Commit Graph

20140 Commits

Author SHA1 Message Date
Ed Santiago
8cb14e54a5 e2e: use ExitCleanly() in cleanup_test.go
Ongoing steps toward RUN-1907: replace Exit(0) with ExitCleanly()

Clean command-line replace.

Also, fix up the Containerized and Debian exceptions in matcher.
I was in a huge rush Thursday night when I added the Debian
exception. This, I hope, makes it slightly easier to understand
the cases where we don't check stderr.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-11 06:33:18 -06:00
OpenShift Merge Robot
adc45ef887 Merge pull request #19916 from eriksjolund/fix-docs-podman-systemd-unit-equivalents
[CI:DOCS] podman-systemd.unit: fix equivalents
2023-09-11 11:19:28 +02:00
Erik Sjölund
65a64da271 [CI:DOCS] podman-systemd.unit: fix equivalents
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
2023-09-11 07:41:10 +02:00
Daniel J Walsh
8acd66c115 Merge pull request #19888 from giuseppe/fix-pod-lifecycle
fix pod cgroup lifecycle
2023-09-10 20:36:21 -04:00
OpenShift Merge Robot
8d37db75ad Merge pull request #19910 from Daskan/main
[CI:DOCS] Update podman-kube-play.1.md.in
2023-09-10 20:49:58 +02:00
OpenShift Merge Robot
51d01dd38e Merge pull request #19907 from n1hility/breakout-altbuild
Split up alt binaries to speed up build
2023-09-10 05:49:09 +02:00
Daskan
5eb0a53a0a Update podman-kube-play.1.md.in
To avoid the error:
`Error: unable to read YAML as Kube Pod: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal object into Go struct field Container.spec.containers.command of type string`

Also makes it easier to understand as you only need the image parameter.

Signed-off-by: Daskan <kevin81991@web.de>
2023-09-09 21:41:41 +02:00
Daniel J Walsh
92bdd912b2 Merge pull request #19891 from edsantiago/run_rmi_warn
run --rmi: "cannot remove" is a warning, not an error
2023-09-09 10:20:49 -04:00
Daniel J Walsh
745201ea23 Merge pull request #19902 from giuseppe/fix-pod-run-with-mounts
pod: fix duplicate volumes from containers.conf
2023-09-09 10:09:25 -04:00
Jason T. Greene
c2cd93cdc2 Split up alt binaries to speed up build
Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
2023-09-08 23:57:20 -05:00
Jason T. Greene
7bf9f302a3 Switch installer task to EC2
Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
2023-09-08 21:36:39 -05:00
Daniel J Walsh
ab5ca5b69c Merge pull request #19895 from edsantiago/ci_test_skipper_fix
CI test runner: upgrade tests rely on system tests
2023-09-08 11:36:48 -04:00
Giuseppe Scrivano
fbbad04398 pod: fix duplicate volumes from containers.conf
If some volumes are specified in containers.conf, they are currently
added twice to the containers spec causing the container to fail:

$ head -n2 ~/.config/containers/containers.conf
[containers]
volumes = ["/tmp:/tmp"]
$ podman pod create --name foo
7ac7f97f9b74a596332483e4a13e58cb9c8d997e9c5baae46804ae0acc26cbc6
$ podman run --pod=foo alpine true
Error: "/tmp": duplicate mount destination

The fix is to ignore the setting from containers.conf when setting the
pod default configuration.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 16:02:55 +02:00
Giuseppe Scrivano
0c75eac637 tests: add test for pod cgroups
This test checks that the pod cgroups are created and that the limits
set for a pod cgroup are enforced also after a reboot.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
b8f6a12d01 libpod: create the cgroup pod before containers
When a container is created and it is part of a pod, we ensure the pod
cgroup exists so limits can be applied on the pod cgroup.

Closes: https://github.com/containers/podman/issues/19175

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
331b3c216d cmd, specgen: allow cgroup resources without --infra
When the infra container is not created, we can still set limits on
the pod cgroup.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
83334fb4e7 specgen: allow --share-parent with --infra=false
This allows to use --share-parent with --infra=false, so that the
containers in the pod can share the parent cgroup.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
5de8f4aba0 libpod: allow cgroup path without infra container
a pod can use cgroups without an infra container.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
5121c9eb0e libpod: check if cgroup exists before creating it
do not create the pod cgroup if it already exists.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
38209ef49d libpod: refactor platformMakePod signature
accept only the resources to be used by the pod, so that the function
can more easily be used by a successive patch.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
627ac1c96b libpod: destroy pod cgroup on pod stop
When the pod is stopped, we need to destroy the pod cgroup, otherwise
it is leaked.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:48 +02:00
Giuseppe Scrivano
9a347619d8 utils: export MoveUnderCgroup
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:47 +02:00
Giuseppe Scrivano
556db46a68 libpod: refactor code to new function
move the code to remove the pod cgroup to a separate function.  It is
a preparation for the next patch.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2023-09-08 14:58:44 +02:00
Daniel J Walsh
f8e1ec731e Merge pull request #19897 from edsantiago/e2e_check_stderr_checkpoint
e2e: use ExitCleanly() in checkpoint tests
2023-09-08 06:57:57 -04:00
Daniel J Walsh
7524753efb Merge pull request #19896 from baude/issue17019
[CI:DOCS]Remove use of --latest|-l from tutorial
2023-09-08 06:56:40 -04:00
Daniel J Walsh
6ee8f73d41 Merge pull request #19885 from rhatdan/kube
Add support for kube  securityContext.procMount
2023-09-08 06:56:05 -04:00
Valentin Rothberg
5d6ec27e95 Merge pull request #19892 from edsantiago/StopSignal_default_name
StopContainer: display signal num when name unknown
2023-09-08 11:42:34 +02:00
Ed Santiago
65bddfcd25 e2e: use ExitCleanly() in checkpoint tests
Ongoing steps toward RUN-1907: replace Exit(0) with ExitCleanly()

Clean command-line replace, with one manual reversion (commented)

And -- duh! -- skip the stderr check on Debian!

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 20:20:28 -06:00
Brent Baude
4796802320 [CI:DOCS]Remove use of --latest|-l from tutorial
Remove the use of the "latest" flags because it cannot be used on
windows or mac.

Fixes #17019

[NO NEW TESTS NEEDED]

Signed-off-by: Brent Baude <bbaude@redhat.com>
2023-09-07 17:57:34 -05:00
Ed Santiago
afeab39d10 CI test runner: upgrade tests rely on system tests
Prevent future occurrences of #19894, by making upgrade tests
run any time there's a change to system tests. That's overly
broad: upgrade tests only rely on test/system/helpers.bash,
not test/system/anything-else. IMHO the cost of CI breaking
is higher than the cost of running unnecessary jobs.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 16:50:40 -06:00
Brent Baude
c0d36b8ab8 Merge pull request #19894 from edsantiago/urgent_ci_fix
URGENT: fix broken CI
2023-09-07 17:49:13 -05:00
Ed Santiago
59bd6a74a0 run --rmi: "cannot remove" is a warning, not an error
When the "rmi" part of "run --rmi" fails due to image being in use
by another container (or for any reason, actually), issue a warning
message, not an error.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 14:30:22 -06:00
Ed Santiago
70cf9740f1 StopContainer: display signal num when name unknown
Under some circumstances podman tries to kill a container
using signal 37, for which unix.SignalName() returns "".
Not helpful. So, when that happens, show "(signal number)".

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 14:13:14 -06:00
Ed Santiago
6f913f5f37 URGENT: fix broken CI
PR #19878 (checking for warnings in system tests) broke upgrade tests.

Reason: my long-ago "optimization" in which, if a PR touches only
tests in X, do not run tests in Y. Unfortunately, upgrade tests
rely on code in the system-test directory. I don't know if this
is fixable; nor if it's an acceptable tradeoff. Please discuss.

Sorry, everyone.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 14:05:30 -06:00
OpenShift Merge Robot
e546aebb32 Merge pull request #19889 from vrothberg/restart-kill
podman: don't restart after kill
2023-09-07 21:28:17 +02:00
OpenShift Merge Robot
0c72726f01 Merge pull request #19878 from edsantiago/bats_check_stderr
sys tests: run_podman: check for unwanted warnings/errors
2023-09-07 17:26:59 +02:00
OpenShift Merge Robot
16f2dd36bb Merge pull request #19887 from rhatdan/kube1
Tmpfs should not be mounted noexec
2023-09-07 16:19:24 +02:00
Daniel J Walsh
b83485022d Add support for kube securityContext\.procMount
Fixes: https://github.com/containers/podman/issues/19881

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-09-07 09:49:11 -04:00
Valentin Rothberg
589867d716 podman: don't restart after kill
Also add a new `StoppedByUser` field to the container-inspect state
which can be useful during debugging and is now also used in the
regression test.  Note that I moved the `false` check one test above
such that we can compare the previous Podman version which should just
be stuck in the `wait $ctr` command since it will continue restarting.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
2023-09-07 15:18:02 +02:00
Daniel J Walsh
2d7d8d1d10 Tmpfs should not be mounted noexec
The logic here makes little sense, basically the /tmp and /var/tmp are
always set noexec, while /run is not.  I don't see a reason to set any
of the three noexec by default.

Fixes: https://github.com/containers/podman/issues/19886

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-09-07 08:06:55 -04:00
Ed Santiago
c2575f726d sys tests: run_podman: check for unwanted warnings/errors
With few exceptions, commands that exit 0 should not emit any
messages with level=warning or =error. Let's start enforcing
that in run_podman.

Allow one-off exceptions, typically when we're testing an
actual warning condition (usual case: "podman stop" where it
times out to SIGKILL). Exceptions are specified via:

    run_podman 0+w subcommand...
               ^^^---- or, rarely, 0+e

"0" stands for "expect exit status 0", which is the default
so it's implicit anyway. The +w / +e (or even +we) is the
new part. I have added it to tests where necessary.

And, because life is what it is, add two global exceptions:

  - Debian. Because runc has too many flakes.
  - kube. Ditto. Kube commands emit lots of nasty error
    messages (yes, level=error) that don't seem to affect
    results.

Similar to #18442

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-07 05:35:21 -06:00
OpenShift Merge Robot
c17c190f89 Merge pull request #19882 from edsantiago/e2e_exitcleanly
e2e: use ExitCleanly() in attach & build tests
2023-09-07 12:27:05 +02:00
Daniel J Walsh
24e9e946cc Merge pull request #19883 from containers/renovate/setuptools-68.x
chore(deps): update dependency setuptools to ~=68.2.0
2023-09-07 06:23:28 -04:00
renovate[bot]
1211518e82 chore(deps): update dependency setuptools to ~=68.2.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-09-07 02:07:32 +00:00
Ed Santiago
465150f10c e2e: use ExitCleanly() in attach & build tests
Small steps toward RUN-1907: replace Exit(0) with ExitCleanly()
in ginkgo tests in two test files. Also, when practical,
replace ALPINE with CITEST_IMAGE.

There are still many thousands of instances left to fix. I will
be submitting in reviewable chunks.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2023-09-06 17:11:38 -06:00
OpenShift Merge Robot
c11ac807f9 Merge pull request #19759 from rhatdan/docs
[CI:DOCS] Some distros do not default to docker.io for shortname searches
2023-09-06 22:04:38 +02:00
Daniel J Walsh
27495981ce Some distros do not default to docker.io for shortname searches
Fixes: #18910

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-09-06 13:37:08 -04:00
OpenShift Merge Robot
af17ddaeed Merge pull request #19871 from giuseppe/accept-empty-capabilities
security: accept empty capabilities list
2023-09-06 17:16:52 +02:00
OpenShift Merge Robot
2806378c1a Merge pull request #19872 from edsantiago/systest_fix_eaddrinuse
systests: random_free_port: fix EADDRINUSE flake
2023-09-06 16:06:49 +02:00
OpenShift Merge Robot
74a7d61f5c Merge pull request #19869 from containers/renovate/github.com-cyphar-filepath-securejoin-0.x
fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
2023-09-06 16:04:17 +02:00