chrootarchive.Tar returns an io.ReadCloser backed by a pipe to the
tar-producing process. CRCreateRootFsDiffTar copies from the stream but
never closes it.
On the successful path the stream is read to EOF, so the producer normally
exits. On early errors, such as failing to create the destination file or
failing while copying to it, the producer can be left without a consumer.
Close the tar stream after it is created so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
We did not do breaking API changes but it seems confusing to have the
latest docs open and it still says API v5.0.0.
And while at it update the logo link.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
I think this should work fine with the defaults. Since we mount the
/etc/containers dir always we should no longer write to /etc/containers.
If we still need this it should be moved into the image and not done at
init time.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add `--ignore` to `podman network rm` so removing a missing
network returns success instead of exit code 1.
Keep existing error behavior for networks in use and other failures.
This commit message was translated from Korean to English using an LLM.
Fixes: #28363
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
When parsing image envs we need to be strict about the format, only the
"key=value" format must be accepted. Just keys must be rejected as they
are not valid according to the image spec.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
QuadletInstall expects the quadlet file to be first in the file list,
The API handler passes files in filepath.Walk order (lexicographic).
Install would fail if a file like "Containerfile" comes before the
quadlet file.
Signed-off-by: Nicola Sella <nsella@redhat.com>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
When we loop over all volumes to inspect them it is possible that some
of them got removed in the meantime. As such we must ignore this case to
not cause random command failures.
I have seen this fail in our system tests:
FAIL: podman volume inspect --format '{{"\n"}}'
expected: = ''
actual: Error: no such volume
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When reading the mount path here it can be missing and thus fail with
ENOENT when the voluem is removed in parallel. Because we do not want to
block for a full directory walk of course with the volume lock the only
choice is to ignore the error.
I have seen this error many times in CI in the past weeks:
FAIL: podman system df --format '{{"\n"}}'
expected: = ''
actual: Error: lstat /home/ubuntu.guest/.local/share/containers/storage/volumes/v-t450-1djh1zmh/_data: no such file or directory
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When multiple containers in a pod YAML specify the same hostPort,
podman kube play previously accepted the YAML and started the
containers, causing one of them to fail at runtime with a confusing
bind() error.
Add early validation in getPodPorts() to detect duplicate
(hostIP, hostPort, protocol) tuples across containers and return
a clear error message naming both conflicting containers.
Fixes: https://github.com/podman-container-tools/podman/issues/26622
Signed-off-by: Miguel Álvarez <mialvare@redhat.com>
FCOS symlinks /home to var/home. systemd rejects a mount unit whose
Where= path traverses a symlink, breaking default home dir mounts.
Resolve known FCOS symlinks before writing the ignition unit.
Fixes: #28911
Signed-off-by: Chanhyeok Seo <chanhyeok.seo@datadoghq.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
When returning error http code (e.g. 4xx, 5xx) the body needs to contain
a JSON that has a key "message" in it,
we must not use jsonmessage.JSONMessage.
The JSON of shape jsonmessage.JSONMessage is used only when client
already received 200.
Signed-off-by: Matej Vašek <matejvasek@gmail.com>
With podman-remote we do not enter a our user namespace like we do with
local podman so we keep running with the real user id.
So if we then try to use chrootarchive as normal user it fails with:
creating mount namespace before pivot: operation not permitted
So simply revert back to the normal archive code.
Now the more interesting thing is we do have a test
"podman save to directory with oci format" but it never runs
rootless+remote in our CI system with our current matrix as we wanted to
reduce jobs.
So rethink the matrix and add one such job as this shows it is needed.
Fixes: 25aee24cbd ("use chrootarchive over plain archive package")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This fixes two problems when parsing ports.
First, check for host port conflicts. When we are given the same ip:host
port combo twice then we need to reject that as invalid, the backend
cannot bind the same port twice and thus we always get a runtime
failure. Failing early in the create code path is much better.
Second, when assigning random ports for expose we still have to check
for proper conflicts. The first error was using allUsedContainerPortsMap
to check for conflicts but this holds container side ports, we need to
ensure there are no conflicts on the host port.
Then there was the other issue that the array in the map was copied and
accessed by value on lookup. And because the code did not reassign the
value it then failed to actually update the correct ports.
To address that I switch the map to store the array by reference which
will avoid the bigger copies as we only need to update the pointer now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
systemd interprets % as specifier characters in unit configuration files
(e.g. %H, %u, %40). Proxy environment variable values that contain
percent-encoded URL characters (such as %40 for @ in usernames) cause
systemd to emit warnings and fail to parse the generated
/etc/systemd/system.conf.d/default-env.conf:
system.conf.d/default-env.conf:2: Failed to resolve specifiers in
HTTP_PROXY=http://user%40example.com@proxy:3128
Fix by adding a bash variable substitution that doubles every % to %%
before writing to the systemd unit conf files. The profile.d and
environment.d destinations do not need this escaping and continue to
use the original value.
Fixes#28698
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
We are seeing frequent flakes in hyperV machine tests. The machine start
fails with an ssh handshake failure:
ssh: handshake failed: read tcp 127.0.0.1:56425->127.0.0.1:56377:
wsarecv: An existing connection was forcibly closed by the remote host.
Normally we do the ssh probe in conductVMReadinessCheck() with a retry
mechanism, however because the hyperV mount code already used ssh in
PostStartNetworking() we never got there and failed early.
PostStartNetworking seems the wrong place to mount anyway so move this
to MountVolumesToVM() instead which is placed after the ready check
already so it should have a working ssh by then.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
