The moby swagger.yaml was changed to quote HTTP status codes as string
as part of moby commit 79658025a2fd.
Thus fix the key lookup here to use a string as well.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Test case bind mounts host's /bin to /hostbin and tries to exec
/hostbin/ls, and expects a particular exit code.
It does not work on Ubuntu 26.04 because it ships with coreutils-rs
by default, in which:
/bin/ls -> ../lib/cargo/bin/coreutils/ls
and so we get ENOENT instead of EPERM.
Fix by replacing ls with true. The funny thing is, it's also a symlink
on Ubuntu 26.04:
/bin/true -> gnutrue
but it works since the destination is in the same directory.
(NOTE the whole test relies on the fact that the kernel checks
permissions first -- a dynamic binary from a different distro
won't be able to run anyway.)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
When copying files from created or stopped containers, podman cp resolves
named volumes on the host instead of using the container mount namespace.
The host-side resolution currently starts at the volume root and ignores the
mount's configured subpath, so cp can read a different file than the one
visible inside the container.
Apply the configured volume subpath before resolving the remaining container
path. Keep the path within the volume using secure path resolution and add
coverage for created, running, and stopped containers.
Fixes: #29840
Signed-off-by: pooyanazad <pooyan.azadparvar@gmail.com>
Table headings for `podman ps` and `podman pod ps` use a plain
`map[string]string`. A table template that calls `.Label` with an
argument fails while rendering the headings, before listing rows
are printed. For example: `podman ps --format 'table {{.Label "app"}}'`
Add a shared `PsHeader` type in `cmd/podman/common` with a `Label`
method that returns the requested label name as the column heading.
Use this type for both container and pod listings.
Add container unit tests and extend the existing container and pod
e2e tests to check label headings, label values, missing labels,
unlabeled objects, and `--noheading` output.
Fixes: #29831
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
GetPort() may return the same port twice, ensure we avoid the case to
not make the startup fail on a port conflict.
I saw this fail in CI once:
$ podman [options] kube play -q --multiple-pods --publish 5811:80,5811:80 /tmp/podman-e2e-759165132/subtest-4128675097/p/ptemp/kube.yaml
starting container b0aea9c7e396: rootlessport listen tcp :5811: bind: address already in use
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The kube down test does the exact same thing already so there is really
no need to duplicate this in the interest of test runtime.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Buildah added some variants of APIs that should improve support for
cancellation, so let's use them.
Remove the import alias for its copier package in
cmd/podman/containers/cp.go and libpod/container_copy_common.go to be
more friendly to grep.
Update the "prune leftover build containers" test to intentionally leave
some behind during its setup instead of SIGKILLing a build process.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Docker documents `dead` and `restarting` as valid values for the
`status` filter on `/containers/json`. Podman returns HTTP 500 when
either of them is used even though no Podman container can ever be in
those states.
Ignore these values in the compat API. If they are the only status
filters, return an empty list like Docker does. Invalid status values
still return an error.
The libpod API still rejects these values since they are Docker
specific. Update the libpod API docs to list the states Podman
actually supports.
Reference:
https://docs.docker.com/reference/api/engine/version/v1.51/#tag/Container/operation/ContainerListFixes: #28904
Signed-off-by: Rudraksha Singh <rudraksharss@gmail.com>
Docker clients send the seccomp profile JSON itself in
HostConfig.SecurityOpt (the docker CLI reads the profile file
client-side and inlines it). The compat API treated the value as a path
to a profile file, so container create failed with "file name too
long". This breaks docker-compat tooling that passes seccomp profiles
through the socket, like Nextcloud AIO and forgejo-runner.
Add a SeccompProfile field to specgen for inline profile content,
next to the existing SeccompProfilePath, as requested in review of the
earlier PR that tried to fix this (#28985). The compat create handler
extracts inline profiles (values starting with "{") from SecurityOpt
and sets the new field. Path-based values and "unconfined" keep their
current meaning, and duplicate seccomp options resolve last-one-wins,
like docker.
Fixes: #27710
Signed-off-by: r-vdp <ramses@well-founded.dev>
Docker documents HostConfig.PidsLimit 0 as unlimited, but runc sets
pids.max=1 for OCI pids.limit 0. Normalize 0 to -1 when building the
OCI spec so native CLI, compat API, and kube play behave consistently.
Fixes: https://github.com/podman-container-tools/podman/issues/29826
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
fix: return tty size in container_inspect_linux.go
This PR updates the console size field for containers with terminal enabled.
For cases where there is an issue with getting the size, suitable debug information is given, no update happens and default [0,0] is returned.
This implementation is only for Linux systems.
For FreeBSD, the console size is not implemented yet so, adds a todo for that.
Fixes: #28368
Signed-off-by: Priyansh Sao <saopriyansh06@gmail.com>
fix: add system test for podman inspect
Adds system test to verify console size is correctly updated, includes two cases:
When a tty is attached to the container - non-zero console size.
When a tty is not attached to the container - zero console size.
Fixes: #28368
Signed-off-by: Priyansh Sao <saopriyansh06@gmail.com>
Docker API v1.44 omits the Created field (previously,
it was the zero value of 0001-01-01T00:00:00Z) if
the Created field is missing from the image config.
Omit it when zero from the compat API GET /images/{id}/json
(using `info.Created` instead of the previous `l.Created()`
that is set to `Now()` in storage/images.go when empty).
Add a test creating an image with the Created field missing.
Fixes: https://redhat.atlassian.net/browse/RUN-3317
Signed-off-by: Marek Simek <msimek@redhat.com>
This is a small Docker compat fix with the API exec endpoints.
With Docker, sending a bare Exec Create (command only, nothing
else set) and then an Exec Start without Detach set performs
a detached exec. With Podman, we threw an error that at least one
stream must be attached to. Fix is trivial; look up the session
before start, check the config for attach streams, and force
detach on if none are set.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Fixed the compat container update path so it preserves the existing restart policy unless the request explicitly includes a new one, and added a regression test for it.
Fixes: #29790
Signed-off-by: Srijan Keshri <212402043+arcusbuilds@users.noreply.github.com>
Allow deployments and scheduled jobs to update a selected group of
containers without checking every auto-update-enabled application.
Reuse the existing container filters and expose them through the CLI,
remote bindings, and REST API.
Filter update candidates while preserving systemd unit and pod restart
behavior. Document the selection semantics and cover filtered updates,
invalid input, remote requests, and pod restarts in the existing tests.
Signed-off-by: Evan Purkhiser <git@evanpurkhiser.com>
Podman 6 dropped cgroups v1 support, and the kernel real-time
scheduler cgroup settings only exist on cgroups v1. That means the
--cpu-rt-period and --cpu-rt-runtime options can never take effect
anymore: on cgroups v2 the values only produce a warning and are
discarded.
As agreed in the linked issue, the full removal of the options is
deferred to the next major release (7.0) to avoid a breaking change
for anyone still setting them. For 6.x this commit implements the
agreed interim step:
- remove the option documentation (docs/source/markdown/options/
cpu-rt-period.md and cpu-rt-runtime.md) and drop the @@option
references from the podman-create, podman-run, podman-update and
podman-container-clone man pages
- hide both flags from --help output
- change the existing warning to state that the option is a NOP,
that the value is ignored, and that the option will be removed in
the next major release
The e2e tests are updated to match the new warning text. Actual
removal of the flags and the spec fields is left for Podman 7.0.
Part of #29750
Signed-off-by: seonghun lee <harrisleesh@gmail.com>
The Docker-compatible network API omitted the IPRange field from the IPAM
config even though Libpod stores this data, so tools reading the Docker
API could not see the configured IP range.
Map Libpod's LeaseRange to Docker-compatible IPAMConfig.IPRange when it
aligns with a full CIDR span derived from FirstIPInSubnet/LastIPInSubnet,
and add an integration test that creates a network via the compat API with
an explicit IPRange and asserts it is returned on inspect.
The span is matched with bit arithmetic rather than by trying every prefix
length: the network address is start-1, and XORing that with end yields the
host mask, which identifies the prefix in a single pass. net/netip carries
the address handling throughout - Unmap collapses 4-in-6, Prev gives the
network address, and Masked confirms the network is aligned to the prefix.
Fixes: #28378
Signed-off-by: aayushbaluni <73417844+aayushbaluni@users.noreply.github.com>
