87 Commits

Author SHA1 Message Date
d997564342 Add space trimming check in ValidateSysctls
This is to catch invalid sysctl configs with extra spacing.

See
https://github.com/containers/common/issues/723#issuecomment-897395506

Signed-off-by: xatier <xatierlike@gmail.com>
2021-08-13 15:24:06 -05:00
8cbbbe6efe Fix TS parsing for fractional values
Parse Unix timestamps that contains fractional part.

Signed-off-by: Matej Vasek <mvasek@redhat.com>
2021-08-04 21:30:47 +02:00
0f7d54b026 migrate Podman to containers/common/libimage
Migrate the Podman code base over to `common/libimage` which replaces
`libpod/image` and a lot of glue code entirely.

Note that I tried to leave bread crumbs for changed tests.

Miscellaneous changes:

 * Some errors yield different messages which required to alter some
   tests.

 * I fixed some pre-existing issues in the code.  Others were marked as
   `//TODO`s to prevent the PR from exploding.

 * The `NamesHistory` of an image is returned as is from the storage.
   Previously, we did some filtering which I think is undesirable.
   Instead we should return the data as stored in the storage.

 * Touched handlers use the ABI interfaces where possible.

 * Local image resolution: previously Podman would match "foo" on
   "myfoo".  This behaviour has been changed and Podman will now
   only match on repository boundaries such that "foo" would match
   "my/foo" but not "myfoo".  I consider the old behaviour to be a
   bug, at the very least an exotic corner case.

 * Futhermore, "foo:none" does *not* resolve to a local image "foo"
   without tag anymore.  It's a hill I am (almost) willing to die on.

 * `image prune` prints the IDs of pruned images.  Previously, in some
   cases, the names were printed instead.  The API clearly states ID,
   so we should stick to it.

 * Compat endpoint image removal with _force_ deletes the entire not
   only the specified tag.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-05-05 11:30:12 +02:00
659dc7843c podman-remote should show podman.sock info
Currently podman-remote info does not show socket information.

Fixes: https://github.com/containers/podman/issues/10077

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-04-20 15:56:45 -04:00
127400880a [NO TESTS NEEDED] Shrink the size of podman-remote
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2021-03-29 09:49:45 -04:00
874f2327e6 Add U volume flag to chown source volumes
Signed-off-by: Eduardo Vega <edvegavalerio@gmail.com>
2021-02-22 22:55:19 -06:00
5dded6fae7 bump go module to v3
We missed bumping the go module, so let's do it now :)

* Automated go code with github.com/sirkon/go-imports-rename
* Manually via `vgrep podman/v2` the rest

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2021-02-22 09:03:51 +01:00
78c8a87362 Enable whitespace linter
Use the whitespace linter and fix the reported problems.

[NO TESTS NEEDED]

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
2021-02-11 23:01:56 +01:00
ef2fc90f2d Enable stylecheck linter
Use the stylecheck linter and fix the reported problems.

[NO TESTS NEEDED]

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
2021-02-11 23:01:29 +01:00
e58fb21ced Support Unix timestamps for podman logs --since
To match what podman-logs(1) describes --since

Signed-off-by: Chih-Hsuan Yen <yan12125@gmail.com>
2020-12-04 15:14:31 +08:00
4f427a89cb Align the podman ps --filter behavior with docker
All of our filters worked exclusive resulting in `--filter status=created --filter status=exited` to return nothing.

In docker filters with the same key work inclusive with the only exception being `label` which is exclusive. Filters with different keys always work exclusive.

This PR aims to match the docker behavior with podman.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
2020-11-18 11:36:06 +01:00
0357964906 Centralize cores and period/quota conversion code
Signed-off-by: Jordan Christiansen <xordspar0@gmail.com>
2020-10-31 10:07:11 -05:00
32af1be01a The cidfile should be created when the container is created
Currently if you run an interactive session of podman run and
specifiy the --cidfile option, the cidfile will not get created
until the container finishes running.  If you run a detached
container, it will get created right away.  This Patch creates
the cidfile as soon as the container is created.  This could allow
other tools to use the cidefile on all running containers.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-10-26 05:53:26 -04:00
33366a2cda Convert Split() calls with an equal sign to SplitN()
After seeing #7759, I decided to look at the calls in
Podman and Buildah to see if we had issues with strings.Split()
calls where an "=" (equals) sign was in play and we expected
to split on only the first one.

There were only one or two that I found in here that I think
might have been troubling, the remainder are just adding
some extra safety.

I also had another half dozen or so that were checking length
expectations appropriately, those I left alone.

Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
2020-10-13 19:30:08 -04:00
4878dff3e2 Remove excessive error wrapping
In case os.Open[File], os.Mkdir[All], ioutil.ReadFile and the like
fails, the error message already contains the file name and the
operation that fails, so there is no need to wrap the error with
something like "open %s failed".

While at it

 - replace a few places with os.Open, ioutil.ReadAll with
   ioutil.ReadFile.

 - replace errors.Wrapf with errors.Wrap for cases where there
   are no %-style arguments.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-10-05 15:30:37 -07:00
81f99c3ecd pull types allow initial caps
validate pulltype will allow initial caps form cli or yaml file passed to i
play kube.

Use code related with pullpolicy from containers/common.

Signed-off-by: Qi Wang <qiwan@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-09-12 07:02:04 -04:00
a5e37ad280 Switch all references to github.com/containers/libpod -> podman
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-07-28 08:23:45 -04:00
d419856009 Fix & add notes regarding problematic language in codebase
Podman is committed to inclusivity, a core value of open source. Historically, there have been technology terms that are problematic and divisive, and should be changed. We are currently taking time to audit our repository in order to eliminate such terminology, and replace it with more inclusive terms. We are starting where we can, with our own code, comments, and documentation. However, such terms may be used in dependencies, and must be used in our repositories at the current moment for compatibility. Podman will change these terms in our repo as soon as new and better terminology is available to us via our dependencies.

For more information: https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language?sc_cid=701600000011gf0AAA

Signed-off-by: Ashley Cui <acui@redhat.com>
2020-07-15 09:13:15 -04:00
a8f583a111 play-kube: add suport for "IfNotPresent" pull type
This change prevents this exception when loading a pod spec
using the "IfNotPresent" pull policy:
  Error: invalid pull type "IfNotPresent"

Signed-off-by: Tristan Cacqueray <tdecacqu@redhat.com>
2020-07-14 17:16:58 +00:00
8489dc4345 move go module to v2
With the advent of Podman 2.0.0 we crossed the magical barrier of go
modules.  While we were able to continue importing all packages inside
of the project, the project could not be vendored anymore from the
outside.

Move the go module to new major version and change all imports to
`github.com/containers/libpod/v2`.  The renaming of the imports
was done via `gomove` [1].

[1] https://github.com/KSubedi/gomove

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-07-06 15:50:12 +02:00
061261ee05 utils: drop default mapping when running uid!=0
this is a leftover from the first implementation of rootless.  This
code is never hit by podman rootless anymore as podman automatically
creates a user namespace now.

Fixes an issue with podman remote when used with uid != 0.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-06-24 18:13:42 +02:00
64d8b4eebb podman: implement userns=keep-id
add missing implementation for userns=keep-id and enable the user
namespaces tests.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-04-24 15:03:50 +02:00
ede8380d37 Move selinux labeling support from pkg/util to pkg/selinux
The goal here is to make the package less heavy and not overload
the pkg/util.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-04-22 14:17:59 -04:00
e62d081770 Update podman to use containers.conf
Add more default options parsing

Switch to using --time as opposed to --timeout to better match Docker.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-04-20 16:11:36 -04:00
09e821a8ea Merge pull request #5690 from rhatdan/selinux
Add support for selecting kvm and systemd labels
2020-04-16 05:29:19 -07:00
30d2964ff8 v2 bloat pruning phase 2
this is second phase of removing unneeded bloat in the remote client. this is important to be able to reduce the client size as well as possible native compilation for windows/mac.

Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-04-15 16:09:27 -05:00
c4ca3c71ff Add support for selecting kvm and systemd labels
In order to better support kata containers and systemd containers
container-selinux has added new types. Podman should execute the
container with an SELinux process label to match the container type.

Traditional Container process : container_t
KVM Container Process: containre_kvm_t
PID 1 Init process: container_init_t

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-04-15 16:52:16 -04:00
d517276426 Add support for the global flags and config files
Note: This PR doesn't provide full rootless support that will be
      addressed in a future PR

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2020-04-14 14:48:37 -07:00
3a0a727110 userns: support --userns=auto
automatically pick an empty range and create an user namespace for the
container.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-04-06 16:32:36 +02:00
4352d58549 Add support for containers.conf
vendor in c/common config pkg for containers.conf

Signed-off-by: Qi Wang qiwan@redhat.com
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-03-27 14:36:03 -04:00
9536560b4f podmanv2 add core container commands
add core container commands for podmanv2: kill, pause, restart, rm, stop, unpause

Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-03-22 13:24:45 -05:00
cb51707f91 Allow users to set TMPDIR environment
Some users have small /var/tmp directories and need to be able to specify a different location
for temporary files, which includes more space.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-03-06 10:21:37 -05:00
85b7374491 add pkg/signal
Add pkg/signal to deal with parts of signal processing and translating
signals from string to numeric representations.  The code has been
copied from docker/docker (and attributed with the copyright) but been
reduced to only what libpod needs (on Linux).

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-02-14 15:04:14 +01:00
67165b7675 make lint: enable gocritic
`gocritic` is a powerful linter that helps in preventing certain kinds
of errors as well as enforcing a coding style.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-13 14:27:02 +01:00
7a11ed5a77 libpod: fix --userns=keep-id with big UIDs
when creating a keep-id namespace, we split the original user
namespace in:

inner ns | outer ns  | size:
0        | 1         | ID
ID       | 0         | 1
ID+1     | ID+1      | availableIds - ID

When the user ID is bigger than the number of available
subuids/subgids we fail to create the user namespace because the first
slice is bigger than the available number of IDs and the third one has
a negative size.

Fix it by not using more than the available number of IDs in the first
slice and creating the third one only if there are other IDs left.

When the user ID is bigger than the number of additional IDs, there
will be a gap between the two mappings so the IDs between the maximum
additional ID and the user ID won't be present inside of the
namespace.

Closes: https://github.com/containers/libpod/issues/4838

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-01-10 22:33:30 +01:00
2311e5ff8a fix lint - pkg/util: func comment
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-08 15:44:30 +01:00
40f55ca3fe signal parsing - better input validation
The helper function we use for signal name mapping does not
check for negative numbers nor invalid (too-high) ones. This
can yield unexpected error messages:

   # podman kill -s -1 foo
   ERRO[0000] unknown signal "18446744073709551615"

This PR introduces a small wrapper for it that:

  1) Strips off a leading dash, allowing '-1' or '-HUP'
     as valid inputs; and
  2) Rejects numbers <1 or >64 (SIGRTMAX)

Also adds a test suite checking signal handling as well as
ensuring that invalid signals are rejected by the command line.

Fixes: #4746

Signed-off-by: Ed Santiago <santiago@redhat.com>
2019-12-26 16:50:21 -07:00
60bfa305a8 Add ONBUILD support to --change
Return types had to change a bit for this, but since we can wrap
the old v1.ImageConfig, changes are overall not particularly bad.

At present, I believe this only works with commit, not import.
This matches how things were before we changed to the new parsing
so I think this is fine.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-12-05 15:11:40 -05:00
001d06d7f6 Completely rework --change parsing
The way we were trying to parse was very broken. I originally
attempted to use Buildah's Dockerfile parser here, but dealing
with it (and convincing it to accept only a limited subset, and
only one instruction at a time) was challenging, so I rewrote a
subset of Dockerfile parsing. This should handle most common
cases well, though there are definitely unhandled edge cases for
ENV and LABEL.

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-12-04 18:55:30 -05:00
8d928d525f codespell: spelling corrections
Signed-off-by: Dmitry Smirnov <onlyjob@member.fsf.org>
2019-11-13 08:15:00 +11:00
11c282ab02 add libpod/config
Refactor the `RuntimeConfig` along with related code from libpod into
libpod/config.  Note that this is a first step of consolidating code
into more coherent packages to make the code more maintainable and less
prone to regressions on the long runs.

Some libpod definitions were moved to `libpod/define` to resolve
circular dependencies.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-10-31 17:42:37 +01:00
a4a70b4506 bump containers/image to v5.0.0, buildah to v1.11.4
Move to containers/image v5 and containers/buildah to v1.11.4.

Replace an equality check with a type assertion when checking for a
docker.ErrUnauthorizedForCredentials in `podman login`.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2019-10-29 13:35:18 -04:00
fa9982b87e rootless: write storage overrides to the conf file
make sure the user overrides are stored in the configuration file when
first created.

Closes: https://github.com/containers/libpod/issues/2659

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-21 12:07:21 +02:00
d3f59bedb3 Update c/image to v4.0.1 and buildah to 1.11.3
This requires updating all import paths throughout, and a matching
buildah update to interoperate.

I can't figure out the reason for go.mod tracking
	github.com/containers/image v3.0.2+incompatible // indirect
((go mod graph) lists it as a direct dependency of libpod, but
(go list -json -m all) lists it as an indirect dependency),
but at least looking at the vendor subdirectory, it doesn't seem
to be actually used in the built binaries.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2019-10-04 20:18:23 +02:00
2c23729c84 Merge pull request #4001 from kunalkushwaha/podman-import-fix
podman import syntax fix
2019-09-30 07:20:09 -07:00
21363a6442 syntax updated for podman import --change
currently, podman import change do not support syntax like
- KEY val
- KEY ["val"]
This adds support for both of these syntax along with KEY=val

Signed-off-by: Kunal Kushwaha <kunal.kushwaha@gmail.com>
2019-09-27 17:17:12 +09:00
82ac0d8925 Podman-remote run should wait for exit code
This change matches what is happening on the podman local side
and should eliminate a race condition.

Also exit commands on the server side should start to return to client.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-09-12 16:20:01 -04:00
1a24ac7ad6 pkg/util: use rootless function to read additional users
make pkg/rootless.GetConfiguredMappings public so that it can be used
from pkg/util.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-03 14:38:08 +02:00
decfea65be add --pull flag for podman create&run
Requirement from https://github.com/containers/libpod/issues/3575#issuecomment-512238393

Added --pull for podman create and pull to match the newly added flag in docker CLI.
`missing`: default value, podman will pull the image if it does not exist in the local.
`always`: podman will always pull the image.
`never`: podman will never pull the image.

Signed-off-by: Qi Wang <qiwan@redhat.com>
2019-08-09 15:21:34 -04:00
5779e89809 Touch up XDG, add rootless links
Touch up a number of formating issues for XDG_RUNTIME_DIRS in a number
of man pages.  Make use of the XDG_CONFIG_HOME environment variable
in a rootless environment if available, or set it if not.

Also added a number of links to the Rootless Podman config page and
added the location of the auth.json files to that doc.

Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
2019-07-29 11:29:41 -04:00