These errors only happen on windows or freebsd. They happen when a
function always returns a hard error there so it assumes the condition
is always true which is not the case on another platform.
We then also need to use nolintlint so it does not trigger on linux
where the nolint is not needed otherwise.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Looks like it picked up new deprecated matches so we need some more
nolint to silence them where we still need them for backwards compat in
the API.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Existing KillContainer handling uses HTTP status code 409 when the request cannot be performed because of the current container state. HTTP status code 404 is also used when the target container does not exist.
In contrast, errors from the stats handler are not reflected in the HTTP status code. The HTTP status code is always 200, and the errors are recorded only as generic errors in the server log.
To maintain compatibility with both streaming enabled and disabled, this change treats obtaining at least one complete unit of response content as the response contract. It then keeps the response content consistent with the HTTP status code.
Signed-off-by: Hiroaki KAWAI <hiroaki.kawai@gmail.com>
Since I use go 1.26 the go fix does not have all the rules built in,
there are newer ones in modernize so run the explicitly to fix more code
for go 1.26.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Docker API v1.44 now includes status properties
in Runtimes for the GET /info endpoint.
Read output of {oci_runtime_cmd} features command
lazily and expose the JSON
output as-is (with removed new lines and
whitespace) as the status field in GET
/info for v1.44+.
Add status to libpod GET /info in ociRuntime.features
and `podman info` (shared).
Add API tests for both endpoints.
Fixes: https://redhat.atlassian.net/browse/RUN-3319
Signed-off-by: Marek Simek <msimek@redhat.com>
Allow the `idmap` volume option to be combined with the overlay `O`
option, e.g. `-v /src:/mnt:O,idmap` or `-v myvol:/mnt:O,idmap`.
Previously any option other than `U`, `upperdir` and `workdir` combined
with `O` was rejected.
The parser in GenVolumeMounts now accepts `idmap` alongside `O` and
rejects the first disallowed option instead of counting flags. The
mappings from the container's user namespace are threaded onto the
generated overlay mount so the runtime idmaps it. This is done for both
the anonymous/host-path overlay volumes and the named-volume overlay
path, which are handled by separate code.
When a volume is idmapped the runtime shifts the mount so that on-disk
IDs map identically into the container, so the overlay backing dirs
(contentDir, upperdir, workdir) must be owned by real root (0) rather
than the host IDs the container root maps to; otherwise they surface as
the overflow ID inside the container and are inaccessible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
When the user owning the storage is not mapped into the container user
namespace (e.g. root with --userns=auto), the runtime cannot mount an
overlay volume from inside the user namespace.
Mount the overlay in podman instead and pass the runtime a bind mount.
Closes: https://github.com/podman-container-tools/podman/issues/28758
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
The subpath mount option is parsed with strings.Split(o, "=")[1], so it keeps only
the text between the first and second '='. A subpath that contains '=' gets cut
short and the container mounts a different directory than the one that was asked for.
--mount type=volume,src=v,dst=/mnt,subpath=/opt/a=b/c mounts /opt/a
Signed-off-by: Atishyy27 <sethatishayjain@gmail.com>
Imported volumes now get ownership and permissions matching the
container's mount tareget.
Previously, permission adjustment was skipped for imported volumes as
they were already non-empty when mounted.
Fixes: #25442
Signed-off-by: Jiwoo Ahn <ikwydls1314@gmail.com>
Replaces regexp.MustCompile with regexp.Delayed from go.podman.io/storage/pkg/regexp
for global regular expressions. This avoids compiling regular expressions
during the global init scope, improving startup performance for all commands.
Tests are kept using regexp.MustCompile where applicable.
Fixes: #29510
Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>
When fetching events with the --until flag on a system using the file events
backend, libpod/events/logfile.go spawned an unmanaged goroutine running
time.Sleep(time.Until(untilTime)). Because time.Sleep is not context-aware,
if a client cancelled the request or dropped the connection, the goroutine
remained sleeping in the background for the full until duration.
Fix this by using time.NewTimer and selecting on ctx.Done() so the background
goroutine exits immediately when the context is cancelled.
Fixes: #29491
Signed-off-by: Harsha Vardhan <harshahvk2005@gmail.com>
file.Size() returns bytes, so the comparison in logNeedsRotation must also
use bytes. The old code used len([]rune(content)) (rune/character count)
which undercounts multi-byte UTF-8 characters and allows the event log to
grow past events_logfile_max_size.
Replace with len(content)+1 (byte count, including the trailing newline
appended by writeToFile) so the size estimate is consistent with file.Size().
Add a regression test with multi-byte UTF-8 content to prevent regressions.
Also, explicitly close temp files before size rotation checks to fix
macOS/Lima CI failures caused by file locking and stat caching.
Fixes: #29414
Signed-off-by: Aftab Ali <aftab123215@gmail.com>
Replace deprecated swagger:alias with swagger:model for ImagePullStatus
and ArtifactPullStatus. Add explicit swagger:model annotations with
unique names to Podman types that collide with vendor types
(DriverData, PruneReport, RootFS, Secret, ThrottleDevice, WeightDevice,
Version) to resolve colliding model name warnings from go-swagger.
The types from libpod/define use a Libpod prefix, matching LibpodInfo
which already does that. Apart from the prefix the names are the ones
go-swagger derives on its own, so the annotations mostly just make the
naming explicit so the tool stops warning about it.
This does not close#29199 entirely. The two remaining name collisions
(Mount and Summary) are each between two vendored types, so they cannot
be controlled from the Podman side, and the dropped-ref-sibling
warnings are a separate problem.
Related: #29199
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
The truncate() function in libpod/events/logfile.go used path.Dir on a filesystem path (filePath). The file is Linux/FreeBSD only per its build tag, so this isn't about Windows correctness — it's about internal consistency: the same file already calls filepath.Dir at line 32 for the same kind of path handling, and filepath is idiomatic for filesystem operations.
Also removes the now-unused 'path' import.
Fixes part of #25165
Signed-off-by: Shreya Vidyadhar <shrevidh03@gmail.com>
Docker now reserves alias specfically for user-defined aliases, and uses another field, dnsnames, to hold all aliases, including container ID and name.
Part of docker v1.45 compat work, but this touches the cli too, since they updated it there too.
Signed-off-by: Ashley Cui <acui@redhat.com>
PruneBuildContainers() iterates over the snapshot returned by
store.Containers(). A build that was killed cleans up its own stage
containers in the background, which is exactly the situation this
function is meant to run after, so a container can disappear between the
snapshot and the calls that act on it.
When that happened ContainerDirectory() aborted the whole prune with a
hard return, and DeleteContainer() recorded "identifier is not a
container" in the report, which made podman system prune --build exit
125 even though the containers were gone.
Pruning wants the container gone, so treat ErrContainerUnknown and
ErrNotAContainer as success instead.
Seen in #28868, though that flake is really about the server side build
not stopping when the remote client is killed.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
Ensure we set the network status to nil after the teardown and save it
to the db. This is needed on network reload as the setup reads the
existing status for the pesto forwarding logic.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This makes use of the new pasta integration code in container-libs.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Errors returned in the healthcheck timer path and events inspect data were formatted with %v, discarding the error chain. Replaced with %w so callers can use errors.Is/errors.As to inspect the underlying causes.
Signed-off-by: Sheikh Muneeb Ahmed <msheikh.bsai24seecs@seecs.edu.pk>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
