The echo and ls were added to help debug #7580, which was closed in
November 2020. The readlink check right below them is the actual
assertion and it prints the pid on failure anyway.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The comment asks for this to be removed once #15488 is fixed. That was
closed in December 2022. I grepped four recent system test job logs and
the warning does not appear in any of them.
It sits in run_podman so it ran on every podman call, and it writes to
fd 3 which means the output shows up even when the test passes.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
In bash arithmetic + binds tighter than &, so
16 + $RANDOM & 15
is (16 + RANDOM) & 15, which gives 0..15. The helper has been handing
out 172.0.x through 172.15.x, which is not in 172.16/12 at all, since
9e3363c5e swapped % 16 for & 15.
subnet_in_use() only checks whether a subnet collides with a host route,
not whether it is private, so nothing caught it.
Add a regression test to helpers.t. It fails on the old expression
(saw 0..15) and passes on the new one (saw 16..31).
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
The cgroups=split e2e test wraps podman in systemd-run --scope but does not request cgroup delegation. Without Delegate=yes, systemd does not guarantee that controllers like pids are written to cgroup.subtree_control for child cgroups. Whether they appear depends on the systemd session state at that moment, causing flaky crun failures when it tries to use unavailable controllers.
Fixes: #28944
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Add a copy-paste-friendly section to test/README.md covering how to run
the hack/ci/ci.sh workflow under Lima, including templatized ci.sh usage,
so contributors can reproduce the CI environment locally. Drop the
contradictory machine bullet.
Fixes#28947
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
With the new config work we expect policy.json to be shipped under
/usr/share/containers/policy.json. However the CI VMs and local users
might still have it in /etc so instead of assuming any host path lets
just create our own files for the --signature-policy tests.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The SELinux volume-permissions NOTE only applies to unprivileged,
rootless containers on an SELinux-enabled host. Emit it only when
both conditions hold, instead of on every volume-bearing object.
Add an e2e case generating from a standalone container with a volume,
asserting the NOTE appears only when rootless and SELinux is enabled.
Fixes: #17743
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
RLIMIT_NPROC is enforced per user namespace, not per container. On
remote with rootless, leaked conmon exec-session processes (which
sleep ~300s) can push the process count in the shared user namespace
high enough that a low nproc ulimit like 512 causes crun to fail with
'clone: Resource temporarily unavailable'. Bump the test value to
10000, with a comment explaining why, so it isn't quietly lowered
again.
Verified locally with:
hack/bats --rootless 280:"podman update - set ulimits"
Fixes: #28940
Signed-off-by: Prachi Gupta <prachig2808@gmail.com>
We only checked for "*" which means all addresses are bound, but that is
only used for dual stack sockets, for ipv4 only we need to check 0.0.0.0
and for ipv6 [::] as well so do that.
This should fix a common flake in the pasta tests which fail to bind
5355 as it is in use by systemd-resolved.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since this runs in parallel there might be a 5s or longer delay between
the run and rm command, as seen in this test log:
not ok 102 |055| podman rm - running container, w/o and w/ force in 9758ms
[13:31:24.753064270] # /var/tmp/podman/bin/podman-remote ... run -d quay.io/libpod/testimage:20241011 sleep 5
[13:31:26.113551343] 6ec4b494cbda820a7bcb31fa7f7a2f9b36000e950477434eaedd0bb3c73f9e00
[13:31:26.120952012] # /var/tmp/podman/bin/podman-remote ... rm 6ec4b494cbda820a7bcb31fa7f7a2f9b36000e950477434eaedd0bb3c73f9e00
[13:31:32.235939009] 6ec4b494cbda820a7bcb31fa7f7a2f9b36000e950477434eaedd0bb3c73f9e00
FAIL: exit code is 0; expected 2
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Docker-compatible inspect templates using `{{.HostIp}}` fail in Podman
because Go templates resolve by struct field name (`HostIP`), not JSON
tag (`HostIp`). Add a `HostIp()` method so both notations work.
Note: this does not address the struct-vs-map difference that prevents
`range` over individual port bindings (would require an API break).
Relates: https://github.com/podman-container-tools/podman/issues/29164
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
The Docker API 1.44 deprecates the fields HairpinMode, LinkLocalIPv6Address,
LinkLocalIPv6PrefixLen, SecondaryIPAddresses, SecondaryIPv6Addresses available in
NetworkSettings when calling GET /containers/{id}/json and will be removed in a future release.
You should instead look for the default network in NetworkSettings.Networks.
The fields are removed in 1.52. Version gate SecondaryIPAddresses, SecondaryIPv6Addresses
in the handler and update test. HairpinMode, LinkLocalIPv6Address, LinkLocalIPv6PrefixLen
are not returned by the compat endpoint as the response is serialized
to the moby/moby/api structure missing these fields.
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
The Docker API in version 1.44 deprecates the is_automated field for
the GET /images/search endpoint. The is_automated field has been deprecated
by Docker Hub's search API. Consequently, searching for is-automated=true
will yield no results.
The Docker API in version 1.44 deprecates the is_automated field
in the GET /images/search response and will always be set to false in the
future because Docker Hub is deprecating the is_automated field in its search API.
Return struct moby/api for the compat endpoint that matches the Docker
API response format and deprecates is_automated.
Update test_v2_0_0_image.py::ImageTestCase::test_search_compat
to verify returned format and fix subtests not being asserted (remove mp).
Fixes: https://redhat.atlassian.net/browse/RUN-3323
Signed-off-by: Marek Simek <msimek@redhat.com>
Progress reporting in container-libs/image did not update
the progress channel for chunked layers. Add test that builds
a new image with chunked layers, pull it using the REST API
and verify that the progress stream contains events for
partial pulls too.
Depends-on: https://github.com/containers/container-libs/issues/469
Signed-off-by: Marek Simek <msimek@redhat.com>
Paul Holzinger