Replaces regexp.MustCompile with regexp.Delayed from go.podman.io/storage/pkg/regexp
for global regular expressions. This avoids compiling regular expressions
during the global init scope, improving startup performance for all commands.
Tests are kept using regexp.MustCompile where applicable.
Fixes: #29510
Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>
When fetching events with the --until flag on a system using the file events
backend, libpod/events/logfile.go spawned an unmanaged goroutine running
time.Sleep(time.Until(untilTime)). Because time.Sleep is not context-aware,
if a client cancelled the request or dropped the connection, the goroutine
remained sleeping in the background for the full until duration.
Fix this by using time.NewTimer and selecting on ctx.Done() so the background
goroutine exits immediately when the context is cancelled.
Fixes: #29491
Signed-off-by: Harsha Vardhan <harshahvk2005@gmail.com>
file.Size() returns bytes, so the comparison in logNeedsRotation must also
use bytes. The old code used len([]rune(content)) (rune/character count)
which undercounts multi-byte UTF-8 characters and allows the event log to
grow past events_logfile_max_size.
Replace with len(content)+1 (byte count, including the trailing newline
appended by writeToFile) so the size estimate is consistent with file.Size().
Add a regression test with multi-byte UTF-8 content to prevent regressions.
Also, explicitly close temp files before size rotation checks to fix
macOS/Lima CI failures caused by file locking and stat caching.
Fixes: #29414
Signed-off-by: Aftab Ali <aftab123215@gmail.com>
Replace deprecated swagger:alias with swagger:model for ImagePullStatus
and ArtifactPullStatus. Add explicit swagger:model annotations with
unique names to Podman types that collide with vendor types
(DriverData, PruneReport, RootFS, Secret, ThrottleDevice, WeightDevice,
Version) to resolve colliding model name warnings from go-swagger.
The types from libpod/define use a Libpod prefix, matching LibpodInfo
which already does that. Apart from the prefix the names are the ones
go-swagger derives on its own, so the annotations mostly just make the
naming explicit so the tool stops warning about it.
This does not close#29199 entirely. The two remaining name collisions
(Mount and Summary) are each between two vendored types, so they cannot
be controlled from the Podman side, and the dropped-ref-sibling
warnings are a separate problem.
Related: #29199
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
The truncate() function in libpod/events/logfile.go used path.Dir on a filesystem path (filePath). The file is Linux/FreeBSD only per its build tag, so this isn't about Windows correctness — it's about internal consistency: the same file already calls filepath.Dir at line 32 for the same kind of path handling, and filepath is idiomatic for filesystem operations.
Also removes the now-unused 'path' import.
Fixes part of #25165
Signed-off-by: Shreya Vidyadhar <shrevidh03@gmail.com>
Docker now reserves alias specfically for user-defined aliases, and uses another field, dnsnames, to hold all aliases, including container ID and name.
Part of docker v1.45 compat work, but this touches the cli too, since they updated it there too.
Signed-off-by: Ashley Cui <acui@redhat.com>
PruneBuildContainers() iterates over the snapshot returned by
store.Containers(). A build that was killed cleans up its own stage
containers in the background, which is exactly the situation this
function is meant to run after, so a container can disappear between the
snapshot and the calls that act on it.
When that happened ContainerDirectory() aborted the whole prune with a
hard return, and DeleteContainer() recorded "identifier is not a
container" in the report, which made podman system prune --build exit
125 even though the containers were gone.
Pruning wants the container gone, so treat ErrContainerUnknown and
ErrNotAContainer as success instead.
Seen in #28868, though that flake is really about the server side build
not stopping when the remote client is killed.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
Ensure we set the network status to nil after the teardown and save it
to the db. This is needed on network reload as the setup reads the
existing status for the pesto forwarding logic.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This makes use of the new pasta integration code in container-libs.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Errors returned in the healthcheck timer path and events inspect data were formatted with %v, discarding the error chain. Replaced with %w so callers can use errors.Is/errors.As to inspect the underlying causes.
Signed-off-by: Sheikh Muneeb Ahmed <msheikh.bsai24seecs@seecs.edu.pk>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
I do not understand this condition in the code, not passing the log file
to the runtime when run with log level debug makes no sense. It means we
do not get the proper error message from the runtime so debug logging
shows a much worse error:
"container create failed (no logs from conmon)..."
When the actual error is the command is not in $PATH for example. So to
fix this just remove the log level check. Also not the support json flag
condition is done inside execOCILog().
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
chrootarchive.Tar returns an io.ReadCloser backed by the tar-producing
process. The checkpoint export path copies from that stream into the
target file, but never closes the reader.
A successful copy reads the stream to EOF, so the producer normally exits.
On early errors, such as failing to create or chmod the target file, or a
copy error, the producer can be left without a consumer.
Close the tar stream after creating it so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
Fixes: #22095
Now handles exporting a container's healthcheck configuration as a
`livenessProbe` in the generated Kubernetes YAML.
Co-authored-by: givensuman <givensuman@duck.com>
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Devesh B <98201065+DeveshB-1@users.noreply.github.com>
Signed-off-by: givensuman <givensuman@duck.com>
Update test/e2e/generate_kube_test.go
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: given <givensuman@gmail.com>
This have been deprecated in podman 1.9, it is safe to assume they are
no longer used by anyone one a recent version.
If someone would update from the old version to 6+ they would run into
much more issues already so this can be safely dropped IMO.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This is used incorrectly by execLightweight which called the function
unlocked which of course does not show up normally as only when there
is a race condition that makes the removal fail we go to unlock and then
the process panics as a double unlocked is not allowed.
While we could fix the caller such incorrect use is way to easy and
the unexpected lock/unlock cycle is basically never expected. Instead
just keep the container locked, that may prevent other commands from
doing something with the container in parallel but the error should be
rare enough to not matter most of the time. And we wait 5s max so it is
not a long time either.
To try to make the wait interval a bit faster poll every 50ms now as we
no longer have to the expensive locking and db sync each iteration.
Fixes: #29012
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
