5148 Commits

Author SHA1 Message Date
f66a2069f1 Update buildah to v1.11.0
Vendor in the latest changes for buildah to apply the implemented
features here as well.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2019-09-05 16:58:08 +02:00
b962b1e353 Merge pull request #3943 from gabibeyer/fix_tests
Fix unit tests missing comparative for 'Expect'
2019-09-05 12:49:21 +02:00
95f5411e88 Fix unit tests missing comparative for 'Expect'
Add '.To(BeTrue())' to 'Expect(' statements in unit tests that
are missing them. These tests weren't being compared to anything,
thus reporting false positives.

Signed-off-by: gabi beyer <gabrielle.n.beyer@intel.com>
2019-09-04 23:30:24 +00:00
e74fcd7335 Merge pull request #3940 from edsantiago/bats
System tests: support for crun on f31/rawhide
2019-09-04 23:13:22 +02:00
ab44484bec Merge pull request #3876 from mheon/fix_mount_flags
Allow suid, exec, dev mount options to cancel nosuid/noexec/nodev
2019-09-04 22:43:41 +02:00
52f2454098 Merge pull request #3933 from giuseppe/skip-polling-on-run
libpod: avoid polling container status
2019-09-04 22:33:06 +02:00
acf55e1f87 System tests: support for crun on f31/rawhide
crun emits wildly different error messages than runc in
two cases:

    podman run ... /no/such/path   (enoent)
    podman run ... /etc            (trying to exec a directory)

Deal with it by getting the runtime from 'podman info' and,
if crun, changing what we expect.

There may be more tweaks needed to get system tests working
with crun, but right now podman rawhide is too broken to
have any hope of finding them all.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2019-09-04 14:03:55 -06:00
84140f5331 Merge pull request #3902 from baude/dnsmasqaddresponse
handle dns response from cni
2019-09-04 21:57:43 +02:00
8e337aff5a libpod: avoid polling container status
use the inotify backend to be notified on the container exit instead
of polling continuosly the runtime.  Polling the runtime slowns
significantly down the podman execution time for short lived
processes:

$ time bin/podman run --rm -ti fedora true

real	0m0.324s
user	0m0.088s
sys	0m0.064s

from:

$ time podman run --rm -ti fedora true

real	0m4.199s
user	0m5.339s
sys	0m0.344s

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-04 19:55:54 +02:00
5f15501578 Add test to verify noexec works with volume mounts
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-09-04 13:19:19 -04:00
f1a3e02aea Merge pull request #3928 from edsantiago/enable_man_page_checker_in_ci
Enable hack/man-page-checker in CI
2019-09-04 14:30:51 +02:00
1d8a940982 Merge pull request #3930 from cevich/update_irc_table
Cirrus: Update e-mail -> IRC Nick table
2019-09-04 11:35:26 +02:00
34dad57cbc Cirrus: Update e-mail -> IRC Nick table
Also add fixes to help prevent 'fatal: Invalid revision range' error.
Should obtaining all authors from the range still fail, only grab the
HEAD commit author as a fallback.

Signed-off-by: Chris Evich <cevich@redhat.com>
2019-09-03 16:39:35 -04:00
8818e358bf handle dns response from cni
when cni returns a list of dns servers, we should add them under the
right conditions.  the defined conditions are as follows:

- if the user provides dns, it and only it are added.
- if not above and you get a cni name server, it is added and a
forwarding dns instance is created for what was in resolv.conf.
- if not either above, the entries from the host's resolv.conf are used.
Signed-off-by: baude <bbaude@redhat.com>

Signed-off-by: baude <bbaude@redhat.com>
2019-09-03 10:10:05 -05:00
a16f63e96e Merge pull request #3926 from giuseppe/add-warning-mismatch-configuration
rootless: detect user namespace configuration changes
2019-09-03 07:02:44 -07:00
c03949986f Merge pull request #3904 from cevich/fix_img_prune
Cirrus: imgprune fixes
2019-09-03 06:04:08 -07:00
1a24ac7ad6 pkg/util: use rootless function to read additional users
make pkg/rootless.GetConfiguredMappings public so that it can be used
from pkg/util.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-03 14:38:08 +02:00
e367fc04d8 Enable hack/man-page-checker in CI
With huge thanks to @rwha for #3915. All man pages are clean
and consistent now - let's keep them that way.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2019-09-03 06:37:29 -06:00
7e238b9e0c Merge pull request #3915 from rwha/fix_man_page_tests
Fix formatting and enable hack/man-page-checker
2019-09-03 05:34:06 -07:00
cfe1d27688 rootless: detect user namespace configuration changes
detect if the current user namespace doesn't match the configuration
in the /etc/subuid and /etc/subgid files.

If there is a mismatch, raise a warning and suggest the user to
recreate the user namespace with "system migrate", that also restarts
the containers.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-03 13:46:48 +02:00
50a191037d Merge pull request #3925 from MatMaul/doc-rootless-systemd
rootless.md: add systemd unit example
2019-09-03 03:09:08 -07:00
bb900be87f rootless.md: add systemd unit example
Signed-off-by: Mathieu Velten <matmaul@gmail.com>
2019-09-03 00:33:33 +02:00
099549bd38 Merge pull request #3909 from giuseppe/rootless-bind-mount-dev
rootless: bind mount devices instead of creating them
2019-09-02 11:06:04 -07:00
03344fff1c Merge pull request #3922 from giuseppe/add-note-failing-systemd-cgroups-v1
docs: add note about failing rhel7 systemd on cgroups v2
2019-09-02 10:55:05 -07:00
6aed6dbcc0 docs: add note about failing rhel7 systemd on cgroups v2
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1747933

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-02 15:56:13 +02:00
759ca2cfc6 spec: provide custom implementation for getDevices
provide an implementation for getDevices that skip unreadable
directories for the current user.

Based on the implementation from runc/libcontainer.

Closes: https://github.com/containers/libpod/issues/3919

Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-02 13:27:47 +02:00
b101a8d366 spec: do not set devices cgroup when rootless
eBPF requires to be root in the init namespace.

Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
2019-09-02 13:03:20 +02:00
ba1c57030f rootless: bind mount devices instead of creating them
when running in rootless mode, --device creates a bind mount from the
host instead of specifying the device in the OCI configuration.  This
is required as an unprivileged user cannot use mknod, even when root
in a user namespace.

Closes: https://github.com/containers/libpod/issues/3905

Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
2019-09-02 13:03:19 +02:00
e5568d4acc Merge pull request #3916 from cevich/personalize_success
Personalize CI success messages to IRC
2019-09-01 08:29:05 -07:00
09f373283a Add command aliases to SYNOPSIS section
The files under docs/links reference another man page, e.g.
`man podman-container-list` displays `podman-ps(1)`. This adds
the alias to the in the displayed page's SYNOPSIS section.

Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-31 16:58:52 -04:00
d266dbea15 Exclude podman-remote
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-31 08:05:51 -04:00
48d1c49078 Cirrus: On success, add IRC nick mention to msg
Rather than spamming the podman channel with impersonal success
messages referring to PR numbers, mention the author by nick name
and include the PR title and link.

Also avoid needless logging of all bot-script interactions with
IRC when there is no error detected.

Signed-off-by: Chris Evich <cevich@redhat.com>
2019-08-30 14:57:42 -04:00
1a9ea04c7f Fix table spacing
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 13:34:36 -04:00
6b7f8b01b9 Revert the descriptive text for podman-remote
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 13:18:38 -04:00
c153895424 WIP - ignore man pages for commands besides podman
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 12:47:41 -04:00
2d95ede7a2 podman-remote is not a subcommand
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 12:47:24 -04:00
e35a5a674d Fix formatting and enable hack/man-page-checker
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 12:00:19 -04:00
56f11b1016 Cirrus: Load base-image names indirectly
Rather than hard-coding all four base-image env. var name,
load the values based on the shared variable name suffix.

Thanks to Ed Santiago <santiago@redhat.com> for the suggestion.

Signed-off-by: Chris Evich <cevich@redhat.com>
2019-08-30 09:46:43 -04:00
704c4c171f Cirrus: Remove image_prune YAML-alias workaround
Originally when written, the image_prune_task was passing incorrect
credentials into it's container.  This was traced back to mishandling of
a YAML-alias, and worked-around (including a comment).  However,
as of this commit, it appear YAML-alias substitution problem has
been addressed.  Restore the (correct) use of a YAML-alias so
the correct credentials are passed into the prune container.

Signed-off-by: Chris Evich <cevich@redhat.com>
2019-08-30 09:46:43 -04:00
8ba21acd45 Merge pull request #3911 from vrothberg/go-proxy
Makefile: use go proxy
2019-08-30 06:46:07 -07:00
7cf6ef01ac Merge pull request #3913 from rwha/fix/manpage-links
Fix links to manpages
2019-08-30 06:25:08 -07:00
3ddfabb30e Fix links to manpages
Signed-off-by: Ryan Whalen <rj.whalen@gmail.com>
2019-08-30 06:49:46 -04:00
3e0fdc7f7a Merge pull request #3908 from TomasTomecek/man-ev-bknd
man: events-logger → events-backend
2019-08-30 02:29:12 -07:00
90ebd7c909 Makefile: use go proxy
Use GOPROXY=https://proxy.golang.org to speed up fetching dependencies.
Setting it makes `make vendor` three times faster in my local env.

For details please refer to https://proxy.golang.org/.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-08-30 10:32:29 +02:00
d110998744 Merge pull request #3907 from baude/commitcaps
dont panic when using varlink commit and uppercase image names
2019-08-29 14:13:09 -07:00
9a5242c881 man: events-logger → events-backend
Signed-off-by: Tomas Tomecek <ttomecek@redhat.com>
2019-08-29 22:44:10 +02:00
2fb6cc2cea dont panic when using varlink commit and uppercase image names
when using an upper case image name for container commit, we observed
panics due to a channel closing early.

Fixes: #3897

Signed-off-by: baude <bbaude@redhat.com>
2019-08-29 14:08:29 -05:00
ab5f52c0d2 Merge pull request #3710 from cevich/release_redo
Release redo
2019-08-29 06:56:43 -07:00
1eb6b271bb Merge pull request #3833 from QiWang19/cert-dir
add --cert-dir image sign
2019-08-28 13:21:48 -07:00
9926a299f7 Merge pull request #3892 from cevich/google_vpc
Cirrus: Block CNI use of google VPCs
2019-08-28 13:03:51 -07:00