Commit graph

6914 commits

Author SHA1 Message Date
Lewis Roy
5dc87663a9 feat: add Podman artifact support to Go bindings and remote clients
Add the Go bindings implementation necessary to support Artifacts.
Implement the tunnel interface that consumes the Artifacts Go bindings.

With this patch, users of the Podman remote clients will now be able to
manage OCI artifacts via the Podman CLI and Podman machine.

Jira: https://issues.redhat.com/browse/RUN-2714#

Signed-off-by: Lewis Roy <lewis@redhat.com>
2025-08-08 09:21:45 -04:00
Nicola Sella
906b97e3e1 compat: remove deprecated VirtualSize
Since compat version 1.43 the VirtualSize field in the
GET /images/{name}/json, GET /images/json, and
GET /system/df responses is deprecated and will no
longer be included in API v1.44. Use the Size field
instead, which contains the same information.

Signed-off-by: Nicola Sella <nsella@redhat.com>
2025-08-08 09:14:23 -04:00
Nicola Sella
17a1e6cfb2 compat: add shared-size par to GET /images/json
Related: https://issues.redhat.com/browse/RUN-2698

Signed-off-by: Nicola Sella <nsella@redhat.com>
2025-08-08 09:14:18 -04:00
Nicola Sella
8bcfe0ea56 compat: RepoTags and RepoDigest return [] and not null
Signed-off-by: Nicola Sella <nsella@redhat.com>
2025-08-08 09:14:12 -04:00
Nicola Sella
e1f65f1642 compat: remove GET /system/df BuilderSize
Signed-off-by: Nicola Sella <nsella@redhat.com>
2025-08-08 09:12:12 -04:00
Nicola Sella
ec778d94b5 compat: GET /_ping return Builder-Version: 1
Signed-off-by: Nicola Sella <nsella@redhat.com>
2025-08-08 09:12:06 -04:00
openshift-merge-bot[bot]
eabb64ddaf
Merge pull request #26666 from TomSweeneyRedHat/dev/tsweeney/buildah_v1.41.0
Bump Buildah to v1.41.0
2025-07-24 12:24:28 +00:00
openshift-merge-bot[bot]
12b7a334ae
Merge pull request #26628 from 2004joshua/build_context
Feat: send additional build contexts as tar files for remote builds
2025-07-24 11:04:32 +00:00
Nalin Dahyabhai
e6f812c21e API server: drop inherit-labels/annotations for compat builds
Drop the inheritlabels and inheritannotations flags in the description
for the compat build endpoint, because the docker engine's build
endpoint doesn't recognize them.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:57:06 -04:00
Nalin Dahyabhai
ac99084d03 API handler: don't force the SkipUnusedStages flag
Don't force the SkipUnusedStages option one way or another when the
client doesn't specifically request one or the other, so that the server
can choose to use its default behavior.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:55:47 -04:00
Nalin Dahyabhai
55f4d2aa25 API handler: don't force the CompatVolumes flag
Don't force the CompatVolumes option one way or another when the client
doesn't specifically request one or the other, so that the server can
choose to use its default behavior.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:55:16 -04:00
Nalin Dahyabhai
db2baee9fa API handler: don't force the IdentityLabel flag
Don't force the IdentityLabel option one way or another when the client
doesn't specifically request one or the other, so that the server can
choose to use its default behavior.

Fixes #26669

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:54:47 -04:00
Nalin Dahyabhai
3e673591ad Update compat-volumes setting for remotes
The "compat-volumes" setting shouldn't be provided by the compat build
endpoint, the docker daemon's isn't expected to recognize it.

It is also a conditional boolean flag, so if it isn't specified by the
caller, don't send a value from a client to the server, so that the
server will be able to apply its own default.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:54:28 -04:00
Nalin Dahyabhai
bf79a9b71e Update inherit-labels setting for remotes
The inherit-labels setting is a conditional boolean flag, so if it isn't
specified either way by the caller, don't send a value from a client to
the server, so that the server will be able to apply its own default.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:54:08 -04:00
Nalin Dahyabhai
bfe6cbe319 pkg/emulation.parseBinfmtMisc(): accept empty "flags" fields
When parsing an entry in /proc/sys/fs/binfmt_misc, don't return an error
if we find an empty "flags" field in the file.  Wine packaged for Fedora
provides a binfmt.d file that results in such a file, so... it's normal.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:53:39 -04:00
Nalin Dahyabhai
a615dde1a5 build endpoint: document the "timestamp" flag
The "timestamp" flag has been around for ages, but we never documented
it in the API.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:53:07 -04:00
Nalin Dahyabhai
7517e3267a remote build: relay more new flags introduced in buildah 1.41
Wire up the source-date-epoch, rewrite-timestamp, and created-annotation
flags so that a client can correctly ask a server to honor them.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2025-07-23 15:52:43 -04:00
Joshua Arrevillaga
73f3e98947 Feat: send additional build contexts for remote builds
Fixed the --build-context flag to properly send files for remote builds. Previously
only the main context was sent over as a tar while additional contexts were passed as
local paths and this would cause builds to fail since the files wouldn't exist.

New changes modifies the Build API to use multipart HTTP requests allowing multiple
build contexts to be used. Each additional context is packaged and
transferred based on its type:
- Local Directories: Sent as tar archives
- Git Repositories: link sent to the server where its then cloned
- Container Images: Image reference sent to the server, it then pulls the image there
- URLs/archives: URL sent to the server, which handles the download

Fixes: #23433

Signed-off-by: Joshua Arrevillaga <2004jarrevillaga@gmail.com>
2025-07-23 11:34:38 -04:00
tomsweeneyredhat
2f71314b4a Add CLI updates for inherit and unset annotations
Add CLI updates for --inheritannotations and --unsetannotations

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
2025-07-23 10:36:22 -04:00
openshift-merge-bot[bot]
051676bc97
Merge pull request #26330 from flouthoc/quadlet-work
Add support for `podman quadlet`
2025-07-21 12:36:48 +00:00
Matt Heon
f293c1a179
Initial implementation of podman quadlet commands
This adds `podman quadlet list`, `podman quadlet install`,
`podman quadlet rm` and `podman quadlet print`.

Signed-off-by: Matt Heon <mheon@redhat.com>
Co-authored-by: flouthoc <flouthoc.git@gmail.com>
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
2025-07-18 13:57:11 -07:00
Paul Holzinger
8b1f06bf8f
podman inspect: fix error difference between local and remote
There is no reason for local and rmeote to use a different error that
just differs in quoting. Make them consitent to simplify the tests.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-07-15 17:15:19 +02:00
Paul Holzinger
e55270a51a
podman auto-update: include container in invalid policy message
I noticed recently when I made a typo that then auto-update errored but
it did not tell me which container was incorrect so I had to check all
containers myself. Include the container ID in the error to make it
clear which container has the issue.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-07-14 14:34:22 +02:00
openshift-merge-bot[bot]
c305a932cc
Merge pull request #26609 from Luap99/bindings-fixes
pkg/bindings/containers: some attach/logs handling fixes
2025-07-11 14:16:31 +00:00
openshift-merge-bot[bot]
b059e47ff2
Merge pull request #26604 from l0rd/seccomp-winpath
Fix seccomp profile path on Windows
2025-07-11 14:13:35 +00:00
openshift-merge-bot[bot]
d07dd054df
Merge pull request #26607 from ygalblum/quadlet-image-pull-policy
Quadlet - add support for the Policy key for .image files
2025-07-11 08:13:38 +00:00
Paul Holzinger
a360b29626
pkg/bindings/containers: do not ignore ErrUnexpectedEOF
Do not ignore ErrUnexpectedEOF from DemuxHeader(), if we fail to parse
the header there must have been a clear protocal error between client
and server which should be reported and not silently ignored. I wonder
ig this might explain why we have missing remote exec/attach output
without any error, it is possible we are eating some internal errors due
this.

Commit ba8eba83ef added the ErrUnexpectedEOF check but without any
explanation why that would be needed. The tests from that commit pass
without it locally but not in CI. With some debugging best I found the
issue is actually a test bug. The channel is not consumed until it is
closed which means the main test exists before the log reading goroutine
is done. And if the main test exists the first step it does is to kill
the podman service which then can trigger the ErrUnexpectedEOF server on
the still open http connection and thus the test case failed there.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-07-10 19:57:16 +02:00
Paul Holzinger
ffec133766
pkg/bindings/containers: do not create sub slice
DemuxFrame() already returns a byte slice with the correct length so
this makes it simpler and the caller does not need to check this at all.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-07-10 19:57:16 +02:00
Paul Holzinger
f42453457c
pkg/bindings/containers: don't check for short read
io.ReadFull() already returns ErrUnexpectedEOF if there was a short read
so this check is redundant and can be dropped.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-07-10 19:57:16 +02:00
Ygal Blum
439448c287 Quadlet - add support for the Policy key for .image files
Resolves: #26446

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2025-07-10 13:06:38 -04:00
Craig Spencer
5e44c17309 Clarifies error message when using an improperly formatted secret with kube
Fixes: #26586

Signed-off-by: Craig Spencer <craig.spencer812@gmail.com>
2025-07-10 12:19:28 -04:00
Mario Loriedo
3e8b2d7d96 Fix seccomp profile path on Windows
Call specgen.ConvertWinMountPath() on seccomp profile paths provided via
security-opt parameter.

Fixes https://github.com/containers/podman/issues/26558

Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
2025-07-10 15:02:54 +02:00
flouthoc
152849ebd2
libpod/build: add headers
Add `headers` for `/libpod/build`

Closes: https://github.com/containers/podman/issues/26440

Signed-off-by: flouthoc <flouthoc.git@gmail.com>
2025-07-08 06:51:32 -07:00
openshift-merge-bot[bot]
0737c19689
Merge pull request #26524 from mheon/libartifact_locking
Add basic locking to Libartifact
2025-07-08 13:01:25 +00:00
openshift-merge-bot[bot]
aab1029b4f
Merge pull request #26584 from ninja-quokka/tidy_artifact_types
[Artifacts] Tidy artifact types
2025-07-08 10:16:01 +00:00
openshift-merge-bot[bot]
b047cfc7e9
Merge pull request #26563 from ygalblum/quadlet-warn-exec-parse-fail
Quadlet - print warning when fail to parse
2025-07-08 08:42:16 +00:00
Lewis Roy
0f61e48ac5
[Artifacts] Remove erroneous ArtifactListOptions var ImagePushOptions
This var has so far been unuesd so easy to remove

Signed-off-by: Lewis Roy <lewis@redhat.com>
2025-07-08 06:53:41 +10:00
Lewis Roy
53b5cb5581
[Artifacts] Add note about ArtifactInspectOptions Remote var
Signed-off-by: Lewis Roy <lewis@redhat.com>
2025-07-08 06:53:05 +10:00
Ygal Blum
cd807f8ff6 Quadlet - print warning when fail to parse
Fixes: #26542

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2025-07-07 14:49:32 -04:00
openshift-merge-bot[bot]
d5a3878b69
Merge pull request #26553 from l0rd/wsl-utf8
Enforce WSL UTF-8 encoded output
2025-07-07 17:52:48 +00:00
Matt Heon
b10beb5395 Add basic locking to Libartifact
Lock access to and modification of the index.json file, to ensure
concurrent addition/removal does not result in lost state. Use a
standard c/storage lockfile, making use of its r/w locking
ability to support concurrent access, only serializing writes.

This is not a very efficient locking scheme around artifact
removal and - especially - addition. I view this as the first
step, establishing any sort of mutual exclusion to prevent state
corruption. Step 2 is to adapt the staged removal work being
done to make image removal require only minimal use of locks,
ensuring it works with artifact addition. This staged addition
means we won't have to hold the lock for the full artifact pull.

Signed-off-by: Matt Heon <mheon@redhat.com>
2025-07-07 13:50:00 -04:00
openshift-merge-bot[bot]
c8272b23a5
Merge pull request #26552 from AgentEpsilon/quadlet-service-unsupported-keys
Quadlet - Error when units define User, Group, or DynamicUser in Serv…
2025-07-04 14:56:04 +00:00
openshift-merge-bot[bot]
00c431c3ca
Merge pull request #26238 from ArthurWuTW/26102
tmpfs: Add support for noatime mount option
2025-07-04 10:55:02 +00:00
Evan Miller
31b4efcaec warn instead of error, lift logic to main.go
Signed-off-by: Evan Miller <miller.evan815@gmail.com>
2025-07-02 18:23:00 -07:00
Mario Loriedo
68e7136536 Enforce wsl.exe UTF-8 encoded output
Currently WSL uses UTF-16 encoded output by default but is planning
to use UTF-8.

See https://github.com/containers/podman/issues/26527

To get ready for the change we are enforcing UTF-8 encoded output by
setting the environment variable `WSL_UTF8=1` and by updating the
code that transfomed wsl output from UTF-16 to UTF-8.

Fixes https://github.com/containers/podman/issues/26527

Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
2025-07-02 20:18:52 +00:00
Mario Loriedo
9fbe2fffe9 WSL commands execution refactoring
Introduced a new function to encapsulate the code to execute WSL
commands.

Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
2025-07-02 20:18:52 +00:00
Evan Miller
4b1f7bcb9a Quadlet - Error when units define User, Group, or DynamicUser in Service group
Fixes: #26543

Signed-off-by: Evan Miller <miller.evan815@gmail.com>
2025-07-02 00:34:46 -07:00
openshift-merge-bot[bot]
72393c1c53
Merge pull request #26522 from ygalblum/quadlet-pod-service-environment
Quadlet - Do not override existing Environment in Service group for Pod units
2025-07-01 19:25:06 +00:00
openshift-merge-bot[bot]
6355a15082
Merge pull request #25922 from jakecorrenti/krunkit-cmdline
machine: enable nested virt on libkrun by default
2025-07-01 13:39:19 +00:00
openshift-merge-bot[bot]
87d88c3b09
Merge pull request #26432 from stefwalter/dont-html-escape-json
api: Don't HTML escape application/json responses
2025-06-30 14:47:55 +00:00