Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
log_path is currently set at the client side and is ignored by
the server in a remote session. This leads to either incorrect log_path
being considered by the server or not honored at all. Move the handling
from client to the server, in line with other flags such as log_driver.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
I was not able to find any external users of pkg/selinux but kept it
for now (and marked as deprecated) so we can remove it later.
PS pkg/selinux adds go:fix directives which are not (yet) recognized
by the gocheckcompilerdirectives linter, so add a temporary exception).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Commit cf021c4ba9 switched the logic to also allow golangci-lint in
$PATH but forgot to update the call here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Change isHyperVAdminMember from returning a bool to returning an error so that callers surface the specific failure reason — particularly distinguishing "not in the group" from "in the group but session not updated" (new ErrHypervUserSessionNotUpdated sentinel). This gives users actionable guidance instead of a generic permission error.
Signed-off-by: lstocchi <lstocchi@redhat.com>
Using modernize (aka go fix) from Go 1.26.3, implement the following
changes:
> pkg/rootless/rootless_linux.go:319:30: fmtappendf: Replace []byte(fmt.Sprintf...) with fmt.Appendf (modernize)
> err = os.WriteFile(uidMap, []byte(fmt.Sprintf("%d %d 1\n", 0, os.Geteuid())), 0o666)
> ^
> pkg/rootless/rootless_linux.go:339:30: fmtappendf: Replace []byte(fmt.Sprintf...) with fmt.Appendf (modernize)
> err = os.WriteFile(gidMap, []byte(fmt.Sprintf("%d %d 1\n", 0, os.Getegid())), 0o666)
> ^
> pkg/rootless/rootless_linux.go:381:6: rangeint: for loop can be modernized using range over int (modernize)
> for sig := 0; sig < numSig; sig++ {
> ^
> pkg/rootless/rootless_linux.go:432:24: stringsseq: Ranging over SplitSeq is more efficient (modernize)
> for _, entry := range bytes.Split(data, []byte{0}) {
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
- Populate the Docker-compatible container summary HostConfig from the
container inspect data
- Remove the unused ContainerCreateConfig wrapper from the compat
handler
- Add APIv2 test
Signed-off-by: Christopher Bii <christopherbii@hyub.org>
The swagger spec generated from pkg/api/server/doc.go sets the contact
URL to https://podman.io/community/. That URL now returns 404, while
https://podman.io/community (no trailing slash) returns 200 and is what
the live site links to from its own navigation. Issue #28298 reports
the link as broken at the top of the rendered API reference, which is
where ReDoc surfaces the contact field.
Drop the trailing slash so the contact link in the generated swagger
spec resolves.
Signed-off-by: Matt Van Horn <mvanhorn@gmail.com>
Add missing defer Close() calls in four locations:
- libpod/container.go: specFromState() opens the container config file
but never closes it after reading, leaking one fd per call.
- libpod/container_internal_common.go: checkpoint() and restore() each
open the bundle directory for CRIU statistics but never close it,
leaking one fd per checkpoint/restore operation.
- pkg/machine/shim/host.go: Init() opens the playbook file but never
closes it after ReadAll, leaking one fd per machine init.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
The os.Open(dirPath) call opens a directory handle used for
Readdirnames() but never closes it, leaking one file descriptor
per call to loadAndMergeConfig().
Add defer dir.Close() after the error check.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Add a --dry-run option to show which volumes would be pruned without removing them.
Related: #27838
Signed-off-by: KyounghoonJang <matkimchi_@naver.com>
This is a Docker compatibility change discovered while working on
cases it is practically speaking required because there are
mandatory parameters in the body, but in those cases you do not
get a JSON decode error back, you get an error about the field
that needs to be set. I see no reason for us not to match this
convention; it doesn't break our existing bindings, but makes
using the API via curl or similar somewhat easier.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
The Docker daemon emits a final `{"aux":{"Tag","Digest","Size"}}` JSON
object on the push event stream so clients can recover the registry-side
manifest digest without an extra registry round-trip.
Several Docker-API clients (e.g. the Pulumi and Terraform docker
providers) parse `aux.Digest` to populate their pushed-image outputs.
Without the trailer they either silently fall back to inspecting the
local image (whose digest does not always match what was pushed - see
containers/podman#14779) or emit "Push completed without reporting a
digest" warnings.
`pushReport.ManifestDigest` is already populated with the correct
on-the-wire digest from `manifest.Digest(pushedManifestBytes)`; this
change just wraps it into the same JSON shape Docker emits and adds an
apiv2 test asserting the trailer is present with Tag, Digest, and Size.
Signed-off-by: nitz <nitz.raz@gmail.com>
With podman 6 we have a --import-native-ca option that handles the
copying of certs much better.
As such remove our old legacy way of copying files these envs and also
the static certs.d dir. Since we now mount the full containers config
dir the certs from the cert.d are mounted already.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The other providers use the volume mounts from containers.conf which
should take care of it. But because WSL is not using this we need to
hard code this ourselves.
Add a new custom unit to make systemd mount the path like we do for
podman socket mounts.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
