(cherry picked from commit 0a43c510a8)
This fixes several cp-related issues in podman-remote:
- Enable container-to-container copy support
- Fix symlink expansion for broken symlinks
- Fix cp from /dev/stdin
- Fix directory extraction to non-existent destination
- Add validation for copying directory to file
- Fix trailing slash handling for broken symlinks
- Fix stdin validation and --overwrite flag support
- Require existing directory destination when copying from stdin
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 652ec9578b)
The test framework was not parsing the '+w' suffix in expected exit
codes (e.g., '0+w' meaning "expect exit code 0 and warnings allowed").
This caused the literal string to be passed as a command argument to
podman, resulting in "unrecognized command" errors.
Added pattern matching for:
- [0-9]+w (single digit with warnings)
- [1-9][0-9]+w (double digit with warnings)
- [12][0-9][0-9]+w (triple digit with warnings)
The '+w' suffix is stripped off and only the numeric exit code is used
for validation. Note: The actual warning validation is not implemented
yet, but this allows tests using the '+w' notation to run correctly.
This fixes the "podman-remote: non-default connection" test failure.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 8fd34d5bfd)
The original cp.go uses buildah/copier which depends on libimage,
making it unavailable in remote builds. This change splits cp
implementation into separate local and remote variants:
- cmd/podman/containers/cp.go: Shared command definitions, flags, and
init function (no build tag)
- cmd/podman/containers/cp_local.go: Local implementation using
buildah/copier (//go:build !remote)
- cmd/podman/containers/cp_remote.go: Remote implementation using
stdlib archive/tar (//go:build remote)
The remote implementation:
- Uses ContainerEngine interface methods that work over REST API:
ContainerStat, ContainerCopyToArchive, ContainerCopyFromArchive
- Properly handles file and directory copying in both directions
- Uses CopyOptions.Rename for file renaming when copying to specific
filenames
- Returns error for container-to-container copying (not supported with
podman-remote)
This follows the same pattern used for other libimage-dependent code
in commit 4231526e18.
Fixes system tests that require cp functionality with podman-remote.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit ca1a0db4e7)
This commit fixes three related issues that prevented userns=auto from
working correctly in rootless containers:
1. Fix setgroups() error with userns=auto
When using userns=auto, supplementary GIDs from the container image
were being passed to setgroups() before user namespace mappings were
allocated by storage, causing EINVAL errors. Added a check in
container_internal_common.go to skip supplementary groups when
AutoUserNs is enabled but GIDMap isn't populated yet.
2. Fix ID mapping allocation bug in storage.go
CreateContainerStorage was returning empty UID/GID mappings from the
input options parameter instead of the allocated mappings from the
storage container object, causing containers to fail with "readlink:
No such file or directory" errors. Changed the return statement to
use container.UIDMap and container.GIDMap.
3. Add workaround for containers/storage v1.51.0 bug
The vendored storage library has a bug in parseMountedFiles where
groupFile path is incorrectly used as a directory path. Set an
explicit Size=65536 in AutoUserNsOpts to bypass the buggy code path.
With these fixes, all userns=auto tests in 170-run-userns.bats now pass
in rootless mode.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 141e6cddfa)
The events file backend writes events as they're generated, which may
not match chronological order due to race conditions during concurrent
operations in rmi -f. The remove and untag events from rmi can appear
in any order in the events file.
This matches the approach used in main branch (see commit 111a4bbe71)
which recognizes that event ordering is not guaranteed for concurrent
operations, especially in podman-remote.
This fix:
- Simplifies initial validation to check for event presence (not order)
- Checks deterministic events (0-6) in exact order
- Validates rmi events (7-9) are present without requiring specific order
- Checks final event (10) is the second loadfromarchive
- Does NOT modify runtime code to enforce ordering (events remain as-generated)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 650b46a368)
This commit fixes two issues in runtime initialization that occur when
vendor code doesn't properly set StaticDir and VolumePath defaults:
1. Add defensive initialization for StaticDir and VolumePath
- Check if StaticDir is empty and set it to GraphRoot/libpod
- Check if VolumePath is empty and set it to GraphRoot/volumes
- This works around missing initialization in older vendor code
without requiring changes to the vendor directory
2. Fix database initialization to allow creating new bolt_state.db
- Previously, getDBState() would fail if bolt_state.db didn't exist
- Now, only return error if it's not os.ErrNotExist
- This allows NewBoltState() to create the database on first run
These changes resolve the "creating runtime static files directory:
mkdir : no such file or directory" error that occurred when running
podman commands.
Tested with:
- podman ps, info, version commands work correctly
- Volume operations create volumes at correct path
- Database is properly initialized on first run
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 4231526e18)
The common v0.57.7 vendor bump added !remote build tags to libimage,
causing podman-remote builds to fail. This change splits files that
use libimage into separate _local and _remote variants:
- pkg/specgen/specgen_{local,remote}.go: Image field storage and methods
- pkg/api/handlers/types_local.go: ImageDataToImageInspect function
- cmd/podman/utils/error_local.go: ExitCodeFromBuildError function
This allows type definitions to be shared between remote and local
builds while keeping libimage-dependent implementations local-only.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Commit "Fix compilation errors for v4.4.1-rhel compatibility"
introduced both go-criu/v5 and go-criu/v6 dependencies, causing a
protobuf registration conflict error:
panic: proto: file "stats/stats.proto" is already registered
previously from: "github.com/checkpoint-restore/go-criu/v5/stats"
currently from: "github.com/checkpoint-restore/go-criu/v6/stats"
Fix this by:
- Removing go-criu/v5 from go.mod
- Updating all imports from v5 to v6 in:
* pkg/criu/criu_linux.go
* pkg/checkpoint/crutils/checkpoint_restore_utils.go
* test/e2e/checkpoint_test.go
- Regenerating vendor directory with 'make vendor'
Generated with the Assistance of AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
The previous commit replaced setProcessCapabilitiesExec() with a
simplified 3-line inline check. This only copies container capabilities
when pspec.Capabilities is nil. It doesn't handle --privileged exec
(which needs the full bounding set) and doesn't handle the case where a
non-root exec user matches the container user (which needs
ambient/inheritable caps set). The original method handles both cases
properly.
Also backport commit 68b2450, 6668ac9 but set tags only to support linux
builds (FreeBSD will never again be built from this branch).
Signed-off-by: Chris Evich <cevich@redhat.com>
Align codebase with v4.4.1-rhel PodmanConfig structure
and API signatures to resolve compilation errors.
- Update all cfg.Engine.* references to
cfg.ContainersConf.Engine.* or
cfg.ContainersConfDefaultsRO.Engine.*
- Update all cfg.Network.* references to
cfg.ContainersConf.Network.*
- Update all cfg.Containers.* references to
cfg.ContainersConf.Containers.* or
cfg.ContainersConfDefaultsRO.Containers.*
- Update cfg.Machine.* references to
cfg.ContainersConfDefaultsRO.Machine.*
- Fix PodmanConfig initialization in config.go to use
ContainersConf and ContainersConfDefaultsRO fields
- Add createOptions parameter to NetworkCreate method
across all implementations (abi, tunnel, handlers)
- Update ContainerEngine interface to match new
NetworkCreate signature
- Fix manager.Store call in secrets.go to use
StoreOptions struct
- Update DiskUsage to handle 3 return values
- Fix NewConnectionWithIdentity call signature
- Remove duplicate setupRemoteConnection function
- Remove duplicate readRemoteCliFlags function
- Remove duplicate function declarations in
container_path_resolution.go, oci_conmon_linux.go
- Comment out duplicate SpecGenToOCI and helper
functions in oci.go/oci_linux.go
- Remove unused imports across multiple files
- Fix SSHMode flag handling (field doesn't exist in
current PodmanConfig)
- Fix ns.NetNS type handling in container_internal_linux.go
- Add missing Terminal() method to Container struct
- Add missing SdNotifySocket field to ContainerConfig
- Fix DefaultCapabilities to use .Get() method
- Fix cgroups.AvailableControllers reference
- Fix ConmonPath type conversion (attributedstring.Slice)
- Add missing ErrNetworkConnected error definition
- Fix NetworkCreateOptions handling in secrets.go
- Update networking code to use getNetNSPathCommon helper
- Fix teardownNetwork method signature
- Fix makeInspectPorts to makeInspectPortBindings
- Remove hardcoded IsPasta() checks
- Fix runtime_libpod.go field access patterns
All changes align with the v4.4.1-rhel worktree structure
to ensure compatibility with upcoming cherry-picks.
Substantially Assisted-by AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit b80a4693c2)
We require GO 1.22, and it looks like Fedora 37
tops out at 1.19. Bump the Fedora to F41.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit e035eb4ffa)
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 6597a24d6c)
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 9b1c32869f)
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Cherry picked from commit 2e8bce201e with
additional updates required for the v4.2.0-rhel branch.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Assisted by AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.
Fixes: CVE-2025-9566
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Unfortunately on a number of occasions, Podman has been released
officially with a `-dev` suffix in the version number. Assist in
catching this mistake at release time by the addition of a simple
conditional test. Note that it must be positively enabled by a
magic env. var. before executing the system tests.
Ref. original PR: https://github.com/containers/podman/pull/26540
Signed-off-by: Chris Evich <cevich@redhat.com>
Commits f34c272 and d25cb5f upgraded these modules along with
`golang.org/x/crypto`. PR #25624 subsequently downgraded the
crypto module but missed rolling back these other changes to
Unfortunately the newer versions of these other modules fall
between the differences from Fedora to RHEL, so CI missed
their RHEL incompatibility. Under RHEL podman fails to
compile with the error:
```
_build/src/github.com/containers/podman/vendor/golang.org/x/net/http2/transport.go:1109:13:
tc.NetConn undefined (type *tls.Conn has no field or method NetConn)
```
Rollback `x/text` -> `v0.15.0`, which then through
`make vendor` pulls in adjustments to `x/tools` and `x/net`. Though
the versions are still newer than what they were prior to
f34c272/d25cb5f, so as far as podman releases go, they're actually
newer than what was available previously.
Manually tested on both RHEL 9.0 & 8.6
Signed-off-by: Chris Evich <cevich@redhat.com>
This commit re-vendors the module from a temporary source, and moves to
an earlier, patched version to address CVE-2025-22869. Prior to this
commit, building podman fails due to platform dependence on golang 1.17
- the version currently used to build for RHEL.
In the future, it is intended that the RHEL platform will migrate to a
newer golang toolchain. This will enable re-vendoring the crypto module
again back to the authoritative upstream source. Thus removing the need
for the temporary fork.
Resolves: RHEL-81301 RHEL-81320
Signed-off-by: Chris Evich <cevich@redhat.com>
The Fedora-36 CI VMs used prior to 2b3867e closely matched RHEL-8.6
which is the intended destination of this v4.2.0-rhel release branch.
Importantly this change, along with one or more future commits
(f34c2726..31e11a06) lead to downstream build failures on RHEL 8.6,
and reproduce using the original Fedora-36 CI VMs. In other words,
leaving the F36 CI VMs in place would have allowed these failures
to be caught during upstream rather than downstream testing.
Also strip the F41 aarch64 build as this similarly isn't relevant
in a RHEL 8.6 context, nor was this architecture present in CI
for this branch previously.
Signed-off-by: Chris Evich <cevich@redhat.com>
Update cirrus.yml to the latest image based of 5.4-rhel, then disable
validate as there no point for it when we do backports. And only
perform a single build on the f41.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
In the remote environment, this test will be failed,
because an error message is different from the local environment.
Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
Basically, in the timeout loop where we checked for new CID
on the restarted container, we were running 'podman inspect'
(not 'inspect --format ID'), and comparing full hundred-line
output against single-line CID string.
While I'm in here, add 'c_' prefix to container to make it
easier for my old eyes to recognize "oh, that's a container name"
vs "is that a name? a SHA? a woozle?"
Signed-off-by: Ed Santiago <santiago@redhat.com>
As the title says. Bumping to address:
CVE-2024-1753
https://issues.redhat.com/browse/RHEL-26761
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
