The recent registries.conf rework made so the backend already reads the
env var. As such clients should no longer set it directly to simplify
the code here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The podman module paths are moving from github.com/containers/podman to
go.podman.io/podman. This will help with future mobility.
Signed-off-by: Brent Baude <bbaude@redhat.com>
This PR reflects the upstream change of moving the buildah module from
github.com/containers/buildah to go.podman.io/buildah.
Signed-off-by: Brent Baude <bbaude@redhat.com>
Use shared configfile instead of custom policy.json path handling.
This updates ocipull to rely on signature.DefaultPolicy(), removes
explicit SignaturePolicyPath, and replaces trust's custom default-policy
path logic with common configfile code.
Replace hidden `--policypath` with --signature-policy` and require
it for `trust set` command instead of path resolution based on
configfile.
For `trust get`, the `--signature-policy` is optional.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
These are two new Buildah flags that we need to wire into Podman
(both local and remote) and document, with the interesting note
that one requires the other and a check needed to be added for
that.
Also: secret parsing was tightened up in Buildah, and was
breaking the remote build tests. Rewire it to use the new parser
Buildah made, which ends up simplifying the code considerably.
Tests are back to passing afterwards.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
This was implemented by containers/netavark #1369; this commit
completes the process by wiring it into Podman. We now respect
the CLI order for configured networks - if a user passes
`--net net1,net2` we guarantee that net1 will be configured
before net2.
For containers created before this patch, we don't retain enough
information to configure networks in CLI order, so we use
alphabetical order instead to still guarantee consistency.
No breaking API changes have been made, but we do add a new
field to supplement the existing map to (optionally) provide
ordering information. The Podman CLI will always pass this.
Existing applications that do not will, again, receive]
deterministic ordering based on an alphabetical sort of network
names.
This requires the latest version of Netavark to work properly.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
The old ErrRelaunchAttempt name was ambiguous — it reads as though the
relaunch attempt failed, when it actually signals success. Rename to
ErrRelaunchSucceeded and update comments at every call site to clarify
that this is not a real error but a sentinel indicating the elevated
child process completed the operation successfully.
Also fix a bug in WSL's launchElevate where a failed elevated process
was incorrectly wrapped with the sentinel, causing callers to treat the
failure as success and print "Machine init complete."
Signed-off-by: lstocchi <lstocchi@redhat.com>
This commit adds automatic UAC elevation prompts for HyperV machine
init/rm actions when administrator privileges are required.
Previously, users had to manually run Podman as administrator
when creating the first machine or removing the last machine, which
requires Windows Registry modifications.
When the HyperV command gets relaunched as elevated, the error of the
elevated process is saved on a file to be displayed by the caller. The
implementation is the same as that used by WSL.
Signed-off-by: lstocchi <lstocchi@redhat.com>
The go std os package to will always make sure to use O_CLOEXEC, however
in cases where we directly call unix.Open() we need to pass that flag
explicitly.
I looked at this as there was a report of a leaked fd on the pasta list,
though I am not sure this will address it.
But anyway doing this should be rather safe and avoid leaks into other
processes.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This will be useful when importing host certificates and the certificates file
isn't mounted in the guest.
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
When an artifact is added without an explicit tag (e.g.
"quay.io/myimage/myartifact"), the TAG column in "podman artifact ls"
was empty instead of showing "latest", unlike container images which
default to :latest.
Add a call to reference.TagNameOnly() after parsing the stored name so
the display normalises the reference before extracting the tag, matching
the behaviour of container images.
Fixes: #27083
Signed-off-by: Devesh B <98201065+DeveshB-1@users.noreply.github.com>
Adds --filter status=<value> support to podman quadlet list.
Also adds shell completion for the status filter values.
Signed-off-by: Himanshu Jaiswal <himanshu.bw5@gmail.com>
rootlessport: clarify RootlessCNI comment
Update the comment for the RootlessCNI conditional to clarify that
the flag is for rootless bridge networking, not CNI specifically.
The bool is set when netStatus != nil in slirp4netns and will be
removed when slirp4netns and rootlessport are fully dropped.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
In remote mode, `podman version` currently returns a connection error before
printing any version information if it cannot connect to the service.
Introduce a reusable `PrintVersion` helper and invoke it at the root level
when a `ConnectionError` is encountered. This ensures that client information
is still shown even when the server cannot be reached.
Fixes: #28222
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This allows things like compose project names to be associated with log
messages and later used in log processing and analysis.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
For remote operation, start the remote service with --tls-details:
using --tls-details on the client side will only affect client's
connection.
This should eventually include many more tests - track down all current
uses of libpod.Runtime.{SystemContext,imageContext,LibimageRuntime}.
That will come later
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Quadlet list always reports the heading, even when using custom
formatting strings. This doesn't follow the behavior of other podman
list commands. Borrow some logic and the "--noheading" flag from the
container list command to make this behavior uniform.
Signed-off-by: Randolph Sapp <rs@ti.com>
