Use shared configfile instead of custom policy.json path handling.
This updates ocipull to rely on signature.DefaultPolicy(), removes
explicit SignaturePolicyPath, and replaces trust's custom default-policy
path logic with common configfile code.
Replace hidden `--policypath` with --signature-policy` and require
it for `trust set` command instead of path resolution based on
configfile.
For `trust get`, the `--signature-policy` is optional.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
This was implemented by containers/netavark #1369; this commit
completes the process by wiring it into Podman. We now respect
the CLI order for configured networks - if a user passes
`--net net1,net2` we guarantee that net1 will be configured
before net2.
For containers created before this patch, we don't retain enough
information to configure networks in CLI order, so we use
alphabetical order instead to still guarantee consistency.
No breaking API changes have been made, but we do add a new
field to supplement the existing map to (optionally) provide
ordering information. The Podman CLI will always pass this.
Existing applications that do not will, again, receive]
deterministic ordering based on an alphabetical sort of network
names.
This requires the latest version of Netavark to work properly.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
The systemd timer created for health checks did not pass global
podman flags to the subprocess, causing it to use default storage
settings instead of matching the parent process. This is most
visible with --transient-store, where the healthcheck looks up
the container in the default store instead of the volatile one.
Extract GlobalPodmanArgs() from CreateExitCommandArgs so both the
exit command and healthcheck timer share the same set of global
flags (--root, --runroot, --transient-store, --storage-driver, etc.).
Fixes: https://github.com/containers/podman/issues/28483
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
PODMAN_CMD is uninitialized until basic_setup() runs, causing
podman_runtime() to invoke an empty command and fall back to [null].
Call basic_setup() before the runtime check to ensure PODMAN_CMD is
populated before use.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Adds --filter status=<value> support to podman quadlet list.
Also adds shell completion for the status filter values.
Signed-off-by: Himanshu Jaiswal <himanshu.bw5@gmail.com>
Add support for `default_host_ips` in containers.conf to set default
host IP(s) if no IP is set when forwarding ports. Multiple IPs can be
configured, and passing explicit IP with -p will always override
the configured defaults.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Add --format (oci-archive, docker-archive) to pass through to podman save.
Default is unchanged (no --format) so podman save uses its own default.
Document that scp is not storage-to-storage and only archive formats
are supported.
Fixes: https://github.com/containers/podman/issues/28183
Fixes: https://issues.redhat.com/browse/RUN-4403
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
When a pause process dies and its PID gets recycled by an unrelated
process, the stale pause.pid file causes join failures. Detect this
by checking /proc/<pid>/environ for _PODMAN_PAUSE=1 after a failed
join attempt.
Closes: https://github.com/containers/podman/issues/28157
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Quadlet list always reports the heading, even when using custom
formatting strings. This doesn't follow the behavior of other podman
list commands. Borrow some logic and the "--noheading" flag from the
container list command to make this behavior uniform.
Signed-off-by: Randolph Sapp <rs@ti.com>
Statement
for line in "${lines[*]}"
does not make sense since line will be a single value consisting of
all elements of lines array, space-separated.
It should be
for line in "${lines[@]}"
if we want to iterate through each value.
Fixes: 00292ae1c4 ("systests: test instrumentation")
Fixes: c33ba70f95 ("system tests: instrument, to try to catch unlinkat-ebusy")
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Given the new config file logic will read many files pritning one
specific one here has no meaning anymore, just delete it.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The main purpose of the transient services/timers is to trigger the
healthcheck execution in regular intervals, their own state should
not depend on the result of the healthchecks. This way there are no
failing systemd services unless there is actually a fatal error.
Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
This is useful for triggering the execution of a healthcheck
without caring about it's result as long as no fatal error occured.
Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
With the config file rewrite we now get other error messages so fix the
tests.
Also note the shell completion test is skipped for now as the logic to
get the directories is not yet exposed in container-libs. I enable that
later.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Remove test cases that only tested CNI-specific functionality:
- Remove "podman --cni-config-dir backwards compat" test
- Remove "podman CNI network create with internal should not have dnsname" test
Update CNI-specific test names to be network-backend agnostic:
- Rename "podman inspect container single CNI network" to "podman inspect container single network"
- Rename "podman inspect container two CNI networks (container not running)" to "podman inspect container two networks (container not running)"
- Rename "podman inspect container two CNI networks" to "podman inspect container two networks"
- Rename "podman run in custom CNI network with --static-ip" to "podman run in custom network with --static-ip"
- Rename "podman rootless cni adds /usr/sbin to PATH" to "podman rootless adds /usr/sbin to PATH"
Update test content to be backend-agnostic:
- Update skip reasons from "Requires root CNI networking" to "Requires root networking"
- Change --rootless-cni flag usage to --rootless-netns
- Update comments from "CNI network" to "network"
- Update comments from "iptables" to "nftables" for netavark
- Update test assertions to remove CNI-specific messaging
Remove CNI-related test documentation and comments:
- Remove commented-out CNI error messages from Python API tests
- Remove CNI network namespace error documentation from upgrade tests
- Remove CNI-related comments from BATS tests
Remove unused import of github.com/containernetworking/plugins/pkg/ns
from test/e2e/run_networking_test.go (test-only usage).
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
use name_to_handle_at and open_by_handle_at to persist rootless
namespaces without needing a pause process.
The namespace file handles are stored in a file and can be used to
rejoin the namespaces, as long as the namespaces still exist.
Fall back to the pause process approach only when the kernel doesn't
support nsfs handles (EOPNOTSUPP).
The feature is currently only enabled when the PODMAN_NO_PAUSE_PROCESS
environment variable is set.
These changes in the kernel are required (landed in Linux 6.18):
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ab378cfa793
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
The test for issue #19800 depended on finding a system user with an
octal UID. This approach was fragile because system users found on the
host may have a different UID in the testing image.
Use the rootless user ID instead which is likely to be octal anyway as
new user IDs start with 1000.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
