Same issue as "podman cp from ctr chown" - the test fails when copying
a file from a container to an existing file on the host. Remote cp
tries to create a directory at the destination, resulting in:
Error: mkdir /tmp/746758151: not a directory
This is the same bug in the remote cp implementation where it doesn't
handle copying to an existing file path. Fix exists in commit
b0836ab624 but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test fails in podman-remote when copying a file from a container
to an existing file on the host. The remote cp implementation tries
to create a directory at the destination path, resulting in:
Error: mkdir /tmp/1457882724: not a directory
This is a bug in the remote cp implementation where it doesn't
properly handle copying to an existing file. A fix exists in commit
b0836ab624 (branch cve-441-crio) but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
The test builds two images where the second image shares some steps
with the first, expecting cache layers to be shared. When the second
image is removed, only 2 images should be deleted (the final image +
one unique intermediate layer). However, in remote mode, cache isn't
shared, so 4 images are deleted instead.
This test was originally skipped for remote (commit pre-4b8df5903f)
with the note "FIXME This should work on podman-remote, problem is
with podman-remote build". It was enabled in commit 4b8df5903f
assuming the issue was fixed, but the underlying cache reuse problem
persists.
Re-add SkipIfRemote until the cache layer sharing issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
When building with --layers=true, the test expects intermediate cache
layers to be reused between builds, resulting in only 2 dangling images.
However, in remote mode, cache isn't reused properly, creating duplicate
intermediate images (5 total instead of 2).
This test was originally skipped for remote (commit d832136349) with
the note "podman-remote build is not working the same as local build".
It was enabled in commit 4b8df5903f assuming the issue was fixed, but
the underlying cache reuse problem persists.
Re-add SkipIfRemote until the cache layer reuse issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The panic occurred because PodmanTestCreateUtil tried to create lock
files in /run/podman before the directory existed. The directory was
only created later in StartRemoteService(), causing all 1000 create
attempts to fail with "no such file or directory" rather than the
expected "file exists" collision error.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add //go:build !remote_testing constraint to build_test.go since it
imports buildah, which depends on libimage. The libimage package has
!remote build constraints, causing compilation failures when this test
is included in remote integration tests.
Fixes the "build constraints exclude all Go files" error in
make remoteintegration.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
WaitForFile only checks if the socket file exists on the filesystem, but
the plugin may not be listening yet. Add a small delay after WaitForFile
to ensure the plugin is actually ready to accept connections.
This fixes flaky volume plugin tests that fail with 'connection refused'
even though the socket file exists.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Wait for the socket to be ready befor trying to create a volume with the
driver.
Fixes: #17956
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
(cherry picked from commit 70abb4ae5b)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We have a lot of systemd and quadlet based tests in the system tests.
This test doesn't seem very useful and it seems to flake so just remove
it.
Fixes#23480
(partial cherry-pick from commit 57016f5cc3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
When loading from an OCI directory without an explicit image name, the
image is now stored by digest instead of using the path as the name.
Update the test to verify the load succeeded and output contains the
sha256 digest, rather than checking for a specific image name.
This aligns with the behavior change from containers/common and fixes
the rootful localintegration test failure.
(partial cherry-pick from commit e66c04c1f7)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The wildcard search test uses registry.access.redhat.com which has been
historically unreliable and often returns no results for wildcard
searches.
In v5+, this test was replaced with a mock registry server (commit
d6f660076b in Oct 2025), but that infrastructure is not available on
v4.4.1-rhel.
Skip the test to avoid flakes from external registry unavailability.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The "podman pull by digest and list --all" e2e test pulls an image using
a tagged reference when an image with the same ID is already present in
a read-only additional image store.
This causes a new image record to be created in read-write storage.
The test then removes this entry, pulls the image again using a digested
reference, and then expects the image to not have any tagged names in it
when it goes to look at it again.
Newer containers/storage will ensure that at the point when the
read-write image record is created, that it includes all of the data
items and naming information from the read-only copy of the image, so
that this information doesn't appear to be lost.
Change the test to use "untag" instead of "rmi", which should pass with
either the older or newer containers/storage.
The test is checking that `podman images` doesn't choke when it
encounters a digested name attached to an image, so the difference in
behavior between containers/storage versions is irrelevant.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
(cherry picked from commit a428555e3e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of container-device-interface
from v0.5.3 to v0.5.4 which requires CDI spec version 0.3.0.
(partial cherry-pick from commit e9942c61dd)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We no longer allow to match ids in the middle, this makes no realy
sense. ID matches should always be by prefix.
https://github.com/containers/podman/issues/18471
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 63f5116ad3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Update the secret name validation test to use names that actually
violate the validation rules. The previous test used "?!" which is
not actually invalid.
Secret names cannot include '=', '/', ',', or '\0' (NULL) characters.
Update to use "foo/bar" and "foo=bar" as test cases.
This is a partial cherry-pick of the test changes from the vendor
update commit that fixed secret name validation.
(partial cherry-pick from commit 13a9500166)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
On RHEL 9, 'nc' is a symlink to 'ncat' (from nmap). With ncat, the -p
flag is for source port (outgoing connections), not the listening port.
For listening, the port is specified as a positional argument.
This fixes the error: "nc: cannot use -p and -l"
Changes:
- nc -v -n -l -p <port> → nc -v -n -l <port>
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The OCI directory pull behavior changed in containers/common (Aug 2023)
to require explicit image names. Without an explicit name, images are
now stored by digest and appear as <none>:<none> in podman images.
Update two test cases to use the new syntax:
- "podman pull from local OCI directory"
- "podman pull and decrypt / From oci"
Changes:
- Use oci:/path:imagename instead of oci:/path
- Check for explicit image name instead of auto-generated path-based name
- Add -q flags for quieter test output
This aligns the tests with the main branch and fixes rootful
localintegration test failures.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Use the new FindInitBinary() function to lookup the init binary, this
allows the use of helper_binaries_dir in contianers.conf[1]
[NO NEW TESTS NEEDED]
[1] https://github.com/containers/common/issues/1110
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit efe5e98d06)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The --hooks-dir flag was being parsed but never applied to the engine
configuration, causing hooks to not be loaded from the specified directory.
This adds the missing code to transfer the flag value to the runtime config
when the flag is set.
Backported from commit e966c86d98 (container.conf: support attributed string
slices) which introduced this fix in the main branch as part of a larger
refactoring. This is a minimal backport containing only the hooks-dir fix.
Fixes integration test failure: "podman test hooks"
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The ginkgo-run target was unconditionally adding the "remote" build tag
to all integration tests, which excluded all libimage source files (they
have "// +build !remote" constraints). This caused localintegration
tests to fail with "build constraints exclude all Go files" errors.
Also fix test compilation errors introduced in commit 0cdddfa8f7:
- Update libimage import to libimage/define for ManifestListData type
- Replace undefined CITEST_IMAGE with ALPINE constant
- Fix getConfigMapVolume call signature (3 params, not 4)
- Replace non-existent PodmanExitCleanly with standard test pattern
- Fix ExitWithError assertion to use Exit() and ContainSubstring()
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
When removing storage containers without force, if the mount status
check fails with an error other than ErrContainerUnknown, return that
error instead of logging a warning and continuing. The previous behavior
allowed containers to be removed even when we couldn't verify their mount
status, causing the 'podman ps --external' test to fail inconsistently
across different infrastructures.
This makes the mount check fail-safe: if we can't determine whether a
container is mounted, we error out rather than allowing deletion.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The previous commit introduced usage of unix.ENOTSUP but forgot to
import golang.org/x/sys/unix, causing a build failure on RHEL 9.2.0.
Fixes the build error:
libpod/container_internal_common.go:2800:20: undefined: unix
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We were ignoreing relabel requests on certain unsupported
file systems and not on others, this changes to consistently
logrus.Debug ENOTSUP file systems.
Fixes: https://github.com/containers/podman/discussions/20745
Still needs some work on the Buildah side.
(partial cherry-pick from commit ddd6cdfd77)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The journald_unavailable() helper was testing 'journalctl -n 1' which
checks the general system journal, but quadlet and auto-update tests
actually need to read user systemd unit logs.
On some RHEL systems, the general journal works but reading user unit
logs fails with 'No journal files were found'.
Update the function to test the actual use case: reading logs from
user systemd units with 'journalctl --user --unit=...'. This properly
detects when user unit logging is unavailable so tests skip correctly.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
After[1] c/image no longer prints "Storing signatures" so we should
not check for it.
[1] https://github.com/containers/image/pull/2001
(partial cherry-pick from commit 6eaf8a271d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The buildah buil kill trick is bad as we have to sleep and wait to aboid
flakes which takes time. Instead it is possible to redo this build part
manually with buildah commands. It is not trival and harder to
understand but it safes 2-3s so I think it is worth it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 350dfabf66)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Make safename() invocations consistent within the same
test. This puts the onus on the caller to add a unique
element when calling multiple times, e.g. "ctr1-$(safename)".
This is not too much of a burden. Major benefit is making
it easy for a reader to associate containers, pods, volumes,
images within a given test.
And, use dashes, not underscores. "podman generate kube"
removes underscores, making it very difficult to do
things like "podman inspect $podname" (because we need
to generate "$podname_with_underscores_removed")
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 380ed3a40d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Many system tests use hardcoded names for containers, images,
and everything. This has worked because system tests run
serially. It will not work if we ever run in parallel.
Create a new safename() helper, and use it as follows:
myctr=c_$(safename)
myvol1=v1_$(safename)
...
Find current instances of hardcoded names, and replace
with safe ones.
Whether or not we ever end up parallelizing system tests,
this is simply good practice.
There are far too many instances to fix in one (reviewable) PR.
This is commit 1 of N.
(partial cherry-pick from commit b28027148b)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The podman-remote build command was not displaying build output, causing
remotesystem tests to fail when expecting output like "COMMIT", "cache",
"Successfully built", etc.
Root causes:
1. BuildOptions.Out was set to nil when no --logfile was specified,
causing all build output to be discarded
2. BuildOptions.Err was not set, preventing auxiliary build output
from being displayed
Changes:
- Set Out and Err to default to os.Stdout and os.Stderr respectively
- Both redirect to logfile when --logfile is specified
- Remove incorrect client-side quiet flag handling (already handled
by build engine via Quiet option)
This matches the behavior of the non-remote build implementation in
build.go and ensures build output is properly streamed from the server
through the bindings to the client's stdout/stderr.
Fixes test failures in make remotesystem for build-related tests.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test was using old expectations that required all containers to
have system_r role. The updated version from main branch correctly
expects that privileged/pid=host/ipc=host/label=disable containers
run with the current user and role, not system_r. This is intentional
behavior to support confined users (see commit 5b7dce8a3d).
This brings the test expectations in line with the actual behavior.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This fixes several cp-related issues in podman-remote:
- Enable container-to-container copy support
- Fix symlink expansion for broken symlinks
- Fix cp from /dev/stdin
- Fix directory extraction to non-existent destination
- Add validation for copying directory to file
- Fix trailing slash handling for broken symlinks
- Fix stdin validation and --overwrite flag support
- Require existing directory destination when copying from stdin
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test framework was not parsing the '+w' suffix in expected exit
codes (e.g., '0+w' meaning "expect exit code 0 and warnings allowed").
This caused the literal string to be passed as a command argument to
podman, resulting in "unrecognized command" errors.
Added pattern matching for:
- [0-9]+w (single digit with warnings)
- [1-9][0-9]+w (double digit with warnings)
- [12][0-9][0-9]+w (triple digit with warnings)
The '+w' suffix is stripped off and only the numeric exit code is used
for validation. Note: The actual warning validation is not implemented
yet, but this allows tests using the '+w' notation to run correctly.
This fixes the "podman-remote: non-default connection" test failure.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The original cp.go uses buildah/copier which depends on libimage,
making it unavailable in remote builds. This change splits cp
implementation into separate local and remote variants:
- cmd/podman/containers/cp.go: Shared command definitions, flags, and
init function (no build tag)
- cmd/podman/containers/cp_local.go: Local implementation using
buildah/copier (//go:build !remote)
- cmd/podman/containers/cp_remote.go: Remote implementation using
stdlib archive/tar (//go:build remote)
The remote implementation:
- Uses ContainerEngine interface methods that work over REST API:
ContainerStat, ContainerCopyToArchive, ContainerCopyFromArchive
- Properly handles file and directory copying in both directions
- Uses CopyOptions.Rename for file renaming when copying to specific
filenames
- Returns error for container-to-container copying (not supported with
podman-remote)
This follows the same pattern used for other libimage-dependent code
in commit 4231526e18.
Fixes system tests that require cp functionality with podman-remote.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This commit fixes three related issues that prevented userns=auto from
working correctly in rootless containers:
1. Fix setgroups() error with userns=auto
When using userns=auto, supplementary GIDs from the container image
were being passed to setgroups() before user namespace mappings were
allocated by storage, causing EINVAL errors. Added a check in
container_internal_common.go to skip supplementary groups when
AutoUserNs is enabled but GIDMap isn't populated yet.
2. Fix ID mapping allocation bug in storage.go
CreateContainerStorage was returning empty UID/GID mappings from the
input options parameter instead of the allocated mappings from the
storage container object, causing containers to fail with "readlink:
No such file or directory" errors. Changed the return statement to
use container.UIDMap and container.GIDMap.
3. Add workaround for containers/storage v1.51.0 bug
The vendored storage library has a bug in parseMountedFiles where
groupFile path is incorrectly used as a directory path. Set an
explicit Size=65536 in AutoUserNsOpts to bypass the buggy code path.
With these fixes, all userns=auto tests in 170-run-userns.bats now pass
in rootless mode.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The events file backend writes events as they're generated, which may
not match chronological order due to race conditions during concurrent
operations in rmi -f. The remove and untag events from rmi can appear
in any order in the events file.
This matches the approach used in main branch (see commit 111a4bbe71)
which recognizes that event ordering is not guaranteed for concurrent
operations, especially in podman-remote.
This fix:
- Simplifies initial validation to check for event presence (not order)
- Checks deterministic events (0-6) in exact order
- Validates rmi events (7-9) are present without requiring specific order
- Checks final event (10) is the second loadfromarchive
- Does NOT modify runtime code to enforce ordering (events remain as-generated)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This commit fixes two issues in runtime initialization that occur when
vendor code doesn't properly set StaticDir and VolumePath defaults:
1. Add defensive initialization for StaticDir and VolumePath
- Check if StaticDir is empty and set it to GraphRoot/libpod
- Check if VolumePath is empty and set it to GraphRoot/volumes
- This works around missing initialization in older vendor code
without requiring changes to the vendor directory
2. Fix database initialization to allow creating new bolt_state.db
- Previously, getDBState() would fail if bolt_state.db didn't exist
- Now, only return error if it's not os.ErrNotExist
- This allows NewBoltState() to create the database on first run
These changes resolve the "creating runtime static files directory:
mkdir : no such file or directory" error that occurred when running
podman commands.
Tested with:
- podman ps, info, version commands work correctly
- Volume operations create volumes at correct path
- Database is properly initialized on first run
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The common v0.57.7 vendor bump added !remote build tags to libimage,
causing podman-remote builds to fail. This change splits files that
use libimage into separate _local and _remote variants:
- pkg/specgen/specgen_{local,remote}.go: Image field storage and methods
- pkg/api/handlers/types_local.go: ImageDataToImageInspect function
- cmd/podman/utils/error_local.go: ExitCodeFromBuildError function
This allows type definitions to be shared between remote and local
builds while keeping libimage-dependent implementations local-only.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
