The current systemd service to mount /etc/containers is not working
right. The Before=podman.socket causes a ordering conflict which causes
the socket to be disabled and thus all podman remote connections fail.
The problem is the unit is wanted by the default.target while the socket
is wanted by sockets.target which can be before the default.target is
triggered. That means that the Before= line cannot be fulfilled and
sometimes systemd thus seems to not start the socket. It is unclear to
me why this is racy as it is sometimes also works.
This was reported by Vladimir Lazar from the PD team, our CI did not
caught this as we use rootless machines by default and the problem only
happens for the rootful socket so we do not see connection failures.
To fix this add at least one rootful socket check.
We do however have a different CI flake that was also caused by the
incorrect mount dependencies. The mount could happen after sshd or other
programs run. So to fix this we must hook the podman-mnt-config.service
into the local-fs.target which runs much earlier and is used for all the
mounts.
Fixes: #29003
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It was removed, with the hardcoded image reference.
So cache was always off, even for the default image.
Fixes: #29090
Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
In remote mode `podman events --format json` could print the literal "null"
instead of an event object. The remote client converts each event received
from the server with ConvertToLibpodEvent, which returned nil when it could
not parse the server result (an unknown status or type, or an invalid
containerExitCode). The tunnel forwarded that nil as an event with no error
set, so the CLI marshalled a nil event and printed "null".
Return a descriptive error from ConvertToLibpodEvent and send it on the event
channel, which the CLI already handles, instead of forwarding a nil event.
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
When the command output is logged we do not need an extra pipe and
scanner to read the output line by line, we can just log it directly via
a writer.
Now this of course does loose the line by line parsing of the scanner
but IMO this is better as it is simpler and less code to worry about.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
The compat logs handler uses the tail query parameter both to select how
many log lines should be returned and as the capacity of the internal log
channel.
Only the former is part of the API semantics. The channel capacity should
not depend on a user-controlled value: negative values can produce an
invalid channel size, while very large values can cause excessive
allocation before any logs are read.
Use a small fixed-size buffer instead.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
convertNumber() strips the sign before parsing the numeric value and then
applies it back via a multiplier. The negative case uses -11 instead of
-1, causing negative values to be converted incorrectly.
This is visible for any caller using the signed result directly, and can
also produce surprising results for unsigned callers if the multiplication
overflows.
Use -1 for the negative multiplier.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
chrootarchive.Tar returns an io.ReadCloser backed by a pipe to the
tar-producing process. CRCreateRootFsDiffTar copies from the stream but
never closes it.
On the successful path the stream is read to EOF, so the producer normally
exits. On early errors, such as failing to create the destination file or
failing while copying to it, the producer can be left without a consumer.
Close the tar stream after it is created so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
We did not do breaking API changes but it seems confusing to have the
latest docs open and it still says API v5.0.0.
And while at it update the logo link.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
I think this should work fine with the defaults. Since we mount the
/etc/containers dir always we should no longer write to /etc/containers.
If we still need this it should be moved into the image and not done at
init time.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
When parsing image envs we need to be strict about the format, only the
"key=value" format must be accepted. Just keys must be rejected as they
are not valid according to the image spec.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
QuadletInstall expects the quadlet file to be first in the file list,
The API handler passes files in filepath.Walk order (lexicographic).
Install would fail if a file like "Containerfile" comes before the
quadlet file.
Signed-off-by: Nicola Sella <nsella@redhat.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
When we loop over all volumes to inspect them it is possible that some
of them got removed in the meantime. As such we must ignore this case to
not cause random command failures.
I have seen this fail in our system tests:
FAIL: podman volume inspect --format '{{"\n"}}'
expected: = ''
actual: Error: no such volume
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When reading the mount path here it can be missing and thus fail with
ENOENT when the voluem is removed in parallel. Because we do not want to
block for a full directory walk of course with the volume lock the only
choice is to ignore the error.
I have seen this error many times in CI in the past weeks:
FAIL: podman system df --format '{{"\n"}}'
expected: = ''
actual: Error: lstat /home/ubuntu.guest/.local/share/containers/storage/volumes/v-t450-1djh1zmh/_data: no such file or directory
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
