28381 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Matt Heon	c1922ea665	Merge pull request #29762 from madhoshyagnik/fix-quadlets-multipart ... pkg/api/handlers/libpod: close quadlets multipart files per iteration and prevent duplicates	2026-09-16 10:05:15 -04:00
Jan Rodák	218d9ce825	Merge pull request #29566 from i-OmSharma/fix-ulimit-memlock-units ... docs: clarify that --ulimit size limits are in bytes	2026-09-16 13:14:00 +02:00
i-OmSharma	552b636939	docs: clarify that --ulimit size limits are in bytes ... The value given to --ulimit is passed to the container unchanged and is interpreted by setrlimit(2), so size limits such as memlock are in bytes. The ulimit shell builtin scales most of those values when printing them (kbytes for -d, -l, -m, -s, 512-byte blocks for -c, -f), which makes the value reported inside the container look wrong. Document the unit used by each limit type, add an example, and note that unit suffixes are not accepted. No behavior change. Fixes: #25236 Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>	2026-09-16 15:24:58 +05:30
Danish Prakash	28850207ee	Merge pull request #29482 from rjgoyln/fix/ci-log-summary-parser ... hack/ci: fix the CI failure summary for non-int suites	2026-09-16 09:11:08 +05:30
Brent Baude	2aed5c4a63	Merge pull request #29775 from podman-container-tools/renovate/dawidd6-action-send-mail-22.x ... Update dawidd6/action-send-mail action to v22	2026-09-15 08:46:16 -05:00
renovate[bot]	c579d05c74	Update dawidd6/action-send-mail action to v22 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-15 12:38:40 +00:00
Jan Rodák	525dfd8700	Merge pull request #29758 from haneul-24/fix/api-endpoint-content-type ... fix: set correct content-type for generate kube	2026-09-15 11:09:46 +02:00
Madhosh Yagnik	94b0c1df14	pkg/api/handlers/libpod: close quadlet files per iteration and prevent duplicates ... processMultipartQuadlets previously deferred closing each multipart part and file inside the loop, leaking descriptors until the handler returned. It also opened files with os.Create, silently overwriting earlier files if a request contained parts with duplicate names. Align processMultipartQuadlets with the manifests multipart upload handler: - Wrap each part processing in a closure so part and file descriptors close immediately on each loop iteration. - Use os.OpenFile with os.O_CREATE|os.O_EXCL|os.O_WRONLY (0600) so duplicate filenames return an error instead of silently overwriting. - Sanitize filenames using filepath.Base to prevent directory traversal. - Add unit tests verifying multiple file extraction, duplicate name rejection, and path traversal sanitization. Fixes: #29752 Signed-off-by: Madhosh Yagnik <madhosh1yagnik@gmail.com>	2026-09-14 23:55:57 +05:30
Jan Rodák	2962afff41	Merge pull request #29730 from jmrplens/docs/rootless-bind-mount-unmapped-parent ... Document rootless bind-mount access through an unmapped parent	2026-09-14 18:45:18 +02:00
Paul Holzinger	6f0386b6f0	Merge pull request #29764 from podman-container-tools/renovate/github.com-mattn-go-shellwords-1.x ... Update module github.com/mattn/go-shellwords to v1.0.15	2026-09-14 17:43:47 +02:00
Jan Rodák	02bffb4017	Merge pull request #29755 from podman-container-tools/renovate/dawidd6-action-send-mail-21.x ... Update dawidd6/action-send-mail action to v21	2026-09-14 17:43:11 +02:00
Paul Holzinger	5439fe7550	Merge pull request #29309 from giuseppe/composefs-handle-ETXTBSY ... hack: drop composefs CI hack	2026-09-14 15:50:08 +02:00
Matt Heon	6e10d5ac76	Merge pull request #29375 from Mahajan-Sachin/quadlet-volume-remainafterexit ... quadlet: do not set RemainAfterExit=yes for volume units by default	2026-09-14 08:52:48 -04:00
Paul Holzinger	687c5e644a	Merge pull request #29525 from sahilnyk/exec-sigproxy-pgid ... exec: forward signals to the exec session's process group	2026-09-14 13:32:46 +02:00
renovate[bot]	bec557b04b	Update module github.com/mattn/go-shellwords to v1.0.15 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-12 21:42:41 +00:00
Sahil Nayak	903a1b6cb6	exec: forward signals to exec sessions over local and remote ... Fixes: #19486 Signed-off-by: Sahil Nayak <contactsahilpnayak@gmail.com>	2026-09-11 21:32:26 +05:30
rjgoyln	ec30a4f7b7	hack/ci: fix the CI failure summary for non-int suites ... The step summary posted when a CI job fails is useless for the bindings suite: it carries a bare failure count and never the failure itself. Two reasons stack up. github_log_summary.py picks between the ginkgo and bats parsers by looking for "int-" in the file name, but int is not the only ginkgo suite - bindings runs ginkgo as well, so its log is handed to the bats parser, which finds nothing beyond the count in ginkgo's summary line. logformatter decides the layout from the log contents, so do the same here. That alone still leaves the summary empty. Only ginkgo run under -p reports a failure on the line logformatter reads the test status from, and `make testbindings` does not pass -p, so every test in a bindings log heads 'log-passed' and the stack trace div is the sole mark of a failure. Key on that div as well. Not on the class by itself: logformatter gives it to error-level logrus lines too, which passing tests emit, but those are spans. Three more things the script got wrong along the way, all of them kept out of sight by the "|| true" on the workflow step. The workflow passes it a glob but only argv[1] was ever read, so any further log was dropped without a word. A job that produces no html log at all leaves that glob unexpanded, which ended in a traceback. And logformatter reads its input through ':utf8', which validates nothing, so a test that wrote raw bytes leaves behind a log that the summary could not even decode. Signed-off-by: rjgoyln <pt40419@gmail.com>	2026-09-11 22:05:08 +08:00
Paul Holzinger	be177b2434	Merge pull request #29677 from haneul-24/Fix/healthcheck-unit-name ... use systemd unit name for healthcheck units	2026-09-11 13:57:29 +02:00
Danish Prakash	7417ed0613	Merge pull request #29388 from AftAb-25/fix/events-network-filter ... events: add missing support for NETWORK filter	2026-09-11 16:39:41 +05:30
Matt Heon	b638cc9f48	Merge pull request #29295 from InvalidInterrupt/fix_api_restart_def_timeout ... Respect container StopTimeout in container restart REST APIs	2026-09-11 06:40:44 -04:00
Aftab Ali	ff12dabebb	events: add missing NETWORK filter to generateEventFilter ... podman events --filter network=<name> was unconditionally returning 'NETWORK is an invalid filter' because the NETWORK case was absent from the generateEventFilter switch statement in filters.go. All other first-class event types (container, image, pod, volume) had corresponding filter cases, but the Network type - despite being fully defined in config.go along with NetworkConnect/NetworkDisconnect statuses and the Event.Network field - had no handler. Add the NETWORK case to filter by network name (e.Network), consistent with Docker's --filter network= behaviour. ID-prefix matching is intentionally omitted: for network connect/disconnect events e.ID holds the container ID, not the network ID, so prefix matching would only work for create/remove events and silently miss join/leave events. Also add unit tests (filters_test.go), integration tests (test/e2e/events_test.go, test/system/090-events.bats), shell completion support for --filter network= (completion.go), and document the new filter key in the man page. Fixes: https://github.com/podman-container-tools/podman/issues/29387 Signed-off-by: Aftab Ali <aftab123215@gmail.com>	2026-09-11 14:31:30 +05:30
José M. Requena Plens	a014988113	Document rootless bind-mount access through an unmapped parent ... A rootless user can bind-mount a directory whose parent is mode 700 when that parent is owned by a UID inside their /etc/subuid range, and gets "statfs ...: permission denied" when the same parent is owned by root. The user has no access to the parent in either case, and nothing in the docs explains the difference. The reason is the user namespace. CAP_DAC_OVERRIDE bypasses a file's mode only when that file's UID and GID are both mapped in the namespace, which is "Operation of file-related capabilities" in user_namespaces(7). A parent whose owner is not mapped is reported with the overflow ID 65534, so root gets no DAC override and the parent's mode is enforced. An owner inside the subordinate range is mapped, the override applies, and mode 700 is bypassed. --userns=keep-id changes none of the outcomes. The report that prompted this was a rootless bind mount of a directory under /etc/letsencrypt, owned by certbot:certbot with mode 750, by a user who is not in that group, and a question about whether that is intentional. The "Using volumes" section explains the ID shift for files created inside the container and says nothing about whether the mount source can be traversed, which is the part the reporter hit. Add a short subsection there that opens with the capability rule and shows three cases as one rule: mode 755 owned by root mounts fine because world permissions already allow it, mode 700 owned by root fails, and mode 700 owned by an ID inside the range succeeds. It also gives the podman unshare check for whether a UID is mapped, and the consequence for subordinate ranges that overlap real accounts. Behavior checked on Debian with podman 5.4.2 and a 100000:65536 range. Discussion: https://github.com/podman-container-tools/podman/discussions/29443 Signed-off-by: José M. Requena Plens <jmrplens@gmail.com>	2026-09-11 10:30:06 +02:00
Danish Prakash	6b8f0d7b73	Merge pull request #29180 from Honny1/vendor-test-pr-845-container-libs ... [Tests] Add blob-level mirror fallback integration tests	2026-09-11 09:34:56 +05:30
renovate[bot]	102a81f7f2	Update dawidd6/action-send-mail action to v21 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-10 23:05:31 +00:00
Sejal	258ba032e1	use consistent name for healthcheck units ... Fixes: #29373 Signed-off-by: Sejal <sej1306kook@gmail.com>	2026-09-10 16:55:33 +00:00
Paul Holzinger	0b62a84304	Merge pull request #29653 from Atishyy27/fix/remote-prune-filter-equals-v2 ... fix(remote): keep '=' in a prune filter value	2026-09-10 18:20:31 +02:00
Giuseppe Scrivano	1881d189f9	hack: drop composefs CI hack ... fixed with https://github.com/podman-container-tools/container-libs/pull/1030 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>	2026-09-10 16:31:07 +02:00
Giuseppe Scrivano	feb7a2a157	vendor: update container-libs ... Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>	2026-09-10 16:31:07 +02:00
Lokesh Mandvekar	38b7f9bd35	Merge pull request #29751 from Luap99/test-cgroupv2 ... test/{apiv2,system}: remove cgroupv2 check	2026-09-10 10:30:20 -04:00
Paul Holzinger	c7e44e4790	test/apiv2: remove cgroupv2 check ... Since podman 6 we only support cgroupv2 systems. Therefore we no longer need this check in the tests and we can simplify them. Signed-off-by: Paul Holzinger <pholzing@redhat.com>	2026-09-10 12:37:52 +02:00
Paul Holzinger	36c16331f6	test/system: remove cgroupv2 check ... Since podman 6 we only support cgroupv2 systems. Therefore we no longer need this check in the tests and we can simplify them. Signed-off-by: Paul Holzinger <pholzing@redhat.com>	2026-09-10 12:33:16 +02:00
Matt Heon	f1b80e5121	Merge pull request #29747 from Luap99/container-libs-module-check ... add new container-libs vendor check	2026-09-10 06:06:12 -04:00
Paul Holzinger	02b2fdb802	Merge pull request #29695 from Fryguy/podman_machine_bootc_extra_arches ... Add a tutorial for adding additional architectures to the bootc image	2026-09-10 12:03:15 +02:00
Jason Frey	fba5515103	Add a tutorial for adding additional architectures to the bootc image ... Built as a general podman machine custom OS tutorial but using the architectures use case as an example. Related to #29688 Signed-off-by: Jason Frey <fryguy9@gmail.com>	2026-09-09 15:54:43 -04:00
Ashley Cui	e967db5f23	Merge pull request #29746 from Luap99/debug ... ci: add dmesg debug for kvm failure	2026-09-09 14:58:19 -04:00
Paul Holzinger	94326feda0	add new container-libs vendor check ... With the container-libs repos we either only supported the tagged versions or using the same vendor commit for all of the at the same time. Mixing different commits, while possible, can run into untested version combinations that cause weird errors later on. To avoid the mismatch add a custom bash script to validate that either all modules use a proper tag or all modules use the same commit. Signed-off-by: Paul Holzinger <pholzing@redhat.com>	2026-09-09 19:21:16 +02:00
Paul Holzinger	137bd6968b	Merge pull request #29734 from lsm5/podman6-vendor-no-slirp ... vendor: go.podman.io/common with slirp removed	2026-09-09 18:50:52 +02:00
Paul Holzinger	aa168a3e4e	ci: add dmesg debug for kvm failure ... The oracle runners sometimes fail with: chown: cannot access '/dev/kvm': No such file or directory Log the kernel logs to see if they say anything of value then to know why this failed. Signed-off-by: Paul Holzinger <pholzing@redhat.com>	2026-09-09 17:34:00 +02:00
Lokesh Mandvekar	820b7bec17	test/e2e: drop dead network_cmd_options config key ... The network_cmd_options engine setting was backed by the slirp4netns network stack, which has been removed. The key is now a no-op (unknown TOML keys are only debug-logged), so drop it from the e2e test config. Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>	2026-09-09 10:30:47 -04:00
Lokesh Mandvekar	b579e7ef99	vendor: go.podman.io/common with slirp removed ... Also bump image and storage to keep in sync with common vendor. container-libs commit 274c303c4db851f26f25ca5421b6346d786fd968 Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>	2026-09-09 10:29:39 -04:00
Paul Holzinger	95cad5d172	Merge pull request #29742 from podman-container-tools/renovate/github.com-onsi-ginkgo-v2-2.x ... Update module github.com/onsi/ginkgo/v2 to v2.32.2	2026-09-09 13:42:08 +02:00
Paul Holzinger	90395386ba	Merge pull request #29743 from podman-container-tools/renovate/zizmorcore-zizmor-action-0.x ... Update zizmorcore/zizmor-action action to v0.6.4	2026-09-09 12:29:20 +02:00
Paul Holzinger	fb57e20133	Merge pull request #29737 from podman-container-tools/renovate/dawidd6-action-send-mail-20.x ... Update dawidd6/action-send-mail action to v20	2026-09-09 12:02:39 +02:00
renovate[bot]	c9aab199fa	Update zizmorcore/zizmor-action action to v0.6.4 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-09 09:55:25 +00:00
Paul Holzinger	4dd6079e51	Merge pull request #29740 from podman-container-tools/renovate/golang.org-x-net-0.x ... Update module golang.org/x/net to v0.59.0	2026-09-09 11:54:21 +02:00
renovate[bot]	9492c578d4	Update module github.com/onsi/ginkgo/v2 to v2.32.2 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-09 06:57:44 +00:00
renovate[bot]	b956bcb390	Update module golang.org/x/net to v0.59.0 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-08 23:18:35 +00:00
Matt Heon	5affbadb26	Merge pull request #29729 from Luap99/machine-test-speedup ... Speed up machine tests	2026-09-08 19:16:42 -04:00
Paul Holzinger	90fbb6a68a	Merge pull request #29735 from podman-container-tools/renovate/golang.org-x-sync-0.x ... Update module golang.org/x/sync to v0.23.0	2026-09-08 19:27:04 +02:00
renovate[bot]	9c96e5d152	Update dawidd6/action-send-mail action to v20 ... Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-08 16:07:30 +00:00