From 9872cbd75696f4dc44bbb419a6b6cbdcfaf5e9a1 Mon Sep 17 00:00:00 2001
From: Povilas Kanapickas <povilas@radix.lt>
Date: Wed, 4 Mar 2026 14:12:33 +0200
Subject: [PATCH] libpod: Validate that log tag requires journald driver

Currently validation that log tag requires journald driver is done in several
places and emits only warning. Making it an error and moving to
`(c *Container) validate()` is a more correct approach.

Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
---
 libpod/container_validate.go      |  4 ++++
 pkg/specgen/generate/container.go | 16 +++++-----------
 pkg/specgen/generate/kube/kube.go | 12 ++----------
 test/e2e/logs_test.go             |  6 ++++++
 4 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/libpod/container_validate.go b/libpod/container_validate.go
index fb53626e3b..c9e12d9b64 100644
--- a/libpod/container_validate.go
+++ b/libpod/container_validate.go
@@ -179,6 +179,10 @@ func (c *Container) validate() error {
 		return fmt.Errorf("default rootfs-based infra container is set for non-infra container")
 	}
 
+	if c.config.LogTag != "" && c.config.LogDriver != define.JournaldLogging {
+		return fmt.Errorf("log tags can only be used with the journald log driver but driver is %q: %w", c.config.LogDriver, define.ErrInvalidArg)
+	}
+
 	if len(c.config.ArtifactVolumes) > 0 {
 		artStore, err := c.runtime.ArtifactStore()
 		if err != nil {
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index bc6693648a..a12d59c2a2 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -20,7 +20,6 @@ import (
 	"github.com/containers/podman/v6/pkg/signal"
 	"github.com/containers/podman/v6/pkg/specgen"
 	"github.com/openshift/imagebuilder"
-	"github.com/sirupsen/logrus"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/image/v5/manifest"
@@ -332,16 +331,11 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		s.LogConfiguration.Driver = rtc.Containers.LogDriver
 	}
 	if len(rtc.Containers.LogTag) > 0 {
-		if s.LogConfiguration.Driver != define.JSONLogging {
-			if s.LogConfiguration.Options == nil {
-				s.LogConfiguration.Options = make(map[string]string)
-			}
-
-			if _, exists := s.LogConfiguration.Options["tag"]; !exists {
-				s.LogConfiguration.Options["tag"] = rtc.Containers.LogTag
-			}
-		} else {
-			logrus.Warnf("log_tag %q is not allowed with %q log_driver", rtc.Containers.LogTag, define.JSONLogging)
+		if s.LogConfiguration.Options == nil {
+			s.LogConfiguration.Options = make(map[string]string)
+		}
+		if _, exists := s.LogConfiguration.Options["tag"]; !exists {
+			s.LogConfiguration.Options["tag"] = rtc.Containers.LogTag
 		}
 	}
 
diff --git a/pkg/specgen/generate/kube/kube.go b/pkg/specgen/generate/kube/kube.go
index 822298e373..33330d78dc 100644
--- a/pkg/specgen/generate/kube/kube.go
+++ b/pkg/specgen/generate/kube/kube.go
@@ -31,7 +31,6 @@ import (
 	"github.com/docker/docker/pkg/meminfo"
 	"github.com/docker/go-units"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/sirupsen/logrus"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/libnetwork/types"
 	"go.podman.io/common/pkg/config"
@@ -265,17 +264,10 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			switch len(val) {
-			case 0:
+			if len(val) == 0 {
 				return nil, fmt.Errorf("invalid log option: %w", define.ErrInvalidArg)
-			default:
-				// tags for journald only
-				if s.LogConfiguration.Driver == "" || s.LogConfiguration.Driver == define.JournaldLogging {
-					s.LogConfiguration.Options[opt] = val
-				} else {
-					logrus.Warnf("Can only set tags with journald log driver but driver is %q", s.LogConfiguration.Driver)
-				}
 			}
+			s.LogConfiguration.Options[opt] = val
 		}
 	}
 
diff --git a/test/e2e/logs_test.go b/test/e2e/logs_test.go
index 1d2a7e01cc..ecf6a6edd9 100644
--- a/test/e2e/logs_test.go
+++ b/test/e2e/logs_test.go
@@ -638,6 +638,12 @@ var _ = Describe("Podman logs", func() {
 		Expect(logc.OutputToString()).To(Equal("podman"))
 	})
 
+	It("log tag with non-journald driver fails", func() {
+		logc := podmanTest.Podman([]string{"run", "--log-driver", "k8s-file", "--log-opt", "tag=mytag", ALPINE, "true"})
+		logc.WaitWithDefaultTimeout()
+		Expect(logc).To(ExitWithError(125, "log tags can only be used with the journald log driver"))
+	})
+
 	It("podman pod logs with container names", func() {
 		SkipIfRemote("Remote can only process one container at a time")
 		podName := "testPod"