The cgroups=split e2e test wraps podman in systemd-run --scope but does not request cgroup delegation. Without Delegate=yes, systemd does not guarantee that controllers like pids are written to cgroup.subtree_control for child cgroups. Whether they appear depends on the systemd session state at that moment, causing flaky crun failures when it tries to use unavailable controllers.
Fixes: #28944
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
With the new config work we expect policy.json to be shipped under
/usr/share/containers/policy.json. However the CI VMs and local users
might still have it in /etc so instead of assuming any host path lets
just create our own files for the --signature-policy tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
I do not understand this condition in the code, not passing the log file
to the runtime when run with log level debug makes no sense. It means we
do not get the proper error message from the runtime so debug logging
shows a much worse error:
"container create failed (no logs from conmon)..."
When the actual error is the command is not in $PATH for example. So to
fix this just remove the log level check. Also not the support json flag
condition is done inside execOCILog().
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
First check for errors and assert them via gomega to make the test fails
which called this.
Then stop calling this for each test spec, most will never access this
so stop reading the file over and over. Callers should just call the
function directly.
Then remove the arch field from it, that is not related to the OS file.
Callers should just access runtime.GOARCH directly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
Fixes: #22095
Now handles exporting a container's healthcheck configuration as a
`livenessProbe` in the generated Kubernetes YAML.
Co-authored-by: givensuman <givensuman@duck.com>
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Devesh B <98201065+DeveshB-1@users.noreply.github.com>
Signed-off-by: givensuman <givensuman@duck.com>
Update test/e2e/generate_kube_test.go
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: given <givensuman@gmail.com>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
For most callers podman run -d already makes sure the container runs so
this does nothing and only slows the test down.
For the signal test we can instead check for container output which is
better as we know the pid1 is actually ready to get the signal.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We do not use this anywhere to run as a different uid. In fact it should
not be supported as it would run without a proper systemd session for
example.
Because we run the test suite as root and a rootless user in CI there is
no need for a specific test to run podman as a different user here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We hard require netavark v2 to run with podman 6, as such it makes
little sense to guard just a specific set of tests.
Remove the helper to remove some code and skip the podman info call to
also speed it up a bit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Right now the tmpdir for the test and cli are are the same and worse the
root/runroot directories are subdirectories of the tmpdir so tests can
create conflicting files.
Also for rootless remote builds this cuases problems for all tests which
uses the main tmpdir as context dir as they then try to copy the storage
files with different uids which will fail. Commit 79e7b0f6fd tried to
work around it but it is not enough as much more tests use this pattern.
So to fix this once and for all properly separate them. And then fixup a
few test cases that depended on the wrong value and make them use the
proper root value directly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
So when running remote and rootless tests the buildImage() thing has one
big problem because it used the main test tmpdir as context.
However that dir also holds all the image layers with files that are
owned by other uids and because podman-remote does not use the userns it
cannot read some files and then fails when trying to tar up the context
dir.
To fix this use an extra sub directory. Now because some tests where
using the parent directory to supply context files just switch the
callers so they have full control still.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
By default we run tests in parallel so when we mount test/certs with the
":Z" option it means only one container can read it, depending on the
startup times this can mean the container fails to start. I observed
this error in a CI run:
level=fatal msg="open /certs/domain.crt: permission denied"
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Because we use hard coded names anyway we might as well skip the extra
command execution here that happened for each test.
Just inline a valid htpasswd line. Also remove the extra sync call,
there is no reason whatsoever for this file to be synced.
For cp there is also no reason at all to call an external command. Worse
the command also was never checked for errors.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
log_path is currently set at the client side and is ignored by
the server in a remote session. This leads to either incorrect log_path
being considered by the server or not honored at all. Move the handling
from client to the server, in line with other flags such as log_driver.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
