36 Commits

Author SHA1 Message Date
c0abfaa7c3 Revert "spec: bind mount /sys only for rootless containers"
It breaks "podman  run --net=host --uidmap=0:1:70000 --gidmap=0:20000:70000 busybox echo hi"

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1285
Approved by: rhatdan
2018-08-16 16:02:32 +00:00
0ddb42b4f7 spec: bind mount /sys only for rootless containers
root can always mount a new instance.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1279
Approved by: rhatdan
2018-08-15 15:30:15 +00:00
cd7102a70e Fix handling of hostname in --net=host
Hostname should be set to the hosts hostname when network is none.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1274
Approved by: giuseppe
2018-08-15 11:38:18 +00:00
cfcd928476 network: add support for rootless network with slirp4netns
slirp4netns is required to setup the network namespace:

https://github.com/rootless-containers/slirp4netns

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1156
Approved by: rhatdan
2018-07-31 13:39:29 +00:00
e56717833e Clear variables used to store options after parsing for every volume
If more than one volume was mounted using the --volume flag in
podman run, the second and onwards volumes were picking up options
of the previous volume mounts defined. Found out that the options were
not be cleared out after every volume was parsed.

Signed-off-by: umohnani8 <umohnani@redhat.com>

Closes: #1142
Approved by: mheon
2018-07-25 14:44:57 +00:00
e43270fc5e podman: allow to specify the IPC namespace to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
977c8a9cd6 podman: allow to specify the UTS namespace to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
8223fbaac6 podman: allow to specify the PID namespace to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
819c807125 podman: allow to specify the userns to join
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
41c7e43b4d network: support ns: prefix to join existing namespace
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
6f65490e27 spec: allow container:NAME network mode
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
2018-07-24 21:50:49 +00:00
a04a8d1dd4 Added full podman pod ps, with tests and man page
Signed-off-by: haircommander <pehunt@redhat.com>
2018-07-13 09:17:33 -04:00
1aad3fd96b Podman pod create/rm commands with man page and tests.
Includes a very stripped down version of podman pod ps, just for testing

Signed-off-by: haircommander <pehunt@redhat.com>
2018-07-13 09:05:03 -04:00
4f699db8da Support multiple networks
This is a refresh of Dan William's PR #974 with a rebase and proper
vendoring of ocicni and containernetworking/cni.  It adds the ability
to define multiple networks as so:

podman run --network=net1,net2,foobar ...

Signed-off-by: baude <bbaude@redhat.com>

Closes: #1082
Approved by: baude
2018-07-12 21:45:47 +00:00
4855998f1c Add --volumes-from flag to podman run and create
podman now supports --volumes-from flag, which allows users
to add all the volumes an existing container has to a new one.

Signed-off-by: umohnani8 <umohnani@redhat.com>

Closes: #931
Approved by: mheon
2018-07-09 19:30:03 +00:00
5a8e5a2b17 Mask /proc/keys to protect information leak about keys on host
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1060
Approved by: mheon
2018-07-08 13:38:20 +00:00
aaab26fd0c Block use of /proc/acpi from inside containers
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1053
Approved by: mheon
2018-07-06 17:29:35 +00:00
4f0c0597a1 spec: Make addPrivilegedDevices and createBlockIO per-platform
b96be3af (changes to allow for darwin compilation, 2018-06-20, #1015)
made AddPrivilegedDevices per-platform and cc6f0e85 (more changes to
compile darwin, 2018-07-04, #1047) made CreateBlockIO per-platform.
But both left but left out docs for the unsupported version [1]:

  pkg/spec/config_unsupported.go:18:1⚠️ exported method
    CreateConfig.AddPrivilegedDevices should have comment or be
    unexported (golint)
  pkg/spec/config_unsupported.go:22:1⚠️ exported method
    CreateConfig.CreateBlockIO should have comment or be unexported
    (golint)

To keep the docs DRY, I've restored the public methods and their docs,
and I've added new, internal methods for the per-platform
implementations.

[1]: https://travis-ci.org/projectatomic/libpod/jobs/400555937#L160

Signed-off-by: W. Trevor King <wking@tremily.us>

Closes: #1034
Approved by: baude
2018-07-06 00:48:40 +00:00
cc6f0e85f9 more changes to compile darwin
this should represent the last major changes to get darwin to **compile**.  again,
the purpose here is to get darwin to compile so that we can eventually implement a
ci task that would protect against regressions for darwin compilation.

i have left the manual darwin compilation largely static still and in fact now only
interject (manually) two build tags to assist with the build.  trevor king has great
ideas on how to make this better and i will defer final implementation of those
to him.

Signed-off-by: baude <bbaude@redhat.com>

Closes: #1047
Approved by: rhatdan
2018-07-05 16:05:12 +00:00
b96be3af1b changes to allow for darwin compilation
Signed-off-by: baude <bbaude@redhat.com>

Closes: #1015
Approved by: baude
2018-06-29 20:44:09 +00:00
7fc1a329bd Add podman container cleanup to CLI
When we run containers in detach mode, nothing cleans up the network stack or
the mount points.  This patch will tell conmon to execute the cleanup code when
the container exits.

It can also be called to attempt to cleanup previously running containers.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #942
Approved by: mheon
2018-06-29 15:25:21 +00:00
810f2b6061 Start using github.com/seccomp/containers-golang
User newer seccomp bindings from the seccomp upstream

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1021
Approved by: giuseppe
2018-06-29 13:18:41 +00:00
fd12c8918b *: Replace Generator.Spec() with Generator.Config
Catching up with opencontainers/runtime-tools@84a62c6a (generate: Move
Generator.spec to Generator.Config, 2016-11-06, #266, v0.6.0), now
that we've bumped runtime-tools in f6c0fc1a (Vendor in latest
runtime-tools, 2018-06-26, #1007).

Signed-off-by: W. Trevor King <wking@tremily.us>

Closes: #1008
Approved by: mheon
2018-06-27 21:27:19 +00:00
c32c491869 generator.New() requires an OS string input variable
Signed-off-by: baude <bbaude@redhat.com>

Closes: #1007
Approved by: baude
2018-06-27 15:16:02 +00:00
5ff90677c8 rootless: add management for the userNS
When running podman as non root user always create an userNS and let
the OCI runtime use it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #936
Approved by: rhatdan
2018-06-27 14:07:17 +00:00
82a948c04e Option handling has become large and should be a shared function
Everytime we add a new option for create, we end up having to also
add it to run, this makes it error prone.  Moving these to the same
function makes it easier to develop and prevents user mistakes.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #975
Approved by: mheon
2018-06-22 14:30:18 +00:00
16ea659757 spec: remove dead code
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #871
Approved by: mheon
2018-06-15 14:53:19 +00:00
c976d49805 network: do not attempt to create a network in rootless mode
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #871
Approved by: mheon
2018-06-15 14:53:18 +00:00
3861098fb3 oci: do not set resources in rootless mode
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #871
Approved by: mheon
2018-06-15 14:53:18 +00:00
ed0261176b spec: change mount options for /dev/pts in rootless mode
The default /dev/pts has the option gid=5 that might not be mapped in
the rootless case.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #871
Approved by: mheon
2018-06-15 14:53:18 +00:00
7bdfb4f9b3 podman: accept option --rootfs to use exploded images
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #871
Approved by: mheon
2018-06-15 14:53:18 +00:00
4b4de5dc21 When setting a memory limit, also set a swap limit
Closes #940

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #946
Approved by: rhatdan
2018-06-15 09:25:21 +00:00
6d52ebdd13 Add flag to add annotations to a container
Also add annotations from the image the container was created
from.

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #886
Approved by: rhatdan
2018-06-04 17:52:28 +00:00
bae80a0b66 Clear all caps, except the bounding set, when --user is specified.
Currently we are giving all caps to users when running with podman run --user,
They should get none by default.  If the command line includes --cap-add, then
we need to run with those capabilties.  Similarly we need to drop caps from
bounding set, if user specifies --cap-drop

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #851
Approved by: mheon
2018-05-31 13:46:08 +00:00
684b544e9c Spell check strings and comments
Signed-off-by: Jhon Honce <jhonce@redhat.com>

Closes: #831
Approved by: rhatdan
2018-05-25 08:45:15 +00:00
82feafecdd podman create, start, getattachsocket
First pass at implement API endpoints for create and start.

Signed-off-by: baude <bbaude@redhat.com>

Closes: #805
Approved by: baude
2018-05-21 19:26:56 +00:00