This seems to flake in the parallel CI runs as another process might
also use 8080 already.
We can use any port here so use GetPort() which should give us a
conflict free one.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 472c53b122)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This is really not nice but it is a quick fix to avoid more flakes.
The 10.11.12.0/24 was used by several tests and podman will only allow
the network to be created once with a given subnet so we need to ensure
they are conflict free, otherwise in parallel runs they will fail
randomly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 97d0279e94)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The container prints "Failed to set RLIMIT_CORE: Operation not permitted"
I do not know why this fails when run with sudo but lets just skip it it
for now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 07e257e7f6)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The test assumes a local id_ed25519 ssh key exists and is setup to
connect to its own user. That is basically never the case locally so the
test is broken by design.
If the test should run in some special CI setup where that is the case
we need to enable it and guard based on that later.
For now I just like to get the lima VM tests passing.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 1de60ebf7b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Verify that creating a secret with driver=shell and no --driver-opts
does not inherit the file driver's default path option. Before the fix,
this produced "invalid shell driver option"; after, it correctly fails
with "missing config value" for unconfigured shell commands.
Signed-off-by: Joe Doss <joe@solidadmin.com>
(cherry picked from commit 8b905613b5)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When `podman-remote` tars the context, extra `podman-build-secret*` paths were
either dropped by `.dockerignore` (#25314) or archived as absolute paths so
`COPY . .` pulled host-shaped trees into the image (#28334).
Use relative names under the primary context for extra sources and do not apply
`.dockerignore` to those forced entries.
Fixes: https://github.com/containers/podman/issues/25314
Fixes: https://github.com/containers/podman/issues/28334
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
(cherry picked from commit e18bb9ea8b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Setting Entrypoint= (empty value) in a quadlet .container file should
produce --entrypoint "" in the generated podman command, which clears
the image's default entrypoint. Previously this was silently ignored
because lookupAndAddString skips empty values.
Move the Entrypoint key out of the generic stringKeys map and handle
it separately so that an empty value is passed through.
Closes#28213
Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com>
(cherry picked from commit 926f562bd5)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
If the sqlite file exists make sure we always use that db and no longer
botldb. There are known race conditions in the db migration logic that
might make it so that both database files exists at once.
In order to ensure we use the correctly migrated one we must prefer
sqlite here.
see https://github.com/containers/podman/issues/28216
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Previously, using --secret=id=foo,env=BAR in remote mode would fail because the client sent the env var name to the server, which tried to resolve it locally. This patch modifies the client to resolve the environment variable locally, write it to a temp file, and send it as a file-based secret.
Fixes#27494
Signed-off-by: ZuhairM7 <ZuhairM7>
Signed-off-by: ZuhairM7 <zuhairmerali@gmail.com>
- Update documentation: Differentiate `unless-stopped` from `always` - containers stopped by the user before a reboot will not restart.
- Add `should-start-on-boot` filter: Identify containers that require a restart after a system reboot.
- Update command documentation: Add `restart-policy` and `label!` filters to the documentation for container commands (rm, ps, start, stop, pause, unpause, restart).
- Add `restart-policy` and `shoud-start-on-boot` to completions.
- Update service: Update `podman-restart.service` to use the `needs-restart=true` filter.
- Preserve state: Preserve the `StoppedByUser` state across reboots.
- Update API: Add a `ShouldStartOnBoot()` method to the Container API.
- Update documentation: Add descriptions for the `should-start-on-boot` filter.
Fixes: https://issues.redhat.com/browse/RHEL-129405
Fixes: https://github.com/containers/podman/issues/20418
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
<MH: Fixed cherry-pick conflicts>
Signed-off-by: Matt Heon <matthew.heon@pm.me>
- remove old CLI validation that only checked --pod flag
- add validation in namespaces.go to catch all paths (cli, quadlet, api)
- block userns mixing for all pods with infra, not just ipc/net
- update error message to be clearer
- fix test cleanup to use PodmanExitCleanly()
- use dynamic pod names in system tests to avoid conflicts
fixes#26848
Signed-off-by: 0xdvc <neilohene@gmail.com>
<MH: Fixed cherry-pick conflicts>
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Fixes: #26588
For use cases like HPC, where `podman exec` is called in rapid succession, the standard exec process can become a bottleneck due to container locking and database I/O for session tracking.
This commit introduces a new `--no-session` flag to `podman exec`. When used, this flag invokes a new, lightweight backend implementation that:
- Skips container locking, reducing lock contention
- Bypasses the creation, tracking, and removal of exec sessions in the database
- Executes the command directly and retrieves the exit code without persisting session state
- Maintains consistency with regular exec for container lookup, TTY handling, and environment setup
- Shares implementation with health check execution to avoid code duplication
The implementation addresses all performance bottlenecks while preserving compatibility with existing exec functionality including --latest flag support and proper exit code handling.
Changes include:
- Add --no-session flag to cmd/podman/containers/exec.go
- Implement lightweight execution path in libpod/container_exec.go
- Ensure consistent container validation and environment setup
- Add comprehensive exit code testing including signal handling (exit 137)
- Optimize configuration to skip unnecessary exit command setup
Signed-off-by: Ryan McCann <ryan_mccann@student.uml.edu>
Signed-off-by: ryanmccann1024 <ryan_mccann@student.uml.edu>
Error messages between runc and crun are not synchronized, and
in some case exit codes can be different, too.
Commit dd1bcabae9 ("CI: use local registry, part 2 of 3: fix tests")
removed the special case handling for runc from the
"podman run --seccomp-policy image (block all syscalls)"
test case, and so it fails, for example, like this:
Error: failed to connect to container's attach socket: /tmp/podman-e2e-2877753109/subtest-1698249469/p/root/overlay-containers/62585e98da7dc3fdb32d3b6de0980c762a8a6cde008ed35c68727fb97f5369c7/userdata/attach: no such file or directory
[FAILED] Command exited with status 127 (expected 126)
or this:
time="2025-08-29T17:16:52-07:00" level=error msg="cannot start a container that has stopped"
Error: `/usr/bin/runc start 63ce789f7037d9545cde832d29343704cab842e7288046407d0efa347d5ecb77` failed: exit status 1
[FAILED] Command exited 126 as expected, but did not emit 'OCI runtime error: runc: read from the init process'
(depending on runc version, phase of the moon etc.)
We can not reasonably expect a specific error message and exit code in
such an unusual scenario, but let's try.
With this commit, the above test passes successfully on my machine.
Tested with:
make localintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc
make remoteintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc
While at it, simplify the error message check for crun (we don't have to
check for the entire message, [the same] substring is fine for both
local and remote cases).
Fixes: dd1bcabae9 ("CI: use local registry, part 2 of 3: fix tests")
Reported-by: Yiqiao Pu <ypu@redhat.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Previously, `secret create` required stdin to be a pipe when using `-`,
blocking interactive stdin forcing users to use insecure patterns like
`echo "secret" | podman secret create <name>`.
Remove the pipe check to allow interactive stdin.
Closes#18591, #27879
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
I happened to run `podman run --config=/path/to/file` and got
an error without a trailing newline, which was a bit jarring.
Fix the instances I noticed.
Assisted-by: OpenCode (Claude Opus 4.5)
Signed-off-by: Colin Walters <walters@verbum.org>
The code checks for isPathOnVolume and isPathOnMount so we can just use
the SecureJoin here directly to check for path existance.
Then instead of walking symlinks and trying to guess if they are on a
mount just assume if it is a link (path is different from the normal
joined one) then don't error out early and let the OCI runtime deal with
it. The runtime does produce a less readable error but it still fails
and we have much less fragile code.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
MkdirAll can fail with EEXIST when the path is a symlink and the target
doesn't exist. As such we should ignore the error.
Note there is something fundemantal wrong here with the path access as
it is following the symlink to the host, however it is only for a
stat() so it is not an security issue here.
Fixes: 637c264e2e ("fix issues found by nilness")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It is failing with:
replacing mount point ".../root/overlay/xxx/merged": directory not empty
First, the build does not need network so ensure we don't leak network
allocations by killing it. Second, kill is always async so ensure to
wait for the actul build process exit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
- Add comprehensive mock registry server for e2e search tests
- Replace quay.io and other external registry calls with local mock
- Improve test reliability by removing network dependencies
- Maintain full test coverage with controlled mock data
Fixes: https://github.com/containers/podman/issues/27304
Fixes: https://issues.redhat.com/browse/RUN-3623
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
This change adds a .CreatedAt format option to the podman artifact ls
command to match the behavior of podman images --format CreatedAt.
The .Created field continues to display human-readable elapsed time
(e.g., '6 hours ago'), while the new .CreatedAt field displays the
full timestamp (e.g., '2025-10-23 12:34:56 +0000 UTC').
Changes:
- Refactored artifactListOutput struct to store time.Time value
- Added CreatedAt() method returning full timestamp string
- Added Created() method for human-readable duration
- Updated documentation to include .CreatedAt field
- Added e2e test for .CreatedAt format option
Generated-with: Cursor AI
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: axel7083 <42176370+axel7083@users.noreply.github.com>
fix: update kube play command cobra use
Signed-off-by: axel7083 <42176370+axel7083@users.noreply.github.com>
Add multi-file support to podman kube play/down
- Support multiple YAML files and URLs in single command
- Combine files with YAML document separators (---)
- Refactor for better testability with dependency injection
- Update documentation with examples for multiple inputs
- Improve memory efficiency with streaming I/O operations
Fixes: https://github.com/containers/podman/issues/26274
Fixes: https://issues.redhat.com/browse/RUN-3586
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Many commands support the `--format` flag which accept a go template to
allow for formatting for certain values, but it is not
yet implemented for artifact inspect command.
Adding this feature will allow easy formatting in scripts as well as
running it on a terminal.
This feature is implemented for artifact inspect by taking reference
from images and network commands implementation.
Fixes: [#27112](https://github.com/containers/podman/issues/27112)
Signed-off-by: Akash Yadav <akashyadav256526@gmail.com>
