The farm command is helpful when it comes to building
multi-architecture container images, with a build out on various
different CPU architecture machines (e.g. amd64, arm64 etc). This
produces a multi-architecture image usable on many different kinds
of machines. Once those farms are built, we can list them out (ls)
in a human readable format.
Currently, podman farm list prints out every field (name,
connections, default, etc). The --quiet/-q flags cut the noise by
only printing the names of the farms, rather than all the other
farm list metadata.
The benefit of having this feature is for automation and scripts to
pull just the farm names from the list, which is mostly important
for CI pipelines to loop over.
Signed-off-by: umar11b <uzaman2018@gmail.com>
The "podman kube --quiet with error" test hardcoded
quay.io/libpod/alpine_nginx:latest directly inside a YAML string instead of
using the NGINX_IMAGE constant, which is already defined per architecture.
This instance was missed in commit cd2f122, which fixed the same pattern in
five other tests in this file, because it used a raw inline literal rather
than the variable.
Signed-off-by: Aryan Nishad <157164036+aryannishad-86@users.noreply.github.com>
The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
Docker now reserves alias specfically for user-defined aliases, and uses another field, dnsnames, to hold all aliases, including container ID and name.
Part of docker v1.45 compat work, but this touches the cli too, since they updated it there too.
Signed-off-by: Ashley Cui <acui@redhat.com>
runc doesn't support --tcp-close, so this test always failed there
once the flag hit the runtime. Skip it entirely for non-crun since
since --tcp-established already covers runc above.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Both the tcp-established and tcp-close checkpoint/restore tests expect
a restore rejected due to an established TCP connection to fail with
"runc: criu failed: type NOTIFY errno 0". criu's RPC server actually
reports this failure as type RESTORE, not NOTIFY. Widen the regex in
both tests to accept RESTORE while still tolerating NOTIFY.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
The 'podman healthcheck on valid container' test was skipped since 2019 due to a consistent flake. The root cause was a brittle manual 5-second polling loop that failed on heavily loaded CI runners before the healthcheck daemon could initialize.
This commit modernizes the polling logic by replacing the manual loop with Ginkgo's robust Eventually block with a 30-second timeout, allowing the test to run reliably on all environments, and removes the Skip directive.
Signed-off-by: Aryanbhargava18 <aryanbhargava644@gmail.com>
pasta's IPv6 local-mode forwarding requires an unreleased upstream
patch. Skip the affected E2E tests until the fix ships in a pasta
release.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The cgroups=split e2e test wraps podman in systemd-run --scope but does not request cgroup delegation. Without Delegate=yes, systemd does not guarantee that controllers like pids are written to cgroup.subtree_control for child cgroups. Whether they appear depends on the systemd session state at that moment, causing flaky crun failures when it tries to use unavailable controllers.
Fixes: #28944
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
With the new config work we expect policy.json to be shipped under
/usr/share/containers/policy.json. However the CI VMs and local users
might still have it in /etc so instead of assuming any host path lets
just create our own files for the --signature-policy tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
I do not understand this condition in the code, not passing the log file
to the runtime when run with log level debug makes no sense. It means we
do not get the proper error message from the runtime so debug logging
shows a much worse error:
"container create failed (no logs from conmon)..."
When the actual error is the command is not in $PATH for example. So to
fix this just remove the log level check. Also not the support json flag
condition is done inside execOCILog().
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
First check for errors and assert them via gomega to make the test fails
which called this.
Then stop calling this for each test spec, most will never access this
so stop reading the file over and over. Callers should just call the
function directly.
Then remove the arch field from it, that is not related to the OS file.
Callers should just access runtime.GOARCH directly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
Fixes: #22095
Now handles exporting a container's healthcheck configuration as a
`livenessProbe` in the generated Kubernetes YAML.
Co-authored-by: givensuman <givensuman@duck.com>
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Devesh B <98201065+DeveshB-1@users.noreply.github.com>
Signed-off-by: givensuman <givensuman@duck.com>
Update test/e2e/generate_kube_test.go
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: given <givensuman@gmail.com>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
