Commit Graph

3646 Commits

Author SHA1 Message Date
Daniel J Walsh ef3f098796
Remove ReservedAnnotations from kube generate specification
Reserved annotations are used internally by Podman and would effect
nothing when run with Kubernetes so we should not be generating these
annotations.

Fixes: https://github.com/containers/podman/issues/17105

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-01-18 08:46:24 -05:00
OpenShift Merge Robot 7093d1fe5c
Merge pull request #17130 from Luap99/remove-dup-code
commit: use libimage code to parse changes
2023-01-17 05:10:22 -05:00
Paul Holzinger 79865c2903
commit: use libimage code to parse changes
This code is duplicated in podman and c/common, we should only use one
version.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-16 16:28:11 +01:00
Valentin Rothberg 067442b570 container kill: handle stopped/exited container
The container lock is released before stopping/killing which implies
certain race conditions with, for instance, the cleanup process changing
the container state to stopped, exited or other states.

The (remaining) flakes seen in #16142 and #15367 strongly indicate a
race in between the stopping/killing a container and the cleanup
process.  To fix the flake make sure to ignore invalid-state errors.
An alternative fix would be to change `KillContainer` to not return such
errors at all but commit c77691f06f indicates an explicit desire to
have these errors being reported in the sig proxy.

[NO NEW TESTS NEEDED] as it's a race already covered by the system
tests.

Fixes: #16142
Fixes: #15367
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2023-01-16 13:56:41 +01:00
Valentin Rothberg 6f919af78b add a comment to container removal
Every time I look at a container-removal issue I wonder why the
container isn't locked directly here, so let's add a comment here.
I am not sure whether I would be better if callers took care of
locking but for now the comment will safe the future me and probably
other readers some time.

[NO NEW TESTS NEEDED]

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2023-01-16 11:45:19 +01:00
OpenShift Merge Robot f1af5b3076
Merge pull request #17100 from rhatdan/regexp
Use containers/storage/pkg/regexp in place of regexp
2023-01-13 04:19:29 -05:00
Daniel J Walsh c2b36beb40
Use containers/storage/pkg/regexp in place of regexp
This is a cleaner solution and guarantees the variables
will be used before they are initialized.

[NO NEW TESTS NEEDED]

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-01-12 18:33:38 -05:00
Matthew Heon 1ab833fb73 Set StoppedByUser earlier in the process of stopping
The StoppedByUser variable indicates that the container was
requested to stop by a user. It's used to prevent restart policy
from firing (so that a restart=always container won't restart if
the user does a `podman stop`. The problem is we were setting it
*very* late in the stop() function. Originally, this was fine,
but after the changes to add the new Stopping state, the logic
that triggered restart policy was firing before StoppedByUser was
even set - so the container would still restart.

Setting it earlier shouldn't hurt anything and guarantees that
checks will see that the container was stopped manually.

Fixes #17069

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2023-01-12 14:45:34 -05:00
Valentin Rothberg d2fb6cf05d service container: less verbose error logs
While manually playing with --service-container, I encountered a number
of too verbose logs.  For instance, there's no need to error-log when
the service-container has already been stopped.

For testing, add a new kube test with a multi-pod YAML which will
implicitly show that #17024 is now working.

Fixes: #17024
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2023-01-12 14:09:23 +01:00
Daniel J Walsh 758f20e20a
Compile regex on demand not in init
Every podman command is paying the price for this compile even when they
don't use the Regex, this will speed up start of podman by a little.

[NO NEW TESTS NEEDED] Existing tests should catch issues.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-01-11 14:38:51 -05:00
Giuseppe Scrivano 4cf06fe7e0
podman: podman rm -f doesn't leave processes
follow-up to 6886e80b45

when "podman -rm -f" is used on a container in "stopping" state, also
make sure it is terminated before removing it from the local storage.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-01-09 21:01:32 +01:00
Giuseppe Scrivano 494db3e166
oci: check for valid PID before kill(pid, 0)
check that the container has a valid pid before attempting to use
kill($PID, 0) on it.  If the PID==0, it means the container is already
stopped.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-01-09 21:01:31 +01:00
Valentin Rothberg 4a7a45f973 remove service container _after_ pods
Do not allow for removing the service container unless all associated
pods have been removed.  Previously, the service container could be
removed when all pods have exited which can lead to a number of issues.

Now, the service container is treated like an infra container and can
only be removed along with the pods.

Also make sure that a pod is unlinked from the service container once
it's being removed.

Fixes: #16964
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2023-01-09 13:44:51 +01:00
OpenShift Merge Robot 74a961a9b8
Merge pull request #17025 from giuseppe/terminate-processes-no-pid-namespace
oci: terminate all container processes on cleanup
2023-01-08 06:45:03 -05:00
OpenShift Merge Robot c83a2f8a0a
Merge pull request #17022 from mheon/fix_defer_locking
Fix a potential defer logic error around locking
2023-01-08 06:42:28 -05:00
OpenShift Merge Robot 5de8cd74f9
Merge pull request #16820 from rhatdan/names
Allow '/' to prefix container names to match Docker
2023-01-07 09:38:19 -05:00
Giuseppe Scrivano 9fe86ec7f6
oci: terminate all container processes on cleanup
if the container has no pid namespace, they are not killed when the
container process ends.  In this case, attempt to kill them in the
same way.

The problem was noticed with toolbox where the exec'ed sessions are
not terminated when the container is stopped, blocking the system
shutdown.

[NO NEW TESTS NEEDED]

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-01-07 15:00:51 +01:00
Matthew Heon 92cdad0315 Fix a potential defer logic error around locking
in several top-level API functions. These are the first line of
the function that contains them, which makes sense; we want to
capture any error returned by the function. However, making this
the first defer means that it is the last thing to run after the
function returns - meaning that the container's
`defer c.lock.Unlock()` has already fired, leading to a chance we
modify the container without holding its lock.

We could move the function around so it's no longer the first
defer, but then we'd have to call it twice (immediately after
`defer c.lock.Unlock()` if the container is not batched, and a
second time in a new `else` block right after the lock/sync call
to make sure we handle batched containers). Seems simpler to just
leave it like this.

[NO NEW TESTS NEEDED] Can't really test for DB corruption easily.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2023-01-06 13:12:19 -05:00
Paul Holzinger 6038200fe0
k8s-file: podman logs --until --follow exit after time
When you use podman logs with --until and --follow it should exit after
the requested until time and not keep hanging forever.

This fixes the behavior for the k8s-file backend.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-06 15:19:23 +01:00
Paul Holzinger 767947ab88
journald: podman logs --until --follow exit after time
When you use podman logs with --until and --follow it should exit after
the requested until time and not keep hanging forever.

To make this work I reworked the code to use the better journald event
reading code for logs as well. this correctly uses the sd_journal API
without having to compare the cursors to find the EOF.

The same problems exists for the k8s-file driver, I will fix this in the
next commit.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-06 15:19:22 +01:00
Paul Holzinger c674b3dd83
journald: seek to time when --since is used
Instead of reading the full journal which can be expensive we can seek
based on the time.

If you have a journald with many podman events just compare the time
`time podman events --since 1s --stream=false` with and without this
patch.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-06 15:19:22 +01:00
Paul Holzinger 5f032256db
podman logs: journald fix --since and --follow
The `containerCouldBeLogging` bool should not be false by default, when
--since is used we seek in the journal and can miss the start event so
that bool would stay false forever. This means that a running container
is not followed even when it should.

To fix this we can just set the `containerCouldBeLogging` bool based on
the current contianer state.

Fixes #16950

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-06 15:19:16 +01:00
OpenShift Merge Robot b7314bdc68
Merge pull request #16806 from jakecorrenti/podman-inspect-add-error-info
Add container error message to ContainerState
2023-01-05 16:02:42 -05:00
Giuseppe Scrivano 6886e80b45
libpod: fix race condition rm'ing stopping containers
do not allow removing containers that are in the stopping state,
otherwise it can lead to a race condition where a "podman rm" removes
the container from the storage while another process is stopping the
same container.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2155828

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-01-04 08:53:19 +01:00
Jake Correnti df02cb51ee Add container error message to ContainerState
This change aims to store an error message to the ContainerState struct
with the last known error from the Start, StartAndAttach, and Stop OCI
Runtime functions.

The goal was to act in accordance with Docker's behavior.

Fixes: #13729

Signed-off-by: Jake Correnti <jakecorrenti+github@proton.me>
2023-01-03 13:21:24 -05:00
Daniel J Walsh 0c94f61852
Allow '/' to prefix container names to match Docker
Fixes: https://github.com/containers/podman/issues/16663

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-12-26 07:37:43 -05:00
Valentin Rothberg 45b180c1f8 events: support "die" filter
Map "die" to the "died" status for Docker compat.

Fixes: #16857
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-12-22 10:59:40 +01:00
Alexander Larsson 3808067ff8 When in transient store mode, use rundir for bundlepath
This means we store things like config.json and the secret files
also on tmpfs, lowering wear on disk and leaving less stuff on disk
on an unclean shutdown.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-21 12:50:23 +01:00
OpenShift Merge Robot 5f4d7b575d
Merge pull request #16888 from Luap99/export-fd
export: use io.Writer instead of file
2022-12-20 10:47:19 -05:00
Paul Holzinger 3ac5d10098
export: use io.Writer instead of file
This allows use to use STDOUT directly without having to call open
again, also this makes the export API endpoint much more performant
since it no longer needs to copy to a temp file.
I noticed that there was no export API test so I added one.

And lastly opening /dev/stdout will not work on windows.

Fixes #16870

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-12-20 14:38:41 +01:00
Giuseppe Scrivano 1bac160960
rootless: always create userns with euid != 0
always create a user namespace when running with euid != 0 since the
user is not owning the current mount namespace.

This issue happened on a Kubernetes cluster, where the pod was running
privileged but the UID was not 0, as it was configured in the image
itself.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-12-20 13:33:23 +01:00
OpenShift Merge Robot 3f83467f3e
Merge pull request #16756 from Luap99/netns-db
libpod: move NetNS into state db instead of extra bucket
2022-12-17 04:17:20 -05:00
OpenShift Merge Robot 12d5e6ab82
Merge pull request #16858 from Luap99/attach-log
libpod: fix header length in http attach with logs
2022-12-16 14:19:00 -05:00
Paul Holzinger 0bc3d35791
libpod: move NetNS into state db instead of extra bucket
This should simplify the db logic. We no longer need a extra db bucket
for the netns, it is still supported in read only mode for backwards
compat. The old version required us to always open the netns before we
could attach it to the container state struct which caused problem in
some cases were the netns was no longer valid.

Now we use the netns as string throughout the code, this allow us to
only open it when needed reducing possible errors.

[NO NEW TESTS NEEDED] Existing tests should cover it and it is only a
flake so hard to reproduce the error.

Fixes #16140

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-12-16 18:30:12 +01:00
OpenShift Merge Robot fd7049b187
Merge pull request #16817 from Luap99/no-CNI
libpod: remove CNI word were no longer applicable
2022-12-16 11:50:07 -05:00
OpenShift Merge Robot f21c64019f
Merge pull request #16800 from Luap99/restore-static-ip
checkpoint restore: fix --ignore-static-ip/mac
2022-12-16 11:03:40 -05:00
Paul Holzinger 4fa65ad0dc
libpod: remove CNI word were no longer applicable
We should have done this much earlier, most of the times CNI networks
just mean networks so I changed this and also fixed some function
names. This should make it more clear what actually refers to CNI and
what is just general network backend stuff.

[NO NEW TESTS NEEDED]

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-12-16 14:20:14 +01:00
Paul Holzinger 1424f0958f
libpod: fix header length in http attach with logs
When we read logs there can be full or partial lines, when it is full we
need to append a newline, thus the message length must be incremented by
one.

Fixes #16856

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-12-16 14:18:30 +01:00
OpenShift Merge Robot d6c2fa6452
Merge pull request #16781 from matejvasek/fix-event-reading-size
fix: event read from syslog when syslog entry too long
2022-12-16 07:30:37 -05:00
OpenShift Merge Robot 18f1a8046b
Merge pull request #16733 from rhatdan/caps
Vendor in latest containers/common with default capabilities
2022-12-16 03:58:06 -05:00
OpenShift Merge Robot 536d3b87f0
Merge pull request #16818 from SoMuchForSubtlety/api-port-bindings
api: remove unmapped ports from PortBindings
2022-12-15 20:19:53 -05:00
Jakob Ahrer 97f63da67d
remove unmapped ports from inspect port bindings
Signed-off-by: Jakob Ahrer <jakob@ahrer.dev>
2022-12-15 23:18:50 +01:00
Daniel J Walsh 3718ac8e96
Vendor in latest containers/common with default capabilities
Also update vendor of containers/storage and image

Cleanup display of added/dropped capabilties as well

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-12-15 14:28:30 -05:00
Valentin Rothberg dcbf7b4481 bump golangci-lint to v1.50.1
Also fix a number of duplicate words.  Yet disable the new `dupword`
linter as it displays too many false positives.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-12-15 13:39:56 +01:00
OpenShift Merge Robot a55bdfaf10
Merge pull request #16697 from rhatdan/pod
stop reporting errors removing containers that don't exist
2022-12-15 03:35:46 -05:00
Giuseppe Scrivano fdcc2257df
libpod: use OCI idmappings for mounts
Now that the OCI runtime specs have support for idmapped mounts, let's
use them instead of relying on the custom annotation in crun.

Also add the mechanism to specify the mapping to use.  Pick the same
format used by crun so it won't be a breaking change for users that
are already using it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-12-14 20:23:45 +01:00
Daniel J Walsh 4a5581ce0d
stop reporting errors removing containers that don't exist
Init containers are removed once they exit, but podman
reports and error that the container does not exist, when
it was previously removed.  Stop reporting missing containers
when removing.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-12-14 14:09:56 -05:00
OpenShift Merge Robot 0037bffbb1
Merge pull request #16803 from cdoern/subpath
add support for subpath in play kube for named volumes
2022-12-12 12:37:59 -05:00
Paul Holzinger 45a40bf587
checkpoint restore: fix --ignore-static-ip/mac
With the 4.0 network rewrite I introduced a regression in 094e1d70de.
It only covered the case where a checkpoint is restored via --import.
The normal restore path was not covered since the static ip/mac are now
part in an extra db bucket. This commit fixes that by changing the config
in the db.

Note that there were no test for --ignore-static-ip/mac so I added a big
system test which should cover all cases (even the ones that already
work). This is not exactly pretty but I don't have to enough time to
come up with something better at the moment.

Fixes #16666

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-12-12 18:34:49 +01:00
Charlie Doern 95cc7e0527 add support for subpath in play kube for named volumes
subpath allows for only a subdirecty of a volumes data to be mounted in the container
add support for the named volume type sub path with others to follow.

resolves #12929

Signed-off-by: Charlie Doern <cbddoern@gmail.com>
2022-12-12 09:54:00 -05:00