opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-19 16:33:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

container creation: don't apply reserved annotations from image

Browse Source 
Do not apply reserved annotations from the image to the container.
Reserved annotations are applied during container creation to retrieve
certain information (e.g., custom seccomp profile or autoremoval)
once a container has been created.

Context: #12671
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
This commit is contained in:
Valentin Rothberg
2021-12-22 13:28:36 +01:00
parent cbcab43425
commit 1aa4e4d4d1
3 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libpod/define/annotations.go
View File

@ -66,3 +66,15 @@ const (
// annotation.
InspectResponseFalse = "FALSE"
)
// IsReservedAnnotation returns true if the specified value corresponds to an
// already reserved annotation that Podman sets during container creation.
func IsReservedAnnotation(value string) bool {
switch value {
case InspectAnnotationCIDFile, InspectAnnotationAutoremove, InspectAnnotationVolumesFrom, InspectAnnotationPrivileged, InspectAnnotationPublishAll, InspectAnnotationInit, InspectAnnotationLabel, InspectAnnotationSeccomp, InspectAnnotationApparmor, InspectResponseTrue, InspectResponseFalse:
return true
default:
return false
}
}

2
pkg/specgen/generate/container.go
View File

@ -156,9 +156,11 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
// Add annotations from the image
for k, v := range inspectData.Annotations {
if !define.IsReservedAnnotation(k) {
annotations[k] = v
}
}
}
// in the event this container is in a pod, and the pod has an infra container
// we will want to configure it as a type "container" instead defaulting to

12
test/e2e/build_test.go
View File

@ -238,19 +238,25 @@ var _ = Describe("Podman build", func() {
Expect("sha256:" + data[0].ID).To(Equal(string(id)))
})
It("podman Test PATH in built image", func() {
It("podman Test PATH and reserved annotation in built image", func() {
path := "/tmp:/bin:/usr/bin:/usr/sbin"
session := podmanTest.Podman([]string{
"build", "--pull-never", "-f", "build/basicalpine/Containerfile.path", "-t", "test-path",
"build", "--annotation", "io.podman.annotations.seccomp=foobar", "--pull-never", "-f", "build/basicalpine/Containerfile.path", "-t", "test-path",
})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
session = podmanTest.Podman([]string{"run", "test-path", "printenv", "PATH"})
session = podmanTest.Podman([]string{"run", "--name", "foobar", "test-path", "printenv", "PATH"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
stdoutLines := session.OutputToStringArray()
Expect(stdoutLines[0]).Should(Equal(path))
// Reserved annotation should not be applied from the image to the container.
session = podmanTest.Podman([]string{"inspect", "foobar"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).NotTo(ContainSubstring("io.podman.annotations.seccomp"))
})
It("podman build --http_proxy flag", func() {