The Docker-compat secret inspect endpoint was incorrectly honoring
the showsecret query parameter, which could expose plaintext secret
data to clients using the Docker-compatible API.
This restricts showsecret to libpod-only requests. Docker-compat
clients always receive redacted secret data, matching Docker's own
behavior.
Add APIv2 tests covering the showsecret behavior on both the
Docker-compat and libpod endpoints, confirming secret data is never
returned from the compat endpoint while libpod continues to honor
the flag.
Fixes: #29570
Signed-off-by: Davoud Azari <davidmotral@gmail.com>
The manifest push and create endpoints accept query parameters that
were never documented, so API users can't discover them.
Push was missing compressionFormat, compressionLevel, format and
removeSignatures. Create was missing annotation and annotations.
The wording matches the same parameters on the image push endpoint.
The deprecated v3 push and add endpoints are left alone.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
POST /containers/create now takes Options as part of HostConfig.Mounts.TmpfsOptions to set options for tmpfs mounts.
Signed-off-by: Ashley Cui <acui@redhat.com>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
The Docker API deprecates Container and ContainerConfig fields in
the GET /images/{name}/json response are deprecated and
they will no longer be included in API v1.45.
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The Docker API 1.44 deprecates the fields HairpinMode, LinkLocalIPv6Address,
LinkLocalIPv6PrefixLen, SecondaryIPAddresses, SecondaryIPv6Addresses available in
NetworkSettings when calling GET /containers/{id}/json and will be removed in a future release.
You should instead look for the default network in NetworkSettings.Networks.
The fields are removed in 1.52. Version gate SecondaryIPAddresses, SecondaryIPv6Addresses
in the handler and update test. HairpinMode, LinkLocalIPv6Address, LinkLocalIPv6PrefixLen
are not returned by the compat endpoint as the response is serialized
to the moby/moby/api structure missing these fields.
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The Docker API in version 1.44 deprecates the is_automated field for
the GET /images/search endpoint. The is_automated field has been deprecated
by Docker Hub's search API. Consequently, searching for is-automated=true
will yield no results.
The Docker API in version 1.44 deprecates the is_automated field
in the GET /images/search response and will always be set to false in the
future because Docker Hub is deprecating the is_automated field in its search API.
Return struct moby/api for the compat endpoint that matches the Docker
API response format and deprecates is_automated.
Update test_v2_0_0_image.py::ImageTestCase::test_search_compat
to verify returned format and fix subtests not being asserted (remove mp).
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
We currently only pass parsed excludes from the ignore file to buildah
and not the ignorefile path. This causes buildah to ignore
`--ignorefile` if the specified file is empty resulting in an empty
exludes. Forward ignoreFile to the server and allow overriding default
ignore files.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
The libpod manifest-create endpoint takes an "images" query parameter that
fills the new list at creation time, but 15-manifest.at never tested it.
Add cases that create a list with images= on both the v4
(/manifests/{name}, 201) and v3 (/manifests/create, 200) endpoints and
check the image ends up in the list.
Also drop the stale "required: true" from the images query parameter in the
swagger docs - the handler treats it as optional, and the existing create
tests (which omit it) already show that.
Fixes: #22258
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
The compat logs handler uses the tail query parameter both to select how
many log lines should be returned and as the capacity of the internal log
channel.
Only the former is part of the API semantics. The channel capacity should
not depend on a user-controlled value: negative values can produce an
invalid channel size, while very large values can cause excessive
allocation before any logs are read.
Use a small fixed-size buffer instead.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
We did not do breaking API changes but it seems confusing to have the
latest docs open and it still says API v5.0.0.
And while at it update the logo link.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
QuadletInstall expects the quadlet file to be first in the file list,
The API handler passes files in filepath.Walk order (lexicographic).
Install would fail if a file like "Containerfile" comes before the
quadlet file.
Signed-off-by: Nicola Sella <nsella@redhat.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
When returning error http code (e.g. 4xx, 5xx) the body needs to contain
a JSON that has a key "message" in it,
we must not use jsonmessage.JSONMessage.
The JSON of shape jsonmessage.JSONMessage is used only when client
already received 200.
Signed-off-by: Matej Vašek <matejvasek@gmail.com>
Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Add CDI information to podman info and podman system info.
The host info now includes the configured CDI spec directories and the
currently discovered CDI devices. The devices are resolved when the info
endpoint is called and there is no need to refresh these in the background.
Also map the same data into the Docker-compatible /info response as CDISpecDirs and DiscoveredDevices.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Returnin nil when input is empty, to skip rlimit replacement
when r_limits is not present in the request.
Fixes: https://issues.redhat.com/browse/RHEL-178653
Signed-off-by: Nicola Sella <nsella@redhat.com>
