These errors only happen on windows or freebsd. They happen when a
function always returns a hard error there so it assumes the condition
is always true which is not the case on another platform.
We then also need to use nolintlint so it does not trigger on linux
where the nolint is not needed otherwise.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Looks like it picked up new deprecated matches so we need some more
nolint to silence them where we still need them for backwards compat in
the API.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Existing KillContainer handling uses HTTP status code 409 when the request cannot be performed because of the current container state. HTTP status code 404 is also used when the target container does not exist.
In contrast, errors from the stats handler are not reflected in the HTTP status code. The HTTP status code is always 200, and the errors are recorded only as generic errors in the server log.
To maintain compatibility with both streaming enabled and disabled, this change treats obtaining at least one complete unit of response content as the response contract. It then keeps the response content consistent with the HTTP status code.
Signed-off-by: Hiroaki KAWAI <hiroaki.kawai@gmail.com>
Since I use go 1.26 the go fix does not have all the rules built in,
there are newer ones in modernize so run the explicitly to fix more code
for go 1.26.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The function logged the wrong error, logging ec which is the return
value from ParseInt makes no sense since the error tells us the function
failed so ec is invalid/undefined. Also ParseInt already includes the
string input in the error so just drop it.
This was flagged by govet now that we use go 1.26 because %q was wrong
for integers.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Plus manually deleting the left over inline functions because go fix
doesn't do that even though they are private functions.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Set the minimum supported go version to go 1.26. container-libs requires
it now and some other deps will need it as well.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Docker API v1.44 now includes status properties
in Runtimes for the GET /info endpoint.
Read output of {oci_runtime_cmd} features command
lazily and expose the JSON
output as-is (with removed new lines and
whitespace) as the status field in GET
/info for v1.44+.
Add status to libpod GET /info in ociRuntime.features
and `podman info` (shared).
Add API tests for both endpoints.
Fixes: https://redhat.atlassian.net/browse/RUN-3319
Signed-off-by: Marek Simek <msimek@redhat.com>
update podman common vendor to get access to precreate
hooks, stdout and stderr. Vendor bump also includes mpb
vendor,image, and storage.
Signed-off-by: Joshua Arrevillaga <2004jarrevillaga@gmail.com>
ostree.go is limited to only amd64 and arm64, but its tests run on all
architectures and fail because all their symbols are missing.
Don't run tests on an architecture where the non-test code doesn't
exist.
References: https://github.com/podman-container-tools/podman/issues/29711
Signed-off-by: Hugo Osvaldo Barrera <hugo@whynothugo.nl>
The remote client uploads the artifact files from a goroutine and waits for it with a sync.WaitGroup, but the goroutine never calls Done(), so Wait() blocks for good and the command never returns. Nothing caught it because no test ran manifest add --artifact against podman-remote.
Start the goroutine with WaitGroup.Go, which releases the counter on its own once the upload is finished.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
Two commands can set a subject on a manifest list, podman manifest annotate --index --subject and podman manifest add --artifact-subject. Both work locally, but they do nothing at all when podman runs with --remote.
The value never leaves the client. Before sending the request the remote client copies everything into manifests.ModifyOptions and manifests.AddArtifactOptions, and neither struct had a field to hold the subject, so it was quietly thrown away. The server had a second problem of its own, ManifestModify rebuilds ManifestAddArtifactOptions by hand and left out the embedded ManifestAnnotateOptions, so --os, --arch and --annotation were being dropped there as well.
Add the missing field to both structs, fill it in from the tunnel ImageEngine, and let the handler pass the annotate options along. Also add two system tests that run both flags for real so the remote path stays covered.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
This reverts commit 0dbe00d272.
The linked bug[1] has been fixed for a while now, remove the skip to
test the port forwarding range properly again with pasta.
The CI images all have a new enough pasta.
[1] https://bugs.passt.top/show_bug.cgi?id=202
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The latest zizmore update fails to validate the pre-commit config as it
cannot deal with the extra .git repo suffix anymore.
Since it is not required simple remove it to also make the new version
work with this.
https://github.com/zizmorcore/zizmor/issues/2358
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
runc 1.5.0 switched to a safe procfs API for setting SELinux labels,
so reopened handles no longer carry a /proc/self path in error
messages, e.g. "write /1/attr/keycreate: invalid argument" instead of
"write /proc/self/attr/keycreate: invalid argument". Relax the regex
to match on "attr/keycreate" without requiring the proc/self prefix.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Allow the `idmap` volume option to be combined with the overlay `O`
option, e.g. `-v /src:/mnt:O,idmap` or `-v myvol:/mnt:O,idmap`.
Previously any option other than `U`, `upperdir` and `workdir` combined
with `O` was rejected.
The parser in GenVolumeMounts now accepts `idmap` alongside `O` and
rejects the first disallowed option instead of counting flags. The
mappings from the container's user namespace are threaded onto the
generated overlay mount so the runtime idmaps it. This is done for both
the anonymous/host-path overlay volumes and the named-volume overlay
path, which are handled by separate code.
When a volume is idmapped the runtime shifts the mount so that on-disk
IDs map identically into the container, so the overlay backing dirs
(contentDir, upperdir, workdir) must be owned by real root (0) rather
than the host IDs the container root maps to; otherwise they surface as
the overflow ID inside the container and are inaccessible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
When the user owning the storage is not mapped into the container user
namespace (e.g. root with --userns=auto), the runtime cannot mount an
overlay volume from inside the user namespace.
Mount the overlay in podman instead and pass the runtime a bind mount.
Closes: https://github.com/podman-container-tools/podman/issues/28758
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
