Looks like it picked up new deprecated matches so we need some more
nolint to silence them where we still need them for backwards compat in
the API.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since I use go 1.26 the go fix does not have all the rules built in,
there are newer ones in modernize so run the explicitly to fix more code
for go 1.26.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The function logged the wrong error, logging ec which is the return
value from ParseInt makes no sense since the error tells us the function
failed so ec is invalid/undefined. Also ParseInt already includes the
string input in the error so just drop it.
This was flagged by govet now that we use go 1.26 because %q was wrong
for integers.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Two commands can set a subject on a manifest list, podman manifest annotate --index --subject and podman manifest add --artifact-subject. Both work locally, but they do nothing at all when podman runs with --remote.
The value never leaves the client. Before sending the request the remote client copies everything into manifests.ModifyOptions and manifests.AddArtifactOptions, and neither struct had a field to hold the subject, so it was quietly thrown away. The server had a second problem of its own, ManifestModify rebuilds ManifestAddArtifactOptions by hand and left out the embedded ManifestAnnotateOptions, so --os, --arch and --annotation were being dropped there as well.
Add the missing field to both structs, fill it in from the tunnel ImageEngine, and let the handler pass the annotate options along. Also add two system tests that run both flags for real so the remote path stays covered.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
Avoid the expensive container walk when a non existing network is passed
in. Because getting the network status needs to hold locks this could be
blocked for a long time otherwise for no reason.
Fixes: #29647
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
ImageEngine.Prune split each --filter on every '=' and kept everything after the
first as separate values, so a filter whose value itself contains '=' was torn
apart. podman-image-prune.1.md documents label=key=value and gives
'--filter label=version=1.0' as an example, which produced
filters["label"] = ["version", "1.0"]
instead of ["version=1.0"]. libimage turns every element into its own label
filter and MatchLabelFilters cuts each one on '=' itself, so the request became
'has a label key version' AND 'has a label key 1.0'. Nothing carries a key named
1.0, so the prune matched no images and silently removed nothing.
Local podman is unaffected: the abi path passes opts.Filter through untouched.
This is remote-only, and it diverges from both siblings -- List uses
SplitN(filter, "=", 2) and Events validates then rejoins with strings.Join.
Prune now mirrors List.
The existing e2e case only used 'label=abc', a bare key, which survives the old
split by accident; added one that uses a key=value label and checks the
non-matching image is still there afterwards.
Signed-off-by: Atishyy27 <sethatishayjain@gmail.com>
Replace deprecated swagger:alias with swagger:model for ImagePullStatus
and ArtifactPullStatus. Add explicit swagger:model annotations with
unique names to Podman types that collide with vendor types
(DriverData, PruneReport, RootFS, Secret, ThrottleDevice, WeightDevice,
Version) to resolve colliding model name warnings from go-swagger.
The types from libpod/define use a Libpod prefix, matching LibpodInfo
which already does that. Apart from the prefix the names are the ones
go-swagger derives on its own, so the annotations mostly just make the
naming explicit so the tool stops warning about it.
This does not close#29199 entirely. The two remaining name collisions
(Mount and Summary) are each between two vendored types, so they cannot
be controlled from the Podman side, and the dropped-ref-sibling
warnings are a separate problem.
Related: #29199
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
When volume.MountCount() fails, we shouldn't silence the error and return that the volume is unmounted. This can hide potential volume state corruption. Propagate the error upwards so that the client/CLI can handle it correctly.
Signed-off-by: prayag0one4 <prayag0one4@users.noreply.github.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
The Docker API in version 1.44 deprecates the is_automated field for
the GET /images/search endpoint. The is_automated field has been deprecated
by Docker Hub's search API. Consequently, searching for is-automated=true
will yield no results.
The Docker API in version 1.44 deprecates the is_automated field
in the GET /images/search response and will always be set to false in the
future because Docker Hub is deprecating the is_automated field in its search API.
Return struct moby/api for the compat endpoint that matches the Docker
API response format and deprecates is_automated.
Update test_v2_0_0_image.py::ImageTestCase::test_search_compat
to verify returned format and fix subtests not being asserted (remove mp).
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
In remote mode `podman events --format json` could print the literal "null"
instead of an event object. The remote client converts each event received
from the server with ConvertToLibpodEvent, which returned nil when it could
not parse the server result (an unknown status or type, or an invalid
containerExitCode). The tunnel forwarded that nil as an event with no error
set, so the CLI marshalled a nil event and printed "null".
Return a descriptive error from ConvertToLibpodEvent and send it on the event
channel, which the CLI already handles, instead of forwarding a nil event.
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
When we loop over all volumes to inspect them it is possible that some
of them got removed in the meantime. As such we must ignore this case to
not cause random command failures.
I have seen this fail in our system tests:
FAIL: podman volume inspect --format '{{"\n"}}'
expected: = ''
actual: Error: no such volume
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When reading the mount path here it can be missing and thus fail with
ENOENT when the voluem is removed in parallel. Because we do not want to
block for a full directory walk of course with the volume lock the only
choice is to ignore the error.
I have seen this error many times in CI in the past weeks:
FAIL: podman system df --format '{{"\n"}}'
expected: = ''
actual: Error: lstat /home/ubuntu.guest/.local/share/containers/storage/volumes/v-t450-1djh1zmh/_data: no such file or directory
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
Wrap ssh.DialNet in a goroutine so it respects context cancellation,
skip retries on context/timeout errors, and invalidate the cached
connection on failure.
Fixes: https://github.com/containers/podman/issues/28453
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
With podman-remote we do not enter a our user namespace like we do with
local podman so we keep running with the real user id.
So if we then try to use chrootarchive as normal user it fails with:
creating mount namespace before pivot: operation not permitted
So simply revert back to the normal archive code.
Now the more interesting thing is we do have a test
"podman save to directory with oci format" but it never runs
rootless+remote in our CI system with our current matrix as we wanted to
reduce jobs.
So rethink the matrix and add one such job as this shows it is needed.
Fixes: 25aee24cbd ("use chrootarchive over plain archive package")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
