Support for these was removed in 3721ff82ff as the feature is
inherently insecure. Checkpoints imply an extremely privileged
operation that is incompatible with the constraints of a
`podman run` command. However, we should still tell folks that
it no longer works with a clear error message. This is done
during Specgen processing, server side, which should be safer
than the previous client-side processing for these.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
This reverts commit f4401567cd.
This commit has been identified as a serious security issue.
Running checkpoints via `podman run` introduces potentially
confusing behavior where all security for a container, even
options specified by the user at the command line, can be turned
off by the checkpoint. Checkpoints have special security
considerations and must be explicitly requested by the user to
ensure they are used safely. We recommend ensuring the lifecycle
of a checkpoint is fully monitored and integrity is ensured at
each stage to guarantee safety.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Docker clients send the seccomp profile JSON itself in
HostConfig.SecurityOpt (the docker CLI reads the profile file
client-side and inlines it). The compat API treated the value as a path
to a profile file, so container create failed with "file name too
long". This breaks docker-compat tooling that passes seccomp profiles
through the socket, like Nextcloud AIO and forgejo-runner.
Add a SeccompProfile field to specgen for inline profile content,
next to the existing SeccompProfilePath, as requested in review of the
earlier PR that tried to fix this (#28985). The compat create handler
extracts inline profiles (values starting with "{") from SecurityOpt
and sets the new field. Path-based values and "unconfined" keep their
current meaning, and duplicate seccomp options resolve last-one-wins,
like docker.
Fixes: #27710
Signed-off-by: r-vdp <ramses@well-founded.dev>
Docker documents HostConfig.PidsLimit 0 as unlimited, but runc sets
pids.max=1 for OCI pids.limit 0. Normalize 0 to -1 when building the
OCI spec so native CLI, compat API, and kube play behave consistently.
Fixes: https://github.com/podman-container-tools/podman/issues/29826
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Docker API v1.44 omits the Created field (previously,
it was the zero value of 0001-01-01T00:00:00Z) if
the Created field is missing from the image config.
Omit it when zero from the compat API GET /images/{id}/json
(using `info.Created` instead of the previous `l.Created()`
that is set to `Now()` in storage/images.go when empty).
Add a test creating an image with the Created field missing.
Fixes: https://redhat.atlassian.net/browse/RUN-3317
Signed-off-by: Marek Simek <msimek@redhat.com>
This is a small Docker compat fix with the API exec endpoints.
With Docker, sending a bare Exec Create (command only, nothing
else set) and then an Exec Start without Detach set performs
a detached exec. With Podman, we threw an error that at least one
stream must be attached to. Fix is trivial; look up the session
before start, check the config for attach streams, and force
detach on if none are set.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Added a done channel and select block to cleanly terminate the signal-forwarding goroutine when the VM starts or fails, preventing a goroutine leak on every 'podman machine start'.
Fixes: #29342
Signed-off-by: Sheikh Muneeb Ahmed <msheikh.bsai24seecs@seecs.edu.pk>
TestConvertAdditionalBuildContexts asserted that the additional build
context "C:\test" is rewritten to "/mnt/c/test". That rewrite is done by
specgen.ConvertWinMountPath, which is a no-op unless shouldResolveWinPaths()
is true: always on Windows, but on Linux only when the client runs inside a
WSL or Hyper-V guest. On an ordinary Linux host the value is passed through
unchanged and the test fails.
Keep the platform independent expectations (URLs, images and unix paths are
never rewritten) in the shared test and move the drive letter case to a
Windows only file, following the existing split in pkg/specgen.
Signed-off-by: Daksha1611 <mehtadaksha1611@gmail.com>
Remove duplicated ValidateSysctls logic and call
go.podman.io/common/pkg/sysctl.Validate instead. This change
picks up the latest validation from c/common.
Signed-off-by: Ijaj Mulani <ijajmulani786@gmail.com>
Fixed the compat container update path so it preserves the existing restart policy unless the request explicitly includes a new one, and added a regression test for it.
Fixes: #29790
Signed-off-by: Srijan Keshri <212402043+arcusbuilds@users.noreply.github.com>
Allow deployments and scheduled jobs to update a selected group of
containers without checking every auto-update-enabled application.
Reuse the existing container filters and expose them through the CLI,
remote bindings, and REST API.
Filter update candidates while preserving systemd unit and pod restart
behavior. Document the selection semantics and cover filtered updates,
invalid input, remote requests, and pod restarts in the existing tests.
Signed-off-by: Evan Purkhiser <git@evanpurkhiser.com>
Podman 6 dropped cgroups v1 support, and the kernel real-time
scheduler cgroup settings only exist on cgroups v1. That means the
--cpu-rt-period and --cpu-rt-runtime options can never take effect
anymore: on cgroups v2 the values only produce a warning and are
discarded.
As agreed in the linked issue, the full removal of the options is
deferred to the next major release (7.0) to avoid a breaking change
for anyone still setting them. For 6.x this commit implements the
agreed interim step:
- remove the option documentation (docs/source/markdown/options/
cpu-rt-period.md and cpu-rt-runtime.md) and drop the @@option
references from the podman-create, podman-run, podman-update and
podman-container-clone man pages
- hide both flags from --help output
- change the existing warning to state that the option is a NOP,
that the value is ignored, and that the option will be removed in
the next major release
The e2e tests are updated to match the new warning text. Actual
removal of the flags and the spec fields is left for Podman 7.0.
Part of #29750
Signed-off-by: seonghun lee <harrisleesh@gmail.com>
The Docker-compatible network API omitted the IPRange field from the IPAM
config even though Libpod stores this data, so tools reading the Docker
API could not see the configured IP range.
Map Libpod's LeaseRange to Docker-compatible IPAMConfig.IPRange when it
aligns with a full CIDR span derived from FirstIPInSubnet/LastIPInSubnet,
and add an integration test that creates a network via the compat API with
an explicit IPRange and asserts it is returned on inspect.
The span is matched with bit arithmetic rather than by trying every prefix
length: the network address is start-1, and XORing that with end yields the
host mask, which identifies the prefix in a single pass. net/netip carries
the address handling throughout - Unmap collapses 4-in-6, Prev gives the
network address, and Masked confirms the network is aligned to the prefix.
Fixes: #28378
Signed-off-by: aayushbaluni <73417844+aayushbaluni@users.noreply.github.com>
processMultipartQuadlets previously deferred closing each multipart part
and file inside the loop, leaking descriptors until the handler returned.
It also opened files with os.Create, silently overwriting earlier files if
a request contained parts with duplicate names.
Align processMultipartQuadlets with the manifests multipart upload handler:
- Wrap each part processing in a closure so part and file descriptors close
immediately on each loop iteration.
- Use os.OpenFile with os.O_CREATE|os.O_EXCL|os.O_WRONLY (0600) so duplicate
filenames return an error instead of silently overwriting.
- Sanitize filenames using filepath.Base to prevent directory traversal.
- Add unit tests verifying multiple file extraction, duplicate name rejection,
and path traversal sanitization.
Fixes: #29752
Signed-off-by: Madhosh Yagnik <madhosh1yagnik@gmail.com>
Until now the default could only be expressed by leaving the option off, which
reads as an omission rather than a choice and gives a script no way to say it
wants the archive transferred as podman save wrote it.
Accept none as a format meaning exactly that. It is taken on the API path too,
so both interfaces share one vocabulary, and it is treated as the absence of a
format throughout: nothing is compressed, a level attached to it is rejected the
same way a level with no format is, and the local user to user transfer has
nothing to warn about ignoring.
The remote client still leaves it off the request, so naming the default does
not make a transfer fail against a service that predates these options.
Signed-off-by: Scott Callaway <github@scottcallaway.co.uk>
The timeout is simply to low, I don't know the previous numbers were
collected because they are simply wrong. A machine init takes around 50s
total. And while the ready timeout itself could be shorter there is
really no good reason to set such a low limit as it will cause wrong
failures.
This is currently flaking a lot in CI, I see it in most hyperV logs I
looked at[1]. While there is likely another problem with the boot
failures I think this added a ton of false positives as it errors out
early.
[1] https://github.com/podman-container-tools/podman/actions/runs/34146238887/job/101820830173
Fixes: dd28c14f8c ("hyperv: add timeout to vsock ready wait")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Even on the slowest of CI systems a normal VM start does not seem to
take more than 1 minute.
Instead we seem to have flakes which cause our command to hang on
startup. In that case we thought waiting longer might help but instead
it just wastes 10 minutes.
Se the default command timeout to 3 minutes which should be plenty even
on the slowest of CI systems. Anything above will likely never finish
and we can just abort the test as failed.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Combine the no volume and --import-native-ca test into one.
This removes one full machine init/start/stop cycle.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Instead of creating a fresh machine which is slow reuse an existing
test for this test.
Also fix the test to actually check the file content properly, it was
using the wrong build output. And then just use one cat for both files
to make it a tiny bit faster.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
