The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
Add one more test to the basic podman commands e2e tests:
- starts an HTTP server on the host
- verify HTTP requests from a container, using
`host.containers.internal` or `host.docker.internal`, are routed
successfully to the server running on the host
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
test
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
The lookup for the gvproxy process was broken on Windows:
- We looked for gvproxy, not gvproxy.exe, and `tasklist` was always
failing
- But `pgrep` wasn't failing because we looked for the wrong `tasklist`
error message (the correct error message on my laptop is "INFO: No tasks
are running which match the specified criteria.")
- WSL uses win-sshproxy.exe, not gvproxy.exe
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
Remove the just provisioned WSL distribution if one of the post install
scripts fail.
Fixes#27036
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
The Docker API deprecates Container and ContainerConfig fields in
the GET /images/{name}/json response are deprecated and
they will no longer be included in API v1.45.
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The Docker API 1.44 deprecates the fields HairpinMode, LinkLocalIPv6Address,
LinkLocalIPv6PrefixLen, SecondaryIPAddresses, SecondaryIPv6Addresses available in
NetworkSettings when calling GET /containers/{id}/json and will be removed in a future release.
You should instead look for the default network in NetworkSettings.Networks.
The fields are removed in 1.52. Version gate SecondaryIPAddresses, SecondaryIPv6Addresses
in the handler and update test. HairpinMode, LinkLocalIPv6Address, LinkLocalIPv6PrefixLen
are not returned by the compat endpoint as the response is serialized
to the moby/moby/api structure missing these fields.
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The Docker API in version 1.44 deprecates the is_automated field for
the GET /images/search endpoint. The is_automated field has been deprecated
by Docker Hub's search API. Consequently, searching for is-automated=true
will yield no results.
The Docker API in version 1.44 deprecates the is_automated field
in the GET /images/search response and will always be set to false in the
future because Docker Hub is deprecating the is_automated field in its search API.
Return struct moby/api for the compat endpoint that matches the Docker
API response format and deprecates is_automated.
Update test_v2_0_0_image.py::ImageTestCase::test_search_compat
to verify returned format and fix subtests not being asserted (remove mp).
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The current systemd service to mount /etc/containers is not working
right. The Before=podman.socket causes a ordering conflict which causes
the socket to be disabled and thus all podman remote connections fail.
The problem is the unit is wanted by the default.target while the socket
is wanted by sockets.target which can be before the default.target is
triggered. That means that the Before= line cannot be fulfilled and
sometimes systemd thus seems to not start the socket. It is unclear to
me why this is racy as it is sometimes also works.
This was reported by Vladimir Lazar from the PD team, our CI did not
caught this as we use rootless machines by default and the problem only
happens for the rootful socket so we do not see connection failures.
To fix this add at least one rootful socket check.
We do however have a different CI flake that was also caused by the
incorrect mount dependencies. The mount could happen after sshd or other
programs run. So to fix this we must hook the podman-mnt-config.service
into the local-fs.target which runs much earlier and is used for all the
mounts.
Fixes: #29003
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It was removed, with the hardcoded image reference.
So cache was always off, even for the default image.
Fixes: #29090
Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
In remote mode `podman events --format json` could print the literal "null"
instead of an event object. The remote client converts each event received
from the server with ConvertToLibpodEvent, which returned nil when it could
not parse the server result (an unknown status or type, or an invalid
containerExitCode). The tunnel forwarded that nil as an event with no error
set, so the CLI marshalled a nil event and printed "null".
Return a descriptive error from ConvertToLibpodEvent and send it on the event
channel, which the CLI already handles, instead of forwarding a nil event.
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
NetworkMode.IsNS matched any value starting with "ns" (e.g. a network named "nsproxy"), unlike UsernsMode.IsNS which requires the "ns:" prefix; require it. IsUserDefined also did not exclude pod, so a pod network was reported as user-defined; exclude it.
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
When the command output is logged we do not need an extra pipe and
scanner to read the output line by line, we can just log it directly via
a writer.
Now this of course does loose the line by line parsing of the scanner
but IMO this is better as it is simpler and less code to worry about.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
The libpod manifest-create endpoint takes an "images" query parameter that
fills the new list at creation time, but 15-manifest.at never tested it.
Add cases that create a list with images= on both the v4
(/manifests/{name}, 201) and v3 (/manifests/create, 200) endpoints and
check the image ends up in the list.
Also drop the stale "required: true" from the images query parameter in the
swagger docs - the handler treats it as optional, and the existing create
tests (which omit it) already show that.
Fixes: #22258
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
When WSL wasn't installed, the lookup erroneously reported that
a VM with the same name existed. Instead, in this case, the lookup
should return zero matching VMs.
Fixes https://github.com/podman-container-tools/podman/issues/29053
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
The compat logs handler uses the tail query parameter both to select how
many log lines should be returned and as the capacity of the internal log
channel.
Only the former is part of the API semantics. The channel capacity should
not depend on a user-controlled value: negative values can produce an
invalid channel size, while very large values can cause excessive
allocation before any logs are read.
Use a small fixed-size buffer instead.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
convertNumber() strips the sign before parsing the numeric value and then
applies it back via a multiplier. The negative case uses -11 instead of
-1, causing negative values to be converted incorrectly.
This is visible for any caller using the signed result directly, and can
also produce surprising results for unsigned callers if the multiplication
overflows.
Use -1 for the negative multiplier.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
