Commit Graph

1052 Commits

Author SHA1 Message Date
OpenShift Merge Robot 85f21fb2bd
Merge pull request #12664 from cdoern/noManagePasswd
Podman run --passwd
2021-12-22 12:09:56 +01:00
cdoern 20ce6e5c60 Podman run --passwd
added support for a new flag --passwd which, when false prohibits podman from creating entries in
/etc/passwd and /etc/groups allowing users to modify those files in the container entrypoint

resolves #11805

Signed-off-by: cdoern <cdoern@redhat.com>
2021-12-21 17:19:41 -05:00
Valentin Rothberg b1f5e861b0 compat: image normalization: handle sha256 prefix
When normalizing image names on the compat API, make sure to take the
`sha256:` prefix into account when matching against the image ID.
Otherwise, the name will mistakingly be subject to docker.io
normalization.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-12-20 17:27:02 +01:00
Leah Neukirchen a1ebde118a legacy events: also set Action="die"
Since #10168, on the event "died", the Status is set to "die"
for compatibility with the Docker API.  Docker also sets
the field Action to "died", so do the same here.

Signed-off-by: Leah Neukirchen <leah@vuxu.org>
2021-12-17 15:24:48 +01:00
OpenShift Merge Robot 7dabcbd7bc
Merge pull request #12534 from Luap99/network-db
network db rewrite
2021-12-15 15:25:14 +01:00
Ananth Bhaskararaman 52b12fe985
Fixes #12063 Add docker compatible output after image build.
Signed-off-by: Ananth Bhaskararaman <antsub@gmail.com>
2021-12-14 21:08:31 +05:30
Paul Holzinger 3e9af2029f
play kube add support for multiple networks
Allow the same --network options for play kube as for podman run/create.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-12-14 15:23:40 +01:00
Paul Holzinger 46938bbf88
fix incorrect swagger doc for network dis/connect
The swagger api docs used the extra Body struct as part of the request
which is wrong. We just want the plain type.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-12-14 15:23:39 +01:00
Paul Holzinger 4791595b5c
network connect allow ip, ipv6 and mac address
Network connect now supports setting a static ipv4, ipv6 and mac address
for the container network. The options are added to the cli and api.

Fixes #9883

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-12-14 15:23:39 +01:00
Valentin Rothberg 81a0a79844 compat build: adhere to q/quiet
Fixes: #12566
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-12-13 09:52:24 +01:00
Miloslav Trmač 2aeb690d37 Don't return a header name from auth.GetCredentials
Almost every caller is using it only to wrap an error
in exactly the same way, so move that error context into GetCredentials
and simplify the users.

(The one other caller, build, was even wrapping the error incorrectly
talking about query parameters; so let it use the same text as the others.)

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2021-12-10 18:16:18 +01:00
Daniel J Walsh 2130d18539
Update vendor or containers/common moving pkg/cgroups there
[NO NEW TESTS NEEDED] This is just moving pkg/cgroups out so
existing tests should be fine.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-12-07 06:17:11 -05:00
Ondra Machacek c9ad1da51c Add restart-sec option to systemd generate
Signed-off-by: Ondra Machacek <omachace@redhat.com>
2021-12-03 12:11:28 +01:00
OpenShift Merge Robot f3a02304c2
Merge pull request #12483 from vrothberg/fix-12468
compat API: push: report size of manifest
2021-12-02 22:08:50 +01:00
Daniel J Walsh 8d6d9df407 compat API: push: report size of manifest
We don't yet have a local registry running in the APIv2 tests.
Tested manually.

[NO NEW TESTS NEEDED]

Fixes: https://github.com/containers/podman/issues/12468

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-12-02 15:34:03 +01:00
Valentin Rothberg 2683ecbbcd compat: images/json
Do not list manifest lists.  Docker doesn't either.

Fixes: #12453
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-12-02 14:29:17 +01:00
OpenShift Merge Robot 85101f69d8
Merge pull request #12414 from flouthoc/api-allow-secrets
tunnel: allow `remote` and `API` to accept `--secrets`
2021-11-30 19:29:33 +01:00
Valentin Rothberg 5bdd571b1e compat API: allow enforcing short-names resolution to Docker Hub
The Docker-compatible REST API has historically behaved just as the rest
of Podman and Buildah (and the atomic Docker in older RHEL/Fedora) where
`containers-registries.conf` is centrally controlling which registries
a short name may resolve to during pull or local image lookups.  Please
refer to a blog for more details [1].

Docker, however, is only resolving short names to docker.io which has
been reported (see #12320) to break certain clients who rely on this
behavior.  In order to support this scenario, `containers.conf(5)`
received a new option to control whether Podman's compat API resolves
to docker.io only or behaves as before.

Most endpoints allow for directly normalizing parameters that represent
an image.  If set in containers.conf, Podman will then normalize the
references directly to docker.io.  The build endpoint is an outlier
since images are also referenced in Dockerfiles.  The Buildah API,
however, supports specifying a custom `types.SystemContext` in which
we can set a field that enforces short-name resolution to docker.io
in `c/image/pkg/shortnames`.

Notice that this a "hybrid" approach of doing the normalization directly
in the compat endpoints *and* in `pkg/shortnames` by passing a system
context.  Doing such a hybrid approach is neccessary since the compat
and the libpod endpoints share the same `libimage.Runtime` which makes
a global enforcement via the `libimage.Runtime.systemContext`
impossible.  Having two separate runtimes for the compat and the libpod
endpoints seems risky and not generally applicable to all endpoints.

[1] https://www.redhat.com/sysadmin/container-image-short-names

Fixes: #12320
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-11-30 14:22:52 +01:00
Aditya Rajan c80a2e4495
podman-remote: prevent leaking secret into image
Prevents temp secrets leaking into image by moving it away from context
directory to parent builder directory. Builder directory automatically
gets cleaned up when we are done with the build.

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-30 15:44:10 +05:30
Aditya Rajan e7204178e1
podman-remote: copy secret to contextdir is absolute path on host
Podman remote must treat build secrets as part of context directory. If
secret path is absolute path on host copy it to tar file and pass it to
remote server.

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-30 14:19:29 +05:30
Aditya Rajan bfcaf538bb
api: allow build api to accept secrets
Following commit makes sure that `build` api can accept external
secret and allows currently `NOOP` `podman-remote build -t tag
--secret id=mysecret,src=/path/on/remote` to become functional.

Just like `docker` following api is a hidden field and only exposed to
`podman-remote` but could document it if it needs exposed on `swagger`.

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-30 14:19:17 +05:30
OpenShift Merge Robot 2b0b4327c4 Merge pull request #12405 from flouthoc/compat-build-error
compat: Add compatiblity with `Docker/Moby` API for scenarios where build fails.
2021-11-29 22:38:19 +01:00
Matej Vasek cbda62d1be fix: error reporting for archive endpoint
Returning 500 when copying to read-only destination.

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-28 19:02:15 +01:00
Aditya Rajan 84e81252f2
compat: Add compatiblity with Docker/Moby API for scenarios where build fails
In order to maintain compatiblity with `moby API` we must the field
`errorDetail` which is primary error reporting field with stream.

Currently podman is using `error` which is already deprecated by moby.

Check: https://github.com/moby/moby/blob/master/pkg/jsonmessage/jsonmessage.go#L147

[NO NEW TESTS NEEDED]
We can't test this in podman CI since we dont have a docker client.

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-24 15:51:12 +05:30
Daniel J Walsh 400ccc6205
Merge pull request #12328 from serverwentdown/fix-compat-ipaddress
compat: Add subnet mask behind IP address to match Docker API
2021-11-23 10:39:32 -05:00
Valentin Rothberg 566b78dd02 generate systemd: add --start-timeout flag
Add a new flag to set the start timeout for a generated systemd unit.
To make naming consistent, add a new --stop-timeout flag as well and let
the previous --time map to it.

Fixes: #11618
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-11-23 09:38:51 +01:00
Aditya Rajan 13ee1788f9
swagger: add layers to build api docs
Add missing `layer` entry to swagger docs for `/build`.

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-22 21:14:16 +05:30
Aditya Rajan 022273c197
compat: add layer caching compatiblity for non podman clients
Non-podman clients do not set `layers` while making request. This is
supposed to be `true` bydefault but `non-podman-clients i.e Docker` dont
know about this field as a result they end up setting this values to
`false`. Causing builds to never use cache for layers.

Adds compatiblity for `docker SDK`.

[NO NEW TESTS NEEDED]

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-11-22 21:11:26 +05:30
Ambrose Chua ab56a7c4b7 compat: Add subnet mask behind IP address to match Docker API
Signed-off-by: Ambrose Chua <ambrose@hey.com>
2021-11-20 21:00:38 +08:00
Radostin Stoyanov b2623ceb4b
api/handlers: Add checkpoint/restore FileLocks
Signed-off-by: Radostin Stoyanov <radostin@redhat.com>
2021-11-19 13:11:21 +00:00
OpenShift Merge Robot 87a7800d14
Merge pull request #12318 from mscherer/2nd_try
Change error message for compatibility with docker
2021-11-19 02:34:10 +01:00
Paul Holzinger 0dae50f1d3
Do not store the exit command in container config
There is a problem with creating and storing the exit command when the
container was created. It only contains the options the container was
created with but NOT the options the container is started with. One
example would be a CNI network config. If I start a container once, then
change the cni config dir with `--cni-config-dir` ans start it a second
time it will start successfully. However the exit command still contains
the wrong `--cni-config-dir` because it was not updated.

To fix this we do not want to store the exit command at all. Instead we
create it every time the conmon process for the container is startet.
This guarantees us that the container cleanup process is startet with
the correct settings.

[NO NEW TESTS NEEDED]

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-11-18 20:28:03 +01:00
Valentin Rothberg fceecc3a5b remote checkpoint/restore: more fixes
* Support `checkpoint --pre-checkpoint`

* Support `checkpoint --with-previous`

* Disable `restore --import-previous` for the remote client since we had
  to send two files which in turn would require to tar them up and hence
  be a breaking change.  Podman 4.0 would be the chance and I hope we'll
  find time before that to remote-restore prettier.

Note that I did not run over swagger yet to check whether all parameters
are actually documented due to time constraints.

Fixes: #12334
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-11-18 16:52:15 +01:00
OpenShift Merge Robot 85733e0b4a
Merge pull request #12281 from vrothberg/fix-12007
fix remote checkpoint/restore
2021-11-17 12:02:37 +01:00
Michael Scherer 422dc5e693 Change error message for compatibility with docker
Fix #12315

Signed-off-by: Michael Scherer <misc@redhat.com>
2021-11-16 19:56:23 +01:00
Valentin Rothberg 33ec8c6698 fix remote checkpoint/restore
Nothing was working before, and it's too much to summarize.  To make
sure we're not regressing in the future again, enable the remote e2e
tests.

Fixes: #12007
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-11-16 14:41:18 +01:00
Daniel J Walsh 44d1618dd7
Add --unsetenv & --unsetenv-all to remove def environment variables
Podman adds a few environment variables by default, and
currently there is no way to get rid of them from your container.
This option will allow  you to specify which defaults you don't
want.

--unsetenv-all will remove all default environment variables.

Default environment variables can come from podman builtin,
containers.conf or from the container image.

Fixes: https://github.com/containers/podman/issues/11836

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-11-15 15:10:12 -05:00
OpenShift Merge Robot e9d8ca22b8
Merge pull request #11076 from boaz0/closes_10275
Support template unit files in podman generate systemd
2021-11-15 16:30:38 +01:00
Adrian Reber 80e56fa12b
Added optional container restore statistics
This adds the parameter '--print-stats' to 'podman container restore'.
With '--print-stats' Podman will measure how long Podman itself, the OCI
runtime and CRIU requires to restore a checkpoint and print out these
information. CRIU already creates process restore statistics which are
just read in addition to the added measurements. In contrast to just
printing out the ID of the restored container, Podman will now print
out JSON:

 # podman container restore --latest --print-stats
 {
     "podman_restore_duration": 305871,
     "container_statistics": [
         {
             "Id": "47b02e1d474b5d5fe917825e91ac653efa757c91e5a81a368d771a78f6b5ed20",
             "runtime_restore_duration": 140614,
             "criu_statistics": {
                 "forking_time": 5,
                 "restore_time": 67672,
                 "pages_restored": 14
             }
         }
     ]
 }

The output contains 'podman_restore_duration' which contains the
number of microseconds Podman required to restore the checkpoint. The
output also includes 'runtime_restore_duration' which is the time
the runtime needed to restore that specific container. Each container
also includes 'criu_statistics' which displays the timing information
collected by CRIU.

Signed-off-by: Adrian Reber <areber@redhat.com>
2021-11-15 11:50:25 +00:00
Adrian Reber 6202e8102b
Added optional container checkpointing statistics
This adds the parameter '--print-stats' to 'podman container checkpoint'.
With '--print-stats' Podman will measure how long Podman itself, the OCI
runtime and CRIU requires to create a checkpoint and print out these
information. CRIU already creates checkpointing statistics which are
just read in addition to the added measurements. In contrast to just
printing out the ID of the checkpointed container, Podman will now print
out JSON:

 # podman container checkpoint --latest --print-stats
 {
     "podman_checkpoint_duration": 360749,
     "container_statistics": [
         {
             "Id": "25244244bf2efbef30fb6857ddea8cb2e5489f07eb6659e20dda117f0c466808",
             "runtime_checkpoint_duration": 177222,
             "criu_statistics": {
                 "freezing_time": 100657,
                 "frozen_time": 60700,
                 "memdump_time": 8162,
                 "memwrite_time": 4224,
                 "pages_scanned": 20561,
                 "pages_written": 2129
             }
         }
     ]
 }

The output contains 'podman_checkpoint_duration' which contains the
number of microseconds Podman required to create the checkpoint. The
output also includes 'runtime_checkpoint_duration' which is the time
the runtime needed to checkpoint that specific container. Each container
also includes 'criu_statistics' which displays the timing information
collected by CRIU.

Signed-off-by: Adrian Reber <areber@redhat.com>
2021-11-15 11:50:24 +00:00
Hironori Shiina 9226ccb59f Enable 'podman run --memory-swappiness=0'
'--memory-swappiness=0' used to work. This patch fixes the regression
issue, which was caused by the change of infra container creation
process.

Signed-off-by: Hironori Shiina <shiina.hironori@jp.fujitsu.com>
2021-11-12 13:20:20 -05:00
Michael Scherer b1c0023424 Always create working directory when using compat API
Docker/Moby always create the working directory, and some tools
rely on that behavior (example, woodpecker/drone).

Fixes #11842

Signed-off-by: Michael Scherer <misc@redhat.com>
2021-11-12 14:18:26 +01:00
OpenShift Merge Robot 6c0690dbab
Merge pull request #12186 from jwhonce/issues/12181
Log Apache access_log-like entries at Info level
2021-11-05 20:53:54 +01:00
OpenShift Merge Robot e04cb6c30c
Merge pull request #12178 from matejvasek/swagger-make-filed-optional
Update swagger doc make field optional
2021-11-05 19:43:55 +01:00
Jhon Honce 5c0351cc6f Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
Only log API access entries when --log-level set to Info or below.

Fixes #12181

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-11-05 10:34:02 -07:00
Matej Vasek ff92d73712 Update swagger doc make filed optional
[NO TESTS NEEDED]

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-04 18:43:34 +01:00
OpenShift Merge Robot 33643f4b09
Merge pull request #12159 from jwhonce/issues/12115
Implement top streaming for containers and pods
2021-11-02 22:28:54 +01:00
OpenShift Merge Robot e63e90999c
Merge pull request #12156 from matejvasek/docker-api-zero-value-fixes
Fix libpod API conformance to swagger
2021-11-02 18:19:24 +01:00
Jhon Honce 449cc7a5c2 Implement top streaming for containers and pods
* Implement API query parameter stream and delay for containers and
  pods top endpoints
* Update swagger with breaking changes
* Add python API tests for endpoints

Fixes #12115

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-11-02 08:11:14 -07:00
Matej Vasek d0dfc5e223 Add tests
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 23:01:17 +01:00
Matej Vasek 48d0d2b4a3 Fix swagger definitions
[NO TESTS NEEDED]

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 22:37:35 +01:00
Matej Vasek 48e1cca9f8 More conforming libpod API and swagger types
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 20:25:58 +01:00
Matej Vasek 62ee24bb7c More conforming libpod API and swagger types
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 20:19:06 +01:00
Matej Vasek a845613d03 Better emptiness test for custom JSON serializer
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 20:12:35 +01:00
Matej Vasek 120ad2d3ca Use correct swagger type in doc-comment
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 17:09:35 +01:00
Matej Vasek 218d91d76d Fix libpod API conformance to swagger
* Return empty array when nothing has been pruned.
* Use correct return type swagger doc-comment.

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-11-01 16:53:49 +01:00
Jhon Honce 98506c961b Allow label and labels when creating volumes
JSON payload may have either key. Labels will override any values set
via Label.

Fixes #12102

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-10-28 16:02:22 -07:00
OpenShift Merge Robot 979b631228
Merge pull request #11956 from vrothberg/pause
remove need to download pause image
2021-10-27 10:22:56 +00:00
OpenShift Merge Robot 22e5dc19b0
Merge pull request #12092 from rhatdan/build
If Dockerfile exists in same directory as service, we should not use it.
2021-10-26 18:33:53 +00:00
Valentin Rothberg 75f478c08b pod create: remove need for pause image
So far, the infra containers of pods required pulling down an image
rendering pods not usable in disconnected environments.  Instead, build
an image locally which uses local pause binary.

Fixes: #10354
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-10-26 13:51:45 +02:00
Daniel J Walsh d6296c918d
If Dockerfile exists in same directory as service, we should not use it.
We should only use the Containerfiles/Dockerfiles found in the context
directory.

Fixes: https://github.com/containers/podman/issues/12054

[NO NEW TESTS NEEDED] It is difficult to setup a test for this in the
CI/CD system, but build tests should find if this PR broke anything.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-10-25 16:33:13 -04:00
Daniel J Walsh acd8b49000
Add support to play kube for --log-opt
Fixes: https://github.com/containers/podman/issues/11727

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-10-25 11:40:42 -04:00
Boaz Shuster ece0c7e5d3 Support template unit files in podman generate systemd
Signed-off-by: Boaz Shuster <boaz.shuster.github@gmail.com>
2021-10-22 04:19:18 +03:00
Aditya Rajan f4f96962c0
tag: Support tagging manifest list instead of resolving to images
Following commit makes sure when buildah tag is invoked on a manifest
list, it tags the same manifest list instead of resolving to an image and
tagging it.

Port of: https://github.com/containers/buildah/pull/3483

Signed-off-by: Aditya Rajan <arajan@redhat.com>
2021-10-21 17:44:31 +05:30
OpenShift Merge Robot 72e87c0ca8
Merge pull request #11924 from jwhonce/issues/11894
Refactor podman search to be more code friendly
2021-10-12 22:17:09 +02:00
Jhon Honce 0459484bdf Fix CI flake on time of shutdown for API service
* Increase timeout for tests to 10s
* To aid in debugging add PID to shutdown package logging
* Added new message for forced service shutdown
* Always wait for HTTP server to shutdown, duration of 0 not friendly
  to clients

Note: The log event

"IdleTracker: StateClosed transition by connection marked un-managed"

denotes a TCP connection has been initiated but no HTTP request was sent.
And is expected during these tests.

Fixes #11921

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-10-12 09:53:19 -07:00
Jhon Honce b28a8bc198 Refactor podman search to be more code friendly
* JSON and API description fields are no longer truncated. Formatting
  moved to client, better support of MVP.
* --no-trunc now defaults to true
* Updated tests for changes

Closes #11894

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-10-12 09:30:40 -07:00
OpenShift Merge Robot 60c711f789
Merge pull request #11869 from jwhonce/wip/pprof
Enable /debug/pprof API service endpoints
2021-10-10 12:54:29 +02:00
Jhon Honce 8d3aec9d08 Enable /debug/pprof API service endpoints
* Refactor sidecar HTTP service for /debug/pprof endpoints to use a TCP
  address given via new podman system service --pprof-address flag

* Allow same URL parsing in "system service" as bindings/connection.go

* Refactor NewServerWithSettings() to use entities.ServiceOptions
  in place of deleted server.Options

* Updated godoc for impacted functions and types

* Fixed API service Shutdown() to do an orderly shutdown when
  terminated and running with --time=0

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-10-08 13:57:20 -07:00
Valentin Rothberg fad14dafe1 faster image inspection
Vendor the latest HEAD in c/common to pull in changes for a faster
inspection of images.  Previously, only the size computation was
optional, now the one for the parent image is as well.

In many cases, the parent image is not needed but it takes around 10ms
on my local machine.  With this change, we cut off 10ms from many code
paths, most importantly, container creation.

[NO NEW TESTS NEEDED]

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-10-08 14:47:33 +02:00
Daniel J Walsh 21c9dc3c40
Add --time out for podman * rm -f commands
Add --time flag to podman container rm
Add --time flag to podman pod rm
Add --time flag to podman volume rm
Add --time flag to podman network rm

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-10-04 07:07:56 -04:00
OpenShift Merge Robot 9dddd6ab4b
Merge pull request #11833 from umohnani8/swagger
Add note about empty fields and null values for API responses
2021-10-01 15:22:15 -04:00
Urvashi Mohnani 4ea5d69719 Add note about empty fields and null values for API responses
Add a note the global swagger docs about some fields not showing
up in responses as they are set to omitempty. Also add a note about
null values for complicated field types that swagger-go has a hard time
with.

[NO TESTS NEEDED]

Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
2021-10-01 13:18:52 -04:00
Daniel J Walsh 641f0ccc4e
Add podman play kube --no-hosts options
This option will setup the containers to not modify their /etc/hosts
file and just use the one from the image.

Fixes: https://github.com/containers/podman/issues/9500

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-10-01 10:53:50 -04:00
Valentin Rothberg a9a54eefab image prune: support removing external containers
Support removing external containers (e.g., build containers) during
image prune.

Fixes: #11472
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-09-28 10:24:16 +02:00
Jelle van der Waa 3d8dec982f Document missing /images/search query parameters
Include the tlsVerify, listTags query parameters for the compat and
libpod endpoint and document the default value for the amount of results
which are returned.

Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
2021-09-24 12:27:55 +02:00
OpenShift Merge Robot e8fc990aad
Merge pull request #11654 from Luap99/health-docker
podman inspect add State.Health field for docker compat
2021-09-23 11:34:42 -04:00
Paul Holzinger 1199733754
podman inspect add State.Health field for docker compat
podman inspect shows the healthcheck status in `.State.Healthcheck`,
docker uses `.State.Health`. To make sure docker scripts work we
should add the `Health` key. Because we do not want to display both keys
by default we only use the new `Health` key. This is a breaking change
for podman users but matches what docker does. To provide some form of
compatibility users can still use `--format {{.State.Healthcheck}}`. IT
is just not shown by default.

Fixes #11645

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-09-23 14:44:34 +02:00
Valentin Rothberg 01bf8a6687 podman save: enforce signature removal
Enforce the removal of signatures in `podman save` to restore behavior
prior to the migration to libimage.  We may consider improving on that
in the future.  For details, please refer to the excellent summary by
@mtrmac [1].

[NO TESTS NEEDED] - manually verified but exisiting tests need some
further investigation (see [1]).

[1] https://github.com/containers/podman/pull/11669#issuecomment-925250264

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-09-23 13:50:49 +02:00
Daniel J Walsh 1c4e6d8624
standardize logrus messages to upper case
Remove ERROR: Error stutter from logrus messages also.

[ NO TESTS NEEDED] This is just code cleanup.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-09-22 15:29:34 -04:00
Valentin Rothberg 49c5688a30 podman save: add `--uncompressed`
Add an option to `podman save` to allow uncompressed layers when
copying OCI images.  Do the neccessary plumbing for the remote client,
add tests and vendor in the latest commit from c/common to fetch
the neccessary changes in libimage.

Closes: #11613
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-09-22 12:38:07 +02:00
cdoern 8fac34b8ff Pod Device Support
added support for pod devices. The device gets added to the infra container and
recreated in all containers that join the pod.

This required a new container config item to keep track of the original device passed in by the user before
the path was parsed into the container device.

Signed-off-by: cdoern <cdoern@redhat.com>
2021-09-20 23:22:43 -04:00
Paul Holzinger 5242030ac2
compat API: /images/json prefix image id with sha256
Docker adds the `sha256:` prefix to the image ID, so our compat endpoint
has to do this as well.

Fixes #11623

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-09-20 13:47:29 +02:00
Paul Holzinger 5c7935057c
Do not allow network modes to be used as network names
`podman network create` should not allow users to create networks with a
name which is already used for a network mode in `podman run --network`.

Fixes #11448

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-09-16 11:01:52 +02:00
Matej Vasek 9c091e42db fix inverted condition
[NO TESTS NEEDED]

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-09-16 00:37:17 +02:00
OpenShift Merge Robot 5f41ffdd19
Merge pull request #11322 from Luap99/network-libpod
Wire network interface into libpod
2021-09-15 16:11:14 -04:00
Matej Vasek 7c5d64b478 Fix /auth compat endpoint
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-09-15 20:01:02 +02:00
Paul Holzinger 85e8fbf7f3
Wire network interface into libpod
Make use of the new network interface in libpod.

This commit contains several breaking changes:
- podman network create only outputs the new network name and not file
  path.
- podman network ls shows the network driver instead of the cni version
  and plugins.
- podman network inspect outputs the new network struct and not the cni
  conflist.
- The bindings and libpod api endpoints have been changed to use the new
  network structure.

The container network status is stored in a new field in the state. The
status should be received with the new `c.getNetworkStatus`. This will
migrate the old status to the new format. Therefore old containers should
contine to work correctly in all cases even when network connect/
disconnect is used.

New features:
- podman network reload keeps the ip and mac for more than one network.
- podman container restore keeps the ip and mac for more than one
  network.
- The network create compat endpoint can now use more than one ipam
  config.

The man pages and the swagger doc are updated to reflect the latest
changes.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-09-15 20:00:20 +02:00
OpenShift Merge Robot 4b6ffda31c
Merge pull request #11409 from cdoern/podVolumes
Pod Volumes Support
2021-09-15 09:10:12 -04:00
OpenShift Merge Robot 10873c6f49
Merge pull request #11578 from jelly/handle_nil_pointer_deref
api: handle nil pointer dereference in api endpoints
2021-09-15 06:23:00 -04:00
OpenShift Merge Robot aff64dda65
Merge pull request #11574 from nalind/buildah-platforms
build: take advantage of --platform lists
2021-09-15 06:21:58 -04:00
Jelle van der Waa 9b04e17893 api: handle nil pointer dereference in rest endpoints
When `?all=garbage` is passed to an API endpoint schema validation fails
and err is nil. Wrapf uses err to create an error message causing a nil
pointer dereference.

Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
2021-09-15 09:14:34 +02:00
Nalin Dahyabhai 5dbf3ee7ae build: take advantage of --platform lists
The builder can take a list of platforms in the Platforms field of its
BuildOptions argument, and we should definitely take advantage of that.

The `bud-multiple-platform-values` test from buildah exercises support
for this, so
[NO TESTS NEEDED]

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2021-09-14 17:09:06 -04:00
Jelle van der Waa 64de4f612e Document `all` query parameter for /libpod/images/prune
Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
2021-09-14 21:54:06 +02:00
cdoern 84005330aa Pod Volumes Support
added support for the --volume flag in pods using the new infra container design.
users can specify all volume options they can with regular containers

resolves #10379

Signed-off-by: cdoern <cdoern@redhat.com>
2021-09-14 08:32:07 -04:00
Jhon Honce deaf969243 Refacter API server emphasis on logging
* To aid in debugging log API request and response bodies at trace
  level. Events can be correlated using the X-Reference-Id.
* Server now echos X-Reference-Id from client if set, otherwise
  generates an unique id.
* Move logic for X-Reference-Id into middleware
* Change uses of Header.Add() to Set() when setting Content-Type
* Log API operations in Apache format using gorilla middleware
* Port server code to use BaseContext and ConnContext

Fixes #10053

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-09-10 15:07:25 -07:00
OpenShift Merge Robot 0b6c56b80d
Merge pull request #11506 from giuseppe/fix-stats-restart-container
stats: detect container restart and allow paused containers
2021-09-10 10:53:47 -04:00
Jelle van der Waa f87f27ddc8 Add /containers/stats response to API docs
Include the response schema for a succesful request in the
/containers/stats API documentation

Additionally remove http 409 from /libpod/containers/stats docs, the
documentation was copied from the deprecated stats endpoint, when a
container is unavailabe the endpoint returns an empty list and no 409.

Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
2021-09-10 15:15:35 +02:00
Giuseppe Scrivano 2b85382ca1
api: correctly set the container stats
override the outer scope variable instead of creating a local one.
Otherwise the wrong variable would be used for the next iterations.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2021-09-10 09:03:09 +02:00
OpenShift Merge Robot 536f23c0b7
Merge pull request #11431 from jmguzik/secrets-ls-filters
Add filtering functionality to http api secrets list
2021-09-07 19:24:20 +02:00
OpenShift Merge Robot 88976fcede
Merge pull request #11466 from jelly/doc_api_restart
[CI:DOCS] Document default timeout for libpod API Container Restart
2021-09-07 17:03:45 +02:00
Jelle van der Waa 1150d1b0b8 Document default timeout for libpod API Container Restart
Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
2021-09-07 14:46:00 +02:00
Valentin Rothberg d1573b95e3 generate systemd: handle --restart
Handle custom restart policies of containers when generating the unit
files; those should be set on the unit level and removed from ExecStart
flags.

Fixes: #11438
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-09-07 13:58:11 +02:00
Jakub Guzik d346e6e734 Add filtering functionality to http api secrets list
Filtering is missing in both compat API and libpod API, while docker
has filtering functinality. This commit enables filtering option using
name and id in both libpod and http API.

Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
2021-09-03 10:29:31 +02:00
cdoern d28e85741f InfraContainer Rework
InfraContainer should go through the same creation process as regular containers. This change was from the cmd level
down, involving new container CLI opts and specgen creating functions. What now happens is that both container and pod
cli options are populated in cmd and used to create a podSpecgen and a containerSpecgen. The process then goes as follows

FillOutSpecGen (infra) -> MapSpec (podOpts -> infraOpts) -> PodCreate -> MakePod -> createPodOptions -> NewPod -> CompleteSpec (infra) -> MakeContainer -> NewContainer -> newContainer -> AddInfra (to pod state)

Signed-off-by: cdoern <cdoern@redhat.com>
2021-08-26 16:05:16 -04:00
OpenShift Merge Robot 94c37d7d47
Merge pull request #11298 from baude/kubeupdown
teardown play kube
2021-08-26 13:58:44 -04:00
OpenShift Merge Robot 54e0afffe7
Merge pull request #11218 from cdoern/untilBug
logFile until flag issue, negative duration replaced with positive
2021-08-26 10:12:09 -04:00
Brent Baude 1e176923b1 teardown play kube
add the ability for play kube to tear down based on the yaml used to
play it.  it is indicated by --down in the play kube command.  volumes
are NOT deleted during the teardown.  pods and their containers are
stopped and removed.

Signed-off-by: Brent Baude <bbaude@redhat.com>
2021-08-24 14:26:14 -05:00
Nalin Dahyabhai 21f396de6f logs: adjust handling around partial log messages
In libpod/logs.LogLine.Write(), don't write a newline to stdout/stderr
when the log message is only part of a line.

In libpod.ConmonOCIRuntime.HTTPAttach(), don't send a newline over the
HTTP connection when the log message is only part of a line.

In pkg/api/handlers/compat.LogsFromContainer(), don't send a newline
over the HTTP connection when the log message is only part of a line,
and don't make doing so conditional on whether or not the client used
the docker or podman endpoint.

In pkg/domain/infra/tunnel.ContainerEngine.ContainerLogs(), don't add
our own newline to log messages, since they already come through from
the server when they need to.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2021-08-23 18:00:18 -04:00
cdoern d06d285e66 logFile until flag issue
we were adding a negative duration in podman events, causing inputs like
-5s to be correct and 5s to be incorrect.

fixes #11158

Signed-off-by: cdoern <cdoern@redhat.com>
2021-08-23 12:51:56 -04:00
OpenShift Merge Robot 2d43e685c3
Merge pull request #11286 from jwhonce/issues/11227
Update /version endpoint to add components
2021-08-20 10:55:00 -04:00
OpenShift Merge Robot 30b036c5d3
Merge pull request #11280 from Luap99/info-plugins
Podman info output plugin information
2021-08-19 17:28:22 -04:00
Jhon Honce fd32c73e3a Update /version endpoint to add components
* Include OCI and conmon information as components

Fixes #11227

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-08-19 14:19:45 -07:00
OpenShift Merge Robot a3f4fbd176
Merge pull request #11271 from jwhonce/issues/8577
Clean up swagger
2021-08-19 14:49:22 -04:00
Paul Holzinger 16dfce486b
Podman info output plugin information
For docker compat include information about available volume, log and
network drivers which should be listed under the plugins key.

Fixes #11265

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-08-19 17:33:20 +02:00
Jhon Honce 0897946f60 [NO TESTS NEEDED] Clean up swagger
* Removed defined by unused responses
* Added missing body definitions
* Updated header input definitions

Outstanding issues:
* Supporting body ContainerConfig for /commit endpoint

Fixes #8577

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-08-19 07:57:54 -07:00
openshift-ci[bot] 8c228bdbd0
Merge pull request #11154 from cdoern/imagesPull
Libpod images pull changes
2021-08-16 15:46:33 +00:00
openshift-ci[bot] de043a5a02
Merge pull request #11203 from rhatdan/codespell
Run codespell to fix spelling
2021-08-12 07:22:48 +00:00
Jhon Honce 5a32946d61 For compatibility, ignore Content-Type
Endpoint /build logs an info entry when a client uses the wrong
Content-Type for build payload. Given Content-Type is ignored and
assumed to be "application/x-tar".

Endpoint /libpod/build will fail unless "application/x-tar" or
"application/tar" is given for Content-Type. "application/tar" will
be logged as an info entry.

Fixes #11012

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-08-11 13:50:51 -07:00
Daniel J Walsh 404488a087
Run codespell to fix spelling
[NO TESTS NEEDED] Just fixing spelling.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-08-11 16:41:45 -04:00
openshift-ci[bot] 1968fdc874
Merge pull request #11173 from jmguzik/pod-ps-until-filter
Add until filter to podman pod ps
2021-08-11 08:38:20 +00:00
Jakub Guzik ed30ae4a8a Add until filter to podman pod ps
This commit adds additional until filter to podman pod ps (ls/list).
Additionally, it also adds descriptions for podman pod ps filters available
via http api.

Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
2021-08-10 22:10:40 +02:00
Daniel J Walsh 221b1add74 Add support for pod inside of user namespace.
Add the --userns flag to podman pod create and keep
track of the userns setting that pod was created with
so that all containers created within the pod will inherit
that userns setting.

Specifically we need to be able to launch a pod with
--userns=keep-id

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
2021-08-09 15:17:22 -04:00
cdoern 12ac4198ca Libpod images pull changes
Added quiet param to docs to limit stream output. Formatted JSON.

fixes #10612

Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
Signed-off-by: cdoern <cdoern@redhat.com>
2021-08-09 14:17:08 -04:00
TomSweeneyRedHat ddc360fe17
Bump Buildah to v1.22.0 [NO TESTS NEEDED]
Bump Buildah to v1.22.0 in preparation for RHEL 8.5 and
RHEL 9.0beta.  Also bump c/common to v0.42.1
[NO TESTS NEEDED]

Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-08-04 12:52:34 -04:00
openshift-ci[bot] 3a922cbc99
Merge pull request #11003 from pascomnet/f_stats
stats: add a interval parameter to cli and api stats streaming
2021-08-04 09:56:57 +00:00
openshift-ci[bot] 1bc8c94409
Merge pull request #11104 from jwhonce/bz/1988252
Only support containers stats using cgroups v2
2021-08-04 09:53:58 +00:00
Jhon Honce 9cc974c963 Only support containers stats using cgroups v2
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1988252

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2021-08-03 15:31:59 -07:00
Milivoje Legenovic a210a22920 Compat API: Fix healthcheck status and healthcheck config
Fixes:

- Do not show healthcheck status if not available or if container
  status is "created" (Docker behaviour)
- Show healthcheck configuration if present (Config.Healthcheck)

Tests:

- Ensure State.Health is not present if container status is "created"
- Ensure Config.Healthcheck is present and values correct
- Ensure State.Health is present if container started

Signed-off-by: Milivoje Legenovic <m.legenovic@gmail.com>
2021-08-03 15:38:04 +02:00
openshift-ci[bot] 1f43e82d38
Merge pull request #11072 from matejvasek/header-timeout
Remove ReadHeaderTimeout
2021-08-02 12:25:19 +00:00
Matej Vasek 872c442e67 Remove ReadHeaderTimeout
Effectively sets timeout to infinity.
This is needed in order to make `podman` work with `pack`.
The `pack` CLI is keeping one connection for prolonged time.
Closing the connection breaks `pack`'s functionality.

[NO TESTS NEEDED]

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-07-29 14:07:47 +02:00
Valentin Rothberg 4df6e31ccb remote build: fix streaming and error handling
Address a number of issues in the streaming logic in remote build, most
importantly an error in using buffered channels on the server side.

The pattern below does not guarantee that the channel is entirely read
before the context fires.

for {
	select {
		case <- bufferedChannel:
		...
		case <- ctx.Done():
		...
	}
}

Fixes: #10154
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-07-28 14:46:15 +02:00
Mehul Arora 6fe03b25ab support container to container copy
Implement container to container copy.  Previously data could only be
copied from/to the host.

Fixes: #7370
Co-authored-by: Mehul Arora <aroram18@mcmaster.ca>
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-07-27 15:32:23 +02:00
Thomas Weber cdbbd79155 stats: add a interval parameter to cli and api stream mode
podman stats polled by default in a 1 sec period.
This can put quite some load on a machine if you run many containers.

The default value is now 5 seconds.
You can change this interval with a new, optional, --interval, -i cli flag.
The api request got also a interval query parameter for the same purpose.

Additionally a unused const was removed.
Api and cli will fail the request if a 0 or negative value is passed in.

Signed-off-by: Thomas Weber <towe75@googlemail.com>
2021-07-27 07:20:47 +02:00
Valentin Rothberg 1b6423e9f1 refine dangling checks
By proxy by vendoring containers/common. Previously, a "dangling" image
was an untagged image; just a described in the Docker docs. The
definition of dangling has now been refined to an untagged image without
children to be compatible with Docker.

Further update a redundant image-prune test.

Fixes: #10998
Fixes: #10832
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-07-26 09:28:17 +02:00
OpenShift Merge Robot 365775489f
Merge pull request #11015 from jmguzik/until-list-volume
Add until filter to volume ls filters list
2021-07-22 14:11:24 -04:00
Jakub Guzik 2d8e837a9b Add until filter to volume ls filters list
As a conclusion of a discussion in #10861, until filter is added
by this commit to volume ls filters.

Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
2021-07-22 00:01:07 +02:00
David Ward ac588c751b [CI:DOCS] Fix GitHub URL to Podman logo
The Podman logo is not rendered on docs.podman.io with the current URL.

Signed-off-by: David Ward <david.ward@ll.mit.edu>
2021-07-21 11:22:01 -04:00
Daniel J Walsh db2f474284
Drop podman create --storage-opt container flag
The global flag will work in either location, and this flag just breaks
users expectations, and is basically a noop.

Also fix global storage-opt so that podman-remote can use it.

[NO TESTS NEEDED] Since it would be difficult to test in ci/cd.

Fixes: https://github.com/containers/podman/issues/10264

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-07-20 16:36:10 -04:00
Valentin Rothberg eaaca49992 compat: image create: handle platform correctly
Handle the platform parameter correctly.  The parameter was only parsed
in presence of credentials and the code was a bit complex.  Also add a
regression test.

Fixes: #10977
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-07-20 09:00:44 +02:00
OpenShift Merge Robot 68585b0168
Merge pull request #10848 from vrothberg/update-libimage
vendor containers/common@main
2021-07-16 11:12:44 -04:00
Valentin Rothberg e1ac0c3033 vendor containers/common@main
The `IgnorePlatform` options has been removed from the
`LookupImageOptions` in libimage to properly support multi-arch images.

Skip one buildah-bud test which requires updated CI images.  This is
currently being done in github.com/containers/podman/pull/10829 but
we need to unblock merging common and buildah into podman.

[NO TESTS NEEDED]

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-07-16 14:19:56 +02:00
José Guilherme Vanz af40dfc2bf
--infra-name command line argument
Adds the new --infra-name command line argument allowing users to define
the name of the infra container

Issue #10794

Signed-off-by: José Guilherme Vanz <jvanz@jvanz.com>
2021-07-15 21:27:51 -03:00
Vikas Goel 48e6a8eed0 Return macvlan object in /network REST API response
Fixes: #10266

Signed-off-by: Vikas Goel <vikas.goel@gmail.com>
2021-07-14 12:24:03 -07:00
OpenShift Merge Robot bef1f03d3c
Merge pull request #10868 from cdoern/untilLog
Implemented Until Query Parameter for Containers/logs
2021-07-10 06:31:49 -04:00
cdoern 4624142c2d Implemented Until Query Parameter for Containers/logs
compat containers/logs was missing actual usage of until query param.

fixes #10859

Signed-off-by: cdoern <cdoern@redhat.com>
2021-07-09 12:21:46 -04:00
Brent Baude daebdf3859 Add container config to compat image inspect
With docker-compose, there is a use case where you can `docker-compose
up -d`, then change a file like docker-compose.yml and run up again.
This requires a ContainerConfig with at least Volumes be populated in
the inspect data.  This PR adds just that.

Fixes: #10795

Signed-off-by: Brent Baude <bbaude@redhat.com>
2021-07-09 10:10:04 -05:00
OpenShift Merge Robot 895b815188
Merge pull request #10836 from Luap99/diff
podman diff accept two images or containers
2021-07-03 06:17:03 -04:00
Paul Holzinger 8f6a0243f4
podman diff accept two images or containers
First, make podman diff accept optionally a second argument. This allows
the user to specify a second image/container to compare the first with.
If it is not set the parent layer will be used as before.

Second, podman container diff should only use containers and podman
image diff should only use images. Previously, podman container diff
would use the image when both an image and container with this name
exists.

To make this work two new parameters have been added to the api. If they
are not used the previous behaviour is used. The same applies to the
bindings.

Fixes #10649

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2021-07-02 17:11:56 +02:00
Matej Vasek 86c6014145 Implement --archive flag for podman cp
Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-07-01 12:01:46 +02:00