28 Commits

Author SHA1 Message Date
419efb9eb5 util: specify a not empty pause dir for root too
commit b3014c1c69d5870104aa45f7caae7af041094171 changed
GetRootlessRuntimeDir() to return an empty string for root, so that
its value is not exported as XDG_RUNTIME_DIR, and other programs like
crun can use a better default.

Now GetRootlessPauseProcessPidPath() uses homedir.GetRuntimeDir().
The homedir.GetRuntimeDir() function returns a value also when running
as root so it can be used inside a nested Podman.

Closes: https://github.com/containers/podman/issues/22327

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2024-05-06 12:14:00 +02:00
4740367330 util: use private propagation with bind
when the "bind" option is used, do not use the "rprivate" propagation
as it would inhibit the effect of "bind", instead default to "private".

Closes: https://github.com/containers/podman/issues/22107

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2024-03-21 11:33:58 +01:00
9a13b8f17d util: add some tests for ProcessOptions
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2024-03-21 11:33:57 +01:00
816c7279e1 utils: do not generate duplicate range
do not generate a duplicated range when --userns=keep-id:uid=0 or
--userns=keep-id:gid=0 are used.

Closes: https://github.com/containers/podman/issues/22078

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2024-03-18 22:31:51 +01:00
0e38815387 utils: add test for the new function
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2024-03-18 22:13:03 +01:00
5b28a2b4a0 Fix podman stop -t -1 CID
Currently if a user specifies a negative time to stop a container the
code ends up specifying the negative time to time.Duration which treats
it as 0. By settine the default to max.Unint32 we end up with a positive
number which indicates > 68 years which is probably close enough to
infinity for our use case.

Fixes: https://github.com/containers/podman/issues/21811

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2024-02-26 16:15:10 -05:00
9fb57d346f Cease using deprecated runc userlookup
Instead switch to github.com/moby/sys/user, which we already had
as an indirect dependency.

Signed-off-by: Matt Heon <mheon@redhat.com>
2024-02-02 11:02:43 -05:00
8b6d2a6d93 Merge pull request #21172 from cgwalters/machine-use-datadir
machine: use GlobalDataDir helper
2024-01-05 17:52:15 +00:00
0a316fa7d4 Merge pull request #21171 from alexandear/refactor-slices-contains
Refactor: replace StringInSlice with slices.Contains
2024-01-05 17:49:26 +00:00
06064150ea machine: use GlobalDataDir helper
We shouldn't hardcode `~/.local` - we should use the internal
config helper APIs which honor the XDG_DATA_DIR etc. standard
environment variables.

Signed-off-by: Colin Walters <walters@verbum.org>
2024-01-05 10:29:36 -05:00
8bdf77aa20 Refactor: replace StringInSlice with slices.Contains
Signed-off-by: Oleksandr Redko <Oleksandr_Redko@epam.com>
2024-01-05 16:25:56 +02:00
b01a330d37 Use single persistent ssh key for all machines
Changes SSH key behavior such that there is a single persisted key for all
machines across all providers. If there is no key that is located at
`.local/share/containers/podman/machine/` then it is created. The keys are
not deleted when the last machine on the host is removed.

The main motivation for this change is it leads to fewer files created on the
host as a result of vm configuration. Having `n` machines on your system doesn't
result in `2n` machine-related files in `.ssh` on your system anymore.

As a result of ssh keys being persisted by default, the `--save-keys` flag
on `podman machine rm` will no longer be supported.

Signed-off-by: Jake Correnti <jakecorrenti+github@proton.me>
2024-01-04 23:47:49 -05:00
d5cf46e807 support lookup of intermediate IDs in gidmapping/uidmapping options in userns=auto
Closes #20699

Signed-off-by: kaivol <github@kavol.de>
2023-11-29 19:03:27 +01:00
91b8bc7f13 uid/gid mapping flags
Motivation
===========

This feature aims to make --uidmap and --gidmap easier to use, especially in rootless podman setups.

(I will focus here on the --gidmap option, although the same applies for --uidmap.)

In rootless podman, the user namespace mapping happens in two steps, through an intermediate mapping.

See https://docs.podman.io/en/latest/markdown/podman-run.1.html#uidmap-container-uid-from-uid-amount
for further detail, here is a summary:

First the user GID is mapped to 0 (root), and all subordinate GIDs (defined at /etc/subgid, and
usually >100000) are mapped starting at 1.

One way to customize the mapping is through the `--gidmap` option, that maps that intermediate mapping
to the final mapping that will be seen by the container.

As an example, let's say we have as main GID the group 1000, and we also belong to the additional GID 2000,
that we want to make accessible inside the container.

We first ask the sysadmin to subordinate the group to us, by adding "$user:2000:1" to /etc/subgid.

Then we need to use --gidmap to specify that we want to map GID 2000 into some GID inside the container.

And here is the first trouble:

Since the --gidmap option operates on the intermediate mapping, we first need to figure out where has
podman placed our GID 2000 in that intermediate mapping using:

    podman unshare cat /proc/self/gid_map

Then, we may see that GID 2000 was mapped to intermediate GID 5. So our --gidmap option should include:

    --gidmap 20000:5:1

This intermediate mapping may change in the future if further groups are subordinated to us (or we stop
having its subordination), so we are forced to verify the mapping with
`podman unshare cat /proc/self/gid_map` every time, and parse it if we want to script it.

**The first usability improvement** we agreed on #18333 is to be able to use:

    --gidmap 20000:@2000:1

so podman does this lookup in the parent user namespace for us.

But this is only part of the problem. We must specify a **full** gidmap and not only what we want:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

This is becoming complicated. We had to break the gidmap at 5, because the intermediate 5 had to
be mapped to another value (20000), and then we had to keep mapping all other subordinate ids... up to
close to the maximum number of subordinate ids that we have (or some reasonable value). This is hard
to explain to someone who does not understand how the mappings work internally.

To simplify this, **the second usability improvement** is to be able to use:

   --gidmap "+20000:@2000:1"

where the plus flag (`+`) states that the given mapping should extend any previous/default mapping,
overriding any previous conflicting assignment.

Podman will set that mapping and fill the rest of mapped gids with all other subordinated gids, leading
to the same (or an equivalent) full gidmap that we were specifying before.

One final usability improvement related to this is the following:

By default, when podman  gets a --gidmap argument but not a --uidmap argument, it copies the mapping.
This is convenient in many scenarios, since usually subordinated uids and gids are assigned in chunks
simultaneously, and the subordinated IDs in /etc/subuid and /etc/subgid for a given user match.

For scenarios with additional subordinated GIDs, this map copying is annoying, since it forces the user
to provide a --uidmap, to prevent the copy from being made. This means, that when the user wants:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

The user has to include a uidmap as well:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1 --uidmap 0:0:65000

making everything even harder to understand without proper context.

For this reason, besides the "+" flag, we introduce the "u" and "g" flags. Those flags applied to a
mapping tell podman that the mapping should only apply to users or groups, and ignored otherwise.

Therefore we can use:

   --gidmap "+g20000:@2000:1"

So the mapping only applies to groups and is ignored for uidmaps. If no "u" nor "g" flag is assigned
podman assumes the mapping applies to both users and groups as before, so we preserve backwards compatibility.

Co-authored-by: Tom Sweeney <tsweeney@redhat.com>
Signed-off-by: Sergio Oller <sergioller@gmail.com>
2023-08-28 20:21:04 +02:00
c7a8d29f12 refactor: improve get ssh path duplicate code
Signed-off-by: Black-Hole1 <bh@bugs.cc>
2023-06-07 09:03:35 +08:00
cbb45a6d42 utils: new conversion method
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-02-01 09:26:50 +01:00
79865c2903 commit: use libimage code to parse changes
This code is duplicated in podman and c/common, we should only use one
version.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-01-16 16:28:11 +01:00
54e0afffe7 Merge pull request #11218 from cdoern/untilBug
logFile until flag issue, negative duration replaced with positive
2021-08-26 10:12:09 -04:00
d06d285e66 logFile until flag issue
we were adding a negative duration in podman events, causing inputs like
-5s to be correct and 5s to be incorrect.

fixes #11158

Signed-off-by: cdoern <cdoern@redhat.com>
2021-08-23 12:51:56 -04:00
d997564342 Add space trimming check in ValidateSysctls
This is to catch invalid sysctl configs with extra spacing.

See
https://github.com/containers/common/issues/723#issuecomment-897395506

Signed-off-by: xatier <xatierlike@gmail.com>
2021-08-13 15:24:06 -05:00
8cbbbe6efe Fix TS parsing for fractional values
Parse Unix timestamps that contains fractional part.

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-08-04 21:30:47 +02:00
0357964906 Centralize cores and period/quota conversion code
Signed-off-by: Jordan Christiansen <xordspar0@gmail.com>
2020-10-31 10:07:11 -05:00
4352d58549 Add support for containers.conf
vendor in c/common config pkg for containers.conf

Signed-off-by: Qi Wang qiwan@redhat.com
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-03-27 14:36:03 -04:00
e625b57d22 Only run TestGetImageConfigStopSignal on Linux
... because the implementation requires Linux-only pkg/signal

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2020-03-21 00:21:59 +01:00
60bfa305a8 Add ONBUILD support to --change
Return types had to change a bit for this, but since we can wrap
the old v1.ImageConfig, changes are overall not particularly bad.

At present, I believe this only works with commit, not import.
This matches how things were before we changed to the new parsing
so I think this is fine.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-12-05 15:11:40 -05:00
001d06d7f6 Completely rework --change parsing
The way we were trying to parse was very broken. I originally
attempted to use Buildah's Dockerfile parser here, but dealing
with it (and convincing it to accept only a limited subset, and
only one instruction at a time) was challenging, so I rewrote a
subset of Dockerfile parsing. This should handle most common
cases well, though there are definitely unhandled edge cases for
ENV and LABEL.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-12-04 18:55:30 -05:00
21363a6442 syntax updated for podman import --change
currently, podman import change do not support syntax like
- KEY val
- KEY ["val"]
This adds support for both of these syntax along with KEY=val

Signed-off-by: Kunal Kushwaha <kunal.kushwaha@gmail.com>
2019-09-27 17:17:12 +09:00
b85b217f55 Stage3 Image Library
This represents the stage3 implementation for the image library.  At this point, we
are moving the image-centric functions to pkg/image including migration of args and
object-oriented references.  This is a not a one-for-one migration of funcs and some
funcs will need to continue to reside in runtime_img as they are overly specific to
libpod and probably not useful to others.

Signed-off-by: baude <bbaude@redhat.com>

Closes: #484
Approved by: baude
2018-03-14 20:21:31 +00:00