Commit Graph

25483 Commits

Author SHA1 Message Date
Paul Holzinger cf87278e66
vendor: update docker to v28.3.0
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-27 15:46:38 +02:00
openshift-merge-bot[bot] 1a3b35673d
Merge pull request #26461 from Luap99/deadcode
remove deadcode
2025-06-26 19:36:02 +00:00
openshift-merge-bot[bot] 3000b1e239
Merge pull request #26512 from Luap99/machine-tls-cert
pkg/machine/e2e: add CVE-2025-6032 regression test
2025-06-26 17:40:10 +00:00
Paul Holzinger 570fbf0078
pkg/domain/infra/tunnel: ignore error from removeContainer()
All callers ignore the error anyways so no reason to return it as the
function itself already logs it.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:17 +02:00
Paul Holzinger 247c1dfb53
libpod: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:16 +02:00
Paul Holzinger 09caf60687
remove test/framework/framework.go
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:16 +02:00
Paul Holzinger d2291d7f1a
pkg/util: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:16 +02:00
Paul Holzinger 552e38ec6d
remove pkg/util/camelcase
It is not used here.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:16 +02:00
Paul Holzinger 6893ecc469
pkg/rootless: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:16 +02:00
Paul Holzinger 880808dfb9
pkg/parallel: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:15 +02:00
Paul Holzinger 6bfd28bc6f
pkg/namespaces: remove deadcode
These types are not used.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:15 +02:00
Paul Holzinger f3c82a917c
pkg/machine: remove deadcode
Yes this is a lot.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:15 +02:00
Paul Holzinger d919a3666b
pkg/libartifact: remove deadcode
Can always added back if it is really needed at some point.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:15 +02:00
Paul Holzinger 6da360a223
pkg/fileserver: remove deadcode
We don't need a stub implementation as this code should never end up
being imported on non windows platforms.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:15 +02:00
Paul Holzinger fb5cbb9b1f
pkg/farm: remove deadcode
Note sure what these are supposed to be used for but they are unused.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:14 +02:00
Paul Holzinger 1a0917de35
pkg/errorhandling: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:14 +02:00
Paul Holzinger 4d5e0a647c
podman images --sort use ChoiceValue flag
Make use of our custom ChoiceValue flag type instead of using yet
another type. With that we can remove the StringSet type.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:14 +02:00
Paul Holzinger a92e685c0b
pkg/domain: remove deadcode
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:14 +02:00
Paul Holzinger fc21bcd7d1
pkg/bindings: remove deadcode
Only one function, there are more public bindings that call a legit
server endpoint but are unused by podman-remote. As external users might
need/want them they should stay.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:13 +02:00
Paul Holzinger 9d328d8782
pkg/api: remove deadcode
One might think Close() should be called but we are already using
Shutdown() which is the graceful way to stop the server so we don't
actually need Close().

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:13 +02:00
Paul Holzinger 75bad52af5
remove unused ShouldRestart() code
Deadcode should that the ShouldRestart() API endpoint was never wired
into the router so the endpoint did not existed and the bindings called
a non existing endpoint which returnd 404 which the binding code
assumed means no restart.

As such remove all this code as it didn't do anything useful. And IMO
exposing a shouldrestart API always feeled wrong to me. The client
should not have to deal with this.

This commit does not change the behavior but it also does not make an
attempt to fix the broken restart handling with the rmeote client. Given
we do not seem to have any user reports about this it seems it is not
used.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:13 +02:00
Paul Holzinger 1d3089ea82
cmd/podman: remove deadcode
These functions are not used.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:13 +02:00
Paul Holzinger 054036f073
podman images --sort autocomplete options
The functionwas added but never wired into the cli option so there never
where shell completions for this.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-26 19:37:12 +02:00
openshift-merge-bot[bot] 494287518b
Merge pull request #26467 from ygalblum/secret-create-ignore
Secret create - add ignore option to allow noop
2025-06-26 15:25:52 +00:00
openshift-merge-bot[bot] 8761b67ca5
Merge pull request #26513 from Luap99/dns-flake
test/e2e: fix podman run check dns flake
2025-06-26 13:09:05 +00:00
openshift-merge-bot[bot] 683e9b2c94
Merge pull request #26434 from mheon/import_export
Add remote support for `podman volume import` and `podman volume export`
2025-06-25 19:48:14 +00:00
Paul Holzinger e00dfa606a
pkg/machine/e2e: add CVE-2025-6032 regression test
Setup a local web server both for HTTP and HTTPS and make sure the
client rejects the connection and does not try to pull the image.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-25 19:27:45 +02:00
openshift-merge-bot[bot] ac5b9b03ff
Merge pull request #26511 from slp/krunkit-0.2.2
Bump bundled krunkit from 0.2.1 to 0.2.2
2025-06-25 15:28:24 +00:00
Paul Holzinger b5783ae1fb
test/e2e: fix podman run check dns flake
For unknown reasons systemd-resolved sometimes responds with NXDOMAIN
instead REFUSED which it seems to use by default for a local name
without domain part. So the fact that this works at all right now is
super weird.

In any case we just want to make sure the name did not get resolved so
allow both here to fix the flake.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-25 16:58:10 +02:00
Sergio Lopez b099a93580
Bump bundled krunkit from 0.2.1 to 0.2.2
Bump bundled krunkit to 0.2.2. This bundle also includes libkrun
1.14.0, allowing us to enable nested virt on M3 and M4 systems by
default.

Signed-off-by: Sergio Lopez <slp@redhat.com>
2025-06-25 13:09:29 +02:00
openshift-merge-bot[bot] 7780e28b45
Merge pull request #26491 from ArthurWuTW/25389
Pod YAML: Add support for `lifecycle.stopSignal`
2025-06-24 19:44:30 +00:00
Ygal Blum bfc327a08e Secret create - add ignore option to allow noop
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2025-06-24 15:43:38 -04:00
openshift-merge-bot[bot] 1f1618fcb0
Merge pull request #26478 from ygalblum/pull-with-policy
Podman pull - add policy flag
2025-06-24 18:54:26 +00:00
openshift-merge-bot[bot] 844ed8296d
Merge pull request #26485 from gumimin/update-latest
cmd/podman: add --latest option to update #26380
2025-06-24 18:15:40 +00:00
openshift-merge-bot[bot] eece0a1204
Merge pull request #26500 from giuseppe/docs-fix-chown-documentation
docs: document when a volume is chowned
2025-06-24 14:07:22 +00:00
Paul Holzinger 230bb355d4
Merge commit from fork
machine init: fix tls check
2025-06-24 15:49:06 +02:00
Hayato Kihara f21dacc4fb cmd/podman: add --latest option to update #26380
Allow users to target the most recently created container with
`podman update --latest` (short `-l`). The same option already exists
on many other commands, so this brings update in line with the rest of
the CLI and saves users from typing or looking up the newest container.

Fixes: #26380

Signed-off-by: Hayato Kihara <kai.21banana@gmail.com>
2025-06-24 22:06:26 +09:00
Giuseppe Scrivano f266034d56
docs: document when a volume is chowned
add documentation to clarify when a volume is chowned.

Closes: https://github.com/containers/podman/issues/26474

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2025-06-24 12:10:06 +02:00
openshift-merge-bot[bot] 5cbd47b45c
Merge pull request #26341 from timcoding1988/update_image_sfx
1. update image_fix 2. skip checkpoint_tests duo to rawhide issue
2025-06-23 19:27:08 +00:00
openshift-merge-bot[bot] 719ea83555
Merge pull request #26454 from TomSweeneyRedHat/dev/tsweeney/tweaked_Governance
[CI:DOCS] Tweak Governance slightly
2025-06-23 18:59:27 +00:00
Matt Heon 98876454cb Refactor `volume import` to support the remote client
As with `volume export`, this was coded up exclusively in cmd/
instead of in libpod. Move it into Libpod, add a REST endpoint,
add bindings, and now everything talks using the ContainerEngine
wiring.

Also similar to `volume export` this also makes things work much
better with volumes that require mounting - we can now guarantee
they're actually mounted, instead of just hoping.

Includes some refactoring of `volume export` as well, to simplify
its implementation and ensure both Import and Export work with
readers/writers, as opposed to just files.

Fixes #26409

Signed-off-by: Matt Heon <mheon@redhat.com>
2025-06-23 13:42:22 -04:00
Tim Zhou 67fa077a5c update image_fix -> automation_images#407
skip test duo to rawhide know issues

Signed-off-by: Tim Zhou <tizhou@redhat.com>
2025-06-23 13:24:58 -04:00
Ygal Blum 5ab4328318 Podman pull - add policy flag
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2025-06-23 11:28:39 -04:00
openshift-merge-bot[bot] 72e8c82c37
Merge pull request #26490 from Luap99/pasta-testfix
test/e2e: fix "with unsafe hostPath subpaths" test
2025-06-23 15:06:37 +00:00
openshift-merge-bot[bot] b433eb5e6d
Merge pull request #26471 from Luap99/refresh-panic
fix panic on state refresh
2025-06-23 15:03:43 +00:00
openshift-merge-bot[bot] 14a99b3d65
Merge pull request #26476 from sushmitha37/add-machine-start-examples
update podman-machine-start with examples for --no-info and --quiet
2025-06-23 13:14:19 +00:00
Arthur Wu 17601aa913 Pod YAML: Add support for `lifecycle.stopSignal`
The field allows users to specify a custom stop signal (e.g., SIGUSR1) per container.
If defined, it overrides the default stop signal (SIGTERM) or that defined in the image metadata.

Fixes: #25389

Signed-off-by: Arthur Wu <lion811004@gmail.com>
2025-06-23 08:23:31 -04:00
Paul Holzinger 726b506acc
machine init: fix tls check
Ensure we verify the TLS connection when pulling the OCI image.

Fixes: CVE-2025-6032

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-23 14:12:55 +02:00
sushmitha37 ca1c4388b3
update podman-machine-start with examples for --no-info and --quiet
Fixes: #26375

Signed-off-by: sushmitha37 <sushu52581@gmail.com>
2025-06-23 16:10:26 +05:30
Paul Holzinger 01fb3aaae4
test/e2e: fix "with unsafe hostPath subpaths" test
A recent pasta update changed the selinux rules and we now run pasta
under pasta_t and no longer the container_runtime_t type. The pasta type
has much stricter type rules on what the file we hand it must be
labelled. This test tries to mount the runroot which gets relabeled with
the container_file_t type but that means pasta can no longer access its
pid file we give it. To fix this test here simply mount a subdir.

see #26473

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-06-23 11:54:02 +02:00