processMultipartQuadlets previously deferred closing each multipart part
and file inside the loop, leaking descriptors until the handler returned.
It also opened files with os.Create, silently overwriting earlier files if
a request contained parts with duplicate names.
Align processMultipartQuadlets with the manifests multipart upload handler:
- Wrap each part processing in a closure so part and file descriptors close
immediately on each loop iteration.
- Use os.OpenFile with os.O_CREATE|os.O_EXCL|os.O_WRONLY (0600) so duplicate
filenames return an error instead of silently overwriting.
- Sanitize filenames using filepath.Base to prevent directory traversal.
- Add unit tests verifying multiple file extraction, duplicate name rejection,
and path traversal sanitization.
Fixes: #29752
Signed-off-by: Madhosh Yagnik <madhosh1yagnik@gmail.com>
Until now the default could only be expressed by leaving the option off, which
reads as an omission rather than a choice and gives a script no way to say it
wants the archive transferred as podman save wrote it.
Accept none as a format meaning exactly that. It is taken on the API path too,
so both interfaces share one vocabulary, and it is treated as the absence of a
format throughout: nothing is compressed, a level attached to it is rejected the
same way a level with no format is, and the local user to user transfer has
nothing to warn about ignoring.
The remote client still leaves it off the request, so naming the default does
not make a transfer fail against a service that predates these options.
Signed-off-by: Scott Callaway <github@scottcallaway.co.uk>
The tunnel engine builds its own ScpOptions, so without this the flags parse
fine under podman --remote and are then dropped, transferring uncompressed with
no indication that anything was ignored.
Carry both options through the bindings to the libpod ImageScp handler, which
hands them to ExecuteTransfer the same way the local path does, and document
them on the endpoint.
This is also the point at which the transfer's own validation becomes reachable
over HTTP, so map it accordingly: a rejected format or level is the caller's
mistake and answers 400, not the 500 every error from the transfer used to
produce.
Signed-off-by: Scott Callaway <github@scottcallaway.co.uk>
Looks like it picked up new deprecated matches so we need some more
nolint to silence them where we still need them for backwards compat in
the API.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Existing KillContainer handling uses HTTP status code 409 when the request cannot be performed because of the current container state. HTTP status code 404 is also used when the target container does not exist.
In contrast, errors from the stats handler are not reflected in the HTTP status code. The HTTP status code is always 200, and the errors are recorded only as generic errors in the server log.
To maintain compatibility with both streaming enabled and disabled, this change treats obtaining at least one complete unit of response content as the response contract. It then keeps the response content consistent with the HTTP status code.
Signed-off-by: Hiroaki KAWAI <hiroaki.kawai@gmail.com>
Since I use go 1.26 the go fix does not have all the rules built in,
there are newer ones in modernize so run the explicitly to fix more code
for go 1.26.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Docker API v1.44 now includes status properties
in Runtimes for the GET /info endpoint.
Read output of {oci_runtime_cmd} features command
lazily and expose the JSON
output as-is (with removed new lines and
whitespace) as the status field in GET
/info for v1.44+.
Add status to libpod GET /info in ociRuntime.features
and `podman info` (shared).
Add API tests for both endpoints.
Fixes: https://redhat.atlassian.net/browse/RUN-3319
Signed-off-by: Marek Simek <msimek@redhat.com>
RestartContainer was always setting options.Timeout with values
from query, without checking if the caller had specified them or if
they were simply zero values. Copy logic from StopContainer to check
for caller-specified values, leaving Timeout nil if not specified.
fixes: https://github.com/podman-container-tools/podman/issues/29276
Signed-off-by: Garry Lawrence <InvalidInterrupt@users.noreply.github.com>
Two commands can set a subject on a manifest list, podman manifest annotate --index --subject and podman manifest add --artifact-subject. Both work locally, but they do nothing at all when podman runs with --remote.
The value never leaves the client. Before sending the request the remote client copies everything into manifests.ModifyOptions and manifests.AddArtifactOptions, and neither struct had a field to hold the subject, so it was quietly thrown away. The server had a second problem of its own, ManifestModify rebuilds ManifestAddArtifactOptions by hand and left out the embedded ManifestAnnotateOptions, so --os, --arch and --annotation were being dropped there as well.
Add the missing field to both structs, fill it in from the tunnel ImageEngine, and let the handler pass the annotate options along. Also add two system tests that run both flags for real so the remote path stays covered.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
The `until` filter was missing from the documentation.
Document it for both GET /libpod/images/json and the
compat GET /images/json.
Add tests for the until filter exercising both endpoints.
Fixes: https://redhat.atlassian.net/browse/RUN-3316
Signed-off-by: Marek Simek <msimek@redhat.com>
When a container has --memory-reservation set without --memory-limit,
resources.Memory is non-nil but resources.Memory.Limit is nil. The
compat stats handler dereferences the nil Limit pointer, causing a
panic that returns a 500 to the client.
Fix: add resources.Memory.Limit != nil guard before the dereference.
Regression test added in test/apiv2/19-stats.at.
Fixes#29627
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
filepath.Walk makes an expensive os.Stat system call on every file. filepath.WalkDir uses os.ReadDir under the hood to bypass this overhead, making directory scanning much faster.
Fixes: #29562
Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>
The Docker-compat secret inspect endpoint was incorrectly honoring
the showsecret query parameter, which could expose plaintext secret
data to clients using the Docker-compatible API.
This restricts showsecret to libpod-only requests. Docker-compat
clients always receive redacted secret data, matching Docker's own
behavior.
Add APIv2 tests covering the showsecret behavior on both the
Docker-compat and libpod endpoints, confirming secret data is never
returned from the compat endpoint while libpod continues to honor
the flag.
Fixes: #29570
Signed-off-by: Davoud Azari <davidmotral@gmail.com>
The manifest push and create endpoints accept query parameters that
were never documented, so API users can't discover them.
Push was missing compressionFormat, compressionLevel, format and
removeSignatures. Create was missing annotation and annotations.
The wording matches the same parameters on the image push endpoint.
The deprecated v3 push and add endpoints are left alone.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
POST /containers/create now takes Options as part of HostConfig.Mounts.TmpfsOptions to set options for tmpfs mounts.
Signed-off-by: Ashley Cui <acui@redhat.com>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
