Handle empty image output before skipping the header row in tagOutputToMap. This prevents a slice bounds panic when imagesOutput is empty and adds coverage for the empty-output case.
Signed-off-by: Atishay Jain <sethatishayjain@gmail.com>
The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
Building without go modules fails as we use different import paths now.
But also there is no reason to to use GO111MODULE=off anymore so just
remove it to make the build work.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
Docker now reserves alias specfically for user-defined aliases, and uses another field, dnsnames, to hold all aliases, including container ID and name.
Part of docker v1.45 compat work, but this touches the cli too, since they updated it there too.
Signed-off-by: Ashley Cui <acui@redhat.com>
runc doesn't support --tcp-close, so this test always failed there
once the flag hit the runtime. Skip it entirely for non-crun since
since --tcp-established already covers runc above.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Both the tcp-established and tcp-close checkpoint/restore tests expect
a restore rejected due to an established TCP connection to fail with
"runc: criu failed: type NOTIFY errno 0". criu's RPC server actually
reports this failure as type RESTORE, not NOTIFY. Widen the regex in
both tests to accept RESTORE while still tolerating NOTIFY.
Signed-off-by: Ricardo Branco <rbranco@suse.de>
The echo and ls were added to help debug #7580, which was closed in
November 2020. The readlink check right below them is the actual
assertion and it prints the pid on failure anyway.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The comment asks for this to be removed once #15488 is fixed. That was
closed in December 2022. I grepped four recent system test job logs and
the warning does not appear in any of them.
It sits in run_podman so it ran on every podman call, and it writes to
fd 3 which means the output shows up even when the test passes.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
pasta's IPv6 local-mode forwarding requires an unreleased upstream
patch. Skip the affected E2E tests until the fix ships in a pasta
release.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
In bash arithmetic + binds tighter than &, so
16 + $RANDOM & 15
is (16 + RANDOM) & 15, which gives 0..15. The helper has been handing
out 172.0.x through 172.15.x, which is not in 172.16/12 at all, since
9e3363c5e swapped % 16 for & 15.
subnet_in_use() only checks whether a subnet collides with a host route,
not whether it is private, so nothing caught it.
Add a regression test to helpers.t. It fails on the old expression
(saw 0..15) and passes on the new one (saw 16..31).
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The cgroups=split e2e test wraps podman in systemd-run --scope but does not request cgroup delegation. Without Delegate=yes, systemd does not guarantee that controllers like pids are written to cgroup.subtree_control for child cgroups. Whether they appear depends on the systemd session state at that moment, causing flaky crun failures when it tries to use unavailable controllers.
Fixes: #28944
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Add a copy-paste-friendly section to test/README.md covering how to run
the hack/ci/ci.sh workflow under Lima, including templatized ci.sh usage,
so contributors can reproduce the CI environment locally. Drop the
contradictory machine bullet.
Fixes#28947
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
With the new config work we expect policy.json to be shipped under
/usr/share/containers/policy.json. However the CI VMs and local users
might still have it in /etc so instead of assuming any host path lets
just create our own files for the --signature-policy tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
RLIMIT_NPROC is enforced per user namespace, not per container. On
remote with rootless, leaked conmon exec-session processes (which
sleep ~300s) can push the process count in the shared user namespace
high enough that a low nproc ulimit like 512 causes crun to fail with
'clone: Resource temporarily unavailable'. Bump the test value to
10000, with a comment explaining why, so it isn't quietly lowered
again.
Verified locally with:
hack/bats --rootless 280:"podman update - set ulimits"
Fixes: #28940
Signed-off-by: Prachi Gupta <prachig2808@gmail.com>
Jan Rodák