Commit graph

697 commits

Author SHA1 Message Date
OpenShift Merge Robot
8d3075e332
Merge pull request #13583 from rhatdan/ipc
Add support for ipc namespace modes "none, private, sharable"
2022-04-16 12:30:01 -04:00
OpenShift Merge Robot
92625eadc6
Merge pull request #13641 from nicrowe00/logfile
Add log rotation based on log size
2022-04-15 06:02:02 -04:00
Valentin Rothberg
2a75164e23 add a regression test for CVE-2022-1227
Will also be included in the upcoming backports.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 14:42:12 +02:00
OpenShift Merge Robot
90293da292
Merge pull request #13866 from edsantiago/bats
System tests: Usage checks: better error messages
2022-04-14 07:28:51 -04:00
OpenShift Merge Robot
5771f82260
Merge pull request #13857 from rhatdan/logs
Fix --tail log on restart problem
2022-04-14 07:22:52 -04:00
Valentin Rothberg
97f93dc78e Revert "images --size"
This reverts commit e133a06d2f.

@nalind found a proper fix in c/storage [1] to address the performance
issue.  So we really don't need the flag anymore.  Note the flag has
never made it into any release.

[1] d76b3606fc

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 10:58:36 +02:00
Niall Crowe
3da3afa576 Add log rotation based on log size
Add new functions to logfile.go for rotating and truncating
the events log file once the log file and its contents
exceed the maximum size limit while keeping 50% of the
log file's content

Also add tests to verify log rotation and truncation

Signed-off-by: Niall Crowe <nicrowe@redhat.com>
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 09:35:29 +01:00
Ed Santiago
9ef745d541 System tests: Usage checks: better error messages
Current error messages are really awful, and cause great
suffering every time someone adds a new subcommand. Let's
see if these are better.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-13 14:09:24 -06:00
Daniel J Walsh
63c38b99f4
Fix --tail log on restart problem
--tail=1 is not working f you restart a container with journald logging.

We see the exit status and then call into the logging a second time
causing all of the logs to print.

Removing the tail log on exited seems to fix the problem.

Fixes: https://github.com/containers/podman/issues/13098

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-04-13 14:07:15 -04:00
Daniel J Walsh
3987c529f4
Add support for ipc namespace modes "none, private, sharable"
Fixes: #13265

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-04-12 13:35:51 -04:00
Ed Santiago
2c800a717c System tests: fix oops in start --filter tests
Bad code got committed by accident: test description on run_podman
line, not test line.

Did not seem to affect tests, but fix it anyway.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-12 11:24:33 -06:00
Ed Santiago
615099ddb9 System tests: reenable ps --external test
Buildah issue 3544 has been fixed and vendored into podman.
We can reenable a long-skipped test.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-11 05:39:39 -06:00
Aditya R
0cebd158b6
container,inspect: convert Entrypoint to array instead of a string
Convert container entrypoint from string to an array inorder to make
sure there is parity between `podman inspect` and `docker inspect`

Signed-off-by: Aditya R <arajan@redhat.com>
2022-04-08 18:43:37 +05:30
Valentin Rothberg
e133a06d2f images --size
Add a --size option to podman images to allow for disabling computing
the size of listed images.  If listing images is critical to
performance, user may chose to turn off size computation to speed things
up.

Context: #13755
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-08 10:09:38 +02:00
Giuseppe Scrivano
164b64ea3b
specgen: do not set OOMScoreAdj by default
do not force a value of OOMScoreAdj=0 if it is wasn't specified by the
user.

Closes: https://github.com/containers/podman/issues/13731

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-04-04 15:40:12 +02:00
Paul Holzinger
eedaaf33cd
fix slirp4netns port forwarding with ranges
The slirp4netns port forwarder was not updated to make use of the new
port format. This results in a problem when port ranges are used since
it does not read the range field from the port.

Update the logic to iterate through all ports with the range and
protocols. Also added a system test for port ranges with slirp4netns,
rootlesskit and the bridge network mode.

Fixes #13643

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-03-29 19:18:40 +02:00
Daniel J Walsh
ffbab30d7b
Run codespell to cleanup typos
[NO NEW TESTS NEEDED]

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-03-25 15:34:41 -04:00
Daniel J Walsh
5e28cbc5fc
When running systemd in a container set container_uuid
systemd expects the container_uuid environment variable be set
when it is running in a container.

Fixes: https://github.com/containers/podman/issues/13187

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-03-23 15:05:30 -04:00
Ed Santiago
53e770566b pod system tests: clean up stray image
One of the pod tests was leaving a stray image behind,
causing scary red warnings in CI logs. Clean that up.

Also, now that #13541 has merged, use 'rmi --ignore' instead of
ignoring exit status from rmi

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-03-21 05:07:34 -06:00
Valentin Rothberg
95dad4d8a4 podman rmi --ignore
Add an `--ignore` flag to `podman image rm` to instruct ignoring image
if a specified image does not exist and to not throw an error.  Other
commands (e.g., `podman container rm`) already support this flag.

Such an `--ignore` flag can come in handy in clean-up scripcts such as
the teardown phases in the Podman tests.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-03-19 10:05:43 +01:00
Valentin Rothberg
ff54aaa634 podman create: building local pause image: do not read ignore files
Make sure to ignore local {container,docker}ignore files when building a
local pause image.  Otherwise, we may mistakenly not be able to copy
catatonit into the build container.

Fixes: #13529
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-03-17 14:18:16 +01:00
Daniel J Walsh
feaa1a134a
Add podman play kube --annotation
Allow users to add annotions in the podman play kube command.
This PR Also fixes the fact that annotations in the pod spec were
not being passed down to containers.

Fixes: https://github.com/containers/podman/issues/12968

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-03-09 17:30:01 -05:00
OpenShift Merge Robot
acfcecf2ae
Merge pull request #12913 from rhatdan/kube
Add --context-dir option to podman play kube
2022-03-09 16:19:59 -05:00
Aditya R
63f92d0a66
test: add a test to verify race free concurrent/parallel builds
Invoking parallel/concurrent builds from podman race against each other
following behviour was fixed in
https://github.com/containers/storage/pull/1153 and https://github.com/containers/image/pull/1480

Test verifies if following bug is fixed in new race-free API or not.
Read more about this issue, see bz 2055487 for more details.

More details here: https://github.com/containers/buildah/pull/3794 and https://github.com/containers/podman/pull/13339

Co-authored-by: Ed Santiago <santiago@redhat.com>
Signed-off-by: Aditya R <arajan@redhat.com>
2022-03-03 21:03:35 +05:30
Daniel J Walsh
675d775eb5
Add --context-dir option to podman play kube
This option was requested so that users could specify alternate
locations to find context directories for each image build. It
requites the --build option to be set.

Partion Fix: https://github.com/containers/podman/issues/12485

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-03-01 08:47:09 -05:00
Daniel J Walsh
3dc1b8e83f
Add podman volume mount support
Fixes: https://github.com/containers/podman/issues/12768

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-02-28 14:26:22 -05:00
OpenShift Merge Robot
8b2432422f
Merge pull request #13232 from rhatdan/volumes
Don't log errors on removing volumes inuse, if container --volumes-from
2022-02-23 03:26:59 -05:00
Daniel J Walsh
6f7a803d06
Cleanup display of trust with transports
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-02-22 15:08:58 -05:00
Daniel J Walsh
c4dfbd58f5
Don't log errors on removing volumes inuse, if container --volumes-from
When removing a container created with a --volumes-from a container
created with a built in volume, we complain if the original container
still exists.  Since this is an expected state, we should not complain
about it.

Fixes: https://github.com/containers/podman/issues/12808

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-02-21 16:47:12 -05:00
Paul Holzinger
b19251242e
system tests: cleanup networks on teardown
When a test which creates a network fail it will not remove the network.
The teardown logic should remove the networks. Since there is no --all
option for network rm we use network prune --force.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-02-21 21:57:08 +01:00
OpenShift Merge Robot
b3963e7081
Merge pull request #13296 from Romain-Geissler-1A/url-and-connection-implies-remote
Option --url and --connection should imply --remote.
2022-02-21 15:21:37 -05:00
OpenShift Merge Robot
c9359e1494
Merge pull request #13306 from Luap99/flag-error
provide better error on invalid flag
2022-02-21 15:11:37 -05:00
Paul Holzinger
44d037898e
provide better error on invalid flag
Add a extra `See 'podman command --help'` to the error output.
With this patch you now get:
```
$ podman run -h
Error: flag needs an argument: 'h' in -h
See 'podman run --help'
```

Fixes #13082
Fixes #13002

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-02-21 19:12:12 +01:00
Ed Santiago
f018c07edf System tests: show one-line config overview
We're running into problems that are impossible to diagnose
because we have no idea if the SUT is using netavark or CNI.
We've previously run into similar problems with runc/crun,
or cgroups 1/2.

This adds a one-line 'echo' with important system info. Now,
when viewing a full test log, it will be possible to view
system settings in one glance.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-02-21 08:49:11 -07:00
Romain Geissler
23a7f4e0de Option --url and --connection should imply --remote.
Closes #13242

Signed-off-by: Romain Geissler <romain.geissler@amadeus.com>
2022-02-19 14:53:37 +00:00
David Gibson
db4d15e852 Propagate $CONTAINERS_CONF to conmon
The CONTAINERS_CONF environment variable can be used to override the
configuration file, which is useful for testing.  However, at the moment
this variable is not propagated to conmon.  That means in particular, that
conmon can't propagate it back to podman when invoking its --exit-command.
The mismatch in configuration between the starting and cleaning up podman
instances can cause a variety of errors.

This patch also adds two related test cases.  One checks explicitly that
the correct CONTAINERS_CONF value appears in conmon's environment.  The
other checks for a possible specific impact of this bug: if we use a
nonstandard name for the runtime (even if its path is just a regular crun),
then the podman container cleanup invoked at container exit will fail.
That has the effect of meaning that a container started with -d --rm won't
be correctly removed once complete.

Fixes #12917

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2022-02-18 12:35:25 +11:00
David Gibson
d615ab81f9 tests: Remove inaccurate comment
This comment refers to overiding $PODMAN although the code below does
nothing of the sort.  Presumbly the comment has been outdated by altering
the containers.conf / $CONTAINERS_CONF instead.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2022-02-18 12:35:25 +11:00
Daniel J Walsh
4966adddbb
Make sure building with relative paths work correctly.
Fixes: https://github.com/containers/podman/issues/12763

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-02-10 20:40:09 -05:00
OpenShift Merge Robot
cbd0980d5b
Merge pull request #13159 from Luap99/slirp4-scope
move rootless netns slirp4netns process to systemd user.slice
2022-02-08 07:10:15 -05:00
Paul Holzinger
8d0fb0a4ed
move rootless netns slirp4netns process to systemd user.slice
When running podman inside systemd user units, it is possible that
systemd kills the rootless netns slirp4netns process because it was
started in the default unit cgroup. When the unit is stopped all
processes in that cgroup are killed. Since the slirp4netns process is
run once for all containers it should not be killed. To make sure
systemd will not kill the process we move it to the user.slice.

Fixes #13153

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-02-07 17:38:53 +01:00
Ed Santiago
d0d1ffa43e Cleanup: remove obsolete/misleading bug workaround
Followup to #13129: remove a no-longer-necessary workaround
for a healthcheck bug.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-02-07 06:58:19 -07:00
OpenShift Merge Robot
b1dcd025c6
Merge pull request #13129 from flouthoc/healthcheck-session-read-from-pipe
healthcheck, libpod: Read healthcheck event output from os pipe
2022-02-07 08:52:23 -05:00
OpenShift Merge Robot
ec390d5d35
Merge pull request #13143 from Luap99/dns
append podman dns search domain
2022-02-04 11:49:11 -05:00
Aditya R
3cf64a8e9a
tests: retrofit healthcheck system tests
All the healthcheck return output now but systems tests is written to
expect empty output which seems wrong.

Modify jq output to contain newline character rather than actual newline

Signed-off-by: Aditya R <arajan@redhat.com>
2022-02-04 21:15:15 +05:30
Paul Holzinger
d733c3baa2
append podman dns search domain
Append the podman dns seach domain to the host search domains when we
use the dnsname/aardvark server. Previously it would only use podman
seach domains and discard the host domains.

Fixes #13103

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-02-04 16:16:06 +01:00
OpenShift Merge Robot
956664f65b
Merge pull request #12930 from cdoern/podCgroup
Podman pod create --share-parent vs --share=cgroup
2022-02-04 09:41:12 -05:00
Ed Santiago
7cfe4d3fe7 System tests: revert emergency skip of checkpoint tests
Revert #13049. criu-3.16.1-6.fc36 fixes the problem and is
now in fc36 stable:

   https://bodhi.fedoraproject.org/updates/FEDORA-2022-183b337712

(Yes, I confirmed that tests pass on a rawhide vm)

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-02-03 14:48:35 -07:00
Chris Evich
642a691cbb
Cirrus: Add netavark/aardvark system test task
Also add a system-test that verifies netavark driver is in use when
magic env. var. is set.

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-02-03 13:07:56 -05:00
cdoern
9eb88ea474 Podman pod create --share-parent vs --share=cgroup
separated cgroupNS sharing from setting the pod as the cgroup parent,
made a new flag --share-parent which sets the pod as the cgroup parent for all
containers entering the pod

remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent.

resolves #12765

Signed-off-by: cdoern <cdoern@redhat.com>
Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
Signed-off-by: cdoern <cdoern@redhat.com>
2022-02-03 09:30:17 -05:00
Paul Holzinger
25e073492f
Revert "Move each search dns to its own line"
This reverts commit a1bc8cb52c.
Please see resolv.conf(5) search domains must be on the same line. If
you use multiple seach key words only the last one is used. I tested this
with alpine and it works correctly when they are on the same line so I
am not sure what issues Dan had with it but this is not correct.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-02-02 19:33:21 +01:00