Backports be5d1261b4
* mountNotifySocket consulted c.notifySocket, which was never populated.
Use persisted c.config.SdNotifySocket instead so the path matches
conmon's --sdnotify-socket and survives container restarts.
* Add WithSdNotifySocket and have MakeContainer read NOTIFY_SOCKET from
the environment when sdnotify mode is container.
* Related to upstream be5d1261b4 (libpod: Move mountNotifySocket to
container_internal_common.go), which introduced the shared
mountNotifySocket path this wiring completes.
Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
The current code only sets EventsLogFilePath when the tmp is overwritten
from the db. We should always set the default when no path was set in
containers.conf.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit b3212a6802)
Signed-off-by: Chris Evich <cevich@redhat.com>
There is no reason to create a new eventer every time. The libpod runtime
already has one attached which should be used instead.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit cd32b929e3)
Signed-off-by: Chris Evich <cevich@redhat.com>
Currently podman events will just fail with `Error: failed to get journal
cursor: failed to get cursor: cannot assign requested address` when the
journal contains zero podman events.
The problem is that we are using the journal accessors wrong. There is no
need to call GetCursor() and compare them manually. The Next() return an
integer which tells if it moved to the next or not. This means the we can
remove GetCursor() which would fail when there is no entry.
This also includes another bug fix. Previously the logic called Next()
twice for the first entry which caused us to miss the first entry.
To reproduce this issue you can run the following commands:
```
sudo journalctl --rotate
sudo journalctl --vacuum-time=1s
```
Note that this will delete the full journal.
Now run podman events and it fails but with this patch it works.
Now generate a single event, i.e. podman pull alpine, and run
podman events --until 1s.
I am not sure how to get a reliable test into CI, I really do not want
to delete the journal and developer or CI systems.
Fixes second part of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 76980a2226)
Signed-off-by: Chris Evich <cevich@redhat.com>
podman --events-backend none events should return with an error since it
will never be able to actually list events.
Fixes part three of #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 138b09c7e2)
Signed-off-by: Chris Evich <cevich@redhat.com>
podman --events-backend file events --stream=false should never hang. The
problem is that our tail library will wait for the file to be created
which makes sense when we do not run with --stream=false. To fix this we
can just always create the file when the logger is initialized. This
would also help to report errors early on in case the file is not
accessible.
Fixes part one from #15688
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit c5bdb6afe7)
Signed-off-by: Chris Evich <cevich@redhat.com>
Set search domain irrespective of nameservers.
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit e2c44c3d49)
Signed-off-by: Chris Evich <cevich@redhat.com>
Aardvark-dns and netavark now accepts custom DNS servers for containers
via new config field `dns_servers`. New field allows containers to use
custom resolvers instead of host's default resolvers.
Following commit instruments libpod to pass these custom DNS servers set
via `--dns` or central config to the network stack.
Depends-on:
* Common: containers/common#1189
* Netavark: containers/netavark#452
* Aardvark-dns: containers/aardvark-dns#240
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit 366e1686a0)
Signed-off-by: Chris Evich <cevich@redhat.com>
While mounting virtual console devices in a systemd container is a
recipe for disaster (I experienced it first hand), mounting serial
console devices, modems, and others should still be done by default
for privileged systemd-based containers.
v2, addressing the review from @fho:
- use backticks in the regular expression to remove backslashes
- pre-compile the regex at the package level
- drop IsVirtualTerminalDevice (not needed for a one-liner)
v3, addressing the review from @fho and @rhatdan:
- re-introduce a private function for matching the device names
- use path.Match rather than a regex not to slow down startup time
Closes#16925.
Fixes: 5a2405ae1b ("Don't mount /dev/tty* inside privileged...")
Cherry-picked from f4c81b0aa5 with
conflict resolution (accept incoming test updates) and additional
systemdMode handling for rootless: only skip /dev/ptmx, /dev/tty,
and virtual consoles (tty0, tty1, ...); pass non-vt TTYs (ttyS0,
ttyACM0, etc.) through to privileged rootless containers.
AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
We bind ports to ensure there are no conflicts and we leak them into
conmon to keep them open. However we bound the ports after the network
was set up so it was possible for a second network setup to overwrite
the firewall configs of a previous container as it failed only later
when binding the port. As such we must ensure we bind before the network
is set up.
This is not so simple because we still have to take care of
PostConfigureNetNS bool in which case the network set up happens after
we launch conmon. Thus we end up with two different conditions.
Also it is possible that we "leak" the ports that are set on the
container until the garbage collector will close them. This is not
perfect but the alternative is adding special error handling on each
function exit after prepare until we start conmon which is a lot of work
to do correctly.
Fixes https://issues.redhat.com/browse/RHEL-50746
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 77081df8cd)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Add systemEventsCommand to support 'podman system events' as an alias
for 'podman events'. This fixes the 'unknown shorthand flag: f' error
when using 'podman system events -f' in tests prior to this commit.
Fix event template handling by changing report.OriginUser to
report.OriginUnknown to prevent the template parser from trying to
iterate over the event struct. This fixes template errors like
'range can't iterate over' for templates like {{.ID}}--{{.Image}}
and {{.Attributes.xxx}} as observed in tests prior to this commit.
Update event journal reading to set Attributes directly on the Event
struct (since Details is embedded) and add support for PodID and
ContainerInspectData fields in the Details struct.
Update event loop to use select statement for proper channel handling
and error propagation.
Assisted-by: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 932481e76e)
When removing storage containers without force, if the mount status
check fails with an error other than ErrContainerUnknown, return that
error instead of logging a warning and continuing. The previous behavior
allowed containers to be removed even when we couldn't verify their mount
status, causing the 'podman ps --external' test to fail inconsistently
across different infrastructures.
This makes the mount check fail-safe: if we can't determine whether a
container is mounted, we error out rather than allowing deletion.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 2c5bb41314)
The previous commit introduced usage of unix.ENOTSUP but forgot to
import golang.org/x/sys/unix, causing a build failure on RHEL 9.2.0.
Fixes the build error:
libpod/container_internal_common.go:2800:20: undefined: unix
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 3bde59fa43)
We were ignoreing relabel requests on certain unsupported
file systems and not on others, this changes to consistently
logrus.Debug ENOTSUP file systems.
Fixes: https://github.com/containers/podman/discussions/20745
Still needs some work on the Buildah side.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
(cherry picked from commit ca1a0db4e7)
This commit fixes three related issues that prevented userns=auto from
working correctly in rootless containers:
1. Fix setgroups() error with userns=auto
When using userns=auto, supplementary GIDs from the container image
were being passed to setgroups() before user namespace mappings were
allocated by storage, causing EINVAL errors. Added a check in
container_internal_common.go to skip supplementary groups when
AutoUserNs is enabled but GIDMap isn't populated yet.
2. Fix ID mapping allocation bug in storage.go
CreateContainerStorage was returning empty UID/GID mappings from the
input options parameter instead of the allocated mappings from the
storage container object, causing containers to fail with "readlink:
No such file or directory" errors. Changed the return statement to
use container.UIDMap and container.GIDMap.
3. Add workaround for containers/storage v1.51.0 bug
The vendored storage library has a bug in parseMountedFiles where
groupFile path is incorrectly used as a directory path. Set an
explicit Size=65536 in AutoUserNsOpts to bypass the buggy code path.
With these fixes, all userns=auto tests in 170-run-userns.bats now pass
in rootless mode.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
(cherry picked from commit 650b46a368)
This commit fixes two issues in runtime initialization that occur when
vendor code doesn't properly set StaticDir and VolumePath defaults:
1. Add defensive initialization for StaticDir and VolumePath
- Check if StaticDir is empty and set it to GraphRoot/libpod
- Check if VolumePath is empty and set it to GraphRoot/volumes
- This works around missing initialization in older vendor code
without requiring changes to the vendor directory
2. Fix database initialization to allow creating new bolt_state.db
- Previously, getDBState() would fail if bolt_state.db didn't exist
- Now, only return error if it's not os.ErrNotExist
- This allows NewBoltState() to create the database on first run
These changes resolve the "creating runtime static files directory:
mkdir : no such file or directory" error that occurred when running
podman commands.
Tested with:
- podman ps, info, version commands work correctly
- Volume operations create volumes at correct path
- Database is properly initialized on first run
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The previous commit replaced setProcessCapabilitiesExec() with a
simplified 3-line inline check. This only copies container capabilities
when pspec.Capabilities is nil. It doesn't handle --privileged exec
(which needs the full bounding set) and doesn't handle the case where a
non-root exec user matches the container user (which needs
ambient/inheritable caps set). The original method handles both cases
properly.
Also backport commit 68b2450, 6668ac9 but set tags only to support linux
builds (FreeBSD will never again be built from this branch).
Signed-off-by: Chris Evich <cevich@redhat.com>
Align codebase with v4.4.1-rhel PodmanConfig structure
and API signatures to resolve compilation errors.
- Update all cfg.Engine.* references to
cfg.ContainersConf.Engine.* or
cfg.ContainersConfDefaultsRO.Engine.*
- Update all cfg.Network.* references to
cfg.ContainersConf.Network.*
- Update all cfg.Containers.* references to
cfg.ContainersConf.Containers.* or
cfg.ContainersConfDefaultsRO.Containers.*
- Update cfg.Machine.* references to
cfg.ContainersConfDefaultsRO.Machine.*
- Fix PodmanConfig initialization in config.go to use
ContainersConf and ContainersConfDefaultsRO fields
- Add createOptions parameter to NetworkCreate method
across all implementations (abi, tunnel, handlers)
- Update ContainerEngine interface to match new
NetworkCreate signature
- Fix manager.Store call in secrets.go to use
StoreOptions struct
- Update DiskUsage to handle 3 return values
- Fix NewConnectionWithIdentity call signature
- Remove duplicate setupRemoteConnection function
- Remove duplicate readRemoteCliFlags function
- Remove duplicate function declarations in
container_path_resolution.go, oci_conmon_linux.go
- Comment out duplicate SpecGenToOCI and helper
functions in oci.go/oci_linux.go
- Remove unused imports across multiple files
- Fix SSHMode flag handling (field doesn't exist in
current PodmanConfig)
- Fix ns.NetNS type handling in container_internal_linux.go
- Add missing Terminal() method to Container struct
- Add missing SdNotifySocket field to ContainerConfig
- Fix DefaultCapabilities to use .Get() method
- Fix cgroups.AvailableControllers reference
- Fix ConmonPath type conversion (attributedstring.Slice)
- Add missing ErrNetworkConnected error definition
- Fix NetworkCreateOptions handling in secrets.go
- Update networking code to use getNetNSPathCommon helper
- Fix teardownNetwork method signature
- Fix makeInspectPorts to makeInspectPortBindings
- Remove hardcoded IsPasta() checks
- Fix runtime_libpod.go field access patterns
All changes align with the v4.4.1-rhel worktree structure
to ensure compatibility with upcoming cherry-picks.
Substantially Assisted-by AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit e035eb4ffa)
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 9b1c32869f)
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Cherry-pick #15788 to v4.2.0-rhel branch per RHBZ 2157930
In view of https://github.com/containers/storage/pull/1337, do this:
for f in $(git grep -l stringid.GenerateNonCryptoID | grep -v '^vendor/'); do
sed -i 's/stringid.GenerateNonCryptoID/stringid.GenerateRandomID/g' $f;
done
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
follow-up to 6886e80b45
when "podman -rm -f" is used on a container in "stopping" state, also
make sure it is terminated before removing it from the local storage.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 4cf06fe7e0)
check that the container has a valid pid before attempting to use
kill($PID, 0) on it. If the PID==0, it means the container is already
stopped.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 494db3e166)
do not allow removing containers that are in the stopping state,
otherwise it can lead to a race condition where a "podman rm" removes
the container from the storage while another process is stopping the
same container.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2155828
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 6886e80b45)
When restarting a container, clean up the healthcheck state by removing
the old log on disk. Carrying over the old state can lead to various
issues, for instance, in a wrong failing streak and hence wrong
behaviour after the restart.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2144754
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
When shutting down the image engine we always wait for the image
even goroutine to finish writing any outstanding events. However,
the loop for that always waits 100msec every iteration. This means
that (depending on the phase) shutdown is always delayed up to 100msec.
This is delaying "podman run" extra much because podman is run twice
(once for the run and once as cleanup via a conmon callback).
Changing the image loop to exit immediately when a libimageEventsShutdown
(but first checking for any outstanding events to write) improves podman
run times by about 100msec on average.
Note: We can't just block on the event loop reading the shutdown event
anymore, we need to wait until it read and processed any outstanding
events, so we now send the shutdown event and then block waiting for the
channel to be closed by the event loop.
[NO NEW TESTS NEEDED]
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Fix the "stop" on-failure action by not removing the transient systemd
timer and service during container stop. Removing the service will
in turn cause systemd to terminate the Podman process attempting to
stop the container and hence leave it in the "stopping" state.
Instead move the removal into the restart sequence.
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Make sure that the on-failure actions only kick in once the health check
has passed its retries. Also fix race conditions on reading/writing the
log.
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
<MH: Addressed cherry-pick conflicts>
Backported to v4.2.0-rhel per RHBZ 2097708
Signed-off-by: Matthew Heon <mheon@redhat.com>
Also, do a general cleanup of all the timeout code. Changes
include:
- Convert from int to *uint where possible. Timeouts cannot be
negative, hence the uint change; and a timeout of 0 is valid,
so we need a new way to detect that the user set a timeout
(hence, pointer).
- Change name in the database to avoid conflicts between new data
type and old one. This will cause timeouts set with 4.2.0 to be
lost, but considering nobody is using the feature at present
(and the lack of validation means we could have invalid,
negative timeouts in the DB) this feels safe.
- Ensure volume plugin timeouts can only be used with volumes
created using a plugin. Timeouts on the local driver are
nonsensical.
- Remove the existing test, as it did not use a volume plugin.
Write a new test that does.
The actual plumbing of the containers.conf timeout in is one line
in volume_api.go; the remainder are the above-described cleanups.
Backported to v4.2.0-rhel per RHBZ 2125241
Signed-off-by: Matthew Heon <mheon@redhat.com>
For systems that have extreme robustness requirements (edge devices,
particularly those in difficult to access environments), it is important
that applications continue running in all circumstances. When the
application fails, Podman must restart it automatically to provide this
robustness. Otherwise, these devices may require customer IT to
physically gain access to restart, which can be prohibitively difficult.
Add a new `--on-failure` flag that supports four actions:
- **none**: Take no action.
- **kill**: Kill the container.
- **restart**: Restart the container. Do not combine the `restart`
action with the `--restart` flag. When running inside of
a systemd unit, consider using the `kill` or `stop`
action instead to make use of systemd's restart policy.
- **stop**: Stop the container.
To remain backwards compatible, **none** is the default action.
Backport of commit aad29e759c
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2097708
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
The process of saving the OCI spec is not particularly
reboot-safe. Normally, this doesn't matter, because we recreate
the spec every time a container starts, but if one was to reboot
(or SIGKILL, or otherwise fatally interrupt) Podman in the middle
of writing the spec to disk, we can end up with a malformed spec
that sticks around until the container is next started. Some
Podman commands want to read the latest version of the spec off
disk (to get information only populated after a container is
started), and will break in the case that a partially populated
spec is present. Swap to just ignoring these errors (with a
logged warning, to let folks know something went wrong) so we
don't break important commands like `podman inspect` in these
cases.
[NO NEW TESTS NEEDED] Provided reproducer involves repeatedly
rebooting the system
Backported to v4.2.0-rhel for RHBZ 2126697
Signed-off-by: Matthew Heon <mheon@redhat.com>
Commit 30e7cbccc1 accidentally added a deadlock as Podman was waiting
for the exit code to show up when the container transitioned to stopped.
Code paths that require the exit code to be written (by the cleanup
process) should already be using `(*Container).Wait()` in a deadlock
free way.
[NO NEW TESTS NEEDED] as I did not manage to a reproducer that would
work in CI. Ultimately, it's a race condition.
Backport-for: #15492
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2124716
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2125647
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Allow the cleanup process (and others) to transition the container from
`stopping` to `exited`. This fixes a race condition detected in #14859
where the cleanup process kicks in _before_ the stopping process can
read the exit file. Prior to this fix, the cleanup process left the
container in the `stopping` state and removed the conmon files, such
that the stopping process also left the container in this state as it
could not read the exit files. Hence, `podman wait` timed out (see the
23 seconds execution time of the test [1]) due to the unexpected/invalid
state and the test failed.
Further turn the warning during stop to a debug message since it's a
natural race due to the daemonless/concurrent architecture and nothing
to worry about.
[NO NEW TESTS NEEDED] since we can only monitor if #14859 continues
flaking or not.
[1] https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/6210434704343040/html/sys-remote-fedora-36-rootless-host.log.html#t--00205Fixes: #14859
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
do not attempt to lock all containers on pod rm since it can cause
deadlocks when other podman cleanup processes are attempting to lock
the same containers in a different order.
[NO NEW TESTS NEEDED]
Closes: https://github.com/containers/podman/issues/14929
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Improve the error message when looking up the exit code of a container.
The state of the container may help us track down #14859 which flakes
rarely and is impossible to reproduce on my machine.
[NO NEW TESTS NEEDED]
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
When running a single podman logs this is not really important since we
will exit when we finish reading the logs. However for the system
service this is very important. Leaking goroutines will cause an
increased memory and CPU ussage over time.
Both the the event and log backend have goroutine leaks with both the
file and journald drivers.
The journald backend has the problem that journal.Wait(IndefiniteWait)
will block until we get a new journald event. So when a client closes
the connection the goroutine would still wait until there is a new
journal entry. To fix this we just wait for a maximum of 5 seconds,
after that we can check if the client connection was closed and exit
correctly in this case.
For the file backend we can fix this by waiting for either the log line
or context cancel at the same time. Currently it would block waiting for
new log lines and only check afterwards if the client closed the
connection and thus hang forever if there are no new log lines.
[NO NEW TESTS NEEDED] I am open to ideas how we can test memory leaks in
CI.
To test manually run a container like this:
`podman run --log-driver $driver --name test -d alpine sh -c 'i=1; while [ "$i" -ne 1000 ]; do echo "line $i"; i=$((i + 1)); done; sleep inf'`
where `$driver` can be either `journald` or `k8s-file`.
Then start the podman system service and use:
`curl -m 1 --output - --unix-socket $XDG_RUNTIME_DIR/podman/podman.sock -v 'http://d/containers/test/logs?follow=1&since=0&stderr=1&stdout=1' &>/dev/null`
to get the logs from the API and then it closes the connection after 1 second.
Now run the curl command several times and check the memory usage of the service.
Fixes#14879
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
PR https://github.com/containers/common/pull/1071 moved `pkg/hooks` to
`c/common` hence remove that from podman and use `pkg/hooks` from
`c/common`
[NO NEW TESTS NEEDED]
[NO TESTS NEEDED]
Signed-off-by: Aditya R <arajan@redhat.com>
Update the init container type default to once instead
of always to match k8s behavior.
Add a new annotation that can be used to change the init
ctr type in the kube yaml.
Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
NFS Servers will thrown ENOTSUPP error if you attempt to
chown a directory to the same UID and GID as the directory
already has. If volumes are stored on NFS directories this
throws an ugly error and then works on the next try.
Bottom line don't chown directories that already have the correct
UID and GID.
Fixes: https://github.com/containers/podman/issues/14766
[NO NEW TESTS NEEDED] Difficult to setup an NFS Server in testing.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
[NO NEW TESTS NEEDED]
Empty path to runtime binary was printed instead of a real path.
Before fix:
TRAC[0000] found runtime ""
TRAC[0000] found runtime ""
After:
TRAC[0000] found runtime "/usr/bin/crun"
TRAC[0000] found runtime "/usr/bin/runc"
Signed-off-by: Mikhail Khachayants <khachayants@arrival.com>
* Correct spelling and typos.
* Improve language.
Co-authored-by: Ed Santiago <santiago@redhat.com>
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
While for some call paths we may be doing this redundantly we need to
make sure the exit code is always read at this point.
[NO NEW TESTS NEEDED] as I do not manage to reproduce the issue which
is very likely caused by a code path not writing the exit code when
running concurrently.
Fixes: #14859
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
If a pod is created without net sharing, allow adding
separate ports for each container to the kube yaml
and also set the pod level hostname correctly if the
uts namespace is not being shared.
Add a warning if the default namespace sharing options
have been modified by the user.
Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
