processMultipartQuadlets previously deferred closing each multipart part
and file inside the loop, leaking descriptors until the handler returned.
It also opened files with os.Create, silently overwriting earlier files if
a request contained parts with duplicate names.
Align processMultipartQuadlets with the manifests multipart upload handler:
- Wrap each part processing in a closure so part and file descriptors close
immediately on each loop iteration.
- Use os.OpenFile with os.O_CREATE|os.O_EXCL|os.O_WRONLY (0600) so duplicate
filenames return an error instead of silently overwriting.
- Sanitize filenames using filepath.Base to prevent directory traversal.
- Add unit tests verifying multiple file extraction, duplicate name rejection,
and path traversal sanitization.
Fixes: #29752
Signed-off-by: Madhosh Yagnik <madhosh1yagnik@gmail.com>
The timeout is simply to low, I don't know the previous numbers were
collected because they are simply wrong. A machine init takes around 50s
total. And while the ready timeout itself could be shorter there is
really no good reason to set such a low limit as it will cause wrong
failures.
This is currently flaking a lot in CI, I see it in most hyperV logs I
looked at[1]. While there is likely another problem with the boot
failures I think this added a ton of false positives as it errors out
early.
[1] https://github.com/podman-container-tools/podman/actions/runs/34146238887/job/101820830173
Fixes: dd28c14f8c ("hyperv: add timeout to vsock ready wait")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Even on the slowest of CI systems a normal VM start does not seem to
take more than 1 minute.
Instead we seem to have flakes which cause our command to hang on
startup. In that case we thought waiting longer might help but instead
it just wastes 10 minutes.
Se the default command timeout to 3 minutes which should be plenty even
on the slowest of CI systems. Anything above will likely never finish
and we can just abort the test as failed.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Combine the no volume and --import-native-ca test into one.
This removes one full machine init/start/stop cycle.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Instead of creating a fresh machine which is slow reuse an existing
test for this test.
Also fix the test to actually check the file content properly, it was
using the wrong build output. And then just use one cat for both files
to make it a tiny bit faster.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Only start a machine once, not three times to safe time.
Also include stdout/err as part of the curl command so errors are
visible. And lastly the latest moby client code should support unix
sockets on windows so we can test it there as well.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Instead of having to start a new machine again here just drop the test
and do the stop check as part of another test which already has a
machine running.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The test should fail before booting a real VM so we can use the fake
image which should make the test a few seconds faster.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The test starts a machine 3 times taking almost 180 seconds in linux CI.
We have a lot of machine starts elsewhere already so we really do not
need a basic start and for the quiet/noinfo checks we can just add them
to another existing start command.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Each machine start/stop adds up in CI, combine several related tests to
reduce the machine init/start/stops cycles.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
On podman machine set we have three modes, not set (keep user),
--rootful (set user to root), --rootful=false (set to rootless user).
The later could not be passed at all before this.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The restart tests are rather slow. On the linux CI 60 seconds for the
stopped case and almost 120 seconds for the restart running case.
Combine both cases into one so we only have to start a machine twice,
not three times and only need to init it once.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Do not set RemainAfterExit=yes by default when converting Quadlet
.volume files to systemd oneshot services.
Setting RemainAfterExit=yes causes systemd to consider the volume
service active even after the volume is deleted manually, preventing
systemd from re-executing volume creation when dependent container
services restart.
Fixes#27862
Signed-off-by: Sachin Mahajan <sachinmahajan903@gmail.com>
These errors only happen on windows or freebsd. They happen when a
function always returns a hard error there so it assumes the condition
is always true which is not the case on another platform.
We then also need to use nolintlint so it does not trigger on linux
where the nolint is not needed otherwise.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Looks like it picked up new deprecated matches so we need some more
nolint to silence them where we still need them for backwards compat in
the API.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Existing KillContainer handling uses HTTP status code 409 when the request cannot be performed because of the current container state. HTTP status code 404 is also used when the target container does not exist.
In contrast, errors from the stats handler are not reflected in the HTTP status code. The HTTP status code is always 200, and the errors are recorded only as generic errors in the server log.
To maintain compatibility with both streaming enabled and disabled, this change treats obtaining at least one complete unit of response content as the response contract. It then keeps the response content consistent with the HTTP status code.
Signed-off-by: Hiroaki KAWAI <hiroaki.kawai@gmail.com>
Since I use go 1.26 the go fix does not have all the rules built in,
there are newer ones in modernize so run the explicitly to fix more code
for go 1.26.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The function logged the wrong error, logging ec which is the return
value from ParseInt makes no sense since the error tells us the function
failed so ec is invalid/undefined. Also ParseInt already includes the
string input in the error so just drop it.
This was flagged by govet now that we use go 1.26 because %q was wrong
for integers.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Plus manually deleting the left over inline functions because go fix
doesn't do that even though they are private functions.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Docker API v1.44 now includes status properties
in Runtimes for the GET /info endpoint.
Read output of {oci_runtime_cmd} features command
lazily and expose the JSON
output as-is (with removed new lines and
whitespace) as the status field in GET
/info for v1.44+.
Add status to libpod GET /info in ociRuntime.features
and `podman info` (shared).
Add API tests for both endpoints.
Fixes: https://redhat.atlassian.net/browse/RUN-3319
Signed-off-by: Marek Simek <msimek@redhat.com>
ostree.go is limited to only amd64 and arm64, but its tests run on all
architectures and fail because all their symbols are missing.
Don't run tests on an architecture where the non-test code doesn't
exist.
References: https://github.com/podman-container-tools/podman/issues/29711
Signed-off-by: Hugo Osvaldo Barrera <hugo@whynothugo.nl>
RestartContainer was always setting options.Timeout with values
from query, without checking if the caller had specified them or if
they were simply zero values. Copy logic from StopContainer to check
for caller-specified values, leaving Timeout nil if not specified.
fixes: https://github.com/podman-container-tools/podman/issues/29276
Signed-off-by: Garry Lawrence <InvalidInterrupt@users.noreply.github.com>
The remote client uploads the artifact files from a goroutine and waits for it with a sync.WaitGroup, but the goroutine never calls Done(), so Wait() blocks for good and the command never returns. Nothing caught it because no test ran manifest add --artifact against podman-remote.
Start the goroutine with WaitGroup.Go, which releases the counter on its own once the upload is finished.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
Two commands can set a subject on a manifest list, podman manifest annotate --index --subject and podman manifest add --artifact-subject. Both work locally, but they do nothing at all when podman runs with --remote.
The value never leaves the client. Before sending the request the remote client copies everything into manifests.ModifyOptions and manifests.AddArtifactOptions, and neither struct had a field to hold the subject, so it was quietly thrown away. The server had a second problem of its own, ManifestModify rebuilds ManifestAddArtifactOptions by hand and left out the embedded ManifestAnnotateOptions, so --os, --arch and --annotation were being dropped there as well.
Add the missing field to both structs, fill it in from the tunnel ImageEngine, and let the handler pass the annotate options along. Also add two system tests that run both flags for real so the remote path stays covered.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
Allow the `idmap` volume option to be combined with the overlay `O`
option, e.g. `-v /src:/mnt:O,idmap` or `-v myvol:/mnt:O,idmap`.
Previously any option other than `U`, `upperdir` and `workdir` combined
with `O` was rejected.
The parser in GenVolumeMounts now accepts `idmap` alongside `O` and
rejects the first disallowed option instead of counting flags. The
mappings from the container's user namespace are threaded onto the
generated overlay mount so the runtime idmaps it. This is done for both
the anonymous/host-path overlay volumes and the named-volume overlay
path, which are handled by separate code.
When a volume is idmapped the runtime shifts the mount so that on-disk
IDs map identically into the container, so the overlay backing dirs
(contentDir, upperdir, workdir) must be owned by real root (0) rather
than the host IDs the container root maps to; otherwise they surface as
the overflow ID inside the container and are inaccessible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
