7591 commits

Author	SHA1	Message	Date
Ashley Cui	48dfbd2dd3	Vendor container-libs@main ... Signed-off-by: Ashley Cui <acui@redhat.com>	2026-09-01 11:30:39 -04:00
Paul Holzinger	2866ef50a1	Merge pull request #29684 from giuseppe/fix-overlay-volume-userns ... libpod: fix :O overlay volumes in a userns	2026-09-01 11:39:26 +02:00
Giuseppe Scrivano	c56c2fc5f8	libpod: do not block idmap with overlay (O) volumes ... Allow the `idmap` volume option to be combined with the overlay `O` option, e.g. `-v /src:/mnt:O,idmap` or `-v myvol:/mnt:O,idmap`. Previously any option other than `U`, `upperdir` and `workdir` combined with `O` was rejected. The parser in GenVolumeMounts now accepts `idmap` alongside `O` and rejects the first disallowed option instead of counting flags. The mappings from the container's user namespace are threaded onto the generated overlay mount so the runtime idmaps it. This is done for both the anonymous/host-path overlay volumes and the named-volume overlay path, which are handled by separate code. When a volume is idmapped the runtime shifts the mount so that on-disk IDs map identically into the container, so the overlay backing dirs (contentDir, upperdir, workdir) must be owned by real root (0) rather than the host IDs the container root maps to; otherwise they surface as the overflow ID inside the container and are inaccessible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>	2026-09-01 09:50:51 +02:00
Brent Baude	2702e99bbe	Merge pull request #29659 from Luap99/network-inspect-lock ... network inspect: do not walk all containers on no match	2026-08-31 09:36:22 -05:00
Paul Holzinger	9c4cfaf7d9	Merge pull request #29590 from prabhat-kumar96/fix-windows-hyperv-9p-detach ... pkg/machine/hyperv: detach 9p server from parent console	2026-08-31 15:57:11 +02:00
Paul Holzinger	1534b1ee86	network inspect: do not walk all containers on no match ... Avoid the expensive container walk when a non existing network is passed in. Because getting the network status needs to hold locks this could be blocked for a long time otherwise for no reason. Fixes: #29647 Signed-off-by: Paul Holzinger <pholzing@redhat.com>	2026-08-31 13:05:42 +02:00
Jan Rodák	c30add3f1c	Merge pull request #29667 from CodeWithAK28/remote-push-signing-error ... pkg/domain/infra/tunnel: error when signing a remote push	2026-08-31 11:32:46 +02:00
Anisha Khairnar	123b9024d5	pkg/domain/infra/tunnel: error when signing a remote push ... Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>	2026-08-28 12:17:51 +05:30
Jan Rodák	7a6c0a0504	Merge pull request #28100 from parmisean/parmisean/implement-ssh-session-type ... pkg/bindings: add dial-stdio fallback for SSH connections	2026-08-28 05:02:14 +02:00
Matt Heon	f542424eab	Merge pull request #29603 from gerryd/feature/create-passwd ... Add support for --passwd to the create command	2026-08-27 22:03:01 -04:00
Gerry Demaret	bd8de9f7aa	Add support for --passwd to the create command ... Give create the same --passwd flag as run currently has. Signed-off-by: Gerry Demaret <gerry@x-net.be>	2026-08-27 15:46:30 +02:00
prabhat-kumar96	debcacc699	pkg/machine: detach helper processes from parent console on Windows ... When starting a machine on Windows, background helper processes (podman.exe machine server9p, gvproxy, and win-sshproxy) could be terminated when the parent CMD/PowerShell session closed. 1. For podman.exe machine server9p (a console subsystem binary), set CreationFlags to CREATE_NO_WINDOW so it runs without attaching to the parent console. 2. For GUI binaries (gvproxy and win-sshproxy), configure DETACHED_PROCESS so they outlive the invoking console session. Fixes: #29573 Signed-off-by: prabhat-kumar96 <prabhatmathur9927@gmail.com>	2026-08-27 18:11:12 +05:30
Paul Holzinger	21326bf274	Merge pull request #29642 from vtushar06/bindings-parallel ... bindings: use a per-test network config dir, allow parallel	2026-08-27 12:52:39 +02:00
Tushar Verma	272f6e1321	bindings: wait for the exec session to finish ... ExecStart returning only means the session was started, so inspecting it straight after can still catch it running. It passed serially because echo is quick, but it failed the first time the suite ran under -p: [FAILED] session should not be running Expected <bool>: true to be false Wait for Running to go false before checking the exit code. Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>	2026-08-26 22:03:04 +05:30
Tushar Verma	a6c9e0954f	bindings: mark the network tests serial ... The network config dir is shared between all the services these tests start, on purpose, so podman can keep subnet allocation consistent. That means the unfiltered prune in the networks BeforeEach, and system.Prune which also prunes networks, would take out networks belonging to another test once the suite runs in parallel. Mark both describes serial like test/e2e does for its own network prune test rather than trying to give each test its own config dir. Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>	2026-08-26 22:03:04 +05:30
Sean Prouty	ee681f80e9	pkg/bindings: add dial-stdio fallback for SSH connections ... Fixes: #27814 Signed-off-by: Sean Prouty <parmisean@proton.me>	2026-08-26 09:05:12 -07:00
Matt Heon	a1c4f9c0e6	Merge pull request #29634 from hihry/fix/Overriding ... specgen: ensure keep-id overrides image USER	2026-08-26 11:57:00 -04:00
Danish Prakash	9dc5707a3d	Merge pull request #29638 from CodeWithAK28/bindings-no-serialize-auth-fields ... pkg/bindings: keep auth fields out of the query string	2026-08-26 12:49:50 +05:30
Himanshu Ravindra Iwanati	b8f7129a1a	specgen: ensure keep-id overrides image USER ... Fixes: #29600 Signed-off-by: Himanshu Ravindra Iwanati <work.himanshu.r.v@gmail.com>	2026-08-25 22:26:31 +05:30
Matt Heon	de350af4b1	Merge pull request #28447 from jude-ruben/fix/machine-image-permissions ... machine: ensure disk image is writable before resize (fix read-only image init failure)	2026-08-24 15:07:36 -04:00
Anisha Khairnar	b142e2e823	pkg/bindings: keep auth fields out of the query string ... Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>	2026-08-24 23:43:27 +05:30
Jude Ruben Fernando	73657e9267	Fix machine init failure with read-only disk image ... Fixes: #2756 Signed-off-by: Jude Ruben Fernando <rubenfdo@gmail.com> machine: fix stdpull internal imports Signed-off-by: Jude Ruben Fernando <rubenfdo@gmail.com>	2026-08-24 14:35:33 +00:00
Matt Heon	ee442ecc47	Merge pull request #29623 from ROKUMATE/test-machine-splitvolume ... pkg/machine/vmconfigs: add tests for SplitVolume	2026-08-24 09:54:26 -04:00
Miloslav Trmač	ca42cbff0a	Merge pull request #29628 from mehrdadbn9/fix/29627-stats-nil-pointer ... fix(api): nil check Memory.Limit before dereference in stats handler	2026-08-24 15:43:09 +02:00
ROKUMATE	724325b709	pkg/machine/vmconfigs: add tests for SplitVolume ... Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>	2026-08-24 15:15:20 +05:30
Jan Rodák	e14fafc21e	Merge pull request #29592 from CodeWithAK28/docs-dedup-generate-kube ... pkg/api/server: drop duplicate generate/kube swagger operation	2026-08-24 09:21:59 +02:00
Mehrdad Biukian Naeini	14506421f9	fix(api): nil check Memory.Limit before dereference in stats handler ... When a container has --memory-reservation set without --memory-limit, resources.Memory is non-nil but resources.Memory.Limit is nil. The compat stats handler dereferences the nil Limit pointer, causing a panic that returns a 500 to the client. Fix: add resources.Memory.Limit != nil guard before the dereference. Regression test added in test/apiv2/19-stats.at. Fixes #29627 Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>	2026-08-23 18:20:37 +04:00
Matt Heon	f19c577355	Merge pull request #29505 from nXtCyberNet/issue/proxy ... made the error message more understandable	2026-08-20 15:50:09 -04:00
Matt Heon	cf156a8ee3	Merge pull request #29468 from JamesBalazs/healthcheck-fix ... support healthcheck: {} inherits healthcheck from image	2026-08-20 15:42:15 -04:00
Matt Heon	f00ce00663	Merge pull request #29565 from magic-peach/fix-29555-kube-memory-emptydir-shared ... kube: share memory backed emptyDir between containers in a pod	2026-08-20 15:28:15 -04:00
Danish Prakash	9eb84c0977	Merge pull request #29588 from ROKUMATE/fix-bindings-generator-trimsuffix ... pkg/bindings/generator: use TrimSuffix to strip the .go extension	2026-08-21 00:00:34 +05:30
Matt Heon	a106ec60ec	Merge pull request #29593 from ROKUMATE/test-pkg-util-restartpolicy ... pkg/util: add tests for ParseRestartPolicy	2026-08-20 14:08:40 -04:00
Paul Holzinger	e9b8854cf4	Merge pull request #29563 from vishnukothakapu/perf-walkdir ... Performance: Upgrade filepath.Walk to filepath.WalkDir	2026-08-20 19:04:21 +02:00
ROKUMATE	a37ca160aa	pkg/util: add tests for ParseRestartPolicy ... ParseRestartPolicy parses the value of the --restart flag and had no unit test. It handles several distinct cases: bare policy names, the "never" -> "no" normalization (case-insensitive), on-failure with a retry count, and a number of error paths (retries specified on a non-on-failure policy, non-numeric or negative retry counts, and too many colon-separated fields). Add a table-driven unit test covering the happy paths and each error branch. Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>	2026-08-20 20:54:42 +05:30
Vishnu Kothakapu	7a71964303	Performance: Upgrade filepath.Walk to filepath.WalkDir ... filepath.Walk makes an expensive os.Stat system call on every file. filepath.WalkDir uses os.ReadDir under the hood to bypass this overhead, making directory scanning much faster. Fixes: #29562 Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>	2026-08-20 20:48:08 +05:30
Anisha Khairnar	c1e2ece120	pkg/api/server: drop duplicate generate/kube swagger operation ... Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>	2026-08-19 23:39:01 +05:30
Paul Holzinger	768072c6a8	Merge pull request #29572 from dexp007/main ... compat/secrets: do not expose secret data on inspect endpoint	2026-08-19 15:55:51 +02:00
ROKUMATE	c619e90e1c	pkg/bindings/generator: use TrimSuffix to strip the .go extension ... Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>	2026-08-19 18:28:33 +05:30
Davoud Azari	b57e7075e2	compat/secrets: do not expose secret data on inspect endpoint ... The Docker-compat secret inspect endpoint was incorrectly honoring the showsecret query parameter, which could expose plaintext secret data to clients using the Docker-compatible API. This restricts showsecret to libpod-only requests. Docker-compat clients always receive redacted secret data, matching Docker's own behavior. Add APIv2 tests covering the showsecret behavior on both the Docker-compat and libpod endpoints, confirming secret data is never returned from the compat endpoint while libpod continues to honor the flag. Fixes: #29570 Signed-off-by: Davoud Azari <davidmotral@gmail.com>	2026-08-19 14:30:37 +03:30
Matt Heon	f63cf24b00	Merge pull request #29460 from RudraDudhat2509/fix/hyperv-vsock-ready-timeout ... hyperv: add timeout to vsock ready wait	2026-08-19 05:11:28 -04:00
Jan Rodák	c21fb45ac8	Merge pull request #29378 from danishprakash/fix-farm-build-tag ... farm: handle tagged --tag references on build	2026-08-19 09:55:37 +02:00
Danish Prakash	5745ac69e0	farm: handle tagged --tag references on build ... podman farm build pushes each per-arch image to the registry by appending `UnknownDigestSuffix` to the image specified using --tag. This fails because a tag is not expected when UnknownDigestSuffix is used. Parse the image reference and pass only the untagged image reference when podman does this suffixed push to the registry. Fixes #25039 Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk> Signed-off-by: Danish Prakash <contact@danishpraka.sh>	2026-08-19 12:44:54 +05:30
nXtCyberNet	87ee2227b6	made the error message more understandable ... Signed-off-by: nXtCyberNet <rohantech2005@gmail.com>	2026-08-19 12:06:57 +05:30
Matt Heon	732e7c9d26	Merge pull request #29574 from CodeWithAK28/docs-manifest-api-params ... pkg/api/server: document missing manifest push and create params	2026-08-18 15:21:05 -04:00
Paul Holzinger	4d055045e5	Merge pull request #29489 from ashley-cui/tmpfs ... Compat v1.46: support HostConfig.Mounts.TmpfsOptions for containers/create	2026-08-18 15:37:15 +02:00
Anisha Khairnar	baddf266c1	pkg/api/server: document missing manifest push and create params ... The manifest push and create endpoints accept query parameters that were never documented, so API users can't discover them. Push was missing compressionFormat, compressionLevel, format and removeSignatures. Create was missing annotation and annotations. The wording matches the same parameters on the image push endpoint. The deprecated v3 push and add endpoints are left alone. Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>	2026-08-18 12:39:30 +05:30
Danish Prakash	598920feef	Merge pull request #29322 from ROKUMATE/test-pkg-machine-env ... pkg/machine/env: add tests for WithPodmanPrefix and dir prefixes	2026-08-18 10:08:39 +05:30
Jan Rodák	4b6873a5ef	Merge pull request #29527 from vishnukothakapu/perf-strings-equalfold ... Performance: Replace strings.ToLower with strings.EqualFold	2026-08-17 21:59:25 +02:00
Akanksha Trehun	70d9884ae9	kube: share memory backed emptyDir between containers in a pod ... An emptyDir with "medium: Memory" was translated into a per-container tmpfs mount, so every container in the pod received its own empty filesystem. Data written by an init container was therefore invisible to the regular containers, while Kubernetes specifies that an emptyDir is shared by all containers in the pod and outlives the init container. Create an anonymous named volume backed by tmpfs instead. Every container in the pod refers to the same volume name, so the mount is shared, and the volume is still removed together with the pod. The emptyDir sizeLimit is passed through as the tmpfs size option, which was previously ignored. Fixes: #29555 Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>	2026-08-17 17:58:17 +05:30
Paul Holzinger	5b366f4b34	Merge pull request #29511 from vishnukothakapu/perf-regexp-mustcompile ... Performance: Hoist regexp.MustCompile out of functions	2026-08-17 12:53:04 +02:00