rootless containers can use pause on cgroups v2.
Whether it is possible or not to use pause depends from multiple
conditions, such as:
- be on a cgroup v2 unified hierarchy,
- using systemd cgroup manager,
- the kernel has the freezer controller,
The last one may fail for root as well.
Instead of trying to catch all the possible conditions in Podman, let
the OCI runtime complain if pause cannot be performed.
Closes: https://github.com/containers/libpod/issues/4813
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Golint claims that image.Image stutters but renaming the type would be a
breaking change which isn't worth the consequences.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
RootlessKit port forwarder has a lot of advantages over the slirp4netns port forwarder:
* Very high throughput.
Benchmark result on Travis: socat: 5.2 Gbps, slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps
(https://travis-ci.org/rootless-containers/rootlesskit/builds/597056377)
* Connections from the host are treated as 127.0.0.1 rather than 10.0.2.2 in the namespace.
No UDP issue (#4586)
* No tcp_rmem issue (#4537)
* Probably works with IPv6. Even if not, it is trivial to support IPv6. (#4311)
* Easily extensible for future support of SCTP
* Easily extensible for future support of `lxc-user-nic` SUID network
RootlessKit port forwarder has been already adopted as the default port forwarder by Rootless Docker/Moby,
and no issue has been reported AFAIK.
As the port forwarder is imported as a Go package, no `rootlesskit` binary is required for Podman.
Fix#4586
May-fix #4559Fix#4537
May-fix #4311
See https://github.com/rootless-containers/rootlesskit/blob/v0.7.0/pkg/port/builtin/builtin.go
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Podman now supports untagging images via the `untag` sub-command for the
root and `image` commands. Testing and documentation has been added as
well.
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
Updates the inspect command demo with an up to date
variant and adds a link to script that ran it.
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Previously we builded RPMs that contained an outdated conmon which was
not compatible. From now on `make-install` will also call
`podman version` and `podman info` in order to perform a minimal
sanity check of the installation.
Fixes: #4665
Signed-off-by: Sorin Sbarnea <ssbarnea@redhat.com>
Rephrase the stale message to be friendlier and bump the closing time to
365 days. The docs of the stale workflow do not indicate whether we can
not close, so a limit of 365 days seems fair.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Two man pages had incorrect references to a nonexistent
policy.conf(5) or policy-conf(5) [dot vs dash]. Fix them.
Also checked for other broken references via:
$ for i in registries.conf storage.conf policy.json ; do grep -R $i.5 docs/source | grep -v containers-$i;done
(No further results found. That's not a guarantee that there
aren't other broken links though).
Signed-off-by: Ed Santiago <santiago@redhat.com>
Changes I am making:
1. The target `.gopathok` was listed in `.PHONY` which
looks wrong as it regenerates `.gopathok` every time we
re-run it, which was a part of the issue. I removed it
to avoid that. If `.gopathok` is present', makefile
should not need to rerun it.
2. Ensure the binaries are created only if they don't
exist by adding `bin/podman`
and `bin/podman-remote`.
3. Add a `SOURCES = $(shell find . -name "*.go")` and put
it as a dependency of the podman binaries target. It allows us
to re-generate the binaries only when there is a change in the
source files. The downside is it increases the running time of
the command that generates them (20 seconds on my virtual machine
running Centos 7). If this is a problem, we could introduce a
hidden file that would list all the files to track, that
would need to be updated only when a dev is introducing new files.
4. Fixed the make package-install as it does not work with yum.
I updated the build_rpm.sh to ensure it works on centos 7
and centos 8 with no pre-required installation.
Closes#4367
Signed-off-by: Neville Cain <neville.cain@qonto.eu>
Add flag --seccomp-profile-root in play kube to allow users to specify where to look for seccomp profiles
update tests
Signed-off-by: Peter Hunt <pehunt@redhat.com>
Currently the use of "*" in tables is causing go-md2man
to screw up the format of the man page.
This PR removes the "*" since it is not really necessary.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Keep the original input source path with "/." so podman can copy the content of the directory when copying from container to host.
Signed-off-by: Qi Wang <qiwan@redhat.com>
move core of network commands from pkg/adapter to pkg/network to assist
with api development and remote podman commands.
Signed-off-by: baude <bbaude@redhat.com>
