NetworkMode.IsNS matched any value starting with "ns" (e.g. a network named "nsproxy"), unlike UsernsMode.IsNS which requires the "ns:" prefix; require it. IsUserDefined also did not exclude pod, so a pod network was reported as user-defined; exclude it.
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
The nightly release validation builds both on main and the latest release branch,
we should upload the artifacts with a suffix to differentiate the two
Signed-off-by: Ashley Cui <acui@redhat.com>
These are AI generated (Gemini 3.5 Thinking). I have included the
full transcript as well so there is a further source of truth in
the event of error in the AI summary, but it seemed reasonably
accurate when I reviewed it.
Signed-off-by: Matt Heon <mheon@redhat.com>
The compat logs handler uses the tail query parameter both to select how
many log lines should be returned and as the capacity of the internal log
channel.
Only the former is part of the API semantics. The channel capacity should
not depend on a user-controlled value: negative values can produce an
invalid channel size, while very large values can cause excessive
allocation before any logs are read.
Use a small fixed-size buffer instead.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
PR #28860 requires non-quadlet files (e.g a Containerfile with no
recognized extension) to be passed as part of a named application.
Update tests added in #28696 to adhere to this requirment.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
The packit copr jobs are consumed by podman-machine-os release process
so any change to the copr targets should be mindful of this fact.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
convertNumber() strips the sign before parsing the numeric value and then
applies it back via a multiplier. The negative case uses -11 instead of
-1, causing negative values to be converted incorrectly.
This is visible for any caller using the signed result directly, and can
also produce surprising results for unsigned callers if the multiplication
overflows.
Use -1 for the negative multiplier.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
chrootarchive.Tar returns an io.ReadCloser backed by the tar-producing
process. The checkpoint export path copies from that stream into the
target file, but never closes the reader.
A successful copy reads the stream to EOF, so the producer normally exits.
On early errors, such as failing to create or chmod the target file, or a
copy error, the producer can be left without a consumer.
Close the tar stream after creating it so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
chrootarchive.Tar returns an io.ReadCloser backed by a pipe to the
tar-producing process. CRCreateRootFsDiffTar copies from the stream but
never closes it.
On the successful path the stream is read to EOF, so the producer normally
exits. On early errors, such as failing to create the destination file or
failing while copying to it, the producer can be left without a consumer.
Close the tar stream after it is created so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
