os.Exit(1) kills the process without ginkgo getting a chance to report
anything, so a failure here shows up as a suite that just stopped with
no output. All six sites run inside ginkgo, three in a SynchronizedBefore
Suite and a helper and three inside It blocks, so Expect works and prints
the error and the location.
The os.Exit(m.Run()) in TestMain stays, that one is correct.
Part of #18540.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
A bool assert on the parsed repo/tag map says nothing about the actual
images output when it fails. Match the line with a regex instead, the
failure then prints every line and the pattern. This also removes
tagOutputToMap which had no other user.
Part of #18540.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The wait and events tests 500 with a dlopen error on the journald reads
when they run against the server the previous file left behind. Paul
tracked down what puts that server in this state, restarting it here
keeps the suite honest until that is fixed.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
Both users are plain if conditions, strings.Contains on the output
does the same without a helper.
Part of #18540.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
Matching a bool and then indexing into the returned lines gives no
useful output when it fails. Use gomega matchers on the output array
instead, they print the array and the expected match on failure.
Part of #18540.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The healthcheck inherit tests build their image with the default oci
format, which drops HEALTHCHECK. The build only warns about it and the
test sends that to /dev/null, so the image has no health config, there
is nothing to inherit and all 21 assertions come back null.
Fixes: 16a1d3fbe9 ("support healthcheck: {} inherits healthcheck from image")
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
When a container has --memory-reservation set without --memory-limit,
resources.Memory is non-nil but resources.Memory.Limit is nil. The
compat stats handler dereferences the nil Limit pointer, causing a
panic that returns a 500 to the client.
Fix: add resources.Memory.Limit != nil guard before the dereference.
Regression test added in test/apiv2/19-stats.at.
Fixes#29627
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
bs=1G means "read 1GB into memory at a time"; we really
don't need that.
On a system with 6GB physical memory (while our test VM is
configured to have 8 GB of virtual RAM), this seems to result
in trashing and exceeding the 30s timeout, while with a
smaller block size, the copy happens in <13 seconds. (dd itself
reports 11 s vs. 27 s).
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Imported volumes now get ownership and permissions matching the
container's mount tareget.
Previously, permission adjustment was skipped for imported volumes as
they were already non-empty when mounted.
Fixes: #25442
Signed-off-by: Jiwoo Ahn <ikwydls1314@gmail.com>
ParseBuildOpts downloads a URL or stdin context into a temp dir and
stores it in TmpDirToClose, but the caller only removes that when
ParseBuildOpts returns successfully. Every error return after the
download leaks it, including the authfile check reproduced in #22642
and a plain build of a git URL with no Containerfile, which leaves the
whole clone behind.
Use the same succeeded guard TempDirForURL itself uses, one level up so
it covers both tmpdir call sites and the logfile next to them.
Fixes: #22642
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
Problem: podman artifact ls has no way to print just artifact
identifiers. Scripts that want to act on artifacts (e.g. remove them)
have to parse table output or use --format {{.Digest}}. Every other
listing command in podman (images, ps, artifact push/pull) already
supports -q/--quiet for this.
Impact: users can now run `podman artifact ls --quiet` to get one
digest per line, no header, suitable for piping into other podman
commands.
Change: adds a --quiet/-q bool flag to the list command. When set (and
--format is not also given), output.Digest is printed for each
artifact instead of the table.
Signed-off-by: umar11b <uzaman2018@gmail.com>
strings.Split(output, "\n") on empty output returns [""], not []. so
ErrorToStringArray() reported empty stderr as one line of empty output
instead of no output, and any caller checking len() got a wrong count.
volume_ls_test.go had to carry HaveLen(1) just to tolerate that on
empty stderr, updated to BeEmpty() now that the length is actually
correct.
filter out empty lines when building the result.
Signed-off-by: Atishyy27 <142108881+Atishyy27@users.noreply.github.com>
With podman 6 we switch the main libpod port bind logic used as rootful
over to bind dual stack sockets correctly and no longer default the host
ip to 0.0.0.0.
So -p 8080:8080 should create one dual stack socket that binds all
addresses. While -p 0.0.0.0:8080:8080 -p [::]:8080:8080 should create
two sockets binding v4 and v6 respectively.
Because the go std lib always defaults to dual stack the second case
currently fails with EADDRINUSE which is wrong, so fix that to pass the
right protocol.
This is also how pasta works already so this makes everything consistent
now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The 'podman artifact ls' command supports a --format flag accepting a go template string. Some commands (eg 'podman image ls') accept a --format=json parameter, and export pure json object to stdout.
This change adds a --format=json output mode to artifact lists too.
Includes simple documentation mention of --format=json option alongside go template description.
Signed-off-by: ellieayla <1447600+me@users.noreply.github.com>
The Docker-compat secret inspect endpoint was incorrectly honoring
the showsecret query parameter, which could expose plaintext secret
data to clients using the Docker-compatible API.
This restricts showsecret to libpod-only requests. Docker-compat
clients always receive redacted secret data, matching Docker's own
behavior.
Add APIv2 tests covering the showsecret behavior on both the
Docker-compat and libpod endpoints, confirming secret data is never
returned from the compat endpoint while libpod continues to honor
the flag.
Fixes: #29570
Signed-off-by: Davoud Azari <davidmotral@gmail.com>
podman farm build pushes each per-arch image to the registry by
appending `UnknownDigestSuffix` to the image specified using --tag. This
fails because a tag is not expected when UnknownDigestSuffix is used.
Parse the image reference and pass only the untagged image
reference when podman does this suffixed push to the registry.
Fixes#25039
Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
An emptyDir with "medium: Memory" was translated into a per-container
tmpfs mount, so every container in the pod received its own empty
filesystem. Data written by an init container was therefore invisible to
the regular containers, while Kubernetes specifies that an emptyDir is
shared by all containers in the pod and outlives the init container.
Create an anonymous named volume backed by tmpfs instead. Every
container in the pod refers to the same volume name, so the mount is
shared, and the volume is still removed together with the pod. The
emptyDir sizeLimit is passed through as the tmpfs size option, which was
previously ignored.
Fixes: #29555
Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>
The farm command is helpful when it comes to building
multi-architecture container images, with a build out on various
different CPU architecture machines (e.g. amd64, arm64 etc). This
produces a multi-architecture image usable on many different kinds
of machines. Once those farms are built, we can list them out (ls)
in a human readable format.
Currently, podman farm list prints out every field (name,
connections, default, etc). The --quiet/-q flags cut the noise by
only printing the names of the farms, rather than all the other
farm list metadata.
The benefit of having this feature is for automation and scripts to
pull just the farm names from the list, which is mostly important
for CI pipelines to loop over.
Signed-off-by: umar11b <uzaman2018@gmail.com>
POST /containers/create now takes Options as part of HostConfig.Mounts.TmpfsOptions to set options for tmpfs mounts.
Signed-off-by: Ashley Cui <acui@redhat.com>
The unhealthy wait polls podman events with a --since that is captured
after the touch which triggers the failing checks. With a 1s interval
the third failure can fire while the "First failure" checks above are
still running, so the window opens after the only unhealthy event that
will ever exist. Journal artifacts from two failed jobs show the event
firing 19ms and 60ms before the captured timestamp.
81fceb48d moved this capture earlier for the same reason but left it
after the trigger. Reuse the timestamp taken before the touch instead.
The wait loop only matches the last event so the wider window is safe,
and the assertion table already accepts FailingStreak 3-6.
Fixes: #29353
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The "podman kube --quiet with error" test hardcoded
quay.io/libpod/alpine_nginx:latest directly inside a YAML string instead of
using the NGINX_IMAGE constant, which is already defined per architecture.
This instance was missed in commit cd2f122, which fixed the same pattern in
five other tests in this file, because it used a raw inline literal rather
than the variable.
Signed-off-by: Aryan Nishad <157164036+aryannishad-86@users.noreply.github.com>
