The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
Docker now reserves alias specfically for user-defined aliases, and uses another field, dnsnames, to hold all aliases, including container ID and name.
Part of docker v1.45 compat work, but this touches the cli too, since they updated it there too.
Signed-off-by: Ashley Cui <acui@redhat.com>
runc doesn't support --tcp-close, so this test always failed there
once the flag hit the runtime. Skip it entirely for non-crun since
since --tcp-established already covers runc above.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Both the tcp-established and tcp-close checkpoint/restore tests expect
a restore rejected due to an established TCP connection to fail with
"runc: criu failed: type NOTIFY errno 0". criu's RPC server actually
reports this failure as type RESTORE, not NOTIFY. Widen the regex in
both tests to accept RESTORE while still tolerating NOTIFY.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
pasta's IPv6 local-mode forwarding requires an unreleased upstream
patch. Skip the affected E2E tests until the fix ships in a pasta
release.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The cgroups=split e2e test wraps podman in systemd-run --scope but does not request cgroup delegation. Without Delegate=yes, systemd does not guarantee that controllers like pids are written to cgroup.subtree_control for child cgroups. Whether they appear depends on the systemd session state at that moment, causing flaky crun failures when it tries to use unavailable controllers.
Fixes: #28944
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
With the new config work we expect policy.json to be shipped under
/usr/share/containers/policy.json. However the CI VMs and local users
might still have it in /etc so instead of assuming any host path lets
just create our own files for the --signature-policy tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
I do not understand this condition in the code, not passing the log file
to the runtime when run with log level debug makes no sense. It means we
do not get the proper error message from the runtime so debug logging
shows a much worse error:
"container create failed (no logs from conmon)..."
When the actual error is the command is not in $PATH for example. So to
fix this just remove the log level check. Also not the support json flag
condition is done inside execOCILog().
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
First check for errors and assert them via gomega to make the test fails
which called this.
Then stop calling this for each test spec, most will never access this
so stop reading the file over and over. Callers should just call the
function directly.
Then remove the arch field from it, that is not related to the OS file.
Callers should just access runtime.GOARCH directly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
Fixes: #22095
Now handles exporting a container's healthcheck configuration as a
`livenessProbe` in the generated Kubernetes YAML.
Co-authored-by: givensuman <givensuman@duck.com>
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Devesh B <98201065+DeveshB-1@users.noreply.github.com>
Signed-off-by: givensuman <givensuman@duck.com>
Update test/e2e/generate_kube_test.go
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: given <givensuman@gmail.com>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
For most callers podman run -d already makes sure the container runs so
this does nothing and only slows the test down.
For the signal test we can instead check for container output which is
better as we know the pid1 is actually ready to get the signal.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We do not use this anywhere to run as a different uid. In fact it should
not be supported as it would run without a proper systemd session for
example.
Because we run the test suite as root and a rootless user in CI there is
no need for a specific test to run podman as a different user here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We hard require netavark v2 to run with podman 6, as such it makes
little sense to guard just a specific set of tests.
Remove the helper to remove some code and skip the podman info call to
also speed it up a bit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
