Commit graph

24493 commits

Author SHA1 Message Date
Paul Holzinger
c2706d0b6a
Bump buildah to v1.39.4
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:39:56 +02:00
Giuseppe Scrivano
66e4a8d31e
libpod: do not cover idmapped mountpoint
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit c9c44d400c)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:39:12 +02:00
Ricardo Branco
ad9c505699
test: Fix runc error message
Signed-off-by: Ricardo Branco <rbranco@suse.de>
(cherry picked from commit 392a8f4ac5)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:34:19 +02:00
Giuseppe Scrivano
52deb8c76e
oci: report empty exec path as ENOENT
unify the error codes returned by runc and crun.

Fix the tests to work with both runtimes, as well as the
https://github.com/containers/crun/pull/1672 changes in progress for
crun.

Follow-up for https://github.com/containers/podman/pull/25340

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 4695564730)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:32:49 +02:00
Giuseppe Scrivano
1a4c075a1f
test: adapt tests new crun error messages
Needed-by: https://github.com/containers/crun/pull/1672

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit c65bb903b6)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:32:34 +02:00
Giuseppe Scrivano
6a5340bc94
test: remove duplicate test
"podman run exit ExecErrorCodeCannotInvoke" does the same thing.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit 35d2a65e3a)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-04-01 11:32:33 +02:00
openshift-merge-bot[bot]
b4024661d0
Merge pull request #25692 from Luap99/v5.4-backports
[v5.4] some CI backports + test fixes for rawhide
2025-03-27 16:35:28 +00:00
Paul Holzinger
3c2ae98953
cirrus: test only on f41/rawhide
Like commit d03e8ffc56, we need to bump to go 1.23 to get some
dependency updates for CVE fixes.

Thus it will no longer build/test on F40, however F40 might get
rebased to go 1.23 soon then we can revert this.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 05fc9d2d6b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-27 14:10:50 +01:00
Paul Holzinger
45e051377c
CI: use z1d instance for windows machine testing
This one has two local NVMe's attached so we should be able to use fast
local storage to hopefully speed the test up. The NVMe are not mounted
by default so we have to format and mount them. I have choosen Z as
drive letter as I guess it seems most likely that it is free.
Then we need to set the TMPDIR envs to make the machine tests use the
new location.

This speeds up hyperV tests by 20mins and wsl by 9 mins.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 9b9c60d814)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-26 18:48:46 +01:00
Paul Holzinger
5bf8f8aeea
New images 2025-03-24
From https://github.com/containers/automation_images/pull/402

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit a0acdb837b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-26 18:47:59 +01:00
Paul Holzinger
ede8eae23c
test/e2e: use go net.Dial() ov nc
This is simpler as we don't have to rely on an external command. The
retry loop is need as we check for a container porcess connection, and
while we know podman binds the port before returning there is no way to
know whenthe contianer application bound the port so we must retry a
bit.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit bcc2063e9e)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-26 18:46:48 +01:00
Paul Holzinger
1266f45a23
test: use ncat over nc
nc can be provided by either ncat (nmap) or netcat (OpenBSD), we only
work with the nmap version so make sure we always use that one and not
the short alias which can be resolved to either one.

It is not clear to me what changed on rawhide but it seemsv netcat is
preferred even though we have nmap-ncat installed.

Note this only changes the host side nc calls, the Alpine based images
only have nc as command so we must continue to use it inside.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit f8787bb219)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-26 18:46:48 +01:00
Paul Holzinger
9902716901
New images 2025-03-12
from https://github.com/containers/automation_images/pull/401

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 1945506905)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-26 18:46:44 +01:00
openshift-merge-bot[bot]
227df90eb7
Merge pull request #25613 from openshift-cherrypick-robot/cherry-pick-25600-to-v5.4
[v5.4] [skip-ci] RPM: Add riscv64 to ExclusiveArch-es
2025-03-18 10:28:09 +00:00
Yanko Kaneti
33b4b301fc RPM: Add riscv64 to ExclusiveArch-es
Signed-off-by: Yanko Kaneti <yaneti@declera.com>
2025-03-18 09:56:34 +00:00
openshift-merge-bot[bot]
555e9abde9
Merge pull request #25591 from openshift-cherrypick-robot/cherry-pick-25520-to-v5.4
[v5.4] Fix HealthCheck log destination, count, and size defaults
2025-03-17 17:13:28 +00:00
Jan Rodák
64e2b91ab4 Fix HealthCheck log destination, count, and size defaults
GoLang sets unset values to the default value of the type. This means that the destination of the log is an empty string and the count and size are set to 0. However, this means that size and count are unbounded, and this is not the default behavior.

Fixes: https://github.com/containers/podman/issues/25473
Fixes: https://issues.redhat.com/browse/RHEL-83262

Signed-off-by: Jan Rodák <hony.com@seznam.cz>
2025-03-17 15:10:59 +00:00
openshift-merge-bot[bot]
61d703ba85
Merge pull request #25592 from openshift-cherrypick-robot/cherry-pick-25553-to-v5.4
[v5.4] Windows installer test: hardcode the ID of the latest GH release
2025-03-14 19:40:15 +00:00
Mario Loriedo
bef77d74d7 Win installer test: hardcode latest GH release ID
To avoid problems when automatically downloading
`latest` podman windows installer (e.g. the windows
installer hasn't been included in the GH release
because of a problems with the keys to sign it), we
are now hardcoding the version of Podman that is
used to test the upgrade from latest to current
version.

Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
2025-03-14 17:41:51 +00:00
openshift-merge-bot[bot]
6df24a5bc2
Merge pull request #25567 from openshift-cherrypick-robot/cherry-pick-25549-to-v5.4
[v5.4] [skip-ci] Packit: Fix action script for updating upstream commit id in rpm spec
2025-03-13 10:07:07 +00:00
Lokesh Mandvekar
88a3bfbde2 Packit: Fix action script for fetching upstream commit
This fixes multiple trailing quotes after the commit and also ensures
the older commit id will be correctly replaced by the newer id.

Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
2025-03-13 09:55:05 +00:00
openshift-merge-bot[bot]
3079ee35fd
Merge pull request #25535 from mheon/bump_541
Bump to v5.4.1
2025-03-11 18:34:12 +00:00
Matt Heon
405c55b4a4 Bump to v5.4.2-dev
Signed-off-by: Matt Heon <mheon@redhat.com>
2025-03-11 13:22:53 -04:00
Matt Heon
b79bc8afe7
Bump to v5.4.1
Signed-off-by: Matt Heon <mheon@redhat.com>
2025-03-11 13:22:13 -04:00
openshift-merge-bot[bot]
854657602f
Merge pull request #25531 from openshift-cherrypick-robot/cherry-pick-25501-to-v5.4
[v5.4] update gvproxy version to 0.8.4
2025-03-11 15:43:08 +00:00
Yevhen Vydolob
01a55d9d5c update gvproxy version to 0.8.4
The 0.8.4 has one important fix[1], which could improve #25121.
Also it set all places to use same version of gvisor-tap-vsock
[1]https://github.com/containers/gvisor-tap-vsock/issues/474

Signed-off-by: Yevhen Vydolob <yvydolob@redhat.com>
2025-03-11 13:55:02 +00:00
openshift-merge-bot[bot]
1c434429fa
Merge pull request #25476 from openshift-cherrypick-robot/cherry-pick-25445-to-v5.4
[v5.4] [skip-ci] Packit/RPM: Display upstream commit SHA in all rpm builds
2025-03-11 10:13:14 +00:00
openshift-merge-bot[bot]
771d7a8d2c
Merge pull request #25521 from mheon/541_backports
Backports for v5.4.1
2025-03-11 10:10:31 +00:00
Matt Heon
0f20d21240 Update Buildah to v1.39.2
Signed-off-by: Matt Heon <mheon@redhat.com>
2025-03-10 14:38:37 -04:00
Matt Heon
bdcede792f Update release notes for v5.4.1
Signed-off-by: Matt Heon <mheon@redhat.com>
2025-03-10 13:22:55 -04:00
Jakub Panek
3e6e003173 Fix reporting summed image size for compat endpoint
Signed-off-by: Jakub Panek <me@panekj.dev>
2025-03-10 13:21:25 -04:00
Brent Baude
090dbc4cee podman-import only supports gz and tar
according to the conversation in #18193, we only support plain tar or
gzipped tar as input.

Fixes: #18193

Signed-off-by: Brent Baude <bbaude@redhat.com>
2025-03-10 13:19:20 -04:00
Paul Holzinger
5327df1921 quadlet kube: correctly mark unit as failed
When no containers could be started we need to make sure the unit status
reflects this. This means we should not send the READ=1 message and not
keep the service container running when we were unable to start any
container.

There is the question what should happen when only a subset was started.
For systemd we can only be either running or failed. And as podman kube
play also just keeps the partial started pods running I opted to let
systemd keep considering this as success.

Fixes #20667
Fixes https://issues.redhat.com/browse/RHEL-80471

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-10 13:16:58 -04:00
Paul Holzinger
bc37e935ba pkg/domain/infra/abi/play.go: fix two nilness issues
The first condition is checking an error where no error is returned and
the second is checking even though err == nil was matched above already
so we know the error is not nil here.

Then also replace os.IsNotExist(err) with errors.Is(err, os.ErrNotExist)
as that should be used for new code.
This should not change behavior in any way.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-10 13:16:51 -04:00
Paul Holzinger
02e8a59774 kube play: don't print start errors twice
It is very bad practise to print to stdout in our backend code without
nay real context. The exact same error message is returned to the caller
and printed in the cli frontend hwere it should be.

Therefore drop this print as it is redundant.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-10 13:16:40 -04:00
Yuri Timenkov
cd8582d4f0 libpod: race in WaitForConditionWithInterval()
There are multiple concurrent goroutinces which produce result and they
race agains each other, while producing different results.

This commit addresses at least a part of the problem - producing
different results for competing "sources".

Fixes: #25479

Signed-off-by: Yuri Timenkov <yuri@timenkov.pro>
2025-03-10 13:14:10 -04:00
Yuri Timenkov
ab7c54b4cf libpod: race in WaitForExit() with autoremove
When waiting for container to be not-running, sometimes wait retuns code
-1 with an empty error instead of actual exit code.

It turned out that syncContainer returns ErrCtrRemoved for a removed
container instead of ErrNoSuchCtr, while data can still be pulled from
the database.

This fixes the issue by taking into account both codes.

Fixes: #25479

Signed-off-by: Yuri Timenkov <yuri@timenkov.pro>
2025-03-10 13:14:02 -04:00
David Negstad
180d55165d Don't try to resolve host path if copying to container from stdin.
Fixes: #25472

Signed-off-by: David Negstad <David.Negstad@microsoft.com>
2025-03-10 13:13:44 -04:00
Ashley Cui
b716aa17e2 Use svg for pkginstaller banner
On external monitors with different resolutions, our pkginstaller logo renders poorly. Using vector graphics solves this problem.

Signed-off-by: Ashley Cui <acui@redhat.com>
2025-03-10 13:12:35 -04:00
openshift-merge-bot[bot]
76e6a3d5e2
Merge pull request #25515 from openshift-cherrypick-robot/cherry-pick-25488-to-v5.4
[v5.4] Create quota before _data dir for volumes
2025-03-10 15:08:00 +00:00
Matt Heon
bff9da4e3a Create quota before _data dir for volumes
This resolves an ordering issue that prevented quotas from being
applied. XFS quotas are applied recursively, but only for
subdirectories created after the quota is applied; if we create
`_data` before the quota, and then use `_data` for all data in
the volume, the quota will never be used by the volume.

Also, add a test that volume quotas are working as designed using
an XFS formatted loop device in the system tests. This should
prevent any further regressions on basic quota functionality,
such as quotas being shared between volumes.

Fixes #25368
Fixes https://issues.redhat.com/browse/RHEL-82198
Fixes https://issues.redhat.com/browse/RHEL-82199

Signed-off-by: Matt Heon <mheon@redhat.com>
2025-03-10 14:18:41 +00:00
openshift-merge-bot[bot]
7b0a999baf
Merge pull request #25482 from openshift-cherrypick-robot/cherry-pick-25478-to-v5.4
[v5.4] [CI:DOCS] Packit: clarify secondary status in CI
2025-03-06 13:20:23 +00:00
Lokesh Mandvekar
a15623d12f Packit: clarify secondary status in CI
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
2025-03-05 14:01:45 +00:00
Lokesh Mandvekar
118aa9ef94 Packit/RPM: Display upstream commit SHA in all rpm builds
Packit's `pre-sync` action allows modification of spec file prior to
dist-git PR creation. This is already being done on containers-common
rpm to update c/storage and c/image verions tags in spec.

This commit will allow `podman version` to show `Git Commit: $SHA` for
copr as well as koji builds.

Ref: https://raw.githubusercontent.com/containers/common/refs/heads/main/.packit.yaml

Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
2025-03-05 10:05:27 +00:00
openshift-merge-bot[bot]
7f6c2ade94
Merge pull request #25444 from openshift-cherrypick-robot/cherry-pick-25408-to-v5.4
[v5.4] podman run: fix --pids-limit -1 wrt runc
2025-03-03 17:19:32 +00:00
Kir Kolyshkin
fea21e9bc0 podman run: fix --pids-limit -1 wrt runc
Since commit c25cc7230 ("Allow a value of -1 to set unlimited pids
limit") podman converts the pids-limit value of -1 to 0 for OCI spec.

Unfortunately, different runtimes (crun and runc) treat pids.limit=0
differently, and the runtime-spec definition is somewhat vague
(see [1]).

Long term fix belongs to runtime-spec and then runtimes should follow
it.

Short term fix is do not convert -1 to 0 (as all runtimes treat -1 as
unlimited).

[NO NEW TESTS NEEDED] -- this is covered by test added in commit 553e53d44.

Fixes: https://issues.redhat.com/browse/RHEL-80973

[1]: https://github.com/opencontainers/runc/issues/4014#issuecomment-1888185352
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-03 10:55:12 +00:00
openshift-merge-bot[bot]
6f616936f5
Merge pull request #25418 from openshift-cherrypick-robot/cherry-pick-25416-to-v5.4
[v5.4] vendor: update github.com/go-jose/go-jose/v3 to v3.0.4
2025-02-27 19:04:59 +00:00
Paul Holzinger
07d7101429 vendor: update github.com/go-jose/go-jose/v3 to v3.0.4
Contains a fix for CVE-2025-27144

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-02-27 18:00:53 +00:00
openshift-merge-bot[bot]
672cc33ad1
Merge pull request #25405 from openshift-cherrypick-robot/cherry-pick-25403-to-v5.4
[v5.4] chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security]
2025-02-27 11:07:59 +00:00
renovate[bot]
599a0b71a6 chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-02-26 14:53:11 +00:00