The pasta_t SELinux domain is denied { create } for pasta.sock
on ifconfig_var_run_t directories. Disable all pasta forwarder
tests (BATS + e2e) until a new passt release ships the fix.
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Since commit def70012b9 git-validation is only used to check if the
commit subject is less than 90 characters.
Drop the vendored git-validation Go tool and the .gitvalidation make
target in favor of hack/commit-subject-check.sh.
This removes a Go build dependency and a vendored tree from
test/tools/ while keeping the same CI and local behavior.
Note the now-removed GIT_CHECK_EXCLUDE was not used by gitvalidation
since commit def70012b9 because it was not checking any specific
files, just the commit subject lengths.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add rootless_port_forwarder="pasta" option that uses pesto to update
pasta's forwarding table via UNIX socket, preserving source IPs that
rootlessport's userspace proxy masks.
HostIP is stripped from port mappings in the netavark wrapper when
pasta forwarding is active because pesto handles host-side binding
while pasta's splice changes the destination IP that netavark DNAT
expects. Pesto binds both 0.0.0.0 and [::] for dual-stack support.
Fixes: https://redhat.atlassian.net/browse/RUN-2214
Fixes: https://github.com/containers/podman/issues/8193
Fixes: https://redhat.atlassian.net/browse/RUN-3587
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
- Populate the Docker-compatible container summary HostConfig from the
container inspect data
- Remove the unused ContainerCreateConfig wrapper from the compat
handler
- Add APIv2 test
Signed-off-by: Christopher Bii <christopherbii@hyub.org>
When a network is created without gateway, i.e. --internal --disable-dns
then the gateway will be nil. But converting a nil ip to string produces
"<nil>" which is not what we want as we like an empty string there to
signal that the network has no gateway.
Fixes: #28705
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
- libpod/events.go & libpod/runtime.go: Added the `Artifact` event type.
Refactored and deduplicated event forwarding logic by introducing
`spawnEventForwarder[T any]`, replacing separate goroutine loops for
images and artifacts. Implemented graceful shutdown and resolved eventer
initialization race conditions.
- libpod/events: Implemented event filtering by name/ID, updated journald
and logfile readers/writers for artifact events, and added `Artifact` to
`ToHumanReadable` formatting.
- cmd/podman: Added shell auto-completion for `artifact=` and `type=artifact` filters.
- docs/test: Documented the `artifact` event type, statuses, and filters in
`podman-events.1.md`. Added an end-to-end test in `events_test.go` to verify
event emissions.
Signed-off-by: Byounguk Lee <nimdrak@gmail.com>
Add a --dry-run option to show which volumes would be pruned without removing them.
Related: #27838
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This is a Docker compatibility change discovered while working on
cases it is practically speaking required because there are
mandatory parameters in the body, but in those cases you do not
get a JSON decode error back, you get an error about the field
that needs to be set. I see no reason for us not to match this
convention; it doesn't break our existing bindings, but makes
using the API via curl or similar somewhat easier.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
This test is currently flaking with the latest pasta update[1]. As part
of debugging this it was hard to see why socat fails 5 times in this
loop as the run function does not log the output so I had to add an echo
here.
[1] https://bugs.passt.top/show_bug.cgi?id=202
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The Docker daemon emits a final `{"aux":{"Tag","Digest","Size"}}` JSON
object on the push event stream so clients can recover the registry-side
manifest digest without an extra registry round-trip.
Several Docker-API clients (e.g. the Pulumi and Terraform docker
providers) parse `aux.Digest` to populate their pushed-image outputs.
Without the trailer they either silently fall back to inspecting the
local image (whose digest does not always match what was pushed - see
containers/podman#14779) or emit "Push completed without reporting a
digest" warnings.
`pushReport.ManifestDigest` is already populated with the correct
on-the-wire digest from `manifest.Digest(pushedManifestBytes)`; this
change just wraps it into the same JSON shape Docker emits and adds an
apiv2 test asserting the trailer is present with Tag, Digest, and Size.
Signed-off-by: nitz <nitz.raz@gmail.com>
This commit addresses two concerns.
Bind dual stack when hostIP unless it is explicitly specified. Since we
use listen(), this change resulted in blocked connections on stacks
without matching DNAT rules (e.g. connecting to [::1] on an IPv4-only
network) because the TCP handshake on the reservation socket would complete
instead of returning ECONNREFUSED allowing the client to fallback to IPv4.
Replacing listen() with raw socket() and bind() syscalls fixes this by
allowing us to reserve this port without accepting connections; clients
get ECONNREFUSED and fall back to IPv4 automatically, as is desired.
Fixes: https://github.com/containers/netavark/issues/1338
Co-authored-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Podman defaults to the directory of the Containerfile when no context dir is explicitly provided.
When running podman build with process subsituiton, `podman build -f <(echo "FROM scratch")`,
the Containerfile path expands to `/dev/fd/<NUM>`, which makes `/dev/fd` the context dir.
When building, Buildah attempts to create an overlay mount on top of the `/dev/fd` context dir, which fails.
In these cases, use a temp context dir instead: `$TMPDIR/podman-build-context-$randnum`
Fixes: https://github.com/containers/podman/issues/28113
Signed-off-by: Ashley Cui <acui@redhat.com>
Introducing a new `podmand system` subcommand to prepare a Windows host
to run Hyper-V based Podman machines: `hyperv-prep`.
When executed it:
- creates of the registry keys for VSocks
- adds the current user to the Hyper-V administrators group
This command requires an administrator terminal.
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
As found in fedora openQA testing on the kernel update this test fails
due a selinux denial.
The kernel now correctly checks the backing fs selinux context in all
cases. See kernel commit 82544d36b172 (selinux: fix overlayfs mmap()
and mprotect() access checks).
The test tries to access another container so the selinux level will
be different from the quadlet roofs container and therefore fail to
access the files.
To fix this we should be able to just use the regular image mount which
has a level all containers can access. The comment that this is not
parallel safe is untrue, mounts are reference counted so this should not
get unmounted all of the sudden by another test.
In fact we have another --rootfs test case where we do this and it
passed in openQA, see "podman run - check workdir".
Fixes: #28602
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
c/common uses the new netavark create command, so some of the error messages have slightly changed. Adjust the tests so they pass.
Signed-off-by: Ashley Cui <acui@redhat.com>
On main these tests fail right now due the parallel merge of commit
d01cd46830 ("test: remove outdated checkpoint skip") and commit
1b99ae56b0 ("New images 2026-04-24").
The new crun and/or criu versions in the CI images changed the error
message so adapt to that.
The new full error is:
Error: crun: (00.054135) Error (criu/cgroup.c:1998): cg: cgroupd: recv req error: No such file or directory: OCI runtime attempted to invoke a command that was not found
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Also remove one podman rm -t0 -fa call, the test cleanup does it already
so no need to do it twice.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When a container in a pod is stopped, its container name is removed from /etc/hosts. etchosts.Remove() filters for any entry matching the container name or the pod hostname. A pod with additional host entries like --add-host FQDN;pod-hostname:127.0.0.1 is affected by this deletion, too.
Only the container name needs to be removed when a container is stopped.
Signed-off-by: Clemens Klug <git@agp8x.org>
