Backports be5d1261b4
* mountNotifySocket consulted c.notifySocket, which was never populated.
Use persisted c.config.SdNotifySocket instead so the path matches
conmon's --sdnotify-socket and survives container restarts.
* Add WithSdNotifySocket and have MakeContainer read NOTIFY_SOCKET from
the environment when sdnotify mode is container.
* Related to upstream be5d1261b4 (libpod: Move mountNotifySocket to
container_internal_common.go), which introduced the shared
mountNotifySocket path this wiring completes.
Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Previously, for podman-remote builds, the compat handler set
`OutputFormat` from the client only, with no default. When the client
didn’t send `outputformat`, Buildah got `""` but still produced OCI
images. Cache lookup then compared the candidate’s OCI manifest type to
`""` and rejected it. Fix this by checking if `query.OutputFormat` is
empty, then if so set `format = buildah.OCIv1ImageManifest` before
calling Buildah, so cache checks match the OCI images that are actually
built.
Also fix a bug so podman-remote is correctly sent the `layers` option
even when it's false (by whatever means). This makes the bindings match
the behavior of a regular `podman build`.
Produced with significant assistance from AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
* Default layers=true for both Docker compat and libpod clients
* Allow builds to stop if a remote client disconnects.
Signed-off-by: Chris Evich <cevich@redhat.com>
Add flush() between Aux and Stream JSON objects in the build API response
to ensure each object is sent separately. Docker clients (e.g. docker-py)
expect one JSON object per read; without this flush, Aux and Stream could
be buffered together causing parse failures.
Backport of cdb00332da (Fix compat build API returning two JSON objects at once)
Closes: containers/podman#16360
AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
Refactored secrets API in common for stability purposes. Move podman to
said API.
[NO NEW TESTS NEEDED]
Signed-off-by: Ashley Cui <acui@redhat.com>
(cherry picked from commit 72e715a110)
Signed-off-by: Chris Evich <cevich@redhat.com>
While mounting virtual console devices in a systemd container is a
recipe for disaster (I experienced it first hand), mounting serial
console devices, modems, and others should still be done by default
for privileged systemd-based containers.
v2, addressing the review from @fho:
- use backticks in the regular expression to remove backslashes
- pre-compile the regex at the package level
- drop IsVirtualTerminalDevice (not needed for a one-liner)
v3, addressing the review from @fho and @rhatdan:
- re-introduce a private function for matching the device names
- use path.Match rather than a regex not to slow down startup time
Closes#16925.
Fixes: 5a2405ae1b ("Don't mount /dev/tty* inside privileged...")
Cherry-picked from f4c81b0aa5 with
conflict resolution (accept incoming test updates) and additional
systemdMode handling for rootless: only skip /dev/ptmx, /dev/tty,
and virtual consoles (tty0, tty1, ...); pass non-vt TTYs (ttyS0,
ttyACM0, etc.) through to privileged rootless containers.
AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>
Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
Add sha256: prefix to image IDs in compat API history responses for
Docker compatibility. Excludes bash test changes as those were already
added by the previous commit.
Fixes: https://github.com/containers/podman/issues/17762
(partial cherry-pick from commit edaf3b4d5e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
The default_ulimits field is currently ignored in podman run commands.
This PR fixes this.
Fixes: https://github.com/containers/podman/issues/17396
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
(cherry picked from commit 6046832f3e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
Use the new FindInitBinary() function to lookup the init binary, this
allows the use of helper_binaries_dir in contianers.conf[1]
[NO NEW TESTS NEEDED]
[1] https://github.com/containers/common/issues/1110
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit efe5e98d06)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 2c0cd36ba4)
After[1] c/image no longer prints "Storing signatures" so we should
not check for it.
[1] https://github.com/containers/image/pull/2001
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 4231526e18)
The common v0.57.7 vendor bump added !remote build tags to libimage,
causing podman-remote builds to fail. This change splits files that
use libimage into separate _local and _remote variants:
- pkg/specgen/specgen_{local,remote}.go: Image field storage and methods
- pkg/api/handlers/types_local.go: ImageDataToImageInspect function
- cmd/podman/utils/error_local.go: ExitCodeFromBuildError function
This allows type definitions to be shared between remote and local
builds while keeping libimage-dependent implementations local-only.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Commit "Fix compilation errors for v4.4.1-rhel compatibility"
introduced both go-criu/v5 and go-criu/v6 dependencies, causing a
protobuf registration conflict error:
panic: proto: file "stats/stats.proto" is already registered
previously from: "github.com/checkpoint-restore/go-criu/v5/stats"
currently from: "github.com/checkpoint-restore/go-criu/v6/stats"
Fix this by:
- Removing go-criu/v5 from go.mod
- Updating all imports from v5 to v6 in:
* pkg/criu/criu_linux.go
* pkg/checkpoint/crutils/checkpoint_restore_utils.go
* test/e2e/checkpoint_test.go
- Regenerating vendor directory with 'make vendor'
Generated with the Assistance of AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
Align codebase with v4.4.1-rhel PodmanConfig structure
and API signatures to resolve compilation errors.
- Update all cfg.Engine.* references to
cfg.ContainersConf.Engine.* or
cfg.ContainersConfDefaultsRO.Engine.*
- Update all cfg.Network.* references to
cfg.ContainersConf.Network.*
- Update all cfg.Containers.* references to
cfg.ContainersConf.Containers.* or
cfg.ContainersConfDefaultsRO.Containers.*
- Update cfg.Machine.* references to
cfg.ContainersConfDefaultsRO.Machine.*
- Fix PodmanConfig initialization in config.go to use
ContainersConf and ContainersConfDefaultsRO fields
- Add createOptions parameter to NetworkCreate method
across all implementations (abi, tunnel, handlers)
- Update ContainerEngine interface to match new
NetworkCreate signature
- Fix manager.Store call in secrets.go to use
StoreOptions struct
- Update DiskUsage to handle 3 return values
- Fix NewConnectionWithIdentity call signature
- Remove duplicate setupRemoteConnection function
- Remove duplicate readRemoteCliFlags function
- Remove duplicate function declarations in
container_path_resolution.go, oci_conmon_linux.go
- Comment out duplicate SpecGenToOCI and helper
functions in oci.go/oci_linux.go
- Remove unused imports across multiple files
- Fix SSHMode flag handling (field doesn't exist in
current PodmanConfig)
- Fix ns.NetNS type handling in container_internal_linux.go
- Add missing Terminal() method to Container struct
- Add missing SdNotifySocket field to ContainerConfig
- Fix DefaultCapabilities to use .Get() method
- Fix cgroups.AvailableControllers reference
- Fix ConmonPath type conversion (attributedstring.Slice)
- Add missing ErrNetworkConnected error definition
- Fix NetworkCreateOptions handling in secrets.go
- Update networking code to use getNetNSPathCommon helper
- Fix teardownNetwork method signature
- Fix makeInspectPorts to makeInspectPortBindings
- Remove hardcoded IsPasta() checks
- Fix runtime_libpod.go field access patterns
All changes align with the v4.4.1-rhel worktree structure
to ensure compatibility with upcoming cherry-picks.
Substantially Assisted-by AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit e035eb4ffa)
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 6597a24d6c)
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
(cherry picked from commit 9b1c32869f)
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Signed-off-by: Chris Evich <cevich@redhat.com>
For ConfigMap and Secret kube play volumes podman populates the data
from the yaml. However the volume content is not controlled by us and we
can be tricked following a symlink to a file on the host instead.
Fixes: CVE-2025-9566
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Someone please revert this once quay search is fixed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
<MH: Cherry-pick into v4.2.0-rhel to fix CI>
Signed-off-by: Matt Heon <mheon@redhat.com>
Docker's newer clients popuates `cacheFrom` and `cacheTo` parameter
by default as empty array for all commands but buildah's design of
distributed cache expects this to be a repo not image hence parse
only the first populated repo and igore if empty array.
Signed-off-by: Aditya R <arajan@redhat.com>
We are unmarshaling and re-marshaling JSON, which can _silently_ drop data
with the Go design decision.data.
Try harder, by using json.RawMessage at least for the data we care about.
Alternatively, this could use json.Decoder.DisallowUnknownFields.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
sigstoreSigned does not have GPG IDs, so we add N/A in that column.
NOTE: this does not show the use-sigstore-attachments value from
registries.d.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Currently
- the output uses the first entry's type, even if the requirements are different
(notably signedBy + sigstoreSIgned)
- all public keys IDs are collected to a single line, even if some of them
are interchangeable, and some are required (e.g. two signedBy requirements
could require an image to be signed by (redhatProd OR redhatBeta) AND (vendor1 OR vendor2)
So, stop collapsing the requirements, and return a separate entry for each one. Multiple
GPG IDs on a single line used to mean AND or OR, now they always mean AND.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Do the registries.d lookup once, separately from building
an entry, so that we can share it across entries.
Also prepare a separate res to allow adding multiple entries.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Just so that we don't have a boolean-named function returning a struct.
Also reorder the parameters to have the container first, and the lookup
key second.
Shoud not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Now that it is the primary return value of a small function,
the long name only makes reading harder.
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This will evetually allow us to use it for the default scope
as well, which currently uses a simplified version.
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Add at least a basic unit test for the various entry types.
So that we don't have to actually deal with GPG keys and /usr/bin/gpg*,
parametrize the code with a gpgIDReader , and pass a fake one
in the unit test.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
We now have only a few entrypoints that are called externally,
so make the rest private. This will make it more obvious that
we are not breaking any external users.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This will allow us to write unit tests without setting up the complete Podman runtime
(and without the Linux dependency).
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
NOTE: This does not edit the use-sigstore-attachments value
in registries.d, similarly to how (podman image trust set) didn't
set the lookaside paths for simple signing.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Also reject public keys with types that don't use them
- Reject unknown trust types
- And add unit tests
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This will allow us to write unit tests without setting up the complete Podman runtime
(and without the Linux dependency).
Also, actually add a basic smoke test of the core functionality.
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Only process the incoming args[] (which is a single-element array
for some reason) once, and use a semantic variable name for the value
we care about.
Should not change behavior, the only caller already supposedly ensures
that len(args) == 1.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Split the existing code into policy.go and registries.go,
depending on which files it concerns.
Only moves unchanged code, should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
We can always recover it from git, but it seems to serve
no purpose anyway.
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Also, do a general cleanup of all the timeout code. Changes
include:
- Convert from int to *uint where possible. Timeouts cannot be
negative, hence the uint change; and a timeout of 0 is valid,
so we need a new way to detect that the user set a timeout
(hence, pointer).
- Change name in the database to avoid conflicts between new data
type and old one. This will cause timeouts set with 4.2.0 to be
lost, but considering nobody is using the feature at present
(and the lack of validation means we could have invalid,
negative timeouts in the DB) this feels safe.
- Ensure volume plugin timeouts can only be used with volumes
created using a plugin. Timeouts on the local driver are
nonsensical.
- Remove the existing test, as it did not use a volume plugin.
Write a new test that does.
The actual plumbing of the containers.conf timeout in is one line
in volume_api.go; the remainder are the above-described cleanups.
Backported to v4.2.0-rhel per RHBZ 2125241
Signed-off-by: Matthew Heon <mheon@redhat.com>
Trying to print the image id on a failed inspect will result in a nil
pointer panic because the image will be nil. Replace image.id with the
image name which is defined as a string without the use of inspect.
Fixes: bz#2131836
[NO NEW TESTS NEEDED]
Signed-off-by: Brent Baude <bbaude@redhat.com>
For systems that have extreme robustness requirements (edge devices,
particularly those in difficult to access environments), it is important
that applications continue running in all circumstances. When the
application fails, Podman must restart it automatically to provide this
robustness. Otherwise, these devices may require customer IT to
physically gain access to restart, which can be prohibitively difficult.
Add a new `--on-failure` flag that supports four actions:
- **none**: Take no action.
- **kill**: Kill the container.
- **restart**: Restart the container. Do not combine the `restart`
action with the `--restart` flag. When running inside of
a systemd unit, consider using the `kill` or `stop`
action instead to make use of systemd's restart policy.
- **stop**: Stop the container.
To remain backwards compatible, **none** is the default action.
Backport of commit aad29e759c
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2097708
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
