When run with `podman-remote`, the `--events-backend` option is
unavailable. However, the `podman logs restarted journald` test blindly
sets `events_backend` without checking if the remote client is being
used. This causes the test to fail. Fix this by skipping the test when
the remote client is being used.
Signed-off-by: Chris Evich <cevich@redhat.com>
Commit 75c7a0dd27 changed the variable name for a helper container
image, but missed one reference. This causes the test to fail at the
end. Fix this by using the correct variable name.
Signed-off-by: Chris Evich <cevich@redhat.com>
This significantly simplifies the ceromony of running a Podman command
in integration tests, from
> session := p.Podman([]string{"stop", id})
> session.WaitWithDefaultTimeout()
> Expect(session).Should(ExitCleanly())
to
> p.PodmanExitCleanly("stop", id)
There are >4650 instances of ExitCleanly() in the tests,
and many could be migrated; this does not do that.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
(cherry picked from commit 0c18beaea7)
Conflicts resolved with the assistance of AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Combined test for (exitcode == 0) && (nothing on stderr).
Returns more useful diagnostic messages than the default:
old: Expected N to equal 0
new: Command failed with exit status N
new: Unexpected warnings seen on stderr: "...."
Adding fro the ExitCleanOnly function that is present
in some tests that were cherry picked for this PR.
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 6cbd17c0f4)
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
(cherry picked from commit a9ac512603)
Signed-off-by: Chris Evich <cevich@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.
Fixes: #26938
Fixes: https://issues.redhat.com/browse/RHEL-132532,
https://issues.redhat.com/browse/RHEL-132531
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 1e4a59dc55)
Signed-off-by: Chris Evich <cevich@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.
Fixes: #26938
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 7fda4dfc00)
Signed-off-by: Chris Evich <cevich@redhat.com>
Backports be5d1261b4
* mountNotifySocket consulted c.notifySocket, which was never populated.
Use persisted c.config.SdNotifySocket instead so the path matches
conmon's --sdnotify-socket and survives container restarts.
* Add WithSdNotifySocket and have MakeContainer read NOTIFY_SOCKET from
the environment when sdnotify mode is container.
* Related to upstream be5d1261b4 (libpod: Move mountNotifySocket to
container_internal_common.go), which introduced the shared
mountNotifySocket path this wiring completes.
Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Previously, for podman-remote builds, the compat handler set
`OutputFormat` from the client only, with no default. When the client
didn’t send `outputformat`, Buildah got `""` but still produced OCI
images. Cache lookup then compared the candidate’s OCI manifest type to
`""` and rejected it. Fix this by checking if `query.OutputFormat` is
empty, then if so set `format = buildah.OCIv1ImageManifest` before
calling Buildah, so cache checks match the OCI images that are actually
built.
Also fix a bug so podman-remote is correctly sent the `layers` option
even when it's false (by whatever means). This makes the bindings match
the behavior of a regular `podman build`.
Produced with significant assistance from AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
* Default layers=true for both Docker compat and libpod clients
* Allow builds to stop if a remote client disconnects.
Signed-off-by: Chris Evich <cevich@redhat.com>
Add flush() between Aux and Stream JSON objects in the build API response
to ensure each object is sent separately. Docker clients (e.g. docker-py)
expect one JSON object per read; without this flush, Aux and Stream could
be buffered together causing parse failures.
Backport of cdb00332da (Fix compat build API returning two JSON objects at once)
Closes: containers/podman#16360
AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
On a fast system, it's theoretically possible that an image pull event
could happen at t0, resulting in the assert on line 90 to fail. Test
output resembling this condition occurring has been observed at least
once. Attempt to fix this by recording the starting timestamp down
to the nanosecond.
Signed-off-by: Chris Evich <cevich@redhat.com>
_test_skopeo_credential_sharing() used port_is_free() to check if a
port has no active listeners. With the new implementation, this is
not equivalent anymore: a port might be in TIME_WAIT, so it's not
free, but the listener might be long gone.
Add tcp_port_probe() to check if there's an active listener on a
given port, and use it in _test_skopeo_credential_sharing().
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
(cherry picked from commit cb8c9af5d3)
Signed-off-by: Chris Evich <cevich@redhat.com>
Previously a build was using a read-only default instead of the config
that includes CLI overrides. In the case of the `--default-mounts-file`
option, this meant it always used what containers-common dropped into
`/usr/share/containers/mount.conf` (ignoring any CLI option). Fix this
by switching it back to the config that includes any CLI override.
Signed-off-by: Chris Evich <cevich@redhat.com>
In order to display all events we have to read until the event channel
is closed.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 2ae4ce7999)
Signed-off-by: Chris Evich <cevich@redhat.com>
The current code only sets EventsLogFilePath when the tmp is overwritten
from the db. We should always set the default when no path was set in
containers.conf.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit b3212a6802)
Signed-off-by: Chris Evich <cevich@redhat.com>
List the default paths to the event log file and the tmpdir option.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 12a1483e7f)
Signed-off-by: Chris Evich <cevich@redhat.com>
Refactored secrets API in common for stability purposes. Move podman to
said API.
[NO NEW TESTS NEEDED]
Signed-off-by: Ashley Cui <acui@redhat.com>
(cherry picked from commit 72e715a110)
Signed-off-by: Chris Evich <cevich@redhat.com>
There is no reason to create a new eventer every time. The libpod runtime
already has one attached which should be used instead.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit cd32b929e3)
Signed-off-by: Chris Evich <cevich@redhat.com>
Currently podman events will just fail with `Error: failed to get journal
cursor: failed to get cursor: cannot assign requested address` when the
journal contains zero podman events.
The problem is that we are using the journal accessors wrong. There is no
need to call GetCursor() and compare them manually. The Next() return an
integer which tells if it moved to the next or not. This means the we can
remove GetCursor() which would fail when there is no entry.
This also includes another bug fix. Previously the logic called Next()
twice for the first entry which caused us to miss the first entry.
To reproduce this issue you can run the following commands:
```
sudo journalctl --rotate
sudo journalctl --vacuum-time=1s
```
Note that this will delete the full journal.
Now run podman events and it fails but with this patch it works.
Now generate a single event, i.e. podman pull alpine, and run
podman events --until 1s.
I am not sure how to get a reliable test into CI, I really do not want
to delete the journal and developer or CI systems.
Fixes second part of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 76980a2226)
Signed-off-by: Chris Evich <cevich@redhat.com>
podman --events-backend none events should return with an error since it
will never be able to actually list events.
Fixes part three of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 138b09c7e2)
Signed-off-by: Chris Evich <cevich@redhat.com>
podman --events-backend file events --stream=false should never hang. The
problem is that our tail library will wait for the file to be created
which makes sense when we do not run with --stream=false. To fix this we
can just always create the file when the logger is initialized. This
would also help to report errors early on in case the file is not
accessible.
Fixes part one from #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit c5bdb6afe7)
Signed-off-by: Chris Evich <cevich@redhat.com>
This test, and the code it exercises has been backported to this branch
from v4.4.1-rhel in the previous commits. However, the version of
netavark present on RHEL 9.2 does not contain the fix in netavark PR
https://github.com/containers/netavark/pull/452
This means netavark does not return `DNSServerIPs` from
`dns_servers` in `containers.conf`, so podman falls back to the
host’s `resolv.conf`.
Signed-off-by: Chris Evich <cevich@redhat.com>
Set search domain irrespective of nameservers.
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit e2c44c3d49)
Signed-off-by: Chris Evich <cevich@redhat.com>
After https://github.com/containers/netavark/pull/452 `netavark` is
incharge of deciding `custom_dns_servers` if any so lets honor that and
libpod should not set these manually.
This also ensures docker parity
Podman populates container's `/etc/resolv.conf` with custom DNS servers ( specified via `--dns` or `dns_server` in containers.conf )
even when container is connected to a network where `dns_enabled` is `true`.
Current behavior does not matches with docker, hence following commit ensures that podman only populates custom DNS server when container is not connected to any network where DNS is enabled and for the cases where `dns_enabled` is `true`
the resolution for custom DNS server will happen via ( `aardvark-dns` or `dnsname` ).
Reference: https://docs.docker.com/config/containers/container-networking/#dns-services
Closes: containers#16172
Signed-off-by: Aditya R <arajan@redhat.com>
Cherry-picked from commit 06241077cc
Signed-off-by: Chris Evich <cevich@redhat.com>
Aardvark-dns and netavark now accepts custom DNS servers for containers
via new config field `dns_servers`. New field allows containers to use
custom resolvers instead of host's default resolvers.
Following commit instruments libpod to pass these custom DNS servers set
via `--dns` or central config to the network stack.
Depends-on:
* Common: containers/common#1189
* Netavark: containers/netavark#452
* Aardvark-dns: containers/aardvark-dns#240
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit 366e1686a0)
Signed-off-by: Chris Evich <cevich@redhat.com>
This test was added along with support for resource limits in pod create
for podman v4.3.0r, ~specifically commit c00ea686fe. Rather than
backporting all that code, simply remove the test.
Signed-off-by: Chris Evich <cevich@redhat.com>
Commit e7d5f1e0eb293be5972f4315ca9f72243332fe5c inadvertently brought in
several tests unrelated to the backport. These tests are all failing
due to missing functionality in this older version. Remove the failing
tests rather than backporting functionality never intended for this
version.
Signed-off-by: Chris Evich <cevich@redhat.com>
While mounting virtual console devices in a systemd container is a
recipe for disaster (I experienced it first hand), mounting serial
console devices, modems, and others should still be done by default
for privileged systemd-based containers.
v2, addressing the review from @fho:
- use backticks in the regular expression to remove backslashes
- pre-compile the regex at the package level
- drop IsVirtualTerminalDevice (not needed for a one-liner)
v3, addressing the review from @fho and @rhatdan:
- re-introduce a private function for matching the device names
- use path.Match rather than a regex not to slow down startup time
Closes#16925.
Fixes: 5a2405ae1b ("Don't mount /dev/tty* inside privileged...")
Cherry-picked from f4c81b0aa5 with
conflict resolution (accept incoming test updates) and additional
systemdMode handling for rootless: only skip /dev/ptmx, /dev/tty,
and virtual consoles (tty0, tty1, ...); pass non-vt TTYs (ttyS0,
ttyACM0, etc.) through to privileged rootless containers.
AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
Bump golang.org/x/crypto to v0.43.0 to address CVE-2025-47913.
This change has bumped Go requirement to v1.24.
Signed-off-by: Chris Evich <cevich@redhat.com>
Bump Fedora to v42 to get the necessary version of Go for this
change.
Signed-off-by: Tom Sweeney <tomsweney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Commit c4c07d329c ("test/system: adjust pod memory limit for runc
minimum requirement") updated the memory limit from 5MB to 6MB for
runc, but failed to update the expected memory.swap.max value.
Later, the memory limit was increased to 20MB for runc to account for
infrastructure overhead (conmon + runc + pause container), but again
the swap calculation was not updated.
The memory.swap.max cgroup value is calculated as:
total_swap - memory_limit
With the 20MB memory limit for runc:
1GB - 20MB = 1073741824 - 20971520 = 1052770304 bytes
The test was checking for the old value (1068498944) which corresponded
to the 5MB limit, causing the test to fail with:
expected: '1068498944'
actual: '1052770304'
Fix by dynamically calculating swap_max_bytes based on the runtime,
similar to how memory_max_bytes is already handled.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
The test was failing intermittently when run under `make remotesystem`
because the remotesystem test harness sets PODMAN_SOCKET in the
environment. After removing all named connections, the test expected
`podman-remote --remote ps` to fail with exit code 125, but it
succeeded (exit 0) by falling back to the PODMAN_SOCKET environment
variable.
Fix by unsetting PODMAN_SOCKET in a subshell before testing for
absence of default connection, ensuring the test works correctly
in both local and remotesystem environments.
Partial cherry-pick of commit feb36e4fe6
("Implement TLS API Support"), extracting only the test fix portion.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
The --userns=auto flag is not being properly applied when building
in remote mode in v4.4.1. Containers are getting the default rootless
user namespace (65536 IDs) instead of an auto-allocated smaller
namespace with the default size of 1024 IDs.
This requires refactoring the namespace setup ordering which is too
complex to backport cleanly to v4.4.1. Skip this test in remote mode.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
runc requires a minimum of 6MB memory to start containers due to
security fixes that increased memory footprint. The test was using
5MB which works with crun but fails with runc, causing conmon to
crash and produce "readObjectStart: expect { or n, but found ,"
JSON parsing errors.
Detect the runtime and adjust memory limits accordingly:
- runc: 6MB minimum (6291456 bytes)
- crun: 5MB (5242880 bytes) - can run with less memory
This fixes the "pod resource limits" test failure when using runc
on RHEL 9.2.0 and other systems.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
When trying to execute a directory, runc and crun return different
error messages and exit codes that also vary between local and remote modes:
- runc local: exit code 255 with "is a directory"
- crun local: exit code 126 with "permission denied"
- runc remote: exit code 125 with "is a directory" (wrapped by remote API)
Update tests to handle all scenarios:
- 030-run.bats: Use triple-backslash escaping for BRE alternation in
variable assignment to match either "permission denied" or "is a directory"
- 075-exec.bats: Use run_podman '?' to accept any non-zero exit code,
then assert it failed. Uses single-backslash for direct pattern match.
Partially cherry-picked from commit 8febb6aa11
("Emergency gating-test fixes for RHEL8")
8febb6aa11
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
The test fails when copying a file to a container with a new filename in
remote mode on RHEL 9.2.0. The file appears empty after the copy.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
We do not use that package that we install for the test anyway and doing
this networking connection is causing heavy flakes at the moment.
(partial) cherry picked from commit 15ae942a48
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Skip all port forwarding tests on RHEL 9.2.0 (not just remote mode)
as they fail with connection timeouts. This appears to be a firewall
issue blocking connections to published ports on 127.0.0.1.
Tests affected:
- podman networking: port on localhost
- podman networking: port with --userns=keep-id/--uidmap
- podman network reload
- podman run port forward range
- podman pod create - hashtag AllTheOptions
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
