The healthcheck log could be corrupted if the
process was interrupted mid-write. It could
lead to Podman crashing.
Write the log files atomically and diferentiate
between corrupted log and different errors in
consumers of readFromFileHealthCheckLog().
Add a system test for a corrupted log file.
Change incorrect log permissions to 0o600.
Fixes: https://redhat.atlassian.net/browse/RHEL-178222
Signed-off-by: Marek Simek <msimek@redhat.com>
chrootarchive.Tar returns an io.ReadCloser backed by the tar-producing
process. The checkpoint export path copies from that stream into the
target file, but never closes the reader.
A successful copy reads the stream to EOF, so the producer normally exits.
On early errors, such as failing to create or chmod the target file, or a
copy error, the producer can be left without a consumer.
Close the tar stream after creating it so error paths release the pipe and
allow the producer to exit.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>
This have been deprecated in podman 1.9, it is safe to assume they are
no longer used by anyone one a recent version.
If someone would update from the old version to 6+ they would run into
much more issues already so this can be safely dropped IMO.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Checking the state outside of locks is not safe and does not guarantee
us anything as the container could be stopped afterwards anyways.
So just skip the state check and then later in the exec logic we do the
same check again and return ErrCtrStateInvalid so just handle that
afterwards.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This is used incorrectly by execLightweight which called the function
unlocked which of course does not show up normally as only when there
is a race condition that makes the removal fail we go to unlock and then
the process panics as a double unlocked is not allowed.
While we could fix the caller such incorrect use is way to easy and
the unexpected lock/unlock cycle is basically never expected. Instead
just keep the container locked, that may prevent other commands from
doing something with the container in parallel but the error should be
rare enough to not matter most of the time. And we wait 5s max so it is
not a long time either.
To try to make the wait interval a bit faster poll every 50ms now as we
no longer have to the expensive locking and db sync each iteration.
Fixes: #29012
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
The exec API accepts a ConsoleSize but it is dropped: the exec
pseudo-terminal is created at its default size and only corrected
afterwards by an asynchronous resize. A short-lived exec that reads its
window size at startup (e.g. `stty size`) can therefore observe the wrong
size, because the resize may arrive after the process has already read it.
docker applies the size at creation.
Carry the requested ConsoleSize through ExecConfig and into the exec OCI
process spec (process.consoleSize) so the runtime sizes the terminal
before the process starts, removing the race. The local and remote CLIs
capture the caller's terminal size when -t is given and pass it through
ExecOptions, matching the behavior of `podman run`.
Re-enable the previously flaky `podman exec` case in the interactive
system test, which this change makes deterministic.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
With podman machine, gvproxy forwards published ports by binding them on
the host (not inside the VM) and runs unprivileged. macOS refuses to bind
a privileged port (< 1024) to a specific IP for a normal user, even though
binding all interfaces is fine, so publishing e.g. -p 127.0.0.1:80:80 used
to fail with an opaque "something went wrong with the request".
Pass the published ip:port into the gvproxy error helper and, when the body
says "permission denied" for a < 1024 port on a specific IP, return an
error that explains gvproxy binds on the host and suggests dropping the
host IP or using a port >= 1024. The raw body is kept for every other case.
Add unit tests for the helper.
Fixes: #28009
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
This replaces the misspelled word in comments "Exosed" with the correct spelling "Exposed" in the file container_inspect.go.
Fixes: #28927
Signed-off-by: Priyansh Sao <saopriyansh06@gmail.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
After checkpoint the SHM tmpfs can briefly return EBUSY while the
kernel releases mount propagation references. Use lazy unmount
instead of retrying, as suggested by review.
Fixes flake: `podman checkpoint/restore ip and mac handling`
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
When --pause defaults to true, a Ctrl-C during commit would leave the
container paused. Register a shutdown handler that unpauses the
container on SIGINT/SIGTERM so it is always restored to its running
state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
ContainerStateStopping is still a running state where processes are
active, so it should also be paused during commit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
I was not able to find any external users of pkg/selinux but kept it
for now (and marked as deprecated) so we can remove it later.
PS pkg/selinux adds go:fix directives which are not (yet) recognized
by the gocheckcompilerdirectives linter, so add a temporary exception).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add CDI information to podman info and podman system info.
The host info now includes the configured CDI spec directories and the
currently discovered CDI devices. The devices are resolved when the info
endpoint is called and there is no need to refresh these in the background.
Also map the same data into the Docker-compatible /info response as CDISpecDirs and DiscoveredDevices.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Creating lookup tables for runtime support is unnecessary, simply verify if the target string exists within the arrays.
Signed-off-by: zhongchunhe.zch <zhongchunhe.zch@qq.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add rootless_port_forwarder="pasta" option that uses pesto to update
pasta's forwarding table via UNIX socket, preserving source IPs that
rootlessport's userspace proxy masks.
HostIP is stripped from port mappings in the netavark wrapper when
pasta forwarding is active because pesto handles host-side binding
while pasta's splice changes the destination IP that netavark DNAT
expects. Pesto binds both 0.0.0.0 and [::] for dual-stack support.
Fixes: https://redhat.atlassian.net/browse/RUN-2214
Fixes: https://github.com/containers/podman/issues/8193
Fixes: https://redhat.atlassian.net/browse/RUN-3587
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
When a network is created without gateway, i.e. --internal --disable-dns
then the gateway will be nil. But converting a nil ip to string produces
"<nil>" which is not what we want as we like an empty string there to
signal that the network has no gateway.
Fixes: #28705
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
- libpod/events.go & libpod/runtime.go: Added the `Artifact` event type.
Refactored and deduplicated event forwarding logic by introducing
`spawnEventForwarder[T any]`, replacing separate goroutine loops for
images and artifacts. Implemented graceful shutdown and resolved eventer
initialization race conditions.
- libpod/events: Implemented event filtering by name/ID, updated journald
and logfile readers/writers for artifact events, and added `Artifact` to
`ToHumanReadable` formatting.
- cmd/podman: Added shell auto-completion for `artifact=` and `type=artifact` filters.
- docs/test: Documented the `artifact` event type, statuses, and filters in
`podman-events.1.md`. Added an end-to-end test in `events_test.go` to verify
event emissions.
Signed-off-by: Byounguk Lee <nimdrak@gmail.com>
Add missing defer Close() calls in four locations:
- libpod/container.go: specFromState() opens the container config file
but never closes it after reading, leaking one fd per call.
- libpod/container_internal_common.go: checkpoint() and restore() each
open the bundle directory for CRIU statistics but never close it,
leaking one fd per checkpoint/restore operation.
- pkg/machine/shim/host.go: Init() opens the playbook file but never
closes it after ReadAll, leaking one fd per machine init.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Add a --dry-run option to show which volumes would be pruned without removing them.
Related: #27838
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
