60 Commits

Author SHA1 Message Date
64d8b4eebb podman: implement userns=keep-id
add missing implementation for userns=keep-id and enable the user
namespaces tests.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-04-24 15:03:50 +02:00
48530acbd9 podman: handle namespaces specified on the CLI
and handle differently the user namespace as it supports additional
options.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-04-23 18:05:03 +02:00
1cd2b746d0 Modify namespace generation code for specgen
Namespaces have now been changed to properly handle all cases.
Spec handling code for namespaces was consolidated in a single
function.

Still missing:
- Image ports
- Pod namespaces likely still broken in Podmanv2

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2020-04-21 14:38:52 -04:00
1d93d21254 V2 Enable rootless
* Enable running podman V2 rootless
* Fixed cobra.PersistentPreRunE usage in all the commands
* Leveraged cobra.PersistentPreRunE/cobra.PersistentPostRunE to manage:
  * rootless
  * trace (--trace)
  * profiling (--cpu-profile)
  * initializing the registry copies of Image/Container engines
* Help and Usage templates autoset for all sub-commands

Signed-off-by: Jhon Honce <jhonce@redhat.com>
2020-04-16 11:08:08 -07:00
7147187942 v2specgen prune libpod
use libpod only in the specgen/generate package so that the remote clients do not inherit libpod bloat.

Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-04-14 20:02:20 -05:00
6514a5c80e v2podman container create
create a container in podmanv2 using specgen approach.  this is the core implementation and still has quite a bit of code commented out specifically around volumes, devices, and namespaces.  need contributions from smes on these parts.

Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-04-03 15:43:03 -05:00
8b5e2a6297 add default network for apiv2 create
during container creation, if no network is provided, we need to add a default value so the container can be later started.

use apiv2 container creation for RunTopContainer instead of an exec to the system podman. RunTopContainer now also returns the container id and an error.

added a libpod commit endpoint.

also, changed the use of the connections and bindings slightly to make it more convenient to write tests.

Fixes: 5366
Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-03-06 14:31:45 -06:00
b163640c61 Allow devs to set labels in container images for default capabilities.
This patch allows users to specify the list of capabilities required
to run their container image.

Setting a image/container label "io.containers.capabilities=setuid,setgid"
tells podman that the contained image should work fine with just these two
capabilties, instead of running with the default capabilities, podman will
launch the container with just these capabilties.

If the user or image specified capabilities that are not in the default set,
the container will print an error message and will continue to run with the
default capabilities.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-03-02 16:37:32 -05:00
418dee100b spec: allow container alias name in lookup
Previously --uts=container: expected the full container ID.

Closes: https://github.com/containers/libpod/issues/5289

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-02-26 15:04:31 +01:00
d65ff6b3ec apiv2 container create using specgen
this uses the specgen structure to create containers rather than the outdated createconfig.  right now, only the apiv2 create is wired up.  eventually the cli will also have to be done.

Signed-off-by: Brent Baude <bbaude@redhat.com>
2020-02-19 15:20:15 -06:00