Same issue as "podman cp from ctr chown" - the test fails when copying
a file from a container to an existing file on the host. Remote cp
tries to create a directory at the destination, resulting in:
Error: mkdir /tmp/746758151: not a directory
This is the same bug in the remote cp implementation where it doesn't
handle copying to an existing file path. Fix exists in commit
b0836ab624 but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test fails in podman-remote when copying a file from a container
to an existing file on the host. The remote cp implementation tries
to create a directory at the destination path, resulting in:
Error: mkdir /tmp/1457882724: not a directory
This is a bug in the remote cp implementation where it doesn't
properly handle copying to an existing file. A fix exists in commit
b0836ab624 (branch cve-441-crio) but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
The test builds two images where the second image shares some steps
with the first, expecting cache layers to be shared. When the second
image is removed, only 2 images should be deleted (the final image +
one unique intermediate layer). However, in remote mode, cache isn't
shared, so 4 images are deleted instead.
This test was originally skipped for remote (commit pre-4b8df5903f)
with the note "FIXME This should work on podman-remote, problem is
with podman-remote build". It was enabled in commit 4b8df5903f
assuming the issue was fixed, but the underlying cache reuse problem
persists.
Re-add SkipIfRemote until the cache layer sharing issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
When building with --layers=true, the test expects intermediate cache
layers to be reused between builds, resulting in only 2 dangling images.
However, in remote mode, cache isn't reused properly, creating duplicate
intermediate images (5 total instead of 2).
This test was originally skipped for remote (commit d832136349) with
the note "podman-remote build is not working the same as local build".
It was enabled in commit 4b8df5903f assuming the issue was fixed, but
the underlying cache reuse problem persists.
Re-add SkipIfRemote until the cache layer reuse issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The panic occurred because PodmanTestCreateUtil tried to create lock
files in /run/podman before the directory existed. The directory was
only created later in StartRemoteService(), causing all 1000 create
attempts to fail with "no such file or directory" rather than the
expected "file exists" collision error.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add //go:build !remote_testing constraint to build_test.go since it
imports buildah, which depends on libimage. The libimage package has
!remote build constraints, causing compilation failures when this test
is included in remote integration tests.
Fixes the "build constraints exclude all Go files" error in
make remoteintegration.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
WaitForFile only checks if the socket file exists on the filesystem, but
the plugin may not be listening yet. Add a small delay after WaitForFile
to ensure the plugin is actually ready to accept connections.
This fixes flaky volume plugin tests that fail with 'connection refused'
even though the socket file exists.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Wait for the socket to be ready befor trying to create a volume with the
driver.
Fixes: #17956
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
(cherry picked from commit 70abb4ae5b)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We have a lot of systemd and quadlet based tests in the system tests.
This test doesn't seem very useful and it seems to flake so just remove
it.
Fixes#23480
(partial cherry-pick from commit 57016f5cc3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
When loading from an OCI directory without an explicit image name, the
image is now stored by digest instead of using the path as the name.
Update the test to verify the load succeeded and output contains the
sha256 digest, rather than checking for a specific image name.
This aligns with the behavior change from containers/common and fixes
the rootful localintegration test failure.
(partial cherry-pick from commit e66c04c1f7)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The wildcard search test uses registry.access.redhat.com which has been
historically unreliable and often returns no results for wildcard
searches.
In v5+, this test was replaced with a mock registry server (commit
d6f660076b in Oct 2025), but that infrastructure is not available on
v4.4.1-rhel.
Skip the test to avoid flakes from external registry unavailability.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The "podman pull by digest and list --all" e2e test pulls an image using
a tagged reference when an image with the same ID is already present in
a read-only additional image store.
This causes a new image record to be created in read-write storage.
The test then removes this entry, pulls the image again using a digested
reference, and then expects the image to not have any tagged names in it
when it goes to look at it again.
Newer containers/storage will ensure that at the point when the
read-write image record is created, that it includes all of the data
items and naming information from the read-only copy of the image, so
that this information doesn't appear to be lost.
Change the test to use "untag" instead of "rmi", which should pass with
either the older or newer containers/storage.
The test is checking that `podman images` doesn't choke when it
encounters a digested name attached to an image, so the difference in
behavior between containers/storage versions is irrelevant.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
(cherry picked from commit a428555e3e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of container-device-interface
from v0.5.3 to v0.5.4 which requires CDI spec version 0.3.0.
(partial cherry-pick from commit e9942c61dd)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We no longer allow to match ids in the middle, this makes no realy
sense. ID matches should always be by prefix.
https://github.com/containers/podman/issues/18471
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 63f5116ad3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Update the secret name validation test to use names that actually
violate the validation rules. The previous test used "?!" which is
not actually invalid.
Secret names cannot include '=', '/', ',', or '\0' (NULL) characters.
Update to use "foo/bar" and "foo=bar" as test cases.
This is a partial cherry-pick of the test changes from the vendor
update commit that fixed secret name validation.
(partial cherry-pick from commit 13a9500166)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
On RHEL 9, 'nc' is a symlink to 'ncat' (from nmap). With ncat, the -p
flag is for source port (outgoing connections), not the listening port.
For listening, the port is specified as a positional argument.
This fixes the error: "nc: cannot use -p and -l"
Changes:
- nc -v -n -l -p <port> → nc -v -n -l <port>
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The OCI directory pull behavior changed in containers/common (Aug 2023)
to require explicit image names. Without an explicit name, images are
now stored by digest and appear as <none>:<none> in podman images.
Update two test cases to use the new syntax:
- "podman pull from local OCI directory"
- "podman pull and decrypt / From oci"
Changes:
- Use oci:/path:imagename instead of oci:/path
- Check for explicit image name instead of auto-generated path-based name
- Add -q flags for quieter test output
This aligns the tests with the main branch and fixes rootful
localintegration test failures.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The ginkgo-run target was unconditionally adding the "remote" build tag
to all integration tests, which excluded all libimage source files (they
have "// +build !remote" constraints). This caused localintegration
tests to fail with "build constraints exclude all Go files" errors.
Also fix test compilation errors introduced in commit 0cdddfa8f7:
- Update libimage import to libimage/define for ManifestListData type
- Replace undefined CITEST_IMAGE with ALPINE constant
- Fix getConfigMapVolume call signature (3 params, not 4)
- Replace non-existent PodmanExitCleanly with standard test pattern
- Fix ExitWithError assertion to use Exit() and ContainSubstring()
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The journald_unavailable() helper was testing 'journalctl -n 1' which
checks the general system journal, but quadlet and auto-update tests
actually need to read user systemd unit logs.
On some RHEL systems, the general journal works but reading user unit
logs fails with 'No journal files were found'.
Update the function to test the actual use case: reading logs from
user systemd units with 'journalctl --user --unit=...'. This properly
detects when user unit logging is unavailable so tests skip correctly.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
After[1] c/image no longer prints "Storing signatures" so we should
not check for it.
[1] https://github.com/containers/image/pull/2001
(partial cherry-pick from commit 6eaf8a271d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The buildah buil kill trick is bad as we have to sleep and wait to aboid
flakes which takes time. Instead it is possible to redo this build part
manually with buildah commands. It is not trival and harder to
understand but it safes 2-3s so I think it is worth it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 350dfabf66)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Make safename() invocations consistent within the same
test. This puts the onus on the caller to add a unique
element when calling multiple times, e.g. "ctr1-$(safename)".
This is not too much of a burden. Major benefit is making
it easy for a reader to associate containers, pods, volumes,
images within a given test.
And, use dashes, not underscores. "podman generate kube"
removes underscores, making it very difficult to do
things like "podman inspect $podname" (because we need
to generate "$podname_with_underscores_removed")
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 380ed3a40d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Many system tests use hardcoded names for containers, images,
and everything. This has worked because system tests run
serially. It will not work if we ever run in parallel.
Create a new safename() helper, and use it as follows:
myctr=c_$(safename)
myvol1=v1_$(safename)
...
Find current instances of hardcoded names, and replace
with safe ones.
Whether or not we ever end up parallelizing system tests,
this is simply good practice.
There are far too many instances to fix in one (reviewable) PR.
This is commit 1 of N.
(partial cherry-pick from commit b28027148b)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test was using old expectations that required all containers to
have system_r role. The updated version from main branch correctly
expects that privileged/pid=host/ipc=host/label=disable containers
run with the current user and role, not system_r. This is intentional
behavior to support confined users (see commit 5b7dce8a3d).
This brings the test expectations in line with the actual behavior.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test framework was not parsing the '+w' suffix in expected exit
codes (e.g., '0+w' meaning "expect exit code 0 and warnings allowed").
This caused the literal string to be passed as a command argument to
podman, resulting in "unrecognized command" errors.
Added pattern matching for:
- [0-9]+w (single digit with warnings)
- [1-9][0-9]+w (double digit with warnings)
- [12][0-9][0-9]+w (triple digit with warnings)
The '+w' suffix is stripped off and only the numeric exit code is used
for validation. Note: The actual warning validation is not implemented
yet, but this allows tests using the '+w' notation to run correctly.
This fixes the "podman-remote: non-default connection" test failure.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The events file backend writes events as they're generated, which may
not match chronological order due to race conditions during concurrent
operations in rmi -f. The remove and untag events from rmi can appear
in any order in the events file.
This matches the approach used in main branch (see commit 111a4bbe71)
which recognizes that event ordering is not guaranteed for concurrent
operations, especially in podman-remote.
This fix:
- Simplifies initial validation to check for event presence (not order)
- Checks deterministic events (0-6) in exact order
- Validates rmi events (7-9) are present without requiring specific order
- Checks final event (10) is the second loadfromarchive
- Does NOT modify runtime code to enforce ordering (events remain as-generated)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Unfortunately on a number of occasions, Podman has been released
officially with a `-dev` suffix in the version number. Assist in
catching this mistake at release time by the addition of a simple
conditional test. Note that it must be positively enabled by a
magic env. var. before executing the system tests.
Ref. original PR: https://github.com/containers/podman/pull/26540
Signed-off-by: Chris Evich <cevich@redhat.com>
Checking for the mountdir is not relevent, a recent c/storage change[1] no
longer deletes the mount point directory so the check will cause a false
positive. findmnt exits 1 when the given path is not a mountpoint so
let's use that to check.
[1] 3f2e81abb3
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
I'm not exactly sure what is happening here, but this call
```
result := podmanTest.Podman([]string{"images", "-q", "-f", "reference=quay.io/libpod/*"})
```
in the test/e2e/images-test.go in this test
```
It("podman images filter reference", func()
```
is now sending back 10 instead of 9 objects. This was a change
that @edsantiago also made in https://github.com/containers/podman/pull/21356
After the other adjustments I made to the tests to right them,
this seemed to be the last issue.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
The scenario for inducing this is as follows:
1. Start a container with a long stop timeout and a PID1 that
ignores SIGTERM
2. Use `podman stop` to stop that container
3. Simultaneously, in another terminal, kill -9 `pidof podman`
(the container is now in ContainerStateStopping)
4. Now kill that container's Conmon with SIGKILL.
5. No commands are able to move the container from Stopping to
Stopped now.
The cause is a logic bug in our exit-file handling logic. Conmon
being dead without an exit file causes no change to the state.
Add handling for this case that tries to clean up, including
stopping the container if it still seems to be running.
Fixes#19629
Addresses: https://issues.redhat.com/browse/ACCELFIX-250
Signed-off-by: Matt Heon <mheon@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
It seems certain test infrastructure prevents cloning repo which
contains symlink outside of the repo itself, generate symlink for such
test by the testsuite itself just before running test and remove it when
test is completed.
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit 607aff55fa)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Drop support for remote use-cases when `.containerignore` or
`.dockerignore` is a symlink pointing to arbitrary location on host.
Signed-off-by: Aditya R <arajan@redhat.com>
Add a wait_for_ready() to one kube-play test, to make sure
container output has made it to the journal.
Probably does not fix#18501, but I think it might fix its
most common presentation.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Someone please revert this once quay search is fixed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 047da19b5f)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Apparent Cython regression causing a warning and traceback when
installing PyYAML with pip:
Ref. Upstream issue 601: https://github.com/yaml/pyyaml/issues/
Ref. warning message:
```
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
```
Ref. traceback snippet:
```
Traceback (most recent call last):
File "/var/tmp/go/src/github.com/containers/podman/venv/lib/python3.10/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
...cut...
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-yiijk0jv/overlay/lib/python3.10/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
```
Signed-off-by: Chris Evich <cevich@redhat.com>
<MH: Cherry-pick back to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
Fixes: https://github.com/containers/podman/issues/18239
[NO NEW TESTS NEEDED]
@test "podman build -f test" in test/system/070-build.bats
Will test this. This was passing when run on a local system since
the remote end was using the clients path to read the Containerfile
The issue is it would not work in a podman machine since the
Containerfile would/should be a different path.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
<MH: Cherry-pick to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
The long term goal was to provide the customer with a way to turn on the
preexec_hooks processing of scripts by having some kind of configuration
that could be read. I had tried putting it into containers.conf to
start, but that turned out to be unyieldly quickly, and time is of
the essence for this fix. That is mostly due to the fact that this
code is preexecution and in C, the containers.conf file is read in
Go much further down the stack.
After first trying this process using an ENVVAR, I have
thought it over and chatted with others, and will now look for a
/etc/containers/podman_preexec_hooks.txt file to exist. If the admin
had put one in there, we will then process the files in the
directories /usr/libexec/podman/pre-exec-hooks
and /etc/containers/pre-exec-hooks.
Thoughts/suggestions gratefully accepted. This will be a 8.8/9.2 ZeroDay
fix and will need to be backported to the v4.4.1-rhel branch.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
When a userns is set we setup the network after the bind mounts, at the
point where resolv.conf is generated we do not yet know the subnet.
Just like the other dns servers for bridge networks we need to add the
ip later in completeNetworkSetup()
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2182492 and
https://bugzilla.redhat.com/show_bug.cgi?id=2182491
This is targeted to RHEL 8.8 and 9.2 ZeroDay
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
skip in setup() if journald unavailable.
To be pedantic, this is overkill: some quadlet tests pass
because they don't run journald. Too bad.
Also skip a play-kube test that requires journal
Signed-off-by: Ed Santiago <santiago@redhat.com>
As described in #17777, the `restart` on-failure action did not behave
correctly when the health check is being run by a transient systemd
unit. It ran just fine when being executed outside such a unit, for
instance, manually or, as done in the system tests, in a scripted
fashion.
There were two issue causing the `restart` on-failure action to
misbehave:
1) The transient systemd units used the default `KillMode=cgroup` which
will nuke all processes in the specific cgroup including the recently
restarted container/conmon once the main `podman healthcheck run`
process exits.
2) Podman attempted to remove the transient systemd unit and timer
during restart. That is perfectly fine when manually restarting the
container but not when the restart itself is being executed inside
such a transient unit. Ultimately, Podman tried to shoot itself in
the foot.
Fix both issues by moving the restart logic in the cleanup process.
Instead of restarting the container, the `healthcheck run` will just
stop the container and the cleanup process will restart the container
once it has turned unhealthy.
Backport of commit 9563415430.
Fixes: #17777
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2180125
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2180126
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Only enforce the passthrough log driver for Quadlet. Commit 68fbebf
introduced a regression on the `podman-kube@` template as `podman logs`
stopped working and settings from containers.conf were ignored.
Fixes: #17482
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Primarily, add skip_if_journald_unavailable because RHEL.
Secondarily, reverse a flipped actual/expect assertion
that made it difficult to understand the RHEL failure.
Signed-off-by: Ed Santiago <santiago@redhat.com>
