159 Commits

Author SHA1 Message Date
e0614367ca pkg/spec.InitFSMounts: optimize
Instead of getting mount options from /proc/self/mountinfo, which is
very costly to read/parse (and can even be unreliable), let's use
statfs(2) to figure out the flags we need.

[v2: move getting default options to pkg/util, make it linux-specific]

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-04-02 07:52:34 -07:00
4352d58549 Add support for containers.conf
vendor in c/common config pkg for containers.conf

Signed-off-by: Qi Wang qiwan@redhat.com
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-03-27 14:36:03 -04:00
e42cbdd1b2 Add bindings for Container Exec Create + Inspect
Also adds some basic tests for these two. More tests are needed
but will have to wait for state to be finished.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-03-26 13:33:33 -04:00
f4e873c4e1 auto updates
Add support to auto-update containers running in systemd units as
generated with `podman generate systemd --new`.

`podman auto-update` looks up containers with a specified
"io.containers.autoupdate" label (i.e., the auto-update policy).

If the label is present and set to "image", Podman reaches out to the
corresponding registry to check if the image has been updated.  We
consider an image to be updated if the digest in the local storage is
different than the one of the remote image.  If an image must be
updated, Podman pulls it down and restarts the container.  Note that the
restarting sequence relies on systemd.

At container-creation time, Podman looks up the "PODMAN_SYSTEMD_UNIT"
environment variables and stores it verbatim in the container's label.
This variable is now set by all systemd units generated by
`podman-generate-systemd` and is set to `%n` (i.e., the name of systemd
unit starting the container).  This data is then being used in the
auto-update sequence to instruct systemd (via DBUS) to restart the unit
and hence to restart the container.

Note that this implementation of auto-updates relies on systemd and
requires a fully-qualified image reference to be used to create the
container.  This enforcement is necessary to know which image to
actually check and pull.  If we used an image ID, we would not know
which image to check/pull anymore.

Fixes: #3575
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-03-17 17:18:56 +01:00
e45456223c Add validate() for containers
Until now, we've been validating every part of container
configuration through the With... functions that set the options.
This if fine when we are just validating the options to an
individual function, but things get complicated once we need to
validate conflicts between different options. We don't know the
order in which things were passed, so we need the validation on
both of the potential options that can conflict, resulting in
significant code duplication. To solve this, add a validate()
function for containers, and use this to check whether everything
is in a good state.

We can probably move more into this function (there are other
parts of container creation that also do validation of a sort)
but this is a good start to simplifying our options.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-03-02 10:58:11 -05:00
e3a549b7b1 Remove ImageVolumes from database
Before Libpod supported named volumes, we approximated image
volumes by bind-mounting in per-container temporary directories.
This was handled by Libpod, and had a corresponding database
entry to enable/disable it.

However, when we enabled named volumes, we completely rewrote the
old implementation; none of the old bind mount implementation
still exists, save one flag in the database. With nothing
remaining to use it, it has no further purpose.

Signed-off-by: Matthew Heon <mheon@redhat.com>
2020-02-21 09:37:30 -05:00
97323808ed Add network options to podman pod create
Enables most of the network-related functionality from
`podman run` in `podman pod create`. Custom CNI networks can be
specified, host networking is supported, DNS options can be
configured.

Also enables host networking in `podman play kube`.

Fixes #2808
Fixes #3837
Fixes #4432
Fixes #4718
Fixes #4770

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-02-19 11:29:30 -05:00
666d8cf1de Add ability for pods to use the host network
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-02-17 16:21:07 -05:00
07a8ab09e0 Add backend code for pod network options
This adds network-related options to the pod in the database. We
are going to add the CLI frontend in further patches.

In short, this should greatly improve the ability of pods to
configure networking, once the CLI parsing is added.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-02-04 10:07:14 -05:00
5d93c731af Deprecate & remove IsCtrSpecific in favor of IsAnon
In Podman 1.6.3, we added support for anonymous volumes - fixing
our old, broken support for named volumes that were created with
containers. Unfortunately, this reused the database field we used
for the old implementation, and toggled volume removal on for
`podman run --rm` - so now, we were removing *named* volumes
created with older versions of Podman.

We can't modify these old volumes in the DB, so the next-safest
thing to do is swap to a new field to indicate volumes should be
removed. Problem: Volumes created with 1.6.3 and up until this
lands, even anonymous volumes, will not be removed. However, this
is safer than removing too many volumes, as we were doing before.

Fixes #5009

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-01-29 14:04:51 -05:00
ba0a6f34e3 podman: add new option --cgroups=no-conmon
it allows to disable cgroups creation only for the conmon process.

A new cgroup is created for the container payload.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-01-16 18:56:51 +01:00
67165b7675 make lint: enable gocritic
`gocritic` is a powerful linter that helps in preventing certain kinds
of errors as well as enforcing a coding style.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-13 14:27:02 +01:00
71341a1948 log: support --log-opt tag=
support a custom tag to add to each log for the container.

It is currently supported only by the journald backend.

Closes: https://github.com/containers/libpod/issues/3653

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-01-10 10:35:19 +01:00
0b53ff2902 fix lint - drop else block
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-08 15:44:21 +01:00
baba52c6b5 fix lint: add comment for NameRegex and error
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-08 13:55:14 +01:00
437bc61f4e container config: add CreateCommand
Store the full command plus arguments of the process the container has
been created with.  Expose this data as a `Config.CreateCommand` field
in the container-inspect data as well.

This information can be useful for debugging, as we can find out which
command has created the container, and, if being created via the Podman
CLI, we know exactly with which flags the container has been created
with.

The immediate motivation for this change is to use this information for
`podman-generate-systemd` to generate systemd-service files that allow
for creating new containers (in contrast to only starting existing
ones).

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-12-13 14:39:45 +01:00
e4275b3453 Merge pull request #4493 from mheon/add_removing_state
Add ContainerStateRemoving
2019-12-02 16:31:11 +01:00
01ae532a89 Allow --ip and --mac to be set when joining a CNI net
These only conflict when joining more than one network. We can
still set a single CNI network and set a static IP and/or static
MAC.

Fixes #4500

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-11-26 09:56:14 -05:00
25cc43c376 Add ContainerStateRemoving
When Libpod removes a container, there is the possibility that
removal will not fully succeed. The most notable problems are
storage issues, where the container cannot be removed from
c/storage.

When this occurs, we were faced with a choice. We can keep the
container in the state, appearing in `podman ps` and available for
other API operations, but likely unable to do any of them as it's
been partially removed. Or we can remove it very early and clean
up after it's already gone. We have, until now, used the second
approach.

The problem that arises is intermittent problems removing
storage. We end up removing a container, failing to remove its
storage, and ending up with a container permanently stuck in
c/storage that we can't remove with the normal Podman CLI, can't
use the name of, and generally can't interact with. A notable
cause is when Podman is hit by a SIGKILL midway through removal,
which can consistently cause `podman rm` to fail to remove
storage.

We now add a new state for containers that are in the process of
being removed, ContainerStateRemoving. We set this at the
beginning of the removal process. It notifies Podman that the
container cannot be used anymore, but preserves it in the DB
until it is fully removed. This will allow Remove to be run on
these containers again, which should successfully remove storage
if it fails.

Fixes #3906

Signed-off-by: Matthew Heon <mheon@redhat.com>
2019-11-19 15:38:03 -05:00
8d928d525f codespell: spelling corrections
Signed-off-by: Dmitry Smirnov <onlyjob@member.fsf.org>
2019-11-13 08:15:00 +11:00
2497b6c77b podman: add support for specifying MAC
I basically copied and adapted the statements for setting IP.

Closes #1136

Signed-off-by: Jakub Filak <jakub.filak@sap.com>
2019-11-06 16:22:19 +01:00
11c282ab02 add libpod/config
Refactor the `RuntimeConfig` along with related code from libpod into
libpod/config.  Note that this is a first step of consolidating code
into more coherent packages to make the code more maintainable and less
prone to regressions on the long runs.

Some libpod definitions were moved to `libpod/define` to resolve
circular dependencies.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-10-31 17:42:37 +01:00
a4a70b4506 bump containers/image to v5.0.0, buildah to v1.11.4
Move to containers/image v5 and containers/buildah to v1.11.4.

Replace an equality check with a type assertion when checking for a
docker.ErrUnauthorizedForCredentials in `podman login`.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2019-10-29 13:35:18 -04:00
77c7a28a72 Merge pull request #4333 from giuseppe/error-rootless-cni
rootless: raise an error with --network=
2019-10-24 21:29:53 +02:00
8f75b3e8c9 rootless: raise an error with --network=
Closes: https://github.com/containers/libpod/issues/4332

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-24 20:14:24 +02:00
f60a814e4d Add parsing for UID, GID in volume "o" option
Everything else is a flag to mount, but "uid" and "gid" are not.
We need to parse them out of "o" and handle them separately.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-10-22 14:32:54 -04:00
feba94eb95 Migrate can move containers to a new runtime
This is a horrible hack to work around issues with Fedora 31, but
other distros might need it to, so we'll move it upstream.

I do not recommend this functionality for general use, and the
manpages and other documentation will reflect this. But for some
upgrade cases, it will be the only thing that allows for a
working system.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-10-10 10:25:06 -04:00
d3f59bedb3 Update c/image to v4.0.1 and buildah to 1.11.3
This requires updating all import paths throughout, and a matching
buildah update to interoperate.

I can't figure out the reason for go.mod tracking
	github.com/containers/image v3.0.2+incompatible // indirect
((go mod graph) lists it as a direct dependency of libpod, but
(go list -json -m all) lists it as an indirect dependency),
but at least looking at the vendor subdirectory, it doesn't seem
to be actually used in the built binaries.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-10-04 20:18:23 +02:00
c5e26f8e40 podman network create: validate user input
Disallow invalid/confusing names such as '../bar' or 'foo '
Closes #4184

Signed-off-by: Mrigank Krishan <mrigankkrishan@gmail.com>
2019-10-04 02:34:01 +05:30
c2284962c7 Add support for launching containers without CGroups
This is mostly used with Systemd, which really wants to manage
CGroups itself when managing containers via unit file.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-09-10 10:52:37 -04:00
5bdd97f77f Set base mount options for bind mounts from base system
If I mount, say, /usr/bin into my container - I expect to be able
to run the executables in that mount. Unconditionally applying
noexec would be a bad idea.

Before my patches to change mount options and allow exec/dev/suid
being set explicitly, we inferred the mount options from where on
the base system the mount originated, and the options it had
there. Implement the same functionality for the new option
handling.

There's a lot of performance left on the table here, but I don't
know that this is ever going to take enough time to make it worth
optimizing.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-08-28 14:28:18 -04:00
02264d597f Add support for 'exec', 'suid', 'dev' mount flags
Previously, we explicitly set noexec/nosuid/nodev on every mount,
with no ability to disable them. The 'mount' command on Linux
will accept their inverses without complaint, though - 'noexec'
is counteracted by 'exec', 'nosuid' by 'suid', etc. Add support
for passing these options at the command line to disable our
explicit forcing of security options.

This also cleans up mount option handling significantly. We are
still parsing options in more than one place, which isn't good,
but option parsing for bind and tmpfs mounts has been unified.

Fixes: #3819
Fixes: #3803

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-08-28 14:28:18 -04:00
bd0b05f138 Merge pull request #3709 from mheon/volume_inspect
Change backend code for 'volume inspect'
2019-08-19 13:57:15 +02:00
98dee275d0 Merge pull request #3836 from chenzhiwei/hostname
Allow customizing pod hostname
2019-08-19 13:33:15 +02:00
7aefc1ac33 Allow customizing pod hostname
* set hostname in pod yaml file
* set --hostname in pod create command

Signed-off-by: Chen Zhiwei <zhiweik@gmail.com>
2019-08-18 03:48:40 +00:00
e6673012b5 do not activate sd_notify support when varlink
add ability to not activate sd_notify when running under varlink as it
causes deadlocks and hangs.

Fixes: #3572

Signed-off-by: baude <bbaude@redhat.com>
2019-08-15 12:32:54 -05:00
8b72a72ca2 Implement backend for 'volume inspect'
Begin to separate the internal structures and frontend for
inspect on volumes. We can't rely on keeping internal data
structures for external presentation - separating presentation
and internal data format is good practice.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-08-02 15:08:30 -04:00
8e8d1ac193 Add a flag to set events logger type
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-07-31 17:28:42 -04:00
1d72f651e4 podman: support --userns=ns|container
allow to join the user namespace of another container.

Closes: https://github.com/containers/libpod/issues/3629

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-07-25 23:04:55 +02:00
a78c885397 golangci-lint pass number 2
clean up and prepare to migrate to the golangci-linter

Signed-off-by: baude <bbaude@redhat.com>
2019-07-11 09:13:06 -05:00
1d36501f96 code cleanup
clean up code identified as problematic by golands inspection

Signed-off-by: baude <bbaude@redhat.com>
2019-07-08 09:18:11 -05:00
d0a0a3fbd9 configure runtime without store
some podman commands do not require the use of a container/image store.
in those cases, it is more effecient to not open the store, because that
results in having to also close the store which can be costly when the
system is under heavy write I/O loads.

Signed-off-by: baude <bbaude@redhat.com>
2019-07-01 14:15:44 -05:00
dd81a44ccf remove libpod from main
the compilation demands of having libpod in main is a burden for the
remote client compilations.  to combat this, we should move the use of
libpod structs, vars, constants, and functions into the adapter code
where it will only be compiled by the local client.

this should result in cleaner code organization and smaller binaries. it
should also help if we ever need to compile the remote client on
non-Linux operating systems natively (not cross-compiled).

Signed-off-by: baude <bbaude@redhat.com>
2019-06-25 13:51:24 -05:00
4e7e5f5cbd Make Inspect's mounts struct accurate to Docker
We were formerly dumping spec.Mount structs, with no care as to
whether it was user-generated or not - a relic of the very early
days when we didn't know whether a user made a mount or not.

Now that we do, match our output to Docker's dedicated mount
struct.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-06-12 17:14:21 -04:00
51bdf29f04 Address comments
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2019-05-28 11:10:57 -04:00
f61fa28d39 Added --log-driver and journald logging
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2019-05-28 11:10:57 -04:00
7ba1b609aa Move to using constants for valid restart policy types
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
0d73ee40b2 Add container restart policy to Libpod & Podman
This initial version does not support restart count, but it works
as advertised otherwise.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
f3c494eb28 Merge pull request #2959 from mheon/merge_volume_flags
Merge volume flags implementation
2019-05-03 01:30:13 +02:00
416cc20c68 Small fixes for #2950
We merged #2950 with some nits still remaining, as Giuseppe was
going on PTO. This addresses those small requested changes.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-01 15:07:30 -04:00