Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.
Fixes: #26938
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.
Fixes: #26938
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Bump runc to v1.2.9, Buildah to v1.37.7 to
address CVE-2025-52881.
Also, remove the runc redirect in go.mod
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.
Fixes: CVE-2025-9566
Fixes: https://issues.redhat.com/browse/OCPBUGS-61265, https://issues.redhat.com/browse/OCPBUGS-61266
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
podman system check --quick currently only skips layer contents, but
practically it's not much quicker than without the flag.
This changes the flag to also skip checking layer digests which speed up
the check significantly.
In some cases, it is useful to opt for a quicker check if we prioritize
detecting and fixing severe corruption and can tolerate minor damage.
The check option is derived from CRI-O's internal repair:
9e4d86d823/internal/lib/container_server.go (L860)
Fixes: https://issues.redhat.com/browse/OCPBUGS-57982
Cherry Picks: https://github.com/containers/podman/pull/26272
Signed-off-by: Sonny Sasaka <sonnysasaka@gmail.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
This seems to have been added as part of the cleanup of our
handling of OOM files, but code was never added to remove it, so
we leaked a single directory with an exit file and OOM file per
container run. Apparently have been doing this for a while - I'd
guess since March of '23 - so I'm surprised more people didn't
notice.
Fixes#25291
Fixes: https://issues.redhat.com/browse/RHEL-86866
Signed-off-by: Matt Heon <mheon@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
GoLang sets unset values to the default value of the type. This means that the destination of the log is an empty string and the count and size are set to 0. However, this means that size and count are unbounded, and this is not the default behavior.
Fixes: https://github.com/containers/podman/issues/25473
Fixes: https://issues.redhat.com/browse/RHEL-83558
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
(cherry picked from commit fff42ac232)
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
The go 1.23 build requirement is to new for the older branches, switch
to a fork maintained by openshift.
Fixes: CVE-2025-22869
Fixes: https://issues.redhat.com/browse/RHEL-81318
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Update cirrus.yml to the latest image based of 5.4-rhel, then disable
validate as there no point for it when we do backports. And only
perform a single build on the f41.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
convert the owner UID and GID into the user namespace only when
":idmap" mount is used.
This changes the behaviour of :idmap with an empty volume. Now the
existing directory ownership is copied up as in the other case.
Closes: https://github.com/containers/podman/issues/23347
Closes: https://issues.redhat.com/browse/RHEL-67842
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 432325236b)
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
if idmap is specified for a volume, reverse the mappings when copying
up from the container, so that the original permissions are maintained.
Closes: https://github.com/containers/podman/issues/23467
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 3ae1568933)
An additional tweak from @Luap99 in #24333
regarding the looping in libpod/container_inspect.go.
The range over int syntax was only added in go 1.22, this branch is
currently build with go 1.21 in RHEL so we need to convert it back to
the old syntax.
And add the missing "fmt" import in the test file.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Undoing some of my own work here from #24090 now that we have the
ExposedPorts field implemented in inspect. I considered a revert
of that patch, but it's still needed as without it we'd be
including exposed ports when --net=container which is not
correct.
Basically, exposed ports for a container should always go in the
new ExposedPorts field we added. They sometimes go in the Ports
field in NetworkSettings, but only when the container is not
net=host and not net=container. We were always including exposed
ports, which was not correct, but is an easy logical fix.
Also required is a test change to correct the expected behavior
as we were testing for incorrect behavior.
Fixes https://issues.redhat.com/browse/RHEL-60382
Signed-off-by: Matt Heon <mheon@redhat.com>
(cherry picked from commit 8061553c0f)
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
A field we missed versus Docker. Matches the format of our
existing Ports list in the NetworkConfig, but only includes
exposed ports (and maps these to struct{}, as they never go to
real ports on the host).
Fixes https://issues.redhat.com/browse/RHEL-60382
Signed-off-by: Matt Heon <mheon@redhat.com>
(cherry picked from commit edc3dc5e11)
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
when net=host
Previously, we didn't bother including exposed ports in the
container config when creating a container with --net=host. Per
Docker this isn't really correct; host-net containers are still
considered to have exposed ports, even though that specific
container can be guaranteed to never use them.
We could just fix this for host container, but we might as well
make it generic. This patch unconditionally adds exposed ports to
the container config - it was previously conditional on a network
namespace being configured. The behavior of `podman inspect` with
exposed ports when using `--net=container:` has also been
corrected. Previously, we used exposed ports from the container
sharing its network namespace, which was not correct. Now, we use
regular port bindings from the namespace container, but exposed
ports from our own container.
Fixes https://issues.redhat.com/browse/RHEL-60382
Signed-off-by: Matt Heon <mheon@redhat.com>
(cherry picked from commit a619c03eff)
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
As discussed at the cabal October 8, 2024 we have no need for these
tests on RHEL branches. The work to maintain them is higher than it is
worth it. We also do not test RHEL but rather some outdated frozen
fedora image build from the time we created the branch.
Therefore we gain little value from them especially as all the internal
Red Hat QE is testing it anyways again on the proper RHEL builds.
So simply delete all the stuff we no longer need:
- alt builds, no point in windows/macos testing and other arches
- all the functional tests
- the build success task (not needed as there is nothing after it
anymore)
- the swagger task, we do not use the swagger from the rhel branches
Fixes: https://issues.redhat.com/browse/RUN-2315
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
