The buildah buil kill trick is bad as we have to sleep and wait to aboid
flakes which takes time. Instead it is possible to redo this build part
manually with buildah commands. It is not trival and harder to
understand but it safes 2-3s so I think it is worth it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Many system tests use hardcoded names for containers, images,
and everything. This has worked because system tests run
serially. It will not work if we ever run in parallel.
Create a new safename() helper, and use it as follows:
myctr=c_$(safename)
myvol1=v1_$(safename)
...
Find current instances of hardcoded names, and replace
with safe ones.
Whether or not we ever end up parallelizing system tests,
this is simply good practice.
There are far too many instances to fix in one (reviewable) PR.
This is commit 1 of N.
Signed-off-by: Ed Santiago <santiago@redhat.com>
safename: consistent within same test, and, dashes
Make safename() invocations consistent within the same
test. This puts the onus on the caller to add a unique
element when calling multiple times, e.g. "ctr1-$(safename)".
This is not too much of a burden. Major benefit is making
it easy for a reader to associate containers, pods, volumes,
images within a given test.
And, use dashes, not underscores. "podman generate kube"
removes underscores, making it very difficult to do
things like "podman inspect $podname" (because we need
to generate "$podname_with_underscores_removed")
Signed-off-by: Ed Santiago <santiago@redhat.com>
The podman-remote build command was not displaying build output, causing
remotesystem tests to fail when expecting output like "COMMIT", "cache",
"Successfully built", etc.
Root causes:
1. BuildOptions.Out was set to nil when no --logfile was specified,
causing all build output to be discarded
2. BuildOptions.Err was not set, preventing auxiliary build output
from being displayed
Changes:
- Set Out and Err to default to os.Stdout and os.Stderr respectively
- Both redirect to logfile when --logfile is specified
- Remove incorrect client-side quiet flag handling (already handled
by build engine via Quiet option)
This matches the behavior of the non-remote build implementation in
build.go and ensures build output is properly streamed from the server
through the bindings to the client's stdout/stderr.
Fixes test failures in make remotesystem for build-related tests.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test was using old expectations that required all containers to
have system_r role. The updated version from main branch correctly
expects that privileged/pid=host/ipc=host/label=disable containers
run with the current user and role, not system_r. This is intentional
behavior to support confined users (see commit 5b7dce8a3d).
This brings the test expectations in line with the actual behavior.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This fixes several cp-related issues in podman-remote:
- Enable container-to-container copy support
- Fix symlink expansion for broken symlinks
- Fix cp from /dev/stdin
- Fix directory extraction to non-existent destination
- Add validation for copying directory to file
- Fix trailing slash handling for broken symlinks
- Fix stdin validation and --overwrite flag support
- Require existing directory destination when copying from stdin
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The test framework was not parsing the '+w' suffix in expected exit
codes (e.g., '0+w' meaning "expect exit code 0 and warnings allowed").
This caused the literal string to be passed as a command argument to
podman, resulting in "unrecognized command" errors.
Added pattern matching for:
- [0-9]+w (single digit with warnings)
- [1-9][0-9]+w (double digit with warnings)
- [12][0-9][0-9]+w (triple digit with warnings)
The '+w' suffix is stripped off and only the numeric exit code is used
for validation. Note: The actual warning validation is not implemented
yet, but this allows tests using the '+w' notation to run correctly.
This fixes the "podman-remote: non-default connection" test failure.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The original cp.go uses buildah/copier which depends on libimage,
making it unavailable in remote builds. This change splits cp
implementation into separate local and remote variants:
- cmd/podman/containers/cp.go: Shared command definitions, flags, and
init function (no build tag)
- cmd/podman/containers/cp_local.go: Local implementation using
buildah/copier (//go:build !remote)
- cmd/podman/containers/cp_remote.go: Remote implementation using
stdlib archive/tar (//go:build remote)
The remote implementation:
- Uses ContainerEngine interface methods that work over REST API:
ContainerStat, ContainerCopyToArchive, ContainerCopyFromArchive
- Properly handles file and directory copying in both directions
- Uses CopyOptions.Rename for file renaming when copying to specific
filenames
- Returns error for container-to-container copying (not supported with
podman-remote)
This follows the same pattern used for other libimage-dependent code
in commit 4231526e18.
Fixes system tests that require cp functionality with podman-remote.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This commit fixes three related issues that prevented userns=auto from
working correctly in rootless containers:
1. Fix setgroups() error with userns=auto
When using userns=auto, supplementary GIDs from the container image
were being passed to setgroups() before user namespace mappings were
allocated by storage, causing EINVAL errors. Added a check in
container_internal_common.go to skip supplementary groups when
AutoUserNs is enabled but GIDMap isn't populated yet.
2. Fix ID mapping allocation bug in storage.go
CreateContainerStorage was returning empty UID/GID mappings from the
input options parameter instead of the allocated mappings from the
storage container object, causing containers to fail with "readlink:
No such file or directory" errors. Changed the return statement to
use container.UIDMap and container.GIDMap.
3. Add workaround for containers/storage v1.51.0 bug
The vendored storage library has a bug in parseMountedFiles where
groupFile path is incorrectly used as a directory path. Set an
explicit Size=65536 in AutoUserNsOpts to bypass the buggy code path.
With these fixes, all userns=auto tests in 170-run-userns.bats now pass
in rootless mode.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The events file backend writes events as they're generated, which may
not match chronological order due to race conditions during concurrent
operations in rmi -f. The remove and untag events from rmi can appear
in any order in the events file.
This matches the approach used in main branch (see commit 111a4bbe71)
which recognizes that event ordering is not guaranteed for concurrent
operations, especially in podman-remote.
This fix:
- Simplifies initial validation to check for event presence (not order)
- Checks deterministic events (0-6) in exact order
- Validates rmi events (7-9) are present without requiring specific order
- Checks final event (10) is the second loadfromarchive
- Does NOT modify runtime code to enforce ordering (events remain as-generated)
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
This commit fixes two issues in runtime initialization that occur when
vendor code doesn't properly set StaticDir and VolumePath defaults:
1. Add defensive initialization for StaticDir and VolumePath
- Check if StaticDir is empty and set it to GraphRoot/libpod
- Check if VolumePath is empty and set it to GraphRoot/volumes
- This works around missing initialization in older vendor code
without requiring changes to the vendor directory
2. Fix database initialization to allow creating new bolt_state.db
- Previously, getDBState() would fail if bolt_state.db didn't exist
- Now, only return error if it's not os.ErrNotExist
- This allows NewBoltState() to create the database on first run
These changes resolve the "creating runtime static files directory:
mkdir : no such file or directory" error that occurred when running
podman commands.
Tested with:
- podman ps, info, version commands work correctly
- Volume operations create volumes at correct path
- Database is properly initialized on first run
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The common v0.57.7 vendor bump added !remote build tags to libimage,
causing podman-remote builds to fail. This change splits files that
use libimage into separate _local and _remote variants:
- pkg/specgen/specgen_{local,remote}.go: Image field storage and methods
- pkg/api/handlers/types_local.go: ImageDataToImageInspect function
- cmd/podman/utils/error_local.go: ExitCodeFromBuildError function
This allows type definitions to be shared between remote and local
builds while keeping libimage-dependent implementations local-only.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
The vendoring of Buildah dragged in a bump of common from v0.51.4 to
v0.57.7 which contained many changes to variable and function names.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
... Podman
cli flags couldn't override the active-destination when env variables were set. As a remedy, the precedence of cli flags has been changed.
Note: This commit is from #19997 and it brought in some pretty massive changes
to how the remote connections are created.
Signed-off-by: Chetan Giradkar <cgiradka@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
These functions were removed in github.com/opencontainers/selinux
v1.12.0.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Unfortunately on a number of occasions, Podman has been released
officially with a `-dev` suffix in the version number. Assist in
catching this mistake at release time by the addition of a simple
conditional test. Note that it must be positively enabled by a
magic env. var. before executing the system tests.
Ref. original PR: https://github.com/containers/podman/pull/26540
Signed-off-by: Chris Evich <cevich@redhat.com>
This commit re-vendors the module from a temporary source, and moves to
an earlier, patched version to address CVE-2025-22869. Prior to this
commit, building podman fails due to platform dependence on golang 1.18
- the version currently used to build for RHEL.
In the future, it is intended that the RHEL platform will migrate to a
newer golang toolchain. This will enable re-vendoring the crypto module
again back to the authoritative upstream source. Thus removing the need
for the temporary fork.
Resolves: RHEL-81300 RHEL-81322
Signed-off-by: Chris Evich <cevich@redhat.com>
The Fedora-37 CI VMs used prior to f8bca0f closely matched RHEL-8.8
which is the intended destination of this v4.4.1-rhel release branch.
Importantly this change, along with one or more future commits
(53a8ef8..b9110a1) lead to downstream build failures on RHEL 8.8,
and reproduce using the original Fedora-37 CI VMs. In other words,
leaving the F37 CI VMs in place would have allowed these failures
to be caught during upstream rather than downstream testing.
Signed-off-by: Chris Evich <cevich@redhat.com>
Update cirrus.yml to the latest image based of 5.4-rhel, then disable
validate as there no point for it when we do backports. And only
perform a single build on the f41.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
As discussed at the cabal October 8, 2024 we have no need for these
tests on RHEL branches. The work to maintain them is higher than it is
worth it. We also do not test RHEL but rather some outdated frozen
fedora image build from the time we created the branch.
Therefore we gain little value from them especially as all the internal
Red Hat QE is testing it anyways again on the proper RHEL builds.
So simply delete all the stuff we no longer need:
- alt builds, no point in windows/macos testing and other arches
- all the functional tests
- the build success task (not needed as there is nothing after it
anymore)
- the swagger task, we do not use the swagger from the rhel branches
Fixes: https://issues.redhat.com/browse/RUN-2315
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Checking for the mountdir is not relevent, a recent c/storage change[1] no
longer deletes the mount point directory so the check will cause a false
positive. findmnt exits 1 when the given path is not a mountpoint so
let's use that to check.
[1] 3f2e81abb3
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
I'm not exactly sure what is happening here, but this call
```
result := podmanTest.Podman([]string{"images", "-q", "-f", "reference=quay.io/libpod/*"})
```
in the test/e2e/images-test.go in this test
```
It("podman images filter reference", func()
```
is now sending back 10 instead of 9 objects. This was a change
that @edsantiago also made in https://github.com/containers/podman/pull/21356
After the other adjustments I made to the tests to right them,
this seemed to be the last issue.
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
