The process of saving the OCI spec is not particularly
reboot-safe. Normally, this doesn't matter, because we recreate
the spec every time a container starts, but if one was to reboot
(or SIGKILL, or otherwise fatally interrupt) Podman in the middle
of writing the spec to disk, we can end up with a malformed spec
that sticks around until the container is next started. Some
Podman commands want to read the latest version of the spec off
disk (to get information only populated after a container is
started), and will break in the case that a partially populated
spec is present. Swap to just ignoring these errors (with a
logged warning, to let folks know something went wrong) so we
don't break important commands like `podman inspect` in these
cases.
[NO NEW TESTS NEEDED] Provided reproducer involves repeatedly
rebooting the system
Signed-off-by: Matthew Heon <mheon@redhat.com>
In view of https://github.com/containers/storage/pull/1337, do this:
for f in $(git grep -l stringid.GenerateNonCryptoID | grep -v '^vendor/'); do
sed -i 's/stringid.GenerateNonCryptoID/stringid.GenerateRandomID/g' $f;
done
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Restart the health-check timers instead of starting them. This will
surpress annoying errors stating that an already running timer cannot be
started anymore.
Also make sure that the transient units/timers are stopped and removed
when stopping a container.
Fixes: #15691
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
This function changed from public to private which broke the FreeBSD build.
Sadly, adding FreeBSD to the cross build isn't currently possible since
github.com/godbus/dbus relies on cgo on FreeBSD. I've tried to fix this
upstream but my PR is going nowhere - I think this dependency is only
needed for systemd which isn't a thing on FreeBSD so it might be
possible to work around the problem in libpod by making the systemd code
conditional on linux.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
The current code only sets EventsLogFilePath when the tmp is overwritten
from the db. We should always set the default when no path was set in
containers.conf.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
There is no reason to create a new eventer every time. The libpod runtime
already has one attached which should be used instead.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Currently podman events will just fail with `Error: failed to get journal
cursor: failed to get cursor: cannot assign requested address` when the
journal contains zero podman events.
The problem is that we are using the journal accessors wrong. There is no
need to call GetCursor() and compare them manually. The Next() return an
integer which tells if it moved to the next or not. This means the we can
remove GetCursor() which would fail when there is no entry.
This also includes another bug fix. Previously the logic called Next()
twice for the first entry which caused us to miss the first entry.
To reproduce this issue you can run the following commands:
```
sudo journalctl --rotate
sudo journalctl --vacuum-time=1s
```
Note that this will delete the full journal.
Now run podman events and it fails but with this patch it works.
Now generate a single event, i.e. podman pull alpine, and run
podman events --until 1s.
I am not sure how to get a reliable test into CI, I really do not want
to delete the journal and developer or CI systems.
Fixes second part of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
podman --events-backend none events should return with an error since it
will never be able to actually list events.
Fixes part three of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
podman --events-backend file events --stream=false should never hang. The
problem is that our tail library will wait for the file to be created
which makes sense when we do not run with --stream=false. To fix this we
can just always create the file when the logger is initialized. This
would also help to report errors early on in case the file is not
accessible.
Fixes part one from #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This also moves Runtime methods ConnectContainerToNetwork and
DisconnectContainerFromNetwork as well as support functions
getFreeInterfaceName and normalizeNetworkName.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
libpod: Move (Connect|Disconnect)Container(To|From)Network and normalizeNetworkName to networking_common.go
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
This uses a jail to manage the container's network. Container jails for
all containers in a pod are nested within this and share the network
resources.
There is some code in networking_freebsd.go which is common with
networking_linux.go. Subsequent commits will move the shared code to
networking_common.go to reduce this duplication.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
This replaces the NetworkJail string field with a struct pointer named
NetNS. This does not try to emulate the complete NetNS interface but does
help to re-use code that just refers to c.state.NetNS.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
This adds a new per-platform method makePlatformBindMounts and moves the
/etc/hostname mount. This file is only needed on Linux.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
The code which generates resolv.conf dereferenced c.config.Spec.Linux
and this field is not set for FreeBSD containers.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
Include the path and helper binary dir so that the podman
environment more closely matches when conmon calls it as an
exit command.
Also match the CONTAINERS_CONF lookup to the codestyle of other
environment lookups.
[NO NEW TESTS NEEDED]
Resolves#15707
Signed-off-by: Kenny MacDermid <kenny@macdermid.ca>
`os.ReadDir` was added in Go 1.16 as part of the deprecation of `ioutil`
package. It is a more efficient implementation than `ioutil.ReadDir`.
Reference: https://pkg.go.dev/io/ioutil#ReadDir
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Podman adds an Error: to every error message. So starting an error
message with "error" ends up being reported to the user as
Error: error ...
This patch removes the stutter.
Also ioutil.ReadFile errors report the Path, so wrapping the err message
with the path causes a stutter.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Fix the error handling in the fallback logic of `stop` when Podman
resorts to killing a container; the error message wrapped the wrong
error.
[NO NEW TESTS NEEDED] as it is a rare flake in the tests and I do not
know how to reliably reproduce it.
Fixes: #15661
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
For systems that have extreme robustness requirements (edge devices,
particularly those in difficult to access environments), it is important
that applications continue running in all circumstances. When the
application fails, Podman must restart it automatically to provide this
robustness. Otherwise, these devices may require customer IT to
physically gain access to restart, which can be prohibitively difficult.
Add a new `--on-failure` flag that supports four actions:
- **none**: Take no action.
- **kill**: Kill the container.
- **restart**: Restart the container. Do not combine the `restart`
action with the `--restart` flag. When running inside of
a systemd unit, consider using the `kill` or `stop`
action instead to make use of systemd's restart policy.
- **stop**: Stop the container.
To remain backwards compatible, **none** is the default action.
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
skip adding the /sys/fs/cgroup/systemd bind mount if it is not already
present on the host.
[NO NEW TESTS NEEDED] requires a system without systemd.
Closes: https://github.com/containers/podman/issues/15647
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
On FreeBSD, ENOTCONN can be reported if shutdown is called on a unix
domain socket where the remote end is already closed. This change
ignores those errors instead of printing an error message on container
exit.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
This moves the code which sets the process capabilites for the exec to
oci_conmon_exec_linux.go since this is a linux-specific feature. Adding
a no-op stub for FreeBSD enables 'podman exec' when using the ocijail
runtime.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
In case of a hard OS shutdown, containers may have a "removing"
state after a reboot, and an attempt to remove Pods with such
containers is unsuccessful:
error freeing lock for container ...: no such file or directory
[NO NEW TESTS NEEDED]
Signed-off-by: Mikhail Khachayants <tyler92@inbox.ru>
It turns out that field names in syscall.Stat_t are platform-specific.
An alternative to this could change fixVolumePermissions to use
unix.Lstat since unix.Stat_t uses the same mmember name for Atim on both
Linux and FreeBSD.
[NO NEW TESTS NEEDED]
Signed-off-by: Doug Rabson <dfr@rabson.org>
