It fails due selinux, it is unlcear why so I filled #27759 for now to
track that so we can get the image update merged.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
There are two fields I'm worried about: shared namespaces and pod
containers. Both are generated via loops over maps and are thus
non-deterministic in ordering. Throw a sort on each to fix the
order so we can actually diff `podman pod inspect` output.
Signed-off-by: Matt Heon <mheon@redhat.com>
- remove old CLI validation that only checked --pod flag
- add validation in namespaces.go to catch all paths (cli, quadlet, api)
- block userns mixing for all pods with infra, not just ipc/net
- update error message to be clearer
- fix test cleanup to use PodmanExitCleanly()
- use dynamic pod names in system tests to avoid conflicts
fixes#26848
Signed-off-by: 0xdvc <neilohene@gmail.com>
<MH: Fixed cherry-pick conflicts>
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Quadlets installed from `.quadlet` file now belongs to a single
application, anyone file removed from this application removes all the
other files as well.
Assited by: claude-4-sonnet
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
Enable installing multiple quadlets from one file using '---' delimiters.
Each section requires '# FileName=<name>' comment for custom naming.
Single quadlet files remain unchanged for backward compatibility.
Assited by: claude-4-sonnet
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
The remote client (podman --remote) was incorrectly throwing an error
when --detach-keys="" was specified for attach, run, or start commands.
According to documentation and the v1.7.0 release notes, specifying an
empty string should disable detaching, not cause an error.
Fixes: #27414
Signed-off-by: shiavm006 <shivammittal42006@gmail.com>
The test for issue #19800 depended on finding a system user with an
octal UID. This approach was fragile because system users found on the
host may have a different UID in the testing image.
Use the rootless user ID instead which is likely to be octal anyway as
new user IDs start with 1000.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
We do not use that package that we install for the test anyway and doing
this networking connection is causing heavy flakes at the moment.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
By default, systemd sets a limit of how many times a service can start,
which means that if you have a healthcheck that runs more often than the
limits, systemd will refuse to start it with a message like "Start request
repeated too quickly." emitted to the journal.
Signed-off-by: Winter M <winter@antithesis.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This is gated behind a new option in `podman system migrate`,
`--migrate-db`.
The basic logic is simple:
* Podman is already configured to use BoltDB
* Open a new, fresh SQLite database to write into
* Migrate all database contents as they exist in BoltDB, to
SQLite.
** Do this as simply as possible: grab the object from the old DB
and write it into the new DB using the standard Add and Save
functions.
* Set the new database in the Runtime, close the old one.
* Move the old database file so it won't be reused
* Show a warning if the user explicitly configured BoltDB in
containers.conf
Our ability to test complex migration scenarios is limited, but
this should handle simple migrations easily.
Fixes#27628
Signed-off-by: Matt Heon <matthew.heon@pm.me>
There are two fields I'm worried about: shared namespaces and pod
containers. Both are generated via loops over maps and are thus
non-deterministic in ordering. Throw a sort on each to fix the
order so we can actually diff `podman pod inspect` output.
Signed-off-by: Matt Heon <mheon@redhat.com>
When trying to join the conmon pid to recreate the pause process based
on the namespace it can be that the pid is no longer valid, i.e. when
conmon crashed or was killed.
Currently we have a big issue that can be reproduced using:
$ podman run -d quay.io/libpod/testimage:20241011 sleep 100
$ killall -9 conmon
$ killall catatonit
All commands would fail as we keep trying to rejoin the namespace of the
non existing conmon process.
So to address that fall back to creating a new namespace if we fail to
join the conmon pids.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This got broken during the remote testing rewrite to enable tls testing
in commit feb36e4fe6. The problem is the function didn't use the proper
podman command with the remote arg so it tried to connect to the default
socket with remote testing.
And in the checkpoint file we use it before the PODMAN_CMD was defined
so fix this by moving the basic_setup before and the use the variable
PODMAN_RUNTIME instead of having to do another info call.
Also fix the debug log output to correctly log the podman commands with
all arguments on a single line.
Fixes: feb36e4fe6 ("Implement TLS API Support")
Fixes: #27266
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Make sure to rmeove the artifact but we don't need to remove the
testfiles as they are part under PODMAN_TMPDIR which gets removed by
default so don't bother with that.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
- use nanoseconds, so we don't need to sleep a full second do put the
time forward.
- use the --format option instead of jq
- run test via remote as well
- don't use static file content
Fixes: #27265
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Somehow this only flakes on debian as it seem the /etc/hosts file on the
host system changes and thus causes a false postive with the
before/after restore comparison.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add new alias `podman quadlet cat` to `podman quadlet print`
to align Podman's quadlet CLI with systemd conventions.
Fixes: https://github.com/containers/podman/issues/27296
Signed-off-by: Artem Sierikov <sierikov@pm.me>
We started logging this in 5.6. In 5.7, we up to a warning. The
upcoming 5.8 will up the warnings further to errors.
Required as we're removing BoltDB support in 6.0 next Spring.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Remove dummy UID/GID mappings added when joining existing user
namespaces, which runc 1.1.11+ rejects as conflicting.
RUNC fix: https://github.com/opencontainers/runc/pull/4124Fixes#27148
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
This commit implements the --replace functionality for the artifact add command,
allowing users to replace existing artifacts without having to manually remove
them first.
Changes made:
- Add Replace field to ArtifactAddOptions entity types
- Add --replace CLI flag with validation to prevent conflicts with --append
- Implement replace logic in ABI backend to remove existing artifacts before adding
- Update API handlers and tunnel implementation for podman-remote support
- Add comprehensive documentation and examples to man page
- Add e2e and system BATS tests for --replace functionality
- Fix code formatting in pkg/bindings/artifacts/types_pull_options.go:
* Reorder imports with proper spacing
* Fix function declaration spacing
* Convert spaces to proper tab indentation
* Remove extraneous blank lines
The --replace option follows the same pattern as other podman replace options
like 'podman container create --replace' and 'podman pod create --replace'.
It gracefully handles cases where no existing artifact exists (no error thrown).
Usage examples:
podman artifact add --replace quay.io/myimage/artifact:latest /path/to/file
podman artifact add --replace localhost/test/artifact /tmp/newfile.txt
Fixes: Implements requested --replace functionality for artifact add command
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
podman wait by default waits for exit not removal as the man page
documents.
Fixes: 3a98b6dc0e ("test: Wait for killed container to avoid leak")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Bash will expand a signle ? to a file name which consists of a single
char, and thus if you have a file named "a" in the cwd it will add a as
argument which causes podman a ... to be executed which clearly fails
the test.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Added flags to point to TLS PEM files to use for exposing and connecting
to an encrypted remote API socket with server and client authentication.
* Added TLS fields for system connection ls templates.
* Added special "tls" format for system connection ls to list TLS fields
in human-readable table format.
* Updated remote integration and system tests to allow specifying a
"transport" to run the full suite against a unix, tcp, tls, or mtls
system service.
* Added system tests to verify basic operation of unix, tcp, tls, and mtls
services, clients, and connections.
Signed-off-by: Andrew Melnick <meln5674.5674@gmail.com>
