Same issue as "podman cp from ctr chown" - the test fails when copying
a file from a container to an existing file on the host. Remote cp
tries to create a directory at the destination, resulting in:
Error: mkdir /tmp/746758151: not a directory
This is the same bug in the remote cp implementation where it doesn't
handle copying to an existing file path. Fix exists in commit
b0836ab624 but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test fails in podman-remote when copying a file from a container
to an existing file on the host. The remote cp implementation tries
to create a directory at the destination path, resulting in:
Error: mkdir /tmp/1457882724: not a directory
This is a bug in the remote cp implementation where it doesn't
properly handle copying to an existing file. A fix exists in commit
b0836ab624 (branch cve-441-crio) but hasn't been merged yet.
Skip the test for remote until the fix is integrated.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
The test builds two images where the second image shares some steps
with the first, expecting cache layers to be shared. When the second
image is removed, only 2 images should be deleted (the final image +
one unique intermediate layer). However, in remote mode, cache isn't
shared, so 4 images are deleted instead.
This test was originally skipped for remote (commit pre-4b8df5903f)
with the note "FIXME This should work on podman-remote, problem is
with podman-remote build". It was enabled in commit 4b8df5903f
assuming the issue was fixed, but the underlying cache reuse problem
persists.
Re-add SkipIfRemote until the cache layer sharing issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Remote builds don't reuse cache layers the same way as local builds.
When building with --layers=true, the test expects intermediate cache
layers to be reused between builds, resulting in only 2 dangling images.
However, in remote mode, cache isn't reused properly, creating duplicate
intermediate images (5 total instead of 2).
This test was originally skipped for remote (commit d832136349) with
the note "podman-remote build is not working the same as local build".
It was enabled in commit 4b8df5903f assuming the issue was fixed, but
the underlying cache reuse problem persists.
Re-add SkipIfRemote until the cache layer reuse issue is resolved.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The panic occurred because PodmanTestCreateUtil tried to create lock
files in /run/podman before the directory existed. The directory was
only created later in StartRemoteService(), causing all 1000 create
attempts to fail with "no such file or directory" rather than the
expected "file exists" collision error.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add //go:build !remote_testing constraint to build_test.go since it
imports buildah, which depends on libimage. The libimage package has
!remote build constraints, causing compilation failures when this test
is included in remote integration tests.
Fixes the "build constraints exclude all Go files" error in
make remoteintegration.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
WaitForFile only checks if the socket file exists on the filesystem, but
the plugin may not be listening yet. Add a small delay after WaitForFile
to ensure the plugin is actually ready to accept connections.
This fixes flaky volume plugin tests that fail with 'connection refused'
even though the socket file exists.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Wait for the socket to be ready befor trying to create a volume with the
driver.
Fixes: #17956
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
(cherry picked from commit 70abb4ae5b)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We have a lot of systemd and quadlet based tests in the system tests.
This test doesn't seem very useful and it seems to flake so just remove
it.
Fixes#23480
(partial cherry-pick from commit 57016f5cc3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
When loading from an OCI directory without an explicit image name, the
image is now stored by digest instead of using the path as the name.
Update the test to verify the load succeeded and output contains the
sha256 digest, rather than checking for a specific image name.
This aligns with the behavior change from containers/common and fixes
the rootful localintegration test failure.
(partial cherry-pick from commit e66c04c1f7)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The wildcard search test uses registry.access.redhat.com which has been
historically unreliable and often returns no results for wildcard
searches.
In v5+, this test was replaced with a mock registry server (commit
d6f660076b in Oct 2025), but that infrastructure is not available on
v4.4.1-rhel.
Skip the test to avoid flakes from external registry unavailability.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The "podman pull by digest and list --all" e2e test pulls an image using
a tagged reference when an image with the same ID is already present in
a read-only additional image store.
This causes a new image record to be created in read-write storage.
The test then removes this entry, pulls the image again using a digested
reference, and then expects the image to not have any tagged names in it
when it goes to look at it again.
Newer containers/storage will ensure that at the point when the
read-write image record is created, that it includes all of the data
items and naming information from the read-only copy of the image, so
that this information doesn't appear to be lost.
Change the test to use "untag" instead of "rmi", which should pass with
either the older or newer containers/storage.
The test is checking that `podman images` doesn't choke when it
encounters a digested name attached to an image, so the difference in
behavior between containers/storage versions is irrelevant.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
(cherry picked from commit a428555e3e)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of container-device-interface
from v0.5.3 to v0.5.4 which requires CDI spec version 0.3.0.
(partial cherry-pick from commit e9942c61dd)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
We no longer allow to match ids in the middle, this makes no realy
sense. ID matches should always be by prefix.
https://github.com/containers/podman/issues/18471
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 63f5116ad3)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Update the secret name validation test to use names that actually
violate the validation rules. The previous test used "?!" which is
not actually invalid.
Secret names cannot include '=', '/', ',', or '\0' (NULL) characters.
Update to use "foo/bar" and "foo=bar" as test cases.
This is a partial cherry-pick of the test changes from the vendor
update commit that fixed secret name validation.
(partial cherry-pick from commit 13a9500166)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
On RHEL 9, 'nc' is a symlink to 'ncat' (from nmap). With ncat, the -p
flag is for source port (outgoing connections), not the listening port.
For listening, the port is specified as a positional argument.
This fixes the error: "nc: cannot use -p and -l"
Changes:
- nc -v -n -l -p <port> → nc -v -n -l <port>
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The OCI directory pull behavior changed in containers/common (Aug 2023)
to require explicit image names. Without an explicit name, images are
now stored by digest and appear as <none>:<none> in podman images.
Update two test cases to use the new syntax:
- "podman pull from local OCI directory"
- "podman pull and decrypt / From oci"
Changes:
- Use oci:/path:imagename instead of oci:/path
- Check for explicit image name instead of auto-generated path-based name
- Add -q flags for quieter test output
This aligns the tests with the main branch and fixes rootful
localintegration test failures.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The ginkgo-run target was unconditionally adding the "remote" build tag
to all integration tests, which excluded all libimage source files (they
have "// +build !remote" constraints). This caused localintegration
tests to fail with "build constraints exclude all Go files" errors.
Also fix test compilation errors introduced in commit 0cdddfa8f7:
- Update libimage import to libimage/define for ManifestListData type
- Replace undefined CITEST_IMAGE with ALPINE constant
- Fix getConfigMapVolume call signature (3 params, not 4)
- Replace non-existent PodmanExitCleanly with standard test pattern
- Fix ExitWithError assertion to use Exit() and ContainSubstring()
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
After[1] c/image no longer prints "Storing signatures" so we should
not check for it.
[1] https://github.com/containers/image/pull/2001
(partial cherry-pick from commit 6eaf8a271d)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
I'm not exactly sure what is happening here, but this call
```
result := podmanTest.Podman([]string{"images", "-q", "-f", "reference=quay.io/libpod/*"})
```
in the test/e2e/images-test.go in this test
```
It("podman images filter reference", func()
```
is now sending back 10 instead of 9 objects. This was a change
that @edsantiago also made in https://github.com/containers/podman/pull/21356
After the other adjustments I made to the tests to right them,
this seemed to be the last issue.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
It seems certain test infrastructure prevents cloning repo which
contains symlink outside of the repo itself, generate symlink for such
test by the testsuite itself just before running test and remove it when
test is completed.
Signed-off-by: Aditya R <arajan@redhat.com>
(cherry picked from commit 607aff55fa)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Drop support for remote use-cases when `.containerignore` or
`.dockerignore` is a symlink pointing to arbitrary location on host.
Signed-off-by: Aditya R <arajan@redhat.com>
Someone please revert this once quay search is fixed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 047da19b5f)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Fixes: https://github.com/containers/podman/issues/18239
[NO NEW TESTS NEEDED]
@test "podman build -f test" in test/system/070-build.bats
Will test this. This was passing when run on a local system since
the remote end was using the clients path to read the Containerfile
The issue is it would not work in a podman machine since the
Containerfile would/should be a different path.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
<MH: Cherry-pick to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
Only enforce the passthrough log driver for Quadlet. Commit 68fbebf
introduced a regression on the `podman-kube@` template as `podman logs`
stopped working and settings from containers.conf were ignored.
Fixes: #17482
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Quadlet should not exit with failure if no files to process have been
found. Otherwise, even simple operations such as reloading systemd
will fail as it retriggers generators.
Fixes: #17374
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Add test to verify that updates without a pids-limit specified no longer
overwrite the previous value.
Also fixes erroneous warning generated by remote clients:
"Resource limits are not supported and ignored on cgroups V1 rootless
systems"
Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
We had a number of references, mostly in docs, to the word master that
can now be changed to main. This PR does that and makes the project a
bit more inclusive.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
If the image being used has a user set that is a positive
integer greater than 0, then set the securityContext.runAsNonRoot
to true for the container in the generated kube yaml.
Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
The Device, Type, Copy and Options keys are now supported in
quadlet .volume files. This allows users to create filesystem
based volumes with quadlets .volume files.
Signed-off-by: Ingo Becker <ingo@orgizm.net>
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
(podman push) and (podman manifest push) now support --sign-by-sigstore=param-file,
using the containers-sigstore-signing-params.yaml(5) file format.
That notably adds support for Fulcio and Rekor signing.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
After https://github.com/containers/netavark/pull/452 `netavark` is
incharge of deciding `custom_dns_servers` if any so lets honor that and
libpod should not set these manually.
This also ensures docker parity
Podman populates container's `/etc/resolv.conf` with custom DNS servers ( specified via `--dns` or `dns_server` in containers.conf )
even when container is connected to a network where `dns_enabled` is `true`.
Current behavior does not matches with docker, hence following commit ensures that podman only populates custom DNS server when container is not connected to any network where DNS is enabled and for the cases where `dns_enabled` is `true`
the resolution for custom DNS server will happen via ( `aardvark-dns` or `dnsname` ).
Reference: https://docs.docker.com/config/containers/container-networking/#dns-services
Closes: containers#16172
Signed-off-by: Aditya R <arajan@redhat.com>
`default` is already used as network mode, i.e. podman run --network
default will choose the default mode not a network named `default`.
We already block names from other network modes, default was forgotten.
Fixes#17169
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
July 2022: test was flaking on new VM images. We needed new
images, so I filed #15014 and skipped the test.
January 2023: no attention from anyone, so I'll try bumping up
a dd timeout from 10s to 30s. But in the interim, the test
has broken: it used to expect "Containerfile" in output (this
was deliberately added in #13655)... but #16810 changed that
so Containerfile no longer appears. @flouthoc argues that
this too is deliberate (#17059). Okay, so let's change the
test then. All I care about is not adding more regressions.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Reserved annotations are used internally by Podman and would effect
nothing when run with Kubernetes so we should not be generating these
annotations.
Fixes: https://github.com/containers/podman/issues/17105
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
