erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-05 08:25:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
spiegel_podman/docs/source/markdown
History
Paul Holzinger 597ebeb60f
top: do not depend on ps(1) in container 
This ended up more complicated then expected. Lets start first with the
problem to show why I am doing this:

Currently we simply execute ps(1) in the container. This has some
drawbacks. First, obviously you need to have ps(1) in the container
image. That is no always the case especially in small images. Second,
even if you do it will often be only busybox's ps which supports far
less options.

Now we also have psgo which is used by default but that only supports a
small subset of ps(1) options. Implementing all options there is way to
much work.

Docker on the other hand executes ps(1) directly on the host and tries
to filter pids with `-q` an option which is not supported by busybox's
ps and conflicts with other ps(1) arguments. That means they fall back
to full ps(1) on the host and then filter based on the pid in the
output. This is kinda ugly and fails short because users can modify the
ps output and it may not even include the pid in the output which causes
an error.

So every solution has a different drawback, but what if we can combine
them somehow?! This commit tries exactly that.

We use ps(1) from the host and execute that in the container's pid
namespace.
There are some security concerns that must be addressed:
- mount the executable paths for ps and podman itself readonly to
  prevent the container from overwriting it via /proc/self/exe.
- set NO_NEW_PRIVS, SET_DUMPABLE and PDEATHSIG
- close all non std fds to prevent leaking files in that the caller had
  open
- unset all environment variables to not leak any into the contianer

Technically this could be a breaking change if somebody does not
have ps on the host and only in the container but I find that very
unlikely, we still have the exec in container fallback.

Because this can be insecure when the contianer has CAP_SYS_PTRACE we
still only use the podman exec version in that case.

This updates the docs accordingly, note that podman pod top never falls
back to executing ps in the container as this makes no sense with
multiple containers so I fixed the docs there as well.

Fixes #19001
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2215572

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-07-10 13:32:55 +02:00
..
links Install podman-systemd.unit man page, make quadlet discoverable 2023-02-03 08:42:20 -06:00
options auto update: fix usage of --authfile 2023-07-05 08:30:39 +02:00
.gitignore Add user mode networking feature to Windows 2023-04-24 17:11:54 -05:00
podman-attach.1.md.in Clean up more language for inclusiveness 2023-01-27 09:40:27 -05:00
podman-auto-update.1.md.in auto update: fix usage of --authfile 2023-07-05 08:30:39 +02:00
podman-build.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-commit.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-completion.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-container-checkpoint.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-container-cleanup.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-container-clone.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-container-diff.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-container-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-container-inspect.1.md.in Address review feedback and add manpage notes 2023-06-06 11:04:59 -04:00
podman-container-prune.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-container-restore.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-container-runlabel.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-container.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-cp.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-create.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-diff.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-events.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-exec.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-export.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-generate-spec.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-generate-systemd.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-generate.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-healthcheck-run.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-healthcheck.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-history.1.md man page --format xref: tighten the autocompletion check 2023-02-14 08:11:54 -07:00
podman-image-diff.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image-inspect.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image-mount.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image-prune.1.md Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-image-scp.1.md Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-image-sign.1.md.in Correct markdown in docs 2023-05-18 16:44:24 -07:00
podman-image-tree.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-image-trust.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image-unmount.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-image.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-images.1.md.in Man pages: fix broken tables 2023-05-26 06:08:14 -06:00
podman-import.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-info.1.md libpod: Podman info output more network information 2023-06-13 11:19:29 +09:00
podman-init.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-inspect.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kill.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kube-apply.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kube-down.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kube-generate.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kube-play.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-kube.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-load.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-login.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-logout.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-logs.1.md.in Man page checker: require canonical name in SEE ALSO 2023-01-03 10:24:55 -07:00
podman-machine-info.1.md Add format to podman machine info 2023-03-15 16:15:59 -04:00
podman-machine-init.1.md.in Use bytes size consistently instead of human size 2023-07-06 14:51:06 +02:00
podman-machine-inspect.1.md Document podman-machine-default behavior 2023-05-15 14:23:17 -04:00
podman-machine-list.1.md.in Add user mode networking feature to Windows 2023-04-24 17:11:54 -05:00
podman-machine-os-apply.1.md Document podman-machine-default behavior 2023-05-15 14:23:17 -04:00
podman-machine-os.1.md Introduce podman machine os apply 2023-02-15 14:48:12 -05:00
podman-machine-rm.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-machine-set.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-machine-ssh.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-machine-start.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-machine-stop.1.md Document podman-machine-default behavior 2023-05-15 14:23:17 -04:00
podman-machine.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-manifest-add.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-manifest-annotate.1.md.in Man pages: refactor common options: --annotation (manifest) 2022-10-12 08:54:04 -06:00
podman-manifest-create.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-manifest-exists.1.md source code comments and docs: fix typos, language, Markdown layout 2023-05-22 07:52:16 +02:00
podman-manifest-inspect.1.md.in Add --insecure,--tls-verify,--verbose flags to podman manifest inspect 2022-11-03 08:00:15 -04:00
podman-manifest-push.1.md.in cmd, push: expose --compression-level 2023-06-21 14:28:16 +02:00
podman-manifest-remove.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-manifest-rm.1.md Add links to all SEE ALSO sections 2021-11-10 09:29:21 -05:00
podman-manifest.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-mount.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-connect.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-create.1.md network create --ip-range allow for custom range 2023-06-16 17:57:17 +02:00
podman-network-disconnect.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-inspect.1.md Add ability to set static routes 2023-06-12 10:31:59 +02:00
podman-network-ls.1.md.in Add ability to set static routes 2023-06-12 10:31:59 +02:00
podman-network-prune.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-reload.1.md.in Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-network-rm.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-network-update.1.md network: add support for podman network update and --network-dns-server 2023-01-12 20:19:14 +05:30
podman-network.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-pause.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-pod-clone.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-pod-create.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-pod-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-pod-inspect.1.md.in Address review feedback and add manpage notes 2023-06-06 11:04:59 -04:00
podman-pod-kill.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-pod-logs.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-pod-pause.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-pod-prune.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-pod-ps.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-pod-restart.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-pod-rm.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-pod-start.1.md.in Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-pod-stats.1.md.in Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-pod-stop.1.md.in Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-pod-top.1.md.in top: do not depend on ps(1) in container 2023-07-10 13:32:55 +02:00
podman-pod-unpause.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-pod.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-port.1.md.in Remove 'you' from man pages 2022-12-07 09:29:29 -05:00
podman-ps.1.md filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-pull.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-push.1.md.in cmd, push: expose --compression-level 2023-06-21 14:28:16 +02:00
podman-remote.1.md [CI:DOCS] Fix service_destinations description in podman man page 2023-06-16 16:04:21 +09:00
podman-rename.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-restart.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-rm.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-rmi.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-run.1.md.in [CI:DOCS] Improve security in mysql examples 2023-05-17 19:44:05 +02:00
podman-save.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-search.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-secret-create.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-secret-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-secret-inspect.1.md Display secret to user in inpspect 2023-06-28 13:14:49 -04:00
podman-secret-ls.1.md.in Display secret to user in inpspect 2023-06-28 13:14:49 -04:00
podman-secret-rm.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-secret.1.md Add support for secret exists 2023-04-03 15:33:50 +03:00
podman-start.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-stats.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-stop.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-system-connection-add.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-system-connection-default.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-system-connection-list.1.md man page --format xref: tighten the autocompletion check 2023-02-14 08:11:54 -07:00
podman-system-connection-remove.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-system-connection-rename.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-system-connection.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-system-df.1.md Add format to podman system df 2023-03-15 16:15:59 -04:00
podman-system-migrate.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-system-prune.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-system-renumber.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-system-reset.1.md system reset: show graphRoot/runRoot before removal 2023-04-26 16:02:59 +02:00
podman-system-service.1.md [CI:DOCS] podman-system-service.1.md: document systemd usage 2023-07-08 18:17:02 +02:00
podman-system.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-systemd.unit.5.md Kube quadlets can support autoupdate as well as containers 2023-06-27 11:20:14 -04:00
podman-tag.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-top.1.md.in top: do not depend on ps(1) in container 2023-07-10 13:32:55 +02:00
podman-unmount.1.md.in Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-unpause.1.md.in filters: better handling of id= 2023-06-07 05:29:06 -06:00
podman-unshare.1.md [CI:DOCS] Add CNI deprecation notices to documentation 2023-01-19 08:09:32 -06:00
podman-untag.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-update.1.md.in man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-version.1.md [CI:DOCS] man pages: document some --format options 2022-09-15 09:59:32 -06:00
podman-volume-create.1.md source code comments and docs: fix typos, language, Markdown layout 2023-05-22 07:52:16 +02:00
podman-volume-exists.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-volume-export.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-volume-import.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-volume-inspect.1.md Address review feedback and add manpage notes 2023-06-06 11:04:59 -04:00
podman-volume-ls.1.md.in Address review feedback and add manpage notes 2023-06-06 11:04:59 -04:00
podman-volume-mount.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-volume-prune.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-volume-reload.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-volume-rm.1.md Remove future tense from man pages 2023-05-16 15:10:33 -04:00
podman-volume-unmount.1.md Fix manpage headers 2022-09-06 09:37:13 -07:00
podman-volume.1.md man pages and command help: clean up descriptions 2023-05-28 18:57:43 +02:00
podman-wait.1.md.in container wait: support health states 2023-06-23 14:16:32 +02:00
podman.1.md Merge pull request #18909 from sstosh/service_destination 2023-06-19 04:14:14 -04:00
podmansh.1.md Fix up podmansh man page 2023-06-27 12:05:24 -04:00