115 Commits

Author SHA1 Message Date
a78c885397 golangci-lint pass number 2
clean up and prepare to migrate to the golangci-linter

Signed-off-by: baude <bbaude@redhat.com>
2019-07-11 09:13:06 -05:00
150778820f Merge pull request #3324 from marcov/detach-keys-configurable
libpod: specify a detach keys sequence in libpod.conf
2019-07-01 15:54:27 +02:00
8561b99644 libpod removal from main (phase 2)
this is phase 2 for the removal of libpod from main.

Signed-off-by: baude <bbaude@redhat.com>
2019-06-27 07:56:24 -05:00
4f56964d55 libpod: fix hang on container start and attach
When a container is attached upon start, the WaitGroup counter may
never be decremented if an error is raised before start, causing
the caller to hang.
Synchronize with the start & attach goroutine using a channel, to be
able to detect failures before start.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2019-06-26 10:17:29 +02:00
dd81a44ccf remove libpod from main
the compilation demands of having libpod in main is a burden for the
remote client compilations.  to combat this, we should move the use of
libpod structs, vars, constants, and functions into the adapter code
where it will only be compiled by the local client.

this should result in cleaner code organization and smaller binaries. it
should also help if we ever need to compile the remote client on
non-Linux operating systems natively (not cross-compiled).

Signed-off-by: baude <bbaude@redhat.com>
2019-06-25 13:51:24 -05:00
de75b1a277 Fix a segfault in 'podman ps --sync'
We weren't properly populating the container's OCI Runtime in
Batch(), causing segfaults on attempting to access it. Add a test
to make sure we actually catch cases like this in the future.

Fixes #3411

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-06-24 09:26:03 -04:00
92bae8d308 Begin adding support for multiple OCI runtimes
Allow Podman containers to request to use a specific OCI runtime
if multiple runtimes are configured. This is the first step to
properly supporting containers in a multi-runtime environment.

The biggest changes are that all OCI runtimes are now initialized
when Podman creates its runtime, and containers now use the
runtime requested in their configuration (instead of always the
default runtime).

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-06-19 17:08:43 -04:00
04858a218f stop/kill: inproper state errors: s/in state/is in state/
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-06-17 14:31:55 +02:00
0f75410e1c kill: print ID and state for non-running containers
Extend kill's error message to include the container's ID and state.
This address cases where error messages caused by other containers
may confuse users.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-06-17 10:55:54 +02:00
3bbb692d80 If container is not in correct state podman exec should exit with 126
This way a tool can determine if the container exists or not, but is in the
wrong state.

Since 126 is documeted as:
**_126_** if the **_contained command_** cannot be invoked

It makes sense that the container would exit with this state.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-06-12 05:15:58 -04:00
39f5ea4c04 Merge pull request #3180 from mheon/inspect_volumes
Begin to break up pkg/inspect
2019-06-08 14:45:24 +02:00
bef83c42ea migration: add possibility to restore a container with a new name
The option to restore a container from an external checkpoint archive
(podman container restore -i /tmp/checkpoint.tar.gz) restores a
container with the same name and same ID as id had before checkpointing.

This commit adds the option '--name,-n' to 'podman container restore'.
With this option the restored container gets the name specified after
'--name,-n' and a new ID. This way it is possible to restore one
container multiple times.

If a container is restored with a new name Podman will not try to
request the same IP address for the container as it had during
checkpointing. This implicitly assumes that if a container is restored
from a checkpoint archive with a different name, that it will be
restored multiple times and restoring a container multiple times with
the same IP address will fail as each IP address can only be used once.

Signed-off-by: Adrian Reber <areber@redhat.com>
2019-06-04 14:02:51 +02:00
0028578b43 Added support to migrate containers
This commit adds an option to the checkpoint command to export a
checkpoint into a tar.gz file as well as importing a checkpoint tar.gz
file during restore. With all checkpoint artifacts in one file it is
possible to easily transfer a checkpoint and thus enabling container
migration in Podman. With the following steps it is possible to migrate
a running container from one system (source) to another (destination).

 Source system:
  * podman container checkpoint -l -e /tmp/checkpoint.tar.gz
  * scp /tmp/checkpoint.tar.gz destination:/tmp

 Destination system:
  * podman pull 'container-image-as-on-source-system'
  * podman container restore -i /tmp/checkpoint.tar.gz

The exported tar.gz file contains the checkpoint image as created by
CRIU and a few additional JSON files describing the state of the
checkpointed container.

Now the container is running on the destination system with the same
state just as during checkpointing. If the container is kept running
on the source system with the checkpoint flag '-R', the result will be
that the same container is running on two different hosts.

Signed-off-by: Adrian Reber <areber@redhat.com>
2019-06-03 22:05:12 +02:00
a05cfd24bb Added helper functions for container migration
This adds a couple of function in structure members needed in the next
commit to make container migration actually work. This just splits of
the function which are not modifying existing code.

Signed-off-by: Adrian Reber <areber@redhat.com>
2019-06-03 22:05:12 +02:00
1be345bd9d Begin to break up pkg/inspect
Let's put inspect structs where they're actually being used. We
originally made pkg/inspect to solve circular import issues.
There are no more circular import issues.

Image structs remain for now, I'm focusing on container inspect.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-06-03 15:54:53 -04:00
f86bb561ef container: move channel close to its writer
let the writer of the channel close it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-20 19:41:02 +02:00
d83d0abfbf Ensure that start() in StartAndAttach() is locked
StartAndAttach() runs start() in a goroutine, which can allow it
to fire after the caller returns - and thus, after the defer to
unlock the container lock has fired.

The start() call _must_ occur while the container is locked, or
else state inconsistencies may occur.

Fixes #3114

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-14 14:54:21 -04:00
d7c367aa61 Address review comments on restart policy
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
7ba1b609aa Move to using constants for valid restart policy types
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
f4db6d5cf6 Add support for retry count with --restart flag
The on-failure restart option supports restarting only a given
number of times. To do this, we need one additional field in the
DB to track restart count (which conveniently fills a field in
Inspect we weren't populating), plus some plumbing logic.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
dc42304f38 Sending signals to containers prevents restart policy
Noticed this when testing some behavior with Docker.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
0d73ee40b2 Add container restart policy to Libpod & Podman
This initial version does not support restart count, but it works
as advertised otherwise.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-03 10:36:16 -04:00
0b2c9c2acc Add basic structure of podman init command
As part of this, rework the number of workers used by various
Podman tasks to match original behavior - need an explicit
fallthrough in the switch statement for that block to work as
expected.

Also, trivial change to Podman cleanup to work on initialized
containers - we need to reset to a different state after cleaning
up the OCI runtime.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-05-01 11:12:24 -04:00
09ff62429a Implement podman-remote rm
* refactor command output to use one function
* Add new worker pool parallel operations
* Implement podman-remote umount
* Refactored podman wait to use printCmdOutput()

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2019-04-09 11:55:26 -07:00
99318b0894 Remove wait event
It's not necessary to log an event for a read-only operation like
wait.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-03-29 14:50:43 -04:00
22fc5a3e57 Merge pull request #2621 from mheon/event_on_death
Add event on container death
2019-03-13 12:03:07 -07:00
8f418f1568 Vendor docker/docker, fsouza and more #2
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>

Vendors in fsouza/docker-client, docker/docker and
a few more related. Of particular note, changes to the TweakCapabilities()
function from docker/docker along with the parse.IDMappingOptions() function
from Buildah. Please pay particular attention to the related changes in
the call from libpod to those functions during the review.

Passes baseline tests.
2019-03-13 11:40:39 -04:00
3b5805d521 Add event on container death
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-03-13 10:18:51 -04:00
ca1e76ff63 Add event logging to libpod, even display to podman
In lipod, we now log major events that occurr.  These events
can be displayed using the `podman events` command. Each
event contains:

* Type (container, image, volume, pod...)
* Status (create, rm, stop, kill, ....)
* Timestamp in RFC3339Nano format
* Name (if applicable)
* Image (if applicable)

The format of the event and the varlink endpoint are to not
be considered stable until cockpit has done its enablement.

Signed-off-by: baude <bbaude@redhat.com>
2019-03-11 15:08:59 -05:00
0b34327ad4 exec: support --preserve-fds
Allow to pass additional FDs to the process being executed.

Closes: https://github.com/containers/libpod/issues/2372

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-03-02 11:45:42 +01:00
d780e69559 Allow Exec API user to override streams
Allow passing in of AttachStreams to libpod.Exec() for usage in podman healthcheck. An API caller can now specify different streams for stdout, stderr and stdin, or no streams at all.

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2019-02-28 14:55:11 -05:00
7141f97270 OpenTracing support added to start, stop, run, create, pull, and ps
Drop context.Context field from cli.Context

Signed-off-by: Sebastian Jug <sejug@redhat.com>
2019-02-18 09:57:08 -05:00
81804fc464 pod infra container is started before a container in a pod is run, started, or attached.
Prior, a pod would have to be started immediately when created, leading to confusion about what a pod state should be immediately after creation. The problem was podman run --pod ... would error out if the infra container wasn't started (as it is a dependency). Fix this by allowing for recursive start, where each of the container's dependencies are started prior to the new container. This is only applied to the case where a new container is attached to a pod.

Also rework container_api Start, StartAndAttach, and Init functions, as there was some duplicated code, which made addressing the problem easier to fix.

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2019-02-15 16:39:24 -05:00
43c6da22b9 Add darwin support for remote-client
Add the ability to cross-compile podman remote for OSX.

Also, add image exists and tag to remote-client.

Signed-off-by: baude <bbaude@redhat.com>
2019-01-11 11:30:28 -06:00
867669374c Add a --workdir option to 'podman exec'
Signed-off-by: Debarshi Ray <rishi@fedoraproject.org>
2019-01-08 17:42:37 +01:00
b945d9128a Add locking to Sync() on containers
Previously not needed as it only worked inside of Batch(), but
now that it can be called anywhere we need to add mutual
exclusion on its config changes.

Signed-off-by: Matthew Heon <mheon@redhat.com>
2018-12-06 09:10:45 -05:00
a0c9be2061 Add --sync option to podman rm
With the changes made recently to ensure Podman does not hit the
OCI runtime as often to sync state, we can find ourselves in a
situation where the runtime's state does not match ours.

Add a --sync flag to podman rm to ensure we can still remove
containers when this happens.

Signed-off-by: Matthew Heon <mheon@redhat.com>
2018-12-06 09:10:45 -05:00
61d4db4806 Fix golang formatting issues
Whe running unittests on newer golang versions, we observe failures with some
formatting types when no declared correctly.

Signed-off-by: baude <bbaude@redhat.com>
2018-11-28 09:26:24 -06:00
effd63d6d5 Merge pull request #1848 from adrianreber/master
Add tcp-established to checkpoint/restore
2018-11-28 07:00:24 -08:00
03c88a3deb Added tcp-established to checkpoint/restore
CRIU can checkpoint and restore processes/containers with established
TCP connections if the correct option is specified. To implement
checkpoint and restore with support for established TCP connections with
Podman this commit adds the necessary options to runc during checkpoint
and also tells conmon during restore to use 'runc restore' with
'--tcp-established'.

For this Podman feature to work a corresponding conmon change is
required.

Example:

$ podman run --tmpfs /tmp --name podman-criu-test -d docker://docker.io/yovfiatbeb/podman-criu-test
$ nc `podman inspect -l | jq -r '.[0].NetworkSettings.IPAddress'` 8080
GET /examples/servlets/servlet/HelloWorldExample
Connection: keep-alive

1
GET /examples/servlets/servlet/HelloWorldExample
Connection: keep-alive

2
$ # Using HTTP keep-alive multiple requests are send to the server in the container
$ # Different terminal:
$ podman container checkpoint -l
criu failed: type NOTIFY errno 0
$ # Looking at the log file would show errors because of established TCP connections
$ podman container checkpoint -l --tcp-established
$ # This works now and after the restore the same connection as above can be used for requests
$ podman container restore -l --tcp-established

The restore would fail without '--tcp-established' as the checkpoint image
contains established TCP connections.

Signed-off-by: Adrian Reber <areber@redhat.com>
2018-11-28 08:00:38 +01:00
0592558289 Use also a struct to pass options to Restore()
This is basically the same change as

 ff47a4c2d5485fc49f937f3ce0c4e2fd6bdb1956 (Use a struct to pass options to Checkpoint())

just for the Restore() function. It is used to pass multiple restore
options to the API and down to conmon which is used to restore
containers. This is for the upcoming changes to support checkpointing
and restoring containers with '--tcp-established'.

Signed-off-by: Adrian Reber <areber@redhat.com>
2018-11-28 08:00:37 +01:00
070ce0c855 exec: don't wait for pidfile when the runtime exited
don't wait for the timeout to expire if the runtime process exited.
I've noticed podman to hang on exit and keeping the container lock
taken when the OCI runtime already exited.

Additionally, it reduces the waiting time as we won't hit the 25
milliseconds waiting time in the worst case.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2018-11-27 12:34:11 +01:00
b0572d6229 Added option to keep containers running after checkpointing
CRIU supports to leave processes running after checkpointing:

  -R|--leave-running    leave tasks in running state after checkpoint

runc also support to leave containers running after checkpointing:

   --leave-running      leave the process running after checkpointing

With this commit the support to leave a container running after
checkpointing is brought to Podman:

   --leave-running, -R  leave the container running after writing checkpoint to disk

Now it is possible to checkpoint a container at some point in time
without stopping the container. This can be used to rollback the
container to an early state:

$ podman run --tmpfs /tmp --name podman-criu-test -d docker://docker.io/yovfiatbeb/podman-criu-test
$ curl 10.88.64.253:8080/examples/servlets/servlet/HelloWorldExample
3
$ podman container checkpoint -R -l
$ curl 10.88.64.253:8080/examples/servlets/servlet/HelloWorldExample
4
$ curl 10.88.64.253:8080/examples/servlets/servlet/HelloWorldExample
5
$ podman stop -l
$ podman container restore -l
$ curl 10.88.64.253:8080/examples/servlets/servlet/HelloWorldExample
4

So after checkpointing the container kept running and was stopped after
some time. Restoring this container will restore the state right at the
checkpoint.

Signed-off-by: Adrian Reber <areber@redhat.com>
2018-11-20 17:25:44 +01:00
ff47a4c2d5 Use a struct to pass options to Checkpoint()
For upcoming changes to the Checkpoint() functions this commit switches
checkpoint options from a boolean to a struct, so that additional
options can be passed easily to Checkpoint() without changing the
function parameters all the time.

Signed-off-by: Adrian Reber <areber@redhat.com>
2018-11-20 17:25:44 +01:00
c3d8328150 Increase pidWaitTimeout to 60s
At scale, it appears that we sometimes hit the 1000ms timeout to create
the PID file when a container is created or executed.
Increasing the value to 60s should help when running a lot of containers
in heavy-loaded environment.

Related #1495
Fixes #1816
Signed-off-by: Emilien Macchi <emilien@redhat.com>
2018-11-15 10:58:27 -05:00
1370c311f5 Merge pull request #1771 from baude/prepare
move defer'd function declaration ahead of prepare error return
2018-11-07 10:55:51 -08:00
e022efa0f8 move defer'd function declaration ahead of prepare error return
Signed-off-by: baude <bbaude@redhat.com>
2018-11-07 10:44:33 -06:00
140f87c474 EXPERIMENTAL: Do not call out to runc for sync
When syncing container state, we normally call out to runc to see
the container's status. This does have significant performance
implications, though, and we've seen issues with large amounts of
runc processes being spawned.

This patch attempts to use stat calls on the container exit file
created by Conmon instead to sync state. This massively decreases
the cost of calling updateContainer (it has gone from an
almost-unconditional fork/exec of runc to a single stat call that
can be avoided in most states).

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>
2018-11-07 11:36:01 -05:00
319a7a7043 Merge pull request #1715 from baude/getusergroup
get user and group information using securejoin and runc's user library
2018-10-30 11:49:15 -07:00
079208cdbc unmount: fix error logic
Only return `ErrCtrStateInvalid` errors when the mount counter is equal
to 1.  Also fix the "can't unmount [...] last mount[..]" error which
hasn't been returned when the error passed to `errors.Errorf()` is nil.

Fixes: #1695
Signed-off-by: Valentin Rothberg <vrothberg@suse.com>
2018-10-29 15:46:54 +01:00