Commit Graph

3926 Commits

Author SHA1 Message Date
Chris Evich
c67d6a52c4 Fix using --network-backend on podman-remote
When this option was added to the e2e tests, there was no CI Automation
support for running remote tests w/ netavark.  When added, many
e2e test errors/failures are generated due to this option not being
valid for the remote client.  Fix this in the tests by conditionally
adding the option if the test is running the remote client.

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-04-21 14:29:44 -04:00
OpenShift Merge Robot
cb09c26c65 Merge pull request #13505 from rst0git/checkpoint-image-1
Add support for checkpoint image
2022-04-21 11:58:56 -04:00
Ed Santiago
97ee411465 system tests: add assert(), and start using it
Problem: the system test 'is()' checker was poorly thought out.
For example, there is no way to check for inequality or for
absence of a substring.

Solution, step 1: introduce new assert(), copied almost verbatim
from buildah, where it has been successful in addressing the
gaps in is().

The logical next step is to search the tests for 'die' and
for 'run', looking for negative assertions which we can
replace with assert(). There were a lot, and in the process
I found a number of ugly bugs in the tests themselves. I've
taken the liberty of fixing these.

Important note: at this time we have both assert() and is().
Replacing all instances of is() would be impossible to review.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-20 16:14:42 -06:00
Chris Evich
d865fcc5ec Fix e2e tests referencing generic env. var.
Use of `$DEBUG` is highly likely to clash.  Fortunately this one is in
a very specific/special context, so a rename fix should be perfectly
adequate.

See also https://github.com/containers/automation/pull/96
and https://github.com/containers/podman/issues/13932

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-04-20 14:02:08 -04:00
Radostin Stoyanov
bbe1063a5a Add checkpoint image tests
The patch introduces the following test cases:

1. An attempt to checkpoint a container that does not exist should fail.
2. Checkpoint of a running container with --create-image should create a
   checkpoint image.
3. A single checkpoint image can be used to restore multiple containers,
   each with a different name.
4. Restoring multiple containers from checkpoint images with a single
   restore command.

Signed-off-by: Radostin Stoyanov <radostin@redhat.com>
2022-04-20 18:55:43 +01:00
OpenShift Merge Robot
3571a7e2eb Merge pull request #13835 from vrothberg/run-1436
benchmarking Podman: proof of concept
2022-04-20 08:41:54 -04:00
Aditya R
519535daa0 healthcheck: set default healthcheck Interval if not specified in image
Set appropriate defaults for `--interval` when
processing a Containerfile with build format as docker.

Signed-off-by: Aditya R <arajan@redhat.com>
2022-04-20 16:12:45 +05:30
Valentin Rothberg
0162f678c0 benchmarking Podman: proof of concept
Add a proof of concept for benchmarking Podman.  The benchmarks are
implemented by means of the end-to-end test suite but hidden behind
a `benchmarks` build tag.  Running `make localbenchmarks` will run
`test/e2e` with the specific build tag and set ginkgo's "focus" to
the specific "Podman Benchmark Suite" to only run this spec and skip
all others.

ginkgo will print a report before terminating listing the CPU and memory
stats for each benchmark.  New benchmarks can easily be added via the
`newBenchmark` function that also supports adding an `init()` function
to each benchmark which allows for performing certain setups for the
specific benchmark.  For instance, benchmarking `podman start` requires
creating a container beforehand.

Podman may be called more than once in the main function of a benchmark
but note that the displayed memory consumption is then a sum of all
Podman invocations.  The memory consumption is collected via
`/usr/bin/time`.

A benchmark's report is split into CPU and memory as displayed below:

```
[CPU] podman images:
  Fastest Time: 0.146s
  Slowest Time: 0.187s
  Average Time: 0.180s ± 0.015s
[MEM] podman images:
  Smallest: 41892.0KB
   Largest: 42792.0KB
   Average: 42380.7KB ± 286.4KB
```

Note that the benchmarks are not wired into the CI yet.  They are meant
as a proof of concept.  More benchmarks and the plumbing into CI will
happen in a later change.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-20 11:31:28 +02:00
cdoern
be0da4a222 Translate Memory Limit to Swap in API
in specgen, CLI path uses the given memory limit to define the swap value (if not already specified)
add a route to this piece of code from within the api handlers

resolves #13145

Signed-off-by: cdoern <cdoern@redhat.com>
2022-04-18 15:38:24 -04:00
OpenShift Merge Robot
8d3075e332 Merge pull request #13583 from rhatdan/ipc
Add support for ipc namespace modes "none, private, sharable"
2022-04-16 12:30:01 -04:00
OpenShift Merge Robot
92625eadc6 Merge pull request #13641 from nicrowe00/logfile
Add log rotation based on log size
2022-04-15 06:02:02 -04:00
OpenShift Merge Robot
f2ab79cc02 Merge pull request #13868 from cdoern/cloneSwap
Fix Memory Swappiness passing in Container Clone
2022-04-15 05:54:05 -04:00
OpenShift Merge Robot
6076e1a9a5 Merge pull request #13616 from giuseppe/passwd-entry
run, create: add --passwd-entry
2022-04-14 15:35:20 -04:00
cdoern
f38b03d375 Fix Memory Swappiness passing in Container Clone
`DefineCreateFlags` was excluding clone from using the memory-swappiness flag leading the value to be zero
when our deafult is -1. Rearrange the if/else to give clone these memory related options

resolves #13856

Signed-off-by: cdoern <cdoern@redhat.com>
2022-04-14 10:40:29 -04:00
Valentin Rothberg
2a75164e23 add a regression test for CVE-2022-1227
Will also be included in the upcoming backports.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 14:42:12 +02:00
OpenShift Merge Robot
90293da292 Merge pull request #13866 from edsantiago/bats
System tests: Usage checks: better error messages
2022-04-14 07:28:51 -04:00
OpenShift Merge Robot
5771f82260 Merge pull request #13857 from rhatdan/logs
Fix --tail log on restart problem
2022-04-14 07:22:52 -04:00
OpenShift Merge Robot
001f619eab Merge pull request #13872 from vrothberg/revert-size
Revert "images --size"
2022-04-14 07:18:52 -04:00
Giuseppe Scrivano
3f2939c2ef run, create: add --passwd-entry
It allows to customize the entry that is written to the `/etc/passwd`
file when --passwd is used.

Closes: https://github.com/containers/podman/issues/13185

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-04-14 11:22:13 +02:00
Valentin Rothberg
97f93dc78e Revert "images --size"
This reverts commit e133a06d2f.

@nalind found a proper fix in c/storage [1] to address the performance
issue.  So we really don't need the flag anymore.  Note the flag has
never made it into any release.

[1] d76b3606fc

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 10:58:36 +02:00
Niall Crowe
3da3afa576 Add log rotation based on log size
Add new functions to logfile.go for rotating and truncating
the events log file once the log file and its contents
exceed the maximum size limit while keeping 50% of the
log file's content

Also add tests to verify log rotation and truncation

Signed-off-by: Niall Crowe <nicrowe@redhat.com>
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-14 09:35:29 +01:00
Ed Santiago
9ef745d541 System tests: Usage checks: better error messages
Current error messages are really awful, and cause great
suffering every time someone adds a new subcommand. Let's
see if these are better.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-13 14:09:24 -06:00
Daniel J Walsh
63c38b99f4 Fix --tail log on restart problem
--tail=1 is not working f you restart a container with journald logging.

We see the exit status and then call into the logging a second time
causing all of the logs to print.

Removing the tail log on exited seems to fix the problem.

Fixes: https://github.com/containers/podman/issues/13098

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-04-13 14:07:15 -04:00
Paul Holzinger
970c8d4724 compat api: use network mode bridge as default
For better docker compatibility we should use the bridge network mode as
default for rootless. This was already done previously but commit
535818414c introduced this regression in v4.0.

Since the apiv2 test are only run rootful we cannot catch this problem
in CI.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-04-13 15:43:47 +02:00
OpenShift Merge Robot
d16e3144e9 Merge pull request #13846 from edsantiago/bats
System tests: fix oops in start --filter tests
2022-04-12 15:37:42 -04:00
Daniel J Walsh
3987c529f4 Add support for ipc namespace modes "none, private, sharable"
Fixes: #13265

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-04-12 13:35:51 -04:00
OpenShift Merge Robot
a82ec1be45 Merge pull request #13787 from Luap99/nohost-api
API: use no_hosts from containers.conf
2022-04-12 13:35:00 -04:00
Ed Santiago
2c800a717c System tests: fix oops in start --filter tests
Bad code got committed by accident: test description on run_podman
line, not test line.

Did not seem to affect tests, but fix it anyway.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-12 11:24:33 -06:00
OpenShift Merge Robot
87d129e805 Merge pull request #13788 from flouthoc/support-volume-opts
run, mount: allow setting driver specific option using `volume-opt=`
2022-04-12 13:17:02 -04:00
Aditya R
81a95fade5 run, mount: allow setting driver specific option using volume-opt
`--mount` should allow setting driver specific options using
`volume-opt` when `type=volume` is set.

This ensures parity with docker's `volume-opt`.

Signed-off-by: Aditya R <arajan@redhat.com>
2022-04-12 12:30:09 +05:30
Paul Holzinger
d8a902a167 API: use no_hosts from containers.conf
The API endpoints should properly honour the `no_hosts=true` setting in
containers.conf.

Fixes #13719

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-04-11 18:41:19 +02:00
OpenShift Merge Robot
4a53689c56 Merge pull request #13822 from edsantiago/buildah_3544_fixed
System tests: reenable ps --external test
2022-04-11 10:37:54 -04:00
Ed Santiago
615099ddb9 System tests: reenable ps --external test
Buildah issue 3544 has been fixed and vendored into podman.
We can reenable a long-skipped test.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-04-11 05:39:39 -06:00
Paul Holzinger
784a13f577 network create: add support for ipam-driver none
Add a new flag to set the ipam-driver. Also adds a new ipam driver none
mode which only creates interfaces but does not assign addresses.

Fixes #13521

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-04-11 11:09:15 +02:00
OpenShift Merge Robot
343778f61a Merge pull request #13811 from flouthoc/container_inspect_entrypoint
container,inspect: convert `Entrypoint` to an array instead of a string
2022-04-08 12:40:23 -04:00
OpenShift Merge Robot
cdbc33112e Merge pull request #13687 from rhatdan/VENDOR
Vendor in new opencontainers/selinux
2022-04-08 10:42:44 -04:00
Aditya R
0cebd158b6 container,inspect: convert Entrypoint to array instead of a string
Convert container entrypoint from string to an array inorder to make
sure there is parity between `podman inspect` and `docker inspect`

Signed-off-by: Aditya R <arajan@redhat.com>
2022-04-08 18:43:37 +05:30
Daniel J Walsh
dc17195bd9 Vendor in new opencontainers/selinux
Also update vendor of containers/common,buildah,storage,image

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2069586

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-04-08 09:02:52 -04:00
Valentin Rothberg
e133a06d2f images --size
Add a --size option to podman images to allow for disabling computing
the size of listed images.  If listing images is critical to
performance, user may chose to turn off size computation to speed things
up.

Context: #13755
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2022-04-08 10:09:38 +02:00
OpenShift Merge Robot
839744af56 Merge pull request #13696 from Luap99/apiv2-netavark
test/apiv2: support netavark
2022-04-04 14:07:28 -04:00
OpenShift Merge Robot
330205ebed Merge pull request #13490 from gcalin/13266
pod logs enhancements: option to color logs
2022-04-04 13:43:27 -04:00
OpenShift Merge Robot
4f31ade2b2 Merge pull request #13765 from giuseppe/do-not-set-oom-score-adj
specgen: do not set OOMScoreAdj by default
2022-04-04 13:19:35 -04:00
Giuseppe Scrivano
164b64ea3b specgen: do not set OOMScoreAdj by default
do not force a value of OOMScoreAdj=0 if it is wasn't specified by the
user.

Closes: https://github.com/containers/podman/issues/13731

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-04-04 15:40:12 +02:00
Andrew Aylett
bf4318e606 Allow creating anonymous volumes with --mount
This fixes #13756.

All the mechanics to create anonymous volumes is already present, but
there's still a validation preventing that path from being taken.  We
remove the validation, which allows the volume to be created
successfully.

Signed-off-by: Andrew Aylett <andrew@aylett.co.uk>
2022-04-02 21:10:40 +01:00
OpenShift Merge Robot
d4394ea368 Merge pull request #13665 from jwhonce/issues/13535
Add build test for .containerignore tar file
2022-04-01 11:59:46 -04:00
OpenShift Merge Robot
23e57575b0 Merge pull request #13594 from cdoern/podVolumes
fix pod volume passing and alter infra inheritance
2022-04-01 09:51:23 -04:00
Giuseppe Scrivano
1cd529b22d specgen: permit --privileged and --cap-add
--cap-add is useful when running a privileged container with UID != 0,
so that individual capabilities can be added to the container process.

Closes: https://github.com/containers/podman/issues/13449

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2022-04-01 10:15:17 +02:00
Jhon Honce
f8c2df87cb Add build test for .containerignore tar file
Ensure a directory added to .containerignore on client is not included
in tar sent to remote podman API service

* Clean up podman invocations to not include duplicate --remote and
  --url flags
* Use pkill vs. pgrep when cleaning up podman API service in tests
* Add exit code when logging error when testing

Closes #13535

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2022-03-31 08:48:54 -07:00
Paul Holzinger
e5745139a7 cli commands: better error for unsupported commands
When you run podman-remote unsahre for example you currently get:
Error: unrecognized command `podman-remote unshare`

This is because we do not add the command to the cobra tree when we run
in remote mode. However this is a bad user experience since it is not
clear that the command is only supported for local podman. Users are
left wondering why this does not work and could think the documentation
is wrong.

To fix it we add a clear error message:
Error: cannot use command "podman-remote unshare" with the remote podman client

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-03-31 16:20:18 +02:00
Aditya R
daeea48df5 kube: configmap volume should be reused if already exists
`podman play kube` creates a new volume for configmap, if same configmap
is applied again volume can be re-used, there is no need to remove and
re-create the volume again

Signed-off-by: Aditya R <arajan@redhat.com>
2022-03-31 15:07:22 +05:30