Implements automatic OS upgrade functionality for Podman machines that requires no user input beyond running the command. The upgrade logic automatically determines the appropriate upgrade path using a three-way comparison between client version, machine version, and OCI registry:
* When the client version is older than the machine version, no action is taken and an error is returned.
* When the client version matches the machine version, the OCI registry is queried to check for in-band updates by comparing image digests. This handles minor, patch level, and updates oci image use cases.
* When the client version is newer than the machine version, the machine is upgraded to match the client's major.minor version.
* No manual image selection or version specification required.
The command supports dry-run mode and JSON (only) output format for automation.
Signed-off-by: Brent Baude <bbaude@redhat.com>
Instead of using rpm-ostree, we now use bootc for os apply. the
implementation is a little murky right now and will require some cleanup
to implement bootc's transports. for now, we only support oci images
from registries.
once we have an upgrade command, the transports can be added and the
docs for apply can be ammended to be more clear.
Fixes: RUN-3836
Signed-off-by: Brent Baude <bbaude@redhat.com>
These are not options directly passed to `--opt`, but these use `--opt o=`, so update the table accordingly.
Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
The documentation incorrectly stated that TimeoutStartSec "cannot be
used" with Type=oneshot services. According to systemd.service(5),
the startup timeout is simply disabled by default (set to infinity)
for oneshot services, but TimeoutStartSec can still be explicitly
configured if a timeout is desired.
Signed-off-by: Daniel Pereira <zdaniel.gp@gmail.com>
- Update documentation: Differentiate `unless-stopped` from `always` - containers stopped by the user before a reboot will not restart.
- Add `should-start-on-boot` filter: Identify containers that require a restart after a system reboot.
- Update command documentation: Add `restart-policy` and `label!` filters to the documentation for container commands (rm, ps, start, stop, pause, unpause, restart).
- Add `restart-policy` and `shoud-start-on-boot` to completions.
- Update service: Update `podman-restart.service` to use the `needs-restart=true` filter.
- Preserve state: Preserve the `StoppedByUser` state across reboots.
- Update API: Add a `ShouldStartOnBoot()` method to the Container API.
- Update documentation: Add descriptions for the `should-start-on-boot` filter.
Fixes: https://issues.redhat.com/browse/RHEL-129405
Fixes: https://github.com/containers/podman/issues/20418
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
When starting a machine and the user has not explicitly passed
-u=true|false AND stdin is a not a tty, we should not prompt to update
connections.
Fixes: #27556
Signed-off-by: Brent Baude <bbaude@redhat.com>
Fixes: #26588
For use cases like HPC, where `podman exec` is called in rapid succession, the standard exec process can become a bottleneck due to container locking and database I/O for session tracking.
This commit introduces a new `--no-session` flag to `podman exec`. When used, this flag invokes a new, lightweight backend implementation that:
- Skips container locking, reducing lock contention
- Bypasses the creation, tracking, and removal of exec sessions in the database
- Executes the command directly and retrieves the exit code without persisting session state
- Maintains consistency with regular exec for container lookup, TTY handling, and environment setup
- Shares implementation with health check execution to avoid code duplication
The implementation addresses all performance bottlenecks while preserving compatibility with existing exec functionality including --latest flag support and proper exit code handling.
Changes include:
- Add --no-session flag to cmd/podman/containers/exec.go
- Implement lightweight execution path in libpod/container_exec.go
- Ensure consistent container validation and environment setup
- Add comprehensive exit code testing including signal handling (exit 137)
- Optimize configuration to skip unnecessary exit command setup
Signed-off-by: Ryan McCann <ryan_mccann@student.uml.edu>
Signed-off-by: ryanmccann1024 <ryan_mccann@student.uml.edu>
Quadlets installed from `.quadlet` file now belongs to a single
application, anyone file removed from this application removes all the
other files as well.
Assited by: claude-4-sonnet
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
Currently our API docs are not working as it fails to fetch the js file
with the redoc code which renders the swagger.
The reason this fails is because we have been tracking the "next"
version and that was recently bumped to v3.0.0-rc.0 which also seem to
have moved the location to use "bundle" (no s). As such we now get a 404
as the CDN doesn't find the file. [1]
I don't get why we have been tracking next to begin with, using latest
would still work as it points but that could be moved anytime as well so
switch the URL to pull in the lastest v2 version which should be safer
against unexpected changes like that.
While it could of course also break in a minor v2 release hard coding an
exact version would mean a fair amount of churn updating this (which I
guess would not happen) so this looks like the best compromise to me.
[1] https://www.npmjs.com/package/redoc/v/3.0.0-rc.0Fixes: #27505
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Enable installing multiple quadlets from one file using '---' delimiters.
Each section requires '# FileName=<name>' comment for custom naming.
Single quadlet files remain unchanged for backward compatibility.
Assited by: claude-4-sonnet
Signed-off-by: flouthoc <flouthoc.git@gmail.com>
Changes made in this commit will fix#16168
The current command in the docs expect a `docker.exe` file to exist in the current working directory.
As this is most likely a typo, changes made in this commit fix this issue.
Signed-off-by: Manuel Thalmann <m@nuth.ch>
In more recent Windows 11 versions (not sure about Windows 10),
Windows now ships its own `curl.exe`,
so PowerShell's "curl"-alias no longer exists.
Changes made in this commit will replace the `curl` alias call with the actual `Invoke-WebRequest` function.
Signed-off-by: Manuel Thalmann <m@nuth.ch>
This allows users to set the associated machine's system connection to the system default when running `podman machine init --now` or `podman machine start`. It also changes the default bbehavior of these commands in that the user will be prompted and asked if they would like to switch the system connection. It also introduces a command line switch called `--update-connection`. If the switch is unset, then the user will be prmpted. If the command value is explicitly set to `false`, the user will not be prompted and the system connection will not be altered. If the value is set to `true`, the system connection will be made the default and the user will not be prompted.
Fixes: https://issues.redhat.com/browse/RUN-3632
Signed-off-by: Brent Baude <bbaude@redhat.com>
This is being added here only for team review. This doc will live in
https://github.com/cncf/tag-security/ and *probably* be removed from
here.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add the ability for users to override the default provider when creating mahcines. The new flag is `--provider` and allows you to specifiy a valid vmtype for the platform. This PR also removes the previous list test where we tested listing all providers. I added a PR for testing --provider which includes a standard `machine ls` which defaults now to showing all providers.
Signed-off-by: Brent Baude <bbaude@redhat.com>
