The lowercase `and` in the License field isn't compatible with spdx
license format.
This commit replaces all `and` with `AND` in the License field in spec.
[NO NEW TESTS NEEDED]
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Include dependencies in rpm/podman.spec to make it easy for end users to
build podman from source. This way users can install all build
dependencies by running `dnf -y builddep rpm/podman.spec`.
This is not usually noticeable except on container environments where
man-db often isn't installed by default.
Refs:
https://github.com/containers/podman.io/issues/157https://github.com/containers/podman.io/pull/174
[NO NEW TESTS NEEDED]
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Switch man page to user USERID instead of UID, since UID environment
variable is set at login, and is not allowed to be changed.
UID=foobar
bash: UID: readonly variable
Fixes: https://github.com/containers/podman/issues/19646
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Building all PRs of all container projects into the same COPR does not
properly isolate PRs from each other: E.g. a podman PR currently runs
against whichever crun PR was opened/updated last; in other words,
sending a broken crun PR will instantly break tests for all subsequent
podman runs.
To avoid that, change the copr_build configuration to use the packit
default COPRs, which are specific to the particular PR, and disappear
after a few weeks. Projects should only run against what landed in
our dependencies' main branches, i.e. the podman-next COPR.
Note that this does not preclude testing a podman PR against a e.g. a
crun PR: This can be explicitly requested [1]. But most PRs don't change
the API and thus should default to isolation.
[1] https://packit.dev/posts/testing-farm-triggering
[NO NEW TESTS NEEDED]
Signed-off-by: Martin Pitt <mpitt@redhat.com>
SELinux tests are failing in f37, f38, Rawhide. (Did I miss any?)
Assume that the new container-selinux will never be available on
any of those, so let's just skip those tests. #19376
Pasta ICMP test fails pretty consistently in Gating, and is even
flaking in Cirrus, so let's skip that too. #19612
Signed-off-by: Ed Santiago <santiago@redhat.com>
The standard Docker client passes "1" for pull query parameter.
This means our compat endpoint has to work with this.
The endpoint was recently modified to accept pull-policy however this is
not how Docker actually work. Docker actually treats `pull` as boolean.
For sake of compatibility I decide to preserve pull-policy parsing too.
We can consider this podman's extension. I should not affect standard
clients.
Signed-off-by: Matej Vasek <mvasek@redhat.com>
Remove the references of the zstd:chunked encryption algorithm as
this will not be supported in RHEL 8.9/9.3 in Podman v4.6.1. Support
is expected in Podman v4.7 and later.
[NO NEW TESTS NEEDED]
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
gvproxy has now been approved as a standalone package on Fedora and will
be included separately for fedora 38 and higher.
[NO NEW TESTS NEEDED]
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
[
Clean cherry-pick of #19302. This is a low-risk change
with potentially very high ROI: the opportunity to catch
interaction problems with updates in other system components.
]
BATS 1.8.0 introduces tags: metadata that can be applied to
a single test or one entire file, then used for filtering
in a test run.
Issue #19299 introduces the possibility of using OpenQA
for podman reverse dependency testing: continuous CI on
all packages that can affect podman, so we don't go two
months with no bodhi builds then get caught by surprise
when systemd or kernel or crun change in ways that break us.
This PR introduces one bats tag, "distro-integration".
The intention is for OpenQA (or other) tests to install
the podman-tests package and run:
bats --filter-tags distro-integration /usr/share/podman/test/system
Goal is to keep the test list short and sweet: we do not
need to test command-line option parsing. We *DO* need to
test interactions with systemd, kernel, nethack, and other
critical components.
Signed-off-by: Ed Santiago <santiago@redhat.com>
If a user puts a quadlet file in his homedirectory with
the same name as one in /etc/containers/systemd/user or
/etc/containers/systemd/user/$UID, then only use the one in
homedir and ignore the others.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
`podman system service` + TCP is not a configuration we should be
recommending. There was already language about this in the
manpages, but it was not sufficient in explaining how bad of an
idea this is. Expand the manpage warnings, add a dedicated
heading so people notice, and add a warning every time the
service starts with a TCP URL that directs people to the manpage
to see that explanation.
Signed-off-by: Matt Heon <mheon@redhat.com>
Podman is basically unusable without cgo, checking if it compiles
without adds no value and just tricks people into thinking it works when
it does not.
This means we do not need extra to NOP out a lot of cgo calls with
functions that just return an error like `XXX is not supported without
cgo`.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We never ever close the stream so we do not need the Close() function in
th ebackend, the caller should close when required which may no be the
case, i.e. when os.Stdout/err is used.
This should not be a breaking change as the io.Writer is a subset of
io.WriteCloser, therfore all code should still compile while allowing to
pass in Writers without Close().
This is useful for podman top where we exec ps in the container via
podman exec.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This ended up more complicated then expected. Lets start first with the
problem to show why I am doing this:
Currently we simply execute ps(1) in the container. This has some
drawbacks. First, obviously you need to have ps(1) in the container
image. That is no always the case especially in small images. Second,
even if you do it will often be only busybox's ps which supports far
less options.
Now we also have psgo which is used by default but that only supports a
small subset of ps(1) options. Implementing all options there is way to
much work.
Docker on the other hand executes ps(1) directly on the host and tries
to filter pids with `-q` an option which is not supported by busybox's
ps and conflicts with other ps(1) arguments. That means they fall back
to full ps(1) on the host and then filter based on the pid in the
output. This is kinda ugly and fails short because users can modify the
ps output and it may not even include the pid in the output which causes
an error.
So every solution has a different drawback, but what if we can combine
them somehow?! This commit tries exactly that.
We use ps(1) from the host and execute that in the container's pid
namespace.
There are some security concerns that must be addressed:
- mount the executable paths for ps and podman itself readonly to
prevent the container from overwriting it via /proc/self/exe.
- set NO_NEW_PRIVS, SET_DUMPABLE and PDEATHSIG
- close all non std fds to prevent leaking files in that the caller had
open
- unset all environment variables to not leak any into the contianer
Technically this could be a breaking change if somebody does not
have ps on the host and only in the container but I find that very
unlikely, we still have the exec in container fallback.
Because this can be insecure when the contianer has CAP_SYS_PTRACE we
still only use the podman exec version in that case.
This updates the docs accordingly, note that podman pod top never falls
back to executing ps in the container as this makes no sense with
multiple containers so I fixed the docs there as well.
Fixes#19001
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2215572
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
