The JSON decoder correctly cannot decode (overflow) negative values (e.g., `-1`) for fields of type `uint64`, as `-1` is used to represent `max` in `POSIXRlimit`. To handle this, we use `tmpSpecGenerator` to decode the request body. The `tmpSpecGenerator` replaces the `POSIXRlimit` type with a `tmpRlimit` type that uses the `json.Number` type for decoding values. The `tmpRlimit` is then converted into the `POSIXRlimit` type and assigned to the `SpecGenerator`.
This approach ensures compatibility with the Podman CLI and remote API, which already handle `-1` by casting it to `uint64` (`uint64(-1)` equals `MaxUint64`) to signify `max`.
Fixes: https://issues.redhat.com/browse/RUN-2859
Fixes: https://github.com/containers/podman/issues/24886
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
The Docker `-XDELETE image/$name?force=true` endpoint only removes
containers using an image if they are in a non running state.
In Podman, when forcefully removing images we also forcefully delete
containers using the image including running containers.
This patch changes the Docker image force delete compat API to act like the
Docker API while maintaining commands like `podman rmi -f $imagename`
It also corrects the API return code returned when an image is requested
to be deleted with running containers using it.
Fixes: https://github.com/containers/podman/issues/25871
Signed-off-by: Lewis Roy <lewis@redhat.com>
This looks like debug leftover, in any case this is not an error so
simply remove the line.
Fixes#25965
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The backstory for this is that runc 1.2 (opencontainers/runc#3967)
fixed a long-standing bug in our mount flag handling (a bug that crun
still has). Before runc 1.2, when dealing with locked mount flags that
user namespaced containers cannot clear, trying to explicitly clearing
locked flags (like rw clearing MS_RDONLY) would silently ignore the rw
flag in most cases and would result in a read-only mount. This is
obviously not what the user expects.
What runc 1.2 did is that it made it so that passing clearing flags
like rw would always result in an attempt to clear the flag (which was
not the case before), and would (in all cases) explicitly return an
error if we try to clear locking flags. (This also let us finally fix a
bunch of other long-standing issues with locked mount flags causing
seemingly spurious errors).
The problem is that podman sets rw on all mounts by default (even if
the user doesn't specify anything). This is actually a no-op in
runc 1.1 and crun because of a bug in how clearing flags were handled
(rw is the absence of MS_RDONLY but until runc 1.2 we didn't correctly
track clearing flags like that, meaning that rw would literally be
handled as if it were not set at all by users) but in runc 1.2 leads to
unfortunate breakages and a subtle change in behaviour (before, a ro
mount being bind-mounted into a container would also be ro -- though
due to the above bug even setting rw explicitly would result in ro in
most cases -- but with runc 1.2 the mount will always be rw even if
the user didn't explicitly request it which most users would find
surprising). By the way, this "always set rw" behaviour is a departure
from Docker and it is not necesssary.
Signed-off-by: rcmadhankumar <madhankumar.chellamuthu@suse.com>
To have consistency with other podman commands like `ps` and `images`,
`volume ls` should output its headers even when there are no volumes.
Fixes: https://github.com/containers/podman/issues/25911
Signed-off-by: Brent Baude <bbaude@redhat.com>
The README.md in test/buildah-bud had the old directory name for the
apply-podman-deltas file. This change removes the `/` and adds a `-`
in that file name.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
in #25884, it was pointed out that the standard detection used to
determine the artifact's file type can be wrong. in those cases, it
would be handy for the user to be able to override the media type of the
layer. as such, added a new option called `--file-type`, which is
optional, and allows users to do just that.
`podman artifact add --file-type text/yaml
quay.io/artifact/config:latest ./config.yaml `
Fixes: #25884
Signed-off-by: Brent Baude <bbaude@redhat.com>
This commit removes the code to build a local pause
image from the Containerfile. It is replaced with
code to find the catatonit binary and include it in
the Rootfs.
This removes the need to build a local pause container
image.
The same logic is also applied to createServiceContainer
which is originally also based on the pause image.
Fixes: #23292
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
When using a custom --root it will not have the image present and as
such cause a pull. We can however use our own local cache if present to
avoid the pull if we give the right podman options via
_PODMAN_TEST_OPTS.
I saw the volume quota test fail during the pull in openQA thus I
noticed this issue.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Somehow the files do not match sometimes, I like to get data on the
/etc/hosts file on the host looks to see if this would explain anything.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It is failing a lot, on the issue (#24571) there is a 100% reproducer
so we don't need to gather more data this is simply broken.
Reduce our flakes by skiping this until the main issue gets resolved.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This reverts commit d633824a95.
The issue has been fixed in commit 9a0c0b2eef and I have not seen it
since so remove this special case.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Sinc v5.0 pasta is the default and if it would not be installed a ton of
tests would already fail. As such these conditional checks are
pointless and can be removed to simplify the tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This `--config` option was initially added here:
4e4c3e3dbf
Under the hood this simply modifies env to set DOCKER_CONFIG=<passed
in string>
The DOCKER_CONFIG env var is used as a directory that contains
multiple config files... of which podman and container libs probably
only use `$DIR/config.json`.
See: https://docs.docker.com/reference/cli/docker/#environment-variables
The old CMD and help text was misleading... if we point the at a
regular file we can see errors like:
```
$ touch /tmp/foo/tmpcr9zrx71
$ /bin/podman --config /tmp/foo/tmpcr9zrx71 build -t foobar:latest
Error: creating build container: initializing source docker://quay.io/centos/centos:stream9: getting username and password: reading JSON file "/tmp/foo/tmpcr9zrx71/config.json": open /tmp/foo/tmpcr9zrx71/config.json: not a directory
```
^^ In this case we had created `/tmp/foo/tmpcr9zrx71` as a regular file.
Signed-off-by: Ian Page Hands <iphands@gmail.com>
Clarify that system test specifc configuration must be done via config
files and not via ad hoc environment variables like in test/e2e.
Also not that we only run the tests with crun so other runtimes may not
work but we accept patches to make them work with runc, e.g. Suse folks
currently run them with runc and contribute patches for them.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
create the /etc/passwd and /etc/group files before any user/group
lookup so that the entries added dynamically are found by --user.
As a side effect, do not automatically create the group with same
value as the uid when not specified, since it is expected to run with
gid=0.
Closes: https://github.com/containers/podman/issues/25805
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
A recent change[1] in netavark makes it so we no longer set the default
dns.podman search domain. As such we must no longer test for it.
[1] https://github.com/containers/netavark/pull/1214
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since commit 945aade38b we do tear down the kube units if all pods
failed to start. This however broke the use case of an empty pod as we
did not consider that being starting successfully which is wrong and
caused a regression for at least one user.
To fix this special case the empty pod and consider that running.
Fixes: #25786
Fixes: 945aade38b ("quadlet kube: correctly mark unit as failed")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Networks are stored in two ways in the DB, first a static network list
which holds all the network with its option for the container. Second,
the network status which hold the actual network result from netavark
but only when the container is running.
If the container is running they must be in sync and podman inspect has
checks to ensure that as well it errors out of there is a desync between
the two.
As the adding to the db and doing actual networking configuration are
diffeent parts it possible that one worked while the other failed which
triggers the desync. To avoid this make the network connect/disconnect
code more robust against partial failures. When the network calls fail
we update the db again to remove/add the network back.
Fixes: https://issues.redhat.com/browse/RHEL-78037
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
golangci-lint v2 introduced a new command, fmt, which runs configured
formatters (see formatters in .golangci.yml).
Use this for generated files. Drop separate goimports binary.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
If the --health-cmd flag is not specified, other flags such as --health-interval, --health-timeout, --health-retries, and --health-start-period are ignored if the image contains a Healthcheck. This makes it impossible to modify these Healthcheck configuration when a container is created.
Fixes: https://github.com/containers/podman/issues/20212
Fixes: https://issues.redhat.com/browse/RUN-2629
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
This is related to #23292 and is needed to replace
pause image container with pause container based
on the rootfs.
Without this change, the GIDs and UIDs are not mapped
in the rootfs container which use overlay if --userns=auto
is used. This leads to an error mounting /dev/pts with gid=5,
becuase GID 5 simply does not exist in the pause container
using rootfs.
All the tests pass with this change, but I have to admit
I did not find out why the original code has been introduced.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
It appears[1] that ginkgo binary can be easily built from the top-level
vendor, so it does not make sense to have a second copy in test/tools
(and a hassle of keeping the two in sync).
Inspired by [1], [2], and a run of make localtest, which shows:
> Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
> Ginkgo CLI Version:
> 2.22.1
> Mismatched package versions found:
> 2.23.3 used by podman, common, containers, parse, quadlet, rootlessport, abi, tunnel, libpod, events, file, shm, logs, annotations, libpod, utils, apiutil, auth, ctime, abi, expansion, utils, emulation, env, errorhandling, machine, compression, connection, define, ocipull, provider, proxyenv, qemu, command, shim, vmconfigs, rootless, signal, specgen, generate, kube, specgenutil, systemd, generate, notifyproxy, parser, timetype, trust, util, utils
[1]: af29bb5b6e (r2020246403)
[2]: e6c7ec94e2 (r2020230241)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This is shown when golangci-lint is run with --tests=false
> test/e2e/config.go:7:2: var fedoraMinimal is unused (unused)
> fedoraMinimal = "quay.io/libpod/systemd-image:20240124"
> ^
> test/e2e/config.go:18:2: var volumeTest is unused (unused)
> volumeTest = "quay.io/libpod/volume-plugin-test-img:20220623"
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This was added by commit 84e42877a ("make lint: re-enable revive"),
making nolintlint became almost useless.
Remove the ungodly amount of unused nolint annotations.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit adds new --cdi-spec-dir global option. This
option is used to add additional CDI spec paths.
Signed-off-by: Micah Chambers (eos) <mchambers@anduril.com>
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
Do not use the interspersed option for logs, it is not needed and just
restricts valid use cases.
Fixes#25653
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This adds support for the UpheldBy option in quadlet files. The UpheldBy option
is the counterpart to the Upholds option added in systemd v249 and is
similar to the existing WantedBy and RequiredBy options.
See https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Upholds=.
Signed-off-by: John Schug <john.ips.schug@gmail.com>
This commit adds new annotation called:
io.podman.annotations.pids-limit/$ctrname
This annotation is used to define the PIDsLimit for
a particular pod. It is also automatically defined
when newly added --pids-limit option is used.
Fixes: #24418
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
This commit adds new Retry= and RetryDelay= options
to quadlet.go which result in --retry and --retry-delay
usage in podman run, image and build commands.
This allows configuring the retry logic in the systemd
files.
Fixes: #25109
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
Trying to generate a Pod yaml file when we are using --mount with
SubPath does not generate a VolumeMount with SubPath. This patch fixes
that.
Note that kube play does support SubPath since 95cc7e052, see:
https://github.com/containers/podman/pull/16803
Signed-off-by: Victor Toso <victortoso@redhat.com>
Following test needs unique cache in TMPDIR so cache of this test does
not conflicts with other tests however for this specific test there is
no convenient way to pass custom TMPDIR.
Skipping this test similar to this already exists in tests/bud.bats but
covers `--mount=type=cache,sharing=locked`
Read more discussion here: https://github.com/containers/podman/issues/25414
Closes: https://github.com/containers/podman/issues/25414
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
The --env is used to add new environment variable to container or
override the existing one. The --unsetenv is used to remove
the environment variable.
It is done by sharing "env" and "unsetenv" flags between both
"update" and "create" commands and later handling these flags
in the "update" command handler.
The list of environment variables to add/remove is stored
in newly added variables in the ContainerUpdateOptions.
The Container.Update API call is refactored to take
the ContainerUpdateOptions as an input to limit the number of its
arguments.
The Env and UnsetEnv lists are later handled using the envLib
package and the Container is updated.
The remote API is also extended to handle Env and EnvUnset.
Fixes: #24875
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
when the code was first added, there was no securejoin.OpenInRoot().
Since there is a function already provided by a dependency and already
used in libpod, replace the custom code with securejoin.OpenInRoot().
The new version does not report a symlink that points outside the
root, but it is still resolved relative to the specified mountpoint,
since that is the openat2 semantic. It does not affect the security
of the function.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Includes one minor test fix as the line number reported as error was
changed, it seems to be actually correct now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Giuseppe is working on some proper fixes, for now in order to get this
moved along skip it so we can merge the disk usage fix.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Have one function without a `defer lock.unlock()` as one of the
commands in it calls a function that also takes the same lock,
so the unlock has to happen prior to function completion.
Unfortunately, this is prone to errors, like the one here: I
missed a case, and we could return without unlocking, causing a
deadlock later in the cleanup code as we tried to take the same
lock again.
Refactor the command to use `defer unlock()` to simplify and
avoid any further errors of this type.
Introduced by e66b788a51 - this
should be included in any backports of that commit.
Fixes#25585
Signed-off-by: Matt Heon <mheon@redhat.com>
This is simpler as we don't have to rely on an external command. The
retry loop is need as we check for a container porcess connection, and
while we know podman binds the port before returning there is no way to
know whenthe contianer application bound the port so we must retry a
bit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
nc can be provided by either ncat (nmap) or netcat (OpenBSD), we only
work with the nmap version so make sure we always use that one and not
the short alias which can be resolved to either one.
It is not clear to me what changed on rawhide but it seemsv netcat is
preferred even though we have nmap-ncat installed.
Note this only changes the host side nc calls, the Alpine based images
only have nc as command so we must continue to use it inside.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
GoLang sets unset values to the default value of the type. This means that the destination of the log is an empty string and the count and size are set to 0. However, this means that size and count are unbounded, and this is not the default behavior.
Fixes: https://github.com/containers/podman/issues/25473
Fixes: https://issues.redhat.com/browse/RHEL-83262
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Add a new option to allow for mounting artifacts in the container, the
syntax is added to the existing --mount option:
type=artifact,src=$artifactName,dest=/path[,digest=x][,title=x]
This works very similar to image mounts. The name is passed down into
the container config and then on each start we lookup the artifact and
the figure out which blobs to mount. There is no protaction against a
user removing the artifact while still being used in a container. When
the container is running the bind mounted files will stay there (as the
kernel keeps the mounts active even if the bind source was deleted).
On the next start it will fail to start as if it does not find the
artifact. The good thing is that this technically allows someone to
update the artifact with the new file by creating a new artifact with
the same name.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
There is no need whatsoever to run container to populate a random file,
this is just much slower than just writing some random bytes directly
without having to run a container and run dd in it.
Also the function accepted the number of bytes, however because dd uses
a minimum block size of 512 bytes it was actually numBytes * 1024 which
where written. That makes no sense so fix the two tests that depended on
the wrong number.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When no containers could be started we need to make sure the unit status
reflects this. This means we should not send the READ=1 message and not
keep the service container running when we were unable to start any
container.
There is the question what should happen when only a subset was started.
For systemd we can only be either running or failed. And as podman kube
play also just keeps the partial started pods running I opted to let
systemd keep considering this as success.
Fixes#20667
Fixes https://issues.redhat.com/browse/RHEL-80471
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When starting a container consider healthcheck errors fatal. That way
user know when systemd-run failed to setup the timer to run the
healthcheck and we don't get into a state where the container is running
but not the healthcheck.
This also fixes the broken error reporting from the systemd-run exec, if
the binary could not be run the output was just empty leaving the users
with no idea what failed.
Fixes#25034
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit adds the "secret" Event type and emits
"create" and "remove" events for this Event type
when Secret is created or removed.
This can be used for example by podman interfaces to
view and manage secrets.
Fixes: #24030
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
This resolves an ordering issue that prevented quotas from being
applied. XFS quotas are applied recursively, but only for
subdirectories created after the quota is applied; if we create
`_data` before the quota, and then use `_data` for all data in
the volume, the quota will never be used by the volume.
Also, add a test that volume quotas are working as designed using
an XFS formatted loop device in the system tests. This should
prevent any further regressions on basic quota functionality,
such as quotas being shared between volumes.
Fixes#25368
Signed-off-by: Matt Heon <mheon@redhat.com>
Add the ability to remove all artifacts with a --all|-a option in podman
artifact rm.
Fixes: https://issues.redhat.com/browse/RUN-2512
Signed-off-by: Brent Baude <bbaude@redhat.com>
In a different PR review, it was noted that defined error types for
artifacts was lacking. We have these for most other commands and they
help with error differentiation. The changes here are to define the
errors, implement them in the library, and adopt test verifications to
match.
Signed-off-by: Brent Baude <bbaude@redhat.com>
fixed a bug in the artifact code where --retry-delay was being
discarded.
Fixes: https://issues.redhat.com/browse/RUN-2511
Signed-off-by: Brent Baude <bbaude@redhat.com>
Buildah bats tests have been made (mostly) parallel-safe
in the past few months. One test is flaking, but it's
not a test that needs to be run under podman: that
functionality is almost entirely buildah-manifest-push
so it uses the buildah binary, and doesn't exercise
anything under podman.
Therefore:
1) run bud tests with -j$(nproc) on fastvm (was: standardvm)
2) desperate scramble to parallelize podman system service.
May not be quite 100% perfect, but I think this is in good
enough shape for someone to adopt and push through.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Ygal Blum
openshift-merge-bot[bot]
Jan Rodák
renovate[bot]
Lewis Roy
Cesar Goncalves
flouthoc
Robin Heinemeier
Paul Holzinger
rcmadhankumar
Brent Baude
tomsweeneyredhat
Inshal Khan
Ricardo Branco
Jan Kaluza
Ian Page Hands
Giuseppe Scrivano
Kir Kolyshkin
xixishidibei
David Negstad
Micah Chambers (eos)
John Schug
axel7083
Victor Toso
Martin Glatzle
Matt Heon
Oleksandr Krutko
Jakub Panek
Ben Boeckel
Ed Santiago