[1] https://github.com/containers/podman/pull/16756
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
New features in netavark/aardvark allows users to update network dns
servers and all the containers attached to those networks uses updated
resolvers.
Following PR adds support in `libnetwork` to support
* Add support for higher level `NetworkUpdate` API
* Add support for `Update` exec call which can invoke netavark with a
new update option added here: https://github.com/containers/netavark/pull/503
Signed-off-by: Aditya R <arajan@redhat.com>
When creating macvlan or ipvlan network configs with the none ipam
driver we would always cause a segfault because of a nil pointer
dereference.
Add a test for both to prevent a regression.
Fixescontainers/podman#16620
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
For now, only add IgnoreIfExists flag.
Having this flag is very useful when using scripts or systemd unit files
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
do not start up a dbus daemon if it is not already running.
[NO NEW TESTS NEEDED] the fix is in a dependency.
Closes: https://github.com/containers/podman/issues/16718
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Add an option to create a more verbose container-create event which
includes a JSON payload with detailed information about the container.
Jira: https://issues.redhat.com/browse/RUN-1702
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
This is taking time on every podman call, and provide limited
protection. Versioning should be handled in the packaging system
and this is an unlikely to happen.
Every exec done by container tools hurts us as we try to get container
startup team to absolute minimal amounts.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This reverts commit 962dbc3281.
As shown in containers/podman/pull/16610 the changes require a number of
changes in Podman's CI. While many issues have been fixed in that PR,
there are some potentially controversial changes such as dropping
NET_RAW.
Let's revert the commit to unblock ongoing work. For the next
iteration, Podman CI must be green before merging.
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
For a couple of years now we have been shipping containers.conf settings
to use only 10 capabities. Docker uses 14, with the difference being
CAP_AUDIT_ALLOW, CAP_NET_RAW, CAP_MKNOD, CAP_CHROOT.
This allows us to run with a tighter security then Docker.
This PR makes the change to default config, so that if no
containers.conf overrides are present, we will run with the tighter
security. Currently most distros that ship the containers.conf already
run with this setting, but this makes it formal, and changes the man
page to match the defaults.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Podman and Buildah do not use this field, and I
know of no users of it, remove it from docs and
the default conf file, so users will not expect
it to do anything.
Leaving implementation in the slight chance someone
has used it in a non containers project.
Fixes: https://github.com/containers/podman/issues/16562
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
libnetwork must allow to pass network_dns_servers so aardvark and
netavark can consume it and enabled network scoped dns.
Feature implemented at netavark and aardvark end
* Netavark: https://github.com/containers/netavark/pull/497
Signed-off-by: Aditya R <arajan@redhat.com>
OpenShift Merge Robot