Replace remaining references to Slirp/slirp4netns in code comments
with Pasta or remove them where the reference is no longer relevant.
Signed-off-by: Lokesh Mandvekar <lsm5@linux.com>
When a container in a pod is stopped, its container name is removed from /etc/hosts. etchosts.Remove() filters for any entry matching the container name or the pod hostname. A pod with additional host entries like --add-host FQDN;pod-hostname:127.0.0.1 is affected by this deletion, too.
Only the container name needs to be removed when a container is stopped.
Signed-off-by: Clemens Klug <git@agp8x.org>
The default std json behavior is to escape &, < and >. Because we print
to the terminal we do not want escapes and rather the real chars.
That is what PrintGenericJSON() does but because we have custom
MarshalJSON() overwrite on the type which called json.Marshal() this
option was not carried into that. The inner type must not escape it.
This is not a problem in the other direction because the outer
json.Marshal call will still escape the chars returned from the inner
MarshalJSON() result if needed.
Fixes: #28560
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The podman module paths are moving from github.com/containers/podman to
go.podman.io/podman. This will help with future mobility.
Signed-off-by: Brent Baude <bbaude@redhat.com>
Check the result from the volume config deletion
to verify rows were actually affected. If no
rows were deleted, return ErrNoSuchVolume.
Signed-off-by: Donal O'Sullivan <osullivanpatrickdonal@gmail.com>
This PR reflects the upstream change of moving the buildah module from
github.com/containers/buildah to go.podman.io/buildah.
Signed-off-by: Brent Baude <bbaude@redhat.com>
Use shared configfile instead of custom policy.json path handling.
This updates ocipull to rely on signature.DefaultPolicy(), removes
explicit SignaturePolicyPath, and replaces trust's custom default-policy
path logic with common configfile code.
Replace hidden `--policypath` with --signature-policy` and require
it for `trust set` command instead of path resolution based on
configfile.
For `trust get`, the `--signature-policy` is optional.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
This was implemented by containers/netavark #1369; this commit
completes the process by wiring it into Podman. We now respect
the CLI order for configured networks - if a user passes
`--net net1,net2` we guarantee that net1 will be configured
before net2.
For containers created before this patch, we don't retain enough
information to configure networks in CLI order, so we use
alphabetical order instead to still guarantee consistency.
No breaking API changes have been made, but we do add a new
field to supplement the existing map to (optionally) provide
ordering information. The Podman CLI will always pass this.
Existing applications that do not will, again, receive]
deterministic ordering based on an alphabetical sort of network
names.
This requires the latest version of Netavark to work properly.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
The systemd timer created for health checks did not pass global
podman flags to the subprocess, causing it to use default storage
settings instead of matching the parent process. This is most
visible with --transient-store, where the healthcheck looks up
the container in the default store instead of the volatile one.
Extract GlobalPodmanArgs() from CreateExitCommandArgs so both the
exit command and healthcheck timer share the same set of global
flags (--root, --runroot, --transient-store, --storage-driver, etc.).
Fixes: https://github.com/containers/podman/issues/28483
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Remove all slirp4netns-specific setup and helper functions while
preserving the RootlessRLK port mapping functions that are still
used by pasta and bridge networking.
Rename networking_slirp4netns.go to networking_rootlessport.go.
Convert the slirp4netns compose test to use pasta instead.
Remove rootlessSlirpSyncR/W fields from container struct and
getSlirp4netnsIP stub from FreeBSD networking.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Using --network=slirp4netns now returns a hard error directing
users to pasta and `podman system migrate`.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add slirp4netns to pasta migration in `podman system migrate`. When
run, it changes the NetMode from slirp4netns to pasta and removes
any slirp4netns network options. Warns about options that cannot be
mapped to pasta (e.g. cidr, allow_host_loopback). The config is
persisted via RewriteContainerConfig.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Just as additional hardening.
Note chrootarchive does not work on macos/windows, in that case it still
falls back to the regular pkg/archive.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The go std os package to will always make sure to use O_CLOEXEC, however
in cases where we directly call unix.Open() we need to pass that flag
explicitly.
I looked at this as there was a report of a leaked fd on the pasta list,
though I am not sure this will address it.
But anyway doing this should be rather safe and avoid leaks into other
processes.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
ExecContainerHTTP returns attachChan to its caller before attachExecHTTP
finishes. The caller's deferred close(holdConnOpen) can therefore fire
while attachExecHTTP is still running (including its own deferred
cleanups), which races with the goroutine inside attachExecHTTP that
reads deferredErr after <-holdConnOpen unblocks.
Fix this by introducing an errCh channel: deferred functions write
deferredErr into it, and the goroutine reads from it after
<-holdConnOpen unblocks, ensuring the read happens-after all writes to
the named return value.
Fixes: #28277
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
Add support for `default_host_ips` in containers.conf to set default
host IP(s) if no IP is set when forwarding ports. Multiple IPs can be
configured, and passing explicit IP with -p will always override
the configured defaults.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
rootlessport: clarify RootlessCNI comment
Update the comment for the RootlessCNI conditional to clarify that
the flag is for rootless bridge networking, not CNI specifically.
The bool is set when netStatus != nil in slirp4netns and will be
removed when slirp4netns and rootlessport are fully dropped.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This prevents a nil pointer crash when running network=host containers
on a FreeBSD host using podman-remote.
Fixes: #28289
Signed-off-by: Doug Rabson <dfr@rabson.org>
When `podman-restart.service` stops containers, it marks them as "stopped by
user" which breaks the `unless-stopped` restart policy. Add hidden
`--not-stopped-by-user` flag to prevent this, allowing `unless-stopped`
containers to restart on next boot.
Fixes: https://github.com/containers/podman/issues/28152
Fixes: https://issues.redhat.com/browse/RUN-4357
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
In the moby/moby, the namesgenerator is internal. We still want to
depend on it, so this commit copies it from moby/moby to our code-base.
The good thing is the file is frozen upstream, so no more changes are
going to appear in it.
Fixes: #27536.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
This allows things like compose project names to be associated with log
messages and later used in log processing and analysis.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
For remote operation, start the remote service with --tls-details:
using --tls-details on the client side will only affect client's
connection.
This should eventually include many more tests - track down all current
uses of libpod.Runtime.{SystemContext,imageContext,LibimageRuntime}.
That will come later
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Currently validation that log tag requires journald driver is done in several
places and emits only warning. Making it an error and moving to
`(c *Container) validate()` is a more correct approach.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
