Clarify that the compose_providers and compose_warning_logs settings belong in the [engine] table of containers.conf.
Fixes: #29122
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
With the remote client on linux we should not check for cgroups and hard
fail if it is not v2. Only the server side matters not the client.
The problem can be reproduced with:
unshare -rm sh -c "mount -t tmpfs none /sys/fs/cgroup && ./bin/podman --remote ps"
I did not add a regression test as it does not seem to fit well into a
test suite, over mounting cgroups seems like not a good idea.
Fixes: #29241
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Logf now always writes to stderr, so the kmsg write is best-effort and
its bool return is intentionally ignored. Make the discard explicit with
`_ = logToKmsg(line)` per review, rather than leaving it implicit.
Signed-off-by: mvanhorn <mvanhorn@gmail.com>
There is a race condition in the signal handling which manifests itself
as flake in our CI.
In short the old code was running the signal handler in a goroutine but
never waited for it to be finished the main routine just waits for the
container exit so it was possible the process exits in PlayKubeDown()
between the PodStop and PodRm calls. So the container/pod was leaked and
thus the test fails.
This can be easily reproduced by adding a sleep there.
To fix this properly we use a wait group to ensure the goroutine is
finished before we exit. Then there is also no need for the extra bool
and teardown on the non signal path. We can just close the channel there
and cleanup via the signal goroutine which will always fire when the
channel is closed.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
formatError appended "or use --replace to instruct Podman to do so" to
every error wrapping storage.ErrDuplicateName, even for commands like
"podman manifest create" that have no --replace flag, telling users to
use a flag that does not exist.
Resolve the invoked command via ExecuteContextC and only add the hint
when that command actually defines a --replace flag.
Fixes: #24537
Signed-off-by: Salih Muhammed <root@lr0.org>
We renamed the variant in machine-os to podman-machine-os so it is not
coreos:
a5c8fbcfc6
Now the main issue with this is the code runs inside the VM, which means
updates from 6.0.0 to the next one still will be broken and needs the os
apply command until this can work again. Of course a new init will also
work with the new image.
Fixes: #29085
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
If the scanner fails to read the file we should return an error to the
user and not make assumptions on the returned value here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Logf wrote to /dev/kmsg and only fell back to stderr when the kmsg
write failed or -dryrun was set. As root the kmsg write succeeds, so
nothing reached stderr and `sudo systemd-analyze --generators verify`
(which captures stderr, not kmsg) showed no diagnostics, while the same
command without sudo did.
Write to /dev/kmsg best-effort for early-boot/journal capture AND always
copy the same line to stderr so verify and interactive sudo runs surface
the messages. Rootless behavior is unchanged.
Fixes: #28888
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
"bind" is a deprecated alias for "anonymous" (documented in the preceding
commit). Emit a warning from CreateInit so that "podman create" and "podman
run" nudge users who pass --image-volume=bind toward --image-volume=anonymous.
The warning only fires when the value is explicitly set to "bind"; the
resulting behavior is otherwise unchanged.
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
The docs, the create/run --help text and the shell completion all show
"bind" as the main/default value for --image-volume. That's wrong: the
accepted values are ignore | tmpfs | anonymous
(pkg/specgen/container_validate.go), the default is anonymous
(pkg/specgen/specgen.go), and "bind" is only a deprecated alias the code
maps to anonymous (pkg/specgenutil/specgen.go,
pkg/specgen/generate/kube/kube.go).
Show "anonymous" everywhere (options man page, the Quadlet ImageVolume=
key, --help, completion) and note that "bind" still works as a deprecated
alias. Behavior is unchanged.
Fixes: #27674
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
This was report on of of my PRs, I do not know why this fails there all
of the sudden, it seems golangci-lint has gotten flaky recently.
Locally the linter passes without this change just fine but in CI this
seems to fail:
Error: cmd/podman-testing/call.go:58:22: SA4023(related information): the lhs of the comparison is the 1st return value of this function call (staticcheck)
reflectionClient := reflectionv1.NewServerReflectionClient(grpcClient)
^
Error: cmd/podman-testing/call.go:59:5: SA4023: this comparison is never true (staticcheck)
if reflectionClient == nil {
^
The lint seems right, NewServerReflectionClient never returns nil so
lets just fix it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
`podman run -ti` warns when stdin is not a tty, but if the container is
run in detached state that warning does not make much sense: we just
need the environment where podman attach will be run to be a tty.
Running with `-ti` even in detached state can make sense to avoid
applications buffering their output (for realtime logs) or allowing
later interaction and should not warn users.
Also remove the comment saying that warning will become fatal, as there
seems to be agreement that such a breaking change will not be made
Signed-off-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Add support for blackhole, unreachable, and prohibit route types in podman
networks. These route types allow silently discarding packets (blackhole),
rejecting with destination unreachable (unreachable), or rejecting with
administratively prohibited (prohibit).
Note: Blackhole routes require netavark >= 2.0.0. Regular unicast routes
remain backward compatible with all netavark versions.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
<MH: Rebased atop latest main & fixed cherry-pick conflicts>
Signed-off-by: Matt Heon <matthew.heon@pm.me>
inspect was using the default system provider (machineProvider) to resolve machine directories instead of the provider returned by shim.VMExists for the specific machine. This caused incorrect results (e.g. listing WSL dirs when inspecting a Hyper-V machine).
Signed-off-by: lstocchi <lstocchi@redhat.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
- libpod/events.go & libpod/runtime.go: Added the `Artifact` event type.
Refactored and deduplicated event forwarding logic by introducing
`spawnEventForwarder[T any]`, replacing separate goroutine loops for
images and artifacts. Implemented graceful shutdown and resolved eventer
initialization race conditions.
- libpod/events: Implemented event filtering by name/ID, updated journald
and logfile readers/writers for artifact events, and added `Artifact` to
`ToHumanReadable` formatting.
- cmd/podman: Added shell auto-completion for `artifact=` and `type=artifact` filters.
- docs/test: Documented the `artifact` event type, statuses, and filters in
`podman-events.1.md`. Added an end-to-end test in `events_test.go` to verify
event emissions.
Signed-off-by: Byounguk Lee <nimdrak@gmail.com>
