This will cause /proc inside of the container to match the mount options
of the host.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1511
Approved by: baude
When image is not tagged, we should just set the imageName to the
image.ID.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1501
Approved by: mheon
When managing the containers with systemd, it takes a bit more than
250ms to have podman creating the pidfile.
Increasing the value to 1 second will avoid timeout issues when running
a lot of containers managed by systemd.
This patch was tested in a VM with 56 services (OpenStack) deployed by
TripleO and managed by systemd.
Fixes#1495
Signed-off-by: Emilien Macchi <emilien@redhat.com>
Closes: #1497
Approved by: rhatdan
Firstly, when adding the privileged catch-all resource device,
first remove the spec's default catch-all resource device.
Second, remove our default rootfs propogation config - Docker
does not set this by default, so I don't think we should either.
Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
Closes: #1491
Approved by: TomSweeneyRedHat
We seem to be having a few flakes on namespace sharing.
Adding this test to make sure sharing with the host is working correctly.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1485
Approved by: mheon
ALso cleanup files section or podman man page
Add description of policy.json
Sort alphabetically.
Add more info on oci hooks
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1487
Approved by: umohnani8
Buildah
Fixes to COPY and ADD to properly follow symbolic links is SRC is a symbolic link
Print out a digest message on successful push.
We should not drop the Bounding set when running as a non priv user in podman build
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1483
Approved by: rhatdan
Containers image has a fix docker tarfile: use the cached digest if existing
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #1482
Approved by: rhatdan
when using the varlink api, we should pass on the registries information
as is present in the cli info command.
Signed-off-by: baude <bbaude@redhat.com>
We were already writing these to our debug logs. But collecting them
and including them in the error message will make it easier for
callers who don't have debugging enabled to figure out what's going
wrong.
Using multierror gives us both pretty formatting (when we print this
for the user) and programmatic access (for any callers that need to
inspect the constituent errors). With this commit and a config like:
$ cat /etc/containers/registries.conf
[registries.search]
registries = ['registry.access.redhat.com', 'quay.io', 'docker.io']
pulling an unqualified missing image looks like:
$ podman pull does-not/exist
Trying to pull registry.access.redhat.com/does-not/exist:latest...Failed
Trying to pull quay.io/does-not/exist:latest...Failed
Trying to pull docker.io/does-not/exist:latest...Failed
error pulling image "does-not/exist": unable to pull does-not/exist: 3 errors occurred:
* Error determining manifest MIME type for docker://registry.access.redhat.com/does-not/exist:latest: Error reading manifest latest in registry.access.redhat.com/does-not/exist: unknown: Not Found
* Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: Error reading manifest latest in quay.io/does-not/exist: unauthorized: access to the requested resource is not authorized
* Error determining manifest MIME type for docker://does-not/exist:latest: Error reading manifest latest in docker.io/does-not/exist: errors:
denied: requested access to the resource is denied
unauthorized: authentication required
A qualified image looks like:
$ podman pull quay.io/does-not/exist
Trying to pull quay.io/does-not/exist...Failed
error pulling image "quay.io/does-not/exist": unable to pull quay.io/does-not/exist: unable to pull image: Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: Error reading manifest latest in quay.io/does-not/exist: unauthorized: access to the requested resource is not authorized
If one of the searched repositories was offline, you'd get a more
useful routing error for that specific registry. For example:
$ cat /etc/hosts
127.0.0.1 quay.io
$ podman pull does-not/exist
Trying to pull registry.access.redhat.com/does-not/exist:latest...Failed
Trying to pull quay.io/does-not/exist:latest...Failed
Trying to pull docker.io/does-not/exist:latest...Failed
error pulling image "does-not/exist": unable to pull does-not/exist: 3 errors occurred:
* Error determining manifest MIME type for docker://registry.access.redhat.com/does-not/exist:latest: Error reading manifest latest in registry.access.redhat.com/does-not/exist: unknown: Not Found
* Error determining manifest MIME type for docker://quay.io/does-not/exist:latest: pinging docker registry returned: Get https://quay.io/v2/: dial tcp 127.0.0.1:443: connect: connection refused
* Error determining manifest MIME type for docker://does-not/exist:latest: Error reading manifest latest in docker.io/does-not/exist: errors:
denied: requested access to the resource is denied
unauthorized: authentication required
This is our first direct dependency on multierror, but we've been
vendoring it for a while now because opencontainers/runtime-tools uses
it for config validation.
Signed-off-by: W. Trevor King <wking@tremily.us>
Closes: #1456
Approved by: rhatdan
do not error out when the storage is not initialized and the
entrypoint command is not available for the specified image. Check it
when we re-exec in an user namespace and can access the storage.
Closes: https://github.com/containers/libpod/issues/1452
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
And pull these from the PATH by default. This way systems like CentOS
that don't have a python3 can still execute 'make clean', which
doesn't care about the Python major version.
The setup.py shebang, mode change, and ./ prefixing helps address
cases where PYTHON is empty. This could be the result of improper
user configuration:
$ make PYTHON='' clean
It could also be the state on systems with no Python installed, in
which case you'll see:
$ make PYTHON='' clean
./setup.py clean --all
/usr/bin/env: 'python': No such file or directory
make: *** [Makefile:13: clean] Error 127
I've also shifted the Python invocations to the end of the clean
recipies so that as much as possible gets cleaned up even on systems
without Python installed.
Signed-off-by: W. Trevor King <wking@tremily.us>
This line landed in 8493dba2 (Initial varlink implementation,
2018-03-26, #627), but this Makefile has never consumed that variable.
Signed-off-by: W. Trevor King <wking@tremily.us>
The only Python dependency in contrib/python's clean is:
$(PYTHON) setup.py clean --all
and our setup.pys work on both major Python versions:
$ make -C contrib/python/podman PYTHON=python2 clean
make: Entering directory `/.../libpod/contrib/python/podman'
python2 setup.py clean --all
/usr/lib64/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'python_requires'
warnings.warn(msg)
running clean
'build/lib' does not exist -- can't clean it
'build/bdist.linux-x86_64' does not exist -- can't clean it
'build/scripts-2.7' does not exist -- can't clean it
rm -rf podman.egg-info dist
find . -depth -name __pycache__ -exec rm -rf {} \;
find . -depth -name \*.pyc -exec rm -f {} \;
make: Leaving directory `/.../libpod/contrib/python/podman'
$ echo $?
0
$ make -C contrib/python/pypodman PYTHON=python2 clean
make: Entering directory `/.../libpod/contrib/python/pypodman'
python2 setup.py clean --all
/usr/lib64/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'python_requires'
warnings.warn(msg)
running clean
removing 'build/lib' (and everything under it)
removing 'build/bdist.linux-x86_64' (and everything under it)
'build/scripts-2.7' does not exist -- can't clean it
removing 'build'
rm -rf pypodman.egg-info dist
find . -depth -name __pycache__ -exec rm -rf {} \;
find . -depth -name \*.pyc -exec rm -f {} \;
make: Leaving directory `/.../libpod/contrib/python/pypodman'
$ echo $?
0
This rolls back part of 390bd16d (tidy up the copr spec, 2018-05-20, #813).
I've also shifted the submake cleans to the end of the main clean
recipe. That way, if one of the submake cleans dies (e.g. because the
system lacks Python entirely), the temp-file removal will still
happen. The way I have it setup now, the podman clean dying will keep
any of the pypodman clean from happening. You could probably work
around that with something like:
$(MAKE) -C contrib/python/podman clean & \
$(MAKE) -C contrib/python/pypodman clean & \
wait
but that seems too fancy for such a corner case.
Signed-off-by: W. Trevor King <wking@tremily.us>
This matches Docker behavior more closely and should resolve an
issue we were seeing with /sys mounts
Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
Closes: #1465
Approved by: rhatdan
We've increased the default rlimits to allow Podman to hold many
ports open without hitting limits and crashing, but this doesn't
solve the amount of memory that holding open potentially
thousands of ports will use. Offer a switch to optionally disable
port reservation for performance- and memory-constrained use
cases.
Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
