I do not understand this condition in the code, not passing the log file
to the runtime when run with log level debug makes no sense. It means we
do not get the proper error message from the runtime so debug logging
shows a much worse error:
"container create failed (no logs from conmon)..."
When the actual error is the command is not in $PATH for example. So to
fix this just remove the log level check. Also not the support json flag
condition is done inside execOCILog().
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
First check for errors and assert them via gomega to make the test fails
which called this.
Then stop calling this for each test spec, most will never access this
so stop reading the file over and over. Callers should just call the
function directly.
Then remove the arch field from it, that is not related to the OS file.
Callers should just access runtime.GOARCH directly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
The versions should be kept in sync to avoid build errors on readthedocs
later, so add a note to remind people to update them.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
PR #28860 requires non-quadlet files (e.g a Containerfile with no
recognized extension) to be passed as part of a named application.
Update tests added in #28696 to adhere to this requirment.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
It is unused and I do not see why we would need this. It is almost
always better to use actual gomega matchers instead of just matching
true/false for the better error messages.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
There is no user for this and using the gomega matcher
ContainSubstring() or MatchRegexp() seems much better.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
For most callers podman run -d already makes sure the container runs so
this does nothing and only slows the test down.
For the signal test we can instead check for container output which is
better as we know the pid1 is actually ready to get the signal.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We do not use this anywhere to run as a different uid. In fact it should
not be supported as it would run without a proper systemd session for
example.
Because we run the test suite as root and a rootless user in CI there is
no need for a specific test to run podman as a different user here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We hard require netavark v2 to run with podman 6, as such it makes
little sense to guard just a specific set of tests.
Remove the helper to remove some code and skip the podman info call to
also speed it up a bit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When parsing image envs we need to be strict about the format, only the
"key=value" format must be accepted. Just keys must be rejected as they
are not valid according to the image spec.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
QuadletInstall expects the quadlet file to be first in the file list,
The API handler passes files in filepath.Walk order (lexicographic).
Install would fail if a file like "Containerfile" comes before the
quadlet file.
Signed-off-by: Nicola Sella <nsella@redhat.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
I have seen a few failures where the test fails without seeing podman rm
fail as the container was already stopped by the time we rm got called.
Bump the timeout a bit to make this less likely to happen again but not
to long as the test would take always that long otherwise.
Test log:
[15:29:08.277631195] # /var/tmp/podman/bin/podman-remote --url=unix:///tmp/bats-run-opRNXi/suite/remotesystem.podman.UvxVxO.sock run -d --name c-t108-d2t7i8rm --health-cmd /bin/false --health-interval 1s --health-retries 2 --health-timeout 1s --health-on-failure=stop --stop-timeout=2 --health-start-period 0 --stop-signal SIGTERM quay.io/libpod/testimage:20241011 sleep infinity
[15:29:09.088765794] 8946226536faa90d28dfa199e8da8fbb8040d1348a6f9142f95f3ba26f6cb2cf
[15:29:09.099141334] # /var/tmp/podman/bin/podman-remote --url=unix:///tmp/bats-run-opRNXi/suite/remotesystem.podman.UvxVxO.sock inspect --format {{.State.Pid}} c-t108-d2t7i8rm
[15:29:09.664964649] 142589
[15:29:09.678215064] # /var/tmp/podman/bin/podman-remote --url=unix:///tmp/bats-run-opRNXi/suite/remotesystem.podman.UvxVxO.sock rm c-t108-d2t7i8rm
[15:29:15.072982751] c-t108-d2t7i8rm
[15:29:15.083236575] # /var/tmp/podman/bin/podman-remote --url=unix:///tmp/bats-run-opRNXi/suite/remotesystem.podman.UvxVxO.sock container exists c-t108-d2t7i8rm
[15:29:15.193476069] [ rc=1 (expected) ]
[15:29:15.203781723] # /var/tmp/podman/bin/podman-remote --url=unix:///tmp/bats-run-opRNXi/suite/remotesystem.podman.UvxVxO.sock container exists 8946226536faa90d28dfa199e8da8fbb8040d1348a6f9142f95f3ba26f6cb2cf
[15:29:15.234141517] [ rc=1 (expected) ]
FAIL: we want at least one failure from podman-rm
expected: -gt 0
actual: 0
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a warning that tests wipe local container state,
a quick-reference table of make targets,
and examples for running specific integration, machine,
system, and unit tests.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
