systemd interprets % as specifier characters in unit configuration files
(e.g. %H, %u, %40). Proxy environment variable values that contain
percent-encoded URL characters (such as %40 for @ in usernames) cause
systemd to emit warnings and fail to parse the generated
/etc/systemd/system.conf.d/default-env.conf:
system.conf.d/default-env.conf:2: Failed to resolve specifiers in
HTTP_PROXY=http://user%40example.com@proxy:3128
Fix by adding a bash variable substitution that doubles every % to %%
before writing to the systemd unit conf files. The profile.d and
environment.d destinations do not need this escaping and continue to
use the original value.
Fixes#28698
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
By default we run tests in parallel so when we mount test/certs with the
":Z" option it means only one container can read it, depending on the
startup times this can mean the container fails to start. I observed
this error in a CI run:
level=fatal msg="open /certs/domain.crt: permission denied"
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Because we use hard coded names anyway we might as well skip the extra
command execution here that happened for each test.
Just inline a valid htpasswd line. Also remove the extra sync call,
there is no reason whatsoever for this file to be synced.
For cp there is also no reason at all to call an external command. Worse
the command also was never checked for errors.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Given his continued contributions and valuable support with PRs,
issue triage, and code review, this is well-deserved.
Signed-off-by: Matt Heon <mheon@redhat.com>
When the validate-source job is re-run manually after adding a label,
it uses stale labels (from the "pull_request" event that originally
triggered it), and so the steps that check labels don't see new labels.
Fix by querying the labels live (similar to how it was done before
commits 6e597af6dc and 1da154117c).
Note the logic differs slightly between hack/ci/make-and-check-size.sh
and hack/ci/pr-should-include-tests. This is because
pr-should-include-tests is also executed locally as well as on non-PRs,
while make-and-check-size is run strictly in CI for PRs only.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Define the team rules we already used before, this makes it explicitly
how the users should be given their access.
In short we should add users to the github teams and not add them
individually to the repos.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The bug reporting instructions previously asked users to compare
their Podman version with the one documented at the top of the README.
This commit updates the issue templates and troubleshooting guide to
point users directly to the latest GitHub release page instead.
Additionally, the obsolete .github/ISSUE_TEMPLATE.md file is removed.
Fixes: #28818
Signed-off-by: Byounguk Lee <nimdrak@gmail.com>
Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
When --pause defaults to true, a Ctrl-C during commit would leave the
container paused. Register a shutdown handler that unpauses the
container on SIGINT/SIGTERM so it is always restored to its running
state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
ContainerStateStopping is still a running state where processes are
active, so it should also be paused during commit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
log_path is currently set at the client side and is ignored by
the server in a remote session. This leads to either incorrect log_path
being considered by the server or not honored at all. Move the handling
from client to the server, in line with other flags such as log_driver.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
