When creating a secret with driver=shell via the API, the file driver's
default DriverOpts (including path) were applied because DriverOpts was
empty. The shell driver rejects path as an unknown option, making it
impossible to create shell-driver secrets via the REST API or
podman-remote.
Only apply default DriverOpts from config when the requested driver
matches the configured default driver.
Signed-off-by: Joe Doss <joe@solidadmin.com>
(cherry picked from commit 667f55c2ce)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
ExecContainerHTTP returns attachChan to its caller before attachExecHTTP
finishes. The caller's deferred close(holdConnOpen) can therefore fire
while attachExecHTTP is still running (including its own deferred
cleanups), which races with the goroutine inside attachExecHTTP that
reads deferredErr after <-holdConnOpen unblocks.
Fix this by introducing an errCh channel: deferred functions write
deferredErr into it, and the goroutine reads from it after
<-holdConnOpen unblocks, ensuring the read happens-after all writes to
the named return value.
Fixes: #28277
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
(cherry picked from commit 497185c14b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When `podman-remote` tars the context, extra `podman-build-secret*` paths were
either dropped by `.dockerignore` (#25314) or archived as absolute paths so
`COPY . .` pulled host-shaped trees into the image (#28334).
Use relative names under the primary context for extra sources and do not apply
`.dockerignore` to those forced entries.
Fixes: https://github.com/containers/podman/issues/25314
Fixes: https://github.com/containers/podman/issues/28334
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
(cherry picked from commit e18bb9ea8b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
In the SystemCheck HTTP handler, when parsing the
unreferenced_layer_max_age query parameter fails, the error response is
sent but execution continues to `unreferencedLayerMaximumAge = &duration`
where `duration` is the zero value. This causes the system check to run
with a zero duration instead of returning the 400 error to the client.
Add the missing `return` after the error response.
Fixes#28350
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
(cherry picked from commit 29d80a26af)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Podman uses this env toi do various things, we don't want the external
env to affect our tests here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 7e3caaed84)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This prevents a nil pointer crash when running network=host containers
on a FreeBSD host using podman-remote.
Fixes: #28289
Signed-off-by: Doug Rabson <dfr@rabson.org>
(cherry picked from commit 9a10cefd18)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Setting Entrypoint= (empty value) in a quadlet .container file should
produce --entrypoint "" in the generated podman command, which clears
the image's default entrypoint. Previously this was silently ignored
because lookupAndAddString skips empty values.
Move the Entrypoint key out of the generic stringKeys map and handle
it separately so that an empty value is passed through.
Closes#28213
Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com>
(cherry picked from commit 926f562bd5)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Recommend the reboot option instead if users cannot shut down all podman
commands. Also update the wording that users MUST shut down commands for
correct migration.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Mention the reboot which should be safer and that in order for the
command the user has to ensure they are no parallel commands.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
If the sqlite file exists make sure we always use that db and no longer
botldb. There are known race conditions in the db migration logic that
might make it so that both database files exists at once.
In order to ensure we use the correctly migrated one we must prefer
sqlite here.
see https://github.com/containers/podman/issues/28216
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Once we have the alive lock and do not refresh check again if another
process migrated the state after we opened the db initially.
This is required to ensure parallel commands notice the migration and
correctly only use sqlite.
see https://github.com/containers/podman/issues/28219
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It fails due selinux, it is unlcear why so I filled #27759 for now to
track that so we can get the image update merged.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Podman uses this env toi do various things, we don't want the external
env to affect our tests here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
