The update to runc broke creation of devices for containers in
the pod cgroup. We don't support the device cgroup for pods at
present, so just disable it for now, resolving the issue.
Thanks to Giuseppe for finding the fix.
[NO NEW TESTS NEEDED] fixes a test break
Signed-off-by: Matt Heon <mheon@redhat.com>
Someone please revert this once quay search is fixed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 047da19b5f)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This backport a fix for c/storage for unlink functionaliy from https://github.com/containers/storage/pull/1631/
This was a WIP, but has been updated and is ready to merge, assuming
happy tests.
[NO NEW TESTS NEEDED]
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Apparent Cython regression causing a warning and traceback when
installing PyYAML with pip:
Ref. Upstream issue 601: https://github.com/yaml/pyyaml/issues/
Ref. warning message:
```
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
```
Ref. traceback snippet:
```
Traceback (most recent call last):
File "/var/tmp/go/src/github.com/containers/podman/venv/lib/python3.10/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
...cut...
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-yiijk0jv/overlay/lib/python3.10/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
```
Signed-off-by: Chris Evich <cevich@redhat.com>
<MH: Cherry-pick back to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
Fixes: https://github.com/containers/podman/issues/18239
[NO NEW TESTS NEEDED]
@test "podman build -f test" in test/system/070-build.bats
Will test this. This was passing when run on a local system since
the remote end was using the clients path to read the Containerfile
The issue is it would not work in a podman machine since the
Containerfile would/should be a different path.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
<MH: Cherry-pick to v4.4.1-rhel>
Signed-off-by: Matt Heon <mheon@redhat.com>
Particularly, fix an issue with SELinux where image volumes would
not mount properly.
Based (loosely) on 2ec11b16ab which
intermingled these changes with other fixes not relevant to this
backport.
Backported to v4.4.1-rhel per RHBZ 2213843
[NO NEW TESTS NEEDED]
Signed-off-by: Matt Heon <mheon@redhat.com>
On 4-24-2023 the `Windows Smoke Test` suddenly started failing. While
it would be informative to find out why, this is a RHEL-centric release
branch. Therefore, Windows testing is unnecessary and unhelpful.
Disable it.
Signed-off-by: Chris Evich <cevich@redhat.com>
The long term goal was to provide the customer with a way to turn on the
preexec_hooks processing of scripts by having some kind of configuration
that could be read. I had tried putting it into containers.conf to
start, but that turned out to be unyieldly quickly, and time is of
the essence for this fix. That is mostly due to the fact that this
code is preexecution and in C, the containers.conf file is read in
Go much further down the stack.
After first trying this process using an ENVVAR, I have
thought it over and chatted with others, and will now look for a
/etc/containers/podman_preexec_hooks.txt file to exist. If the admin
had put one in there, we will then process the files in the
directories /usr/libexec/podman/pre-exec-hooks
and /etc/containers/pre-exec-hooks.
Thoughts/suggestions gratefully accepted. This will be a 8.8/9.2 ZeroDay
fix and will need to be backported to the v4.4.1-rhel branch.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
When a userns is set we setup the network after the bind mounts, at the
point where resolv.conf is generated we do not yet know the subnet.
Just like the other dns servers for bridge networks we need to add the
ip later in completeNetworkSetup()
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2182492 and
https://bugzilla.redhat.com/show_bug.cgi?id=2182491
This is targeted to RHEL 8.8 and 9.2 ZeroDay
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
skip in setup() if journald unavailable.
To be pedantic, this is overkill: some quadlet tests pass
because they don't run journald. Too bad.
Also skip a play-kube test that requires journal
Signed-off-by: Ed Santiago <santiago@redhat.com>
As described in #17777, the `restart` on-failure action did not behave
correctly when the health check is being run by a transient systemd
unit. It ran just fine when being executed outside such a unit, for
instance, manually or, as done in the system tests, in a scripted
fashion.
There were two issue causing the `restart` on-failure action to
misbehave:
1) The transient systemd units used the default `KillMode=cgroup` which
will nuke all processes in the specific cgroup including the recently
restarted container/conmon once the main `podman healthcheck run`
process exits.
2) Podman attempted to remove the transient systemd unit and timer
during restart. That is perfectly fine when manually restarting the
container but not when the restart itself is being executed inside
such a transient unit. Ultimately, Podman tried to shoot itself in
the foot.
Fix both issues by moving the restart logic in the cleanup process.
Instead of restarting the container, the `healthcheck run` will just
stop the container and the cleanup process will restart the container
once it has turned unhealthy.
Backport of commit 9563415430.
Fixes: #17777
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2180125
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2180126
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Backports #17755 from @adrianreber to fix an append issue. Will be
used for a ZeroDay delivery to RHEL 8.8/9.2.
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2177611
Original commit message:
The code was not using append() to add items to a slice.
Accessing non allocated elements of the slice failed with:
```
$ podman container restore -l
panic: runtime error: index out of range [0] with length 0
goroutine 1 [running]:
github.com/containers/podman/v4/pkg/domain/infra/abi.(*ContainerEngine).ContainerRestore(0xc00051a8b8, {0x1dbced0, 0xc0000440d0}, {0x2a31b30, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, ...})
/share/go/src/github.com/containers/podman/pkg/domain/infra/abi/containers.go:676 +0x39c
github.com/containers/podman/v4/cmd/podman/containers.restore(0x28fb6c0?, {0xc0002c9080, 0x0, 0x1?})
/share/go/src/github.com/containers/podman/cmd/podman/containers/restore.go:171 +0x4ef
github.com/spf13/cobra.(*Command).execute(0x28fb6c0, {0xc0000400b0, 0x1, 0x1})
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:916 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0x291ab00)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:1044 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:968
github.com/spf13/cobra.(*Command).ExecuteContext(...)
/share/go/src/github.com/containers/podman/vendor/github.com/spf13/cobra/command.go:961
main.Execute()
/share/go/src/github.com/containers/podman/cmd/podman/root.go:107 +0xcc
main.main()
/share/go/src/github.com/containers/podman/cmd/podman/main.go:41 +0x7c
```
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Only enforce the passthrough log driver for Quadlet. Commit 68fbebf
introduced a regression on the `podman-kube@` template as `podman logs`
stopped working and settings from containers.conf were ignored.
Fixes: #17482
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
This is a working theory fix. The man pages including the
secret.md option are not resolving properly. The secret.md
file is the only one with a text line with three back ticks on the start
and end of the line. Elsewhere we have the backticks on separate lines
and the text in it's own line.
This might not fix the issue, but at the very least it makes things
consistent.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
* Utils must support higher level API to create Tar with chrooted into
directory
* Volume export: use TarwithChroot instead of Tar so we can make sure no
symlink can be exported by tar if it exists outside of the source
directory.
* container export: use chroot and Tar instead of Tar so we can make sure no
symlink can be exported by tar if it exists outside of the mointPoint.
[NO NEW TESTS NEEDED]
[NO TESTS NEEDED]
Race needs combination of external/in-container mechanism which is hard to repro in CI.
CVE: https://access.redhat.com/security/cve/CVE-2023-0778
Signed-off-by: Aditya R <arajan@redhat.com>
MH: Cherry-pick to v4.4.1-rhel per RHBZ 2169618
Signed-off-by: Matt Heon <mheon@redhat.com>
Primarily, add skip_if_journald_unavailable because RHEL.
Secondarily, reverse a flipped actual/expect assertion
that made it difficult to understand the RHEL failure.
Signed-off-by: Ed Santiago <santiago@redhat.com>
An ongoing issue with uploading artifacts is hindering development
progress. Temporarily disable all aflicted tasks until the problem is
resolved. Typical error message:
```
Uploading 1 artifacts for
Failed to upload artifacts: Put
...cut...
tls: server selected unsupported protocol version 303
Re-trying to artifacts upload...
```
Signed-off-by: Chris Evich <cevich@redhat.com>
