22 Commits

Author SHA1 Message Date
e62e42bfa9 quadlet: Add device support for .volume files
The Device, Type, Copy and Options keys are now supported in
quadlet  .volume files. This allows users to create filesystem
based volumes with quadlets .volume files.

Signed-off-by: Ingo Becker <ingo@orgizm.net>
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2023-01-26 14:46:57 +02:00
b29313811f Change example target to default in doc
Signed-off-by: Martin Jackson <martjack@redhat.com>
2023-01-20 12:37:41 -06:00
b10a906b5c Quadlet Kube - add support for PublishPort key
Move the handling of Publish key to a method
use --publish instead of -p
Use the new method for both .container and .kube files
Adjust .container tests
Add .kube tests
Update the man page

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2023-01-12 10:19:14 +02:00
1bd3d32c5f Quadlet: Add support for ConfigMap key in Kube section
For each instance of ConfigMap pass the path via --configmap
Add tests
Add to doc

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2023-01-09 14:58:31 +02:00
347d5372e1 Quadlet Container: Add support for EnvironmentFile and EnvironmentHost
Add the new keys to the supported keys list for the Container group
Pass the list of EnvironmentFile values while maintaining the order
Quadlet e2e test framework: Add support for checking regex in Podman args
Add relevant tests
Update man

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2023-01-03 13:14:31 +02:00
9f5f092f16 Quadlet Doc: Add section for .kube files
In addition, for .container add RemapUidSize and fix Network

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2022-12-29 09:35:32 +02:00
d974a79e27 Quadlet: add network support
Support .network file to create a systemd service that runs podman network create
Support networks with .network suffix in Container and Kube to link with Quadlet created networks
Add E2E Tests
Add man doc

Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2022-12-18 11:25:20 +02:00
fd92a68071 quadlet: Default VolatileTmp to off
This is another case where we're diverging from the defaults in
podman.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-13 14:58:48 +01:00
7665bbc127 Remove 'you' from man pages
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-12-07 09:29:29 -05:00
16cf34dc3a quadlet: Use same default capability set as podman run
Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-02 16:37:22 +01:00
098ad52ecb quadlet: Change default of ReadOnly to no
This matches the default podman run behaviour.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-02 16:30:15 +01:00
1c3fddfaf7 quadlet: Change RunInit default to no
This matches the default of podman run.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-02 16:25:47 +01:00
d19ea6a60d quadlet: Change NoNewPrivileges default to false
This matches the default of podman run.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-12-02 16:24:47 +01:00
285d6c9ba0 quadlet: Rework uid/gid remapping
Quadlet was doing some custom handling of uid/gid remapping, originating
from pre --userns=auto support, including its own user for getting subuids
which kinda conflicts with the "container" user used for that.

This drops all the old support for id remapping in favour of a new set
of keys that more directly map to the podman run options.

We have essentially 3 modes now:

```
RemapUsers=manual
RemapUid=0:10000:10
RemapUid=10:20000:10
RemapGid=0:10000:10
RemapGid=10:20000:10
```

This maps to --uidmap and --gidmap options.

```
RemapUsers=auto
```

This maps to --userns=auto. But you can additionally specify RemapUid,
RemapGid and RemapUidSize which gets applied as options to the
--userns podman option.

```
RemapUsers=keep-id
```
This maps to --userns=keep-id and only works for user units.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-11-21 18:02:19 +01:00
bac907abf8 Clarify the docs on DropCapability
It was a bit unclear what setting it to empty means.

Also, add to the tests verification that this works.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:10:18 +02:00
b07ba24419 quadlet: Support multiple Network=
This is supported by podman run with --network, so makes sense.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:09:51 +02:00
8716de2ac3 quadlet: Add support for Network=...
This just gets translated to --network=...

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:09:51 +02:00
6042ca7fd0 quadlet: Add support for AddDevice=
This lets you add custom device nodes into the container

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:09:51 +02:00
f6f65f49db quadlet: Add support for setting seccomp profile
Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:09:48 +02:00
a9f0957c24 quadlet: Allow multiple elements on each Add/DropCaps line
You can still use multiple lines, but this is not necessary.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:09:22 +02:00
998f834b04 quadlet: Change ReadOnly to default to enabled
This makees much more sense for typical service loads, and can
easily be reverted by `ReadOnly=no`.

Also updates and adds various tests for this.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-25 13:08:21 +02:00
34ee37b91e Add man page for quadlet
This adds the "podman-systemd.unit(5)" manpage that describes
the podman generators from a high level, and all the supported
options.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
2022-10-19 10:30:31 +02:00