Commit graph

25966 commits

Author SHA1 Message Date
Daniel Rudolf
6f9cc3755a
Mention no_hosts and base_hosts_file configs in CLI option docs
Follow-up to #24043

Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>
2024-10-02 23:15:24 +02:00
openshift-merge-bot[bot]
70f31281d6
Merge pull request #24114 from kolyshkin/sys-cap
vendor: switch to moby/sys/capability
2024-10-02 16:56:54 +00:00
Ed Santiago
043b82ef59
Fixes for vendoring Buildah
This commit was automatically cherry-picked
by buildah-vendor-treadmill v0.3
from the buildah vendor treadmill PR, #13808

  * Fix conflict caused by Ed's local-registry PR in buildah
  * Wire in "new" --retry and --retry-delay, these existed for longer
    but where non functional.

Signed-off-by: Ed Santiago <santiago@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-10-02 18:38:38 +02:00
Paul Holzinger
83a0299309
vendor: update buildah to latest
Includes a fix for CVE-2024-9407

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-10-02 18:04:39 +02:00
openshift-merge-bot[bot]
4eb43de41a
Merge pull request #24128 from ygalblum/quadlet-remove-equal-sign
Quadlet - prefer "param val" over "param=val" to allow env expansion
2024-10-02 15:34:35 +00:00
Ygal Blum
23f256349b Makefile - silence skipped tests when focusing on a file
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2024-10-02 09:54:06 -04:00
openshift-merge-bot[bot]
75a6a6681d
Merge pull request #24110 from mheon/fix_rhel_60382_round_2
Add ExposedPorts to Inspect's ContainerConfig
2024-10-02 13:41:34 +00:00
openshift-merge-bot[bot]
06f24180ce
Merge pull request #24125 from edsantiago/ci-desired-network
CI: require and test CI_DESIRED_NETWORK on RHEL
2024-10-02 12:48:49 +00:00
Paul Holzinger
dde1c3d98c
vendor: update to latest c/common
Includes a fix for CVE-2024-9341

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-10-02 11:24:01 +02:00
openshift-merge-bot[bot]
8d7bdc9cb0
Merge pull request #24127 from edsantiago/wait-for-sock
System tests: sdnotify: wait for socket file creation
2024-10-02 07:55:10 +00:00
Ygal Blum
fc25a3a5fc Quadlet - prefer "param val" over "param=val" to allow env expansion
When possible use a generic function to add strings and booleans
Adjust tests

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2024-10-01 18:01:05 -04:00
openshift-merge-bot[bot]
857a47de9b
Merge pull request #24082 from Luap99/netns-leak
Fix netns leak on container creation and exit code 1 on SIGTERM.
2024-10-01 21:02:05 +00:00
Ed Santiago
410537808e System tests: sdnotify: wait for socket file creation
Potential race between starting socat (which creates a socket
file) and processes accessing said socket. Or maybe not. I
dunno, I'm grasping at straws. This is an elusive flake.

Fixes: #23798 (I hope)

Signed-off-by: Ed Santiago <santiago@redhat.com>
2024-10-01 14:50:16 -06:00
Kir Kolyshkin
28e01cc8cc Switch to moby/sys/capability
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2024-10-01 12:52:18 -07:00
Kir Kolyshkin
6a91149b53 platformInspectContainerHostConfig: rm dead code
In this code, g.HostSpecific is _always_ false, as it is never set by
generate.New and is thus left at the default value (false).

Remove dead code.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2024-10-01 12:52:18 -07:00
Ed Santiago
b791dfb558 CI: require and test CI_DESIRED_NETWORK on RHEL
Although podman has moved on from CNI, RHEL has not. Make
sure that builds on RHEL test the desired network backend(s).

Effective immediately, gating.yaml on all RHEL branches
must set CI_DESIRED_NETWORK (=cni or =netavark)

Signed-off-by: Ed Santiago <santiago@redhat.com>
2024-10-01 10:44:07 -06:00
openshift-merge-bot[bot]
13b78c9da9
Merge pull request #24116 from containers/renovate/golang.org-x-exp-digest
fix(deps): update golang.org/x/exp digest to 701f63a
2024-10-01 13:06:17 +00:00
openshift-merge-bot[bot]
0c6be7aedb
Merge pull request #24119 from Luap99/quadlet-publish
quadlet: allow variables in PublishPort
2024-10-01 11:59:54 +00:00
Matt Heon
edc3dc5e11 Add ExposedPorts to Inspect's ContainerConfig
A field we missed versus Docker. Matches the format of our
existing Ports list in the NetworkConfig, but only includes
exposed ports (and maps these to struct{}, as they never go to
real ports on the host).

Fixes https://issues.redhat.com/browse/RHEL-60382

Signed-off-by: Matt Heon <mheon@redhat.com>
2024-10-01 07:54:52 -04:00
openshift-merge-bot[bot]
ded7833255
Merge pull request #24109 from Luap99/rpm-iptables-fedora
rpm: do not load iptables modules on f41+
2024-10-01 10:17:27 +00:00
openshift-merge-bot[bot]
e40b28fdb2
Merge pull request #24115 from containers/renovate/github.com-godbus-dbus-v5-digest
fix(deps): update github.com/godbus/dbus/v5 digest to a817f3c
2024-10-01 10:09:10 +00:00
openshift-merge-bot[bot]
09a2c8f3f5
Merge pull request #24112 from containers/renovate/github.com-cyphar-filepath-securejoin-0.x
fix(deps): update module github.com/cyphar/filepath-securejoin to v0.3.3
2024-10-01 08:18:40 +00:00
renovate[bot]
28d3775c4d
fix(deps): update golang.org/x/exp digest to 701f63a
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-01 08:16:24 +00:00
Paul Holzinger
abc4cfb049
quadlet: allow variables in PublishPort
There is no reason to validate the args here, first podman may change
the syntax so this is just duplication that may hurt us long term. It
also added special handling of some options that just do not make sense,
i.e. removing 0.0.0.0, podman should really be the only parser here. And
more importantly this prevents variables from being used.

Fixes #24081

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-10-01 10:07:20 +02:00
openshift-merge-bot[bot]
a3ba5ff320
Merge pull request #24113 from mtrmac/chunked-encryption
Document that zstd:chunked is downgraded to zstd when encrypting
2024-10-01 07:12:14 +00:00
renovate[bot]
7cde3abd17
fix(deps): update module github.com/shirou/gopsutil/v4 to v4.24.9
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-01 06:17:02 +00:00
renovate[bot]
8ef495594c
fix(deps): update github.com/godbus/dbus/v5 digest to a817f3c
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-01 01:31:16 +00:00
Miloslav Trmač
bb35ad1da4 Document that zstd:chunked is downgraded to zstd when encrypting
A part of https://github.com/containers/common/issues/2117 .

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2024-09-30 21:52:35 +02:00
openshift-merge-bot[bot]
1f5ec677d8
Merge pull request #24091 from Luap99/mount-race
podman mount: ignore ErrLayerUnknown
2024-09-30 18:31:32 +00:00
openshift-merge-bot[bot]
639f3c6336
Merge pull request #24104 from Sativarsainath-26/network-cmd-removal
update docs for network-cmd-path
2024-09-30 15:50:05 +00:00
renovate[bot]
ce9716ee41
fix(deps): update module github.com/cyphar/filepath-securejoin to v0.3.3
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-09-30 15:44:20 +00:00
openshift-merge-bot[bot]
b4b33aa4c1
Merge pull request #24086 from containers/renovate/ubuntu-24.x
chore(deps): update dependency ubuntu to v24
2024-09-30 14:18:35 +00:00
openshift-merge-bot[bot]
5cef143030
Merge pull request #24043 from PhrozenByte/docs-add-host-gateway
[CI:DOCS] Update documentation of CLI options affecting `/etc/hosts`
2024-09-30 13:37:22 +00:00
renovate[bot]
ece76a2537
chore(deps): update dependency ubuntu to v24
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-09-30 12:03:09 +00:00
Paul Holzinger
b5e1863d1c
rpm: do not load iptables modules on f41+
As we started to default to nftables on f41[1,2] we no longer have to
load legacy iptables modules.

[1] https://fedoraproject.org/wiki/Changes/NetavarkNftablesDefault
[2] https://github.com/containers/netavark/pull/1038

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-30 13:52:07 +02:00
Sainath Sativar
e07c31068f adding docs for network-cmd-path
Signed-off-by: Sainath Sativar <Sativar.sainath@gmail.com>
2024-09-30 10:41:10 +01:00
openshift-merge-bot[bot]
e1496c992a
Merge pull request #24090 from mheon/fix_rhel_60382
Include exposed ports in inspect output when net=host
2024-09-27 22:32:08 +00:00
Matt Heon
a619c03eff Include exposed ports in inspect output when net=host
Previously, we didn't bother including exposed ports in the
container config when creating a container with --net=host. Per
Docker this isn't really correct; host-net containers are still
considered to have exposed ports, even though that specific
container can be guaranteed to never use them.

We could just fix this for host container, but we might as well
make it generic. This patch unconditionally adds exposed ports to
the container config - it was previously conditional on a network
namespace being configured. The behavior of `podman inspect` with
exposed ports when using `--net=container:` has also been
corrected. Previously, we used exposed ports from the container
sharing its network namespace, which was not correct. Now, we use
regular port bindings from the namespace container, but exposed
ports from our own container.

Fixes https://issues.redhat.com/browse/RHEL-60382

Signed-off-by: Matt Heon <mheon@redhat.com>
2024-09-27 12:54:24 -04:00
openshift-merge-bot[bot]
adbb735958
Merge pull request #23945 from jakecorrenti/default-conn
Handle default system connection transfer properly on machine removal
2024-09-27 13:55:08 +00:00
fixomatic-ctrl
1dd90dbe20
feat(libpod): support kube play tar content-type (#24015)
feat(libpod): support kube play tar content-type

Signed-off-by: fixomatic-ctrl <180758136+fixomatic-ctrl@users.noreply.github.com>
2024-09-27 15:40:55 +02:00
openshift-merge-bot[bot]
514d25d53b
Merge pull request #24068 from edsantiago/cors-fixes
CORS system test: clean up
2024-09-27 13:19:28 +00:00
Paul Holzinger
1950555b26
podman mount: some better error wrapping
As shown in #23671 these functions can return the raw error without any
useful context to the user which makes it hard to understand where
things went wrong. Simply add some context to some error paths here.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-27 15:15:23 +02:00
Paul Holzinger
5c3019e028
podman mount: ignore ErrLayerUnknown
When we check for a storage container mount we normally expect a
ErrContainerUnknown when it does not exists. However during we check if
it is actually mounted we also can get ErrLayerUnknown when the
contianer was removed between the Container and Mount checks as they do
not happen under the same lock.

Fixes #23671

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-27 15:15:22 +02:00
openshift-merge-bot[bot]
87dcf9d9d2
Merge pull request #24062 from ygalblum/quadlet-restore-dir-order
Quadlet - make sure the order of the UnitsDir is deterministic
2024-09-27 12:02:24 +00:00
openshift-merge-bot[bot]
13e4b084eb
Merge pull request #24083 from Luap99/packit-centos
packit: disable Centos Stream/fedora ELN teasks
2024-09-27 10:48:08 +00:00
openshift-merge-bot[bot]
08cbd38994
Merge pull request #24073 from edsantiago/oh-i-give-up
System tests: set a default XDG_RUNTIME_DIR
2024-09-26 18:45:39 +00:00
Ygal Blum
ebbec00b0d Quadlet - make sure the order of the UnitsDir is deterministic
Change getUnitDirs to maintain a slice in addition to the map and return the slice
Add helper functions to make the code more readable
Adjust unit tests
Restore system test

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2024-09-26 10:57:47 -04:00
Paul Holzinger
f47abd8e1e
packit: disable Centos Stream/fedora ELN teasks
The go version there is only go 1.22.5 but we need go 1.22.6 as of
https://github.com/containers/podman/pull/24054

It is not clear to me how to best monitor the repos there to see when
they get the update. And then there is the fear that podman keeps
updating faster then these envs which makes testing there immposible[1]

[1] https://github.com/containers/image/pull/2550#discussion_r1743588062

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-26 16:49:48 +02:00
Paul Holzinger
5de7b7c3f3
libpod: remove shutdown.Unregister()
It is never used and needed so let's just remove some dead code.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-26 16:20:56 +02:00
Paul Holzinger
0bbef4b830
libpod: rework shutdown handler flow
Currently podman run -d can exit 0 if we send SIGTERM during startup
even though the contianer was never started. That just doesn't make any
sense is horribly confusing for a external job manager like systemd.

The original motivation was to exit 0 for the podman.service in commit
ca7376bb11. That does make sense but it should only do so for the
service and only if the server did indeed gracefully shutdown.

So we rework how the exit logic works, do not let the handler perform
the exit. Instead the shutdown package does the exit after all handlers
are run, this solves the issue of ordering. Then we default to exit code
1 like we did before and allow the service exit handler to overwrite the
exit code 0 in case of a graceful shutdown.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2024-09-26 16:14:30 +02:00