Add sha256: prefix to image IDs in compat API history responses for
Docker compatibility. Excludes bash test changes as those were already
added by the previous commit.
Fixes: https://github.com/containers/podman/issues/17762
(partial cherry-pick from commit edaf3b4d5e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The default_ulimits field is currently ignored in podman run commands.
This PR fixes this.
Fixes: https://github.com/containers/podman/issues/17396
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
(cherry picked from commit 6046832f3e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Use the new FindInitBinary() function to lookup the init binary, this
allows the use of helper_binaries_dir in contianers.conf[1]
[NO NEW TESTS NEEDED]
[1] https://github.com/containers/common/issues/1110
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit efe5e98d06)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
After[1] c/image no longer prints "Storing signatures" so we should
not check for it.
[1] https://github.com/containers/image/pull/2001
(partial cherry-pick from commit 6eaf8a271d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The common v0.57.7 vendor bump added !remote build tags to libimage,
causing podman-remote builds to fail. This change splits files that
use libimage into separate _local and _remote variants:
- pkg/specgen/specgen_{local,remote}.go: Image field storage and methods
- pkg/api/handlers/types_local.go: ImageDataToImageInspect function
- cmd/podman/utils/error_local.go: ExitCodeFromBuildError function
This allows type definitions to be shared between remote and local
builds while keeping libimage-dependent implementations local-only.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
When we walk the /dev tree we need to lookup all device paths. Now in
order to get the major and minor version we have to actually stat each
device. This can again fail of course. There is at least a race between
the readdir at stat call so it must ignore ENOENT errors to avoid
the race condition as this is not a user problem. Second, we should
also not return other errors and just log them instead, returning an
error means stopping the walk and returning early which means inspect
fails with an error which would be bad.
Also there seems to be cases were ENOENT will be returned all the time,
e.g. when a device is forcefully removed. In the reported bug this is
triggered with iSCSI devices.
Because the caller does already lookup the device from the created map
it reports a warning there if the device is missing on the host so it
is not a problem to ignore a error during lookup here.
[NO NEW TESTS NEEDED] Requires special device setup to trigger
consistentlyand we cannot do that in CI.
Original Fixed https://issues.redhat.com/browse/RHEL-11158
This fixes: https://issues.redhat.com/browse/RHEL-20488
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Drop support for remote use-cases when `.containerignore` or
`.dockerignore` is a symlink pointing to arbitrary location on host.
Signed-off-by: Aditya R <arajan@redhat.com>
Someone please revert this once quay search is fixed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 047da19b5f)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Fixes: https://github.com/containers/podman/issues/18239
[NO NEW TESTS NEEDED]
@test "podman build -f test" in test/system/070-build.bats
Will test this. This was passing when run on a local system since
the remote end was using the clients path to read the Containerfile
The issue is it would not work in a podman machine since the
Containerfile would/should be a different path.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
<MH: Cherry-pick to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
The long term goal was to provide the customer with a way to turn on the
preexec_hooks processing of scripts by having some kind of configuration
that could be read. I had tried putting it into containers.conf to
start, but that turned out to be unyieldly quickly, and time is of
the essence for this fix. That is mostly due to the fact that this
code is preexecution and in C, the containers.conf file is read in
Go much further down the stack.
After first trying this process using an ENVVAR, I have
thought it over and chatted with others, and will now look for a
/etc/containers/podman_preexec_hooks.txt file to exist. If the admin
had put one in there, we will then process the files in the
directories /usr/libexec/podman/pre-exec-hooks
and /etc/containers/pre-exec-hooks.
Thoughts/suggestions gratefully accepted. This will be a 8.8/9.2 ZeroDay
fix and will need to be backported to the v4.4.1-rhel branch.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Backports #17755 from @adrianreber to fix an append issue. Will be
used for a ZeroDay delivery to RHEL 8.8/9.2.
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2177611
Original commit message:
The code was not using append() to add items to a slice.
Accessing non allocated elements of the slice failed with:
```
$ podman container restore -l
panic: runtime error: index out of range [0] with length 0
goroutine 1 [running]:
github.com/containers/podman/v4/pkg/domain/infra/abi.(*ContainerEngine).ContainerRestore(0xc00051a8b8, {0x1dbced0, 0xc0000440d0}, {0x2a31b30, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, ...})
/share/go/src/github.com/containers/podman/pkg/domain/infra/abi/containers.go:676 +0x39c
github.com/containers/podman/v4/cmd/podman/containers.restore(0x28fb6c0?, {0xc0002c9080, 0x0, 0x1?})
/share/go/src/github.com/containers/podman/cmd/podman/containers/restore.go:171 +0x4ef
github.com/spf13/cobra.(*Command).execute(0x28fb6c0, {0xc0000400b0, 0x1, 0x1})
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:916 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0x291ab00)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:1044 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:968
github.com/spf13/cobra.(*Command).ExecuteContext(...)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:961
main.Execute()
/share/go/src/github.com/containers/podman/cmd/podman/root.go:107 +0xcc
main.main()
/share/go/src/github.com/containers/podman/cmd/podman/main.go:41 +0x7c
```
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Only enforce the passthrough log driver for Quadlet. Commit 68fbebf
introduced a regression on the `podman-kube@` template as `podman logs`
stopped working and settings from containers.conf were ignored.
Fixes: #17482
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Add missing return after utils.Error(),
utils.InternalServerError(), utils.BadRequest().
[NO NEW TESTS NEEDED]
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
when using --userns=auto or --userns=pod, we should bind mount /sys
from the host instead of creating a new /sys in the container,
otherwise we rely on the fallback provided by crun, which might not be
available in other runtimes.
Also, in the last version of crun the fallback is stricter than it
used to be before and it uses a recursive bind mount through the new
mount API. That can be missing on old kernel.
Closes: https://github.com/containers/crun/issues/1131
[NO NEW TESTS NEEDED] to trigger the failure, we need a specific
combination of kernel, libc and OCI runtime.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
The function which generates and assigns a random
port number for the --publish-all functionality
was not properly marking some ports as "used".
In very rare occasions this can cause a randomly
"generated" port to be used twice creating an
impossible container configuration.
Signed-off-by: telday <ellis.wright@cyberark.com>
Only assume that http(s) scheme URLs (only ones supported by http.Client anyway) are URLs.
Treat everything else as a file path. (Windows paths can look like a URL scheme)
Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
As @mheon pointed out in PR #17055[^1], isVirtualConsoleDevice() does
not only matches VT device paths but also devices named like
/dev/tty0abcd.
This causes that non VT device paths named /dev/tty[0-9]+[A-Za-z]+ are
not mounted into privileged container and systemd containers accidentally.
This is an unlikely issue because the Linux kernel does not use device
paths like that.
To make it failproof and prevent issues in unlikely scenarios, change
isVirtualConsoleDevice() to exactly match ^/dev/tty[0-9]+$ paths.
Because it is not possible to match this path exactly with Glob syntax,
the path is now checked with strings.TrimPrefix() and
strconv.ParseUint().
ParseUint uses a bitsize of 16, this is sufficient because the max
number of TTY devices is 512 in Linux 6.1.5.
(Checked via 'git grep -e '#define' --and -e 'TTY_MINORS').
The commit also adds a unit-test for isVirtualConsoleDevice().
Fixes: f4c81b0aa5 ("Only prevent VTs to be mounted inside...")
[^1]: https://github.com/containers/podman/pull/17055#issuecomment-1378904068
Signed-off-by: Fabian Holler <mail@fholler.de>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
The Device, Type, Copy and Options keys are now supported in
quadlet .volume files. This allows users to create filesystem
based volumes with quadlets .volume files.
Signed-off-by: Ingo Becker <ingo@orgizm.net>
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
If podman is the default wsl distribution, the (default) string is appended and result is assigned false.
[NO NEW TESTS NEEDED]
Fixes#17227
Signed-off-by: shblue21 <jihunkimkw@gmail.com>
(podman push) and (podman manifest push) now support --sign-by-sigstore=param-file,
using the containers-sigstore-signing-params.yaml(5) file format.
That notably adds support for Fulcio and Rekor signing.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Loading container states speed things up when listing all containers but
it comes with a price tag for many other call paths. Hence, make
loading the state conditional to allow for keeping `podman ps` fast
without other commands regressing in performance.
[NO NEW TESTS NEEDED]
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
This looks like the correct fix, but I have no idea how to test.
Fixes: https://github.com/containers/podman/issues/17106
[NO NEW TESTS NEEDED]
Will have reporter verify if this fixes the problem.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Also do not return (and immediately suppress) an error if no health
check is defined for a given container.
Makes listing 100 containers around 10 percent faster.
[NO NEW TESTS NEEDED]
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
The network functions popped up in the CPU profiles when listing 2042
containers. Not a very realistic or common use case but a nice way to
get something on the CPU profiles.
Listing 2042 containers now runs 1.54 times faster.
[NO NEW TESTS NEEDED]
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
The user is only reading the config, so creating a copy turns out to be
extremely expensive. With this change, listing containers is 1.39 times
faster than before.
[NO NEW TESTS NEEDED] as it is not a functional change.
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
`default` is already used as network mode, i.e. podman run --network
default will choose the default mode not a network named `default`.
We already block names from other network modes, default was forgotten.
Fixes#17169
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Reserved annotations are used internally by Podman and would effect
nothing when run with Kubernetes so we should not be generating these
annotations.
Fixes: https://github.com/containers/podman/issues/17105
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
to not give a false sense of security since these are not a security
mechanism but a hook to run arbitrary code before executing a
command.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
