When multiple containers in a pod YAML specify the same hostPort,
podman kube play previously accepted the YAML and started the
containers, causing one of them to fail at runtime with a confusing
bind() error.
Add early validation in getPodPorts() to detect duplicate
(hostIP, hostPort, protocol) tuples across containers and return
a clear error message naming both conflicting containers.
Fixes: https://github.com/podman-container-tools/podman/issues/26622
Signed-off-by: Miguel Álvarez <mialvare@redhat.com>
FCOS symlinks /home to var/home. systemd rejects a mount unit whose
Where= path traverses a symlink, breaking default home dir mounts.
Resolve known FCOS symlinks before writing the ignition unit.
Fixes: #28911
Signed-off-by: Chanhyeok Seo <chanhyeok.seo@datadoghq.com>
Add a podman volume rename command, REST API endpoint, and bindings for renaming volumes.
The rename updates both the VolumeConfig and VolumeState tables in a single transaction and moves the volume directory on disk, rolling back if the transaction fails. Renaming an anonymous volume converts it to a named volume. Volumes that are in use, mounted, or backed by a volume plugin or the image driver cannot be renamed.
Fixes: #28189
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
When returning error http code (e.g. 4xx, 5xx) the body needs to contain
a JSON that has a key "message" in it,
we must not use jsonmessage.JSONMessage.
The JSON of shape jsonmessage.JSONMessage is used only when client
already received 200.
Signed-off-by: Matej Vašek <matejvasek@gmail.com>
With podman-remote we do not enter a our user namespace like we do with
local podman so we keep running with the real user id.
So if we then try to use chrootarchive as normal user it fails with:
creating mount namespace before pivot: operation not permitted
So simply revert back to the normal archive code.
Now the more interesting thing is we do have a test
"podman save to directory with oci format" but it never runs
rootless+remote in our CI system with our current matrix as we wanted to
reduce jobs.
So rethink the matrix and add one such job as this shows it is needed.
Fixes: 25aee24cbd ("use chrootarchive over plain archive package")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This fixes two problems when parsing ports.
First, check for host port conflicts. When we are given the same ip:host
port combo twice then we need to reject that as invalid, the backend
cannot bind the same port twice and thus we always get a runtime
failure. Failing early in the create code path is much better.
Second, when assigning random ports for expose we still have to check
for proper conflicts. The first error was using allUsedContainerPortsMap
to check for conflicts but this holds container side ports, we need to
ensure there are no conflicts on the host port.
Then there was the other issue that the array in the map was copied and
accessed by value on lookup. And because the code did not reassign the
value it then failed to actually update the correct ports.
To address that I switch the map to store the array by reference which
will avoid the bigger copies as we only need to update the pointer now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
systemd interprets % as specifier characters in unit configuration files
(e.g. %H, %u, %40). Proxy environment variable values that contain
percent-encoded URL characters (such as %40 for @ in usernames) cause
systemd to emit warnings and fail to parse the generated
/etc/systemd/system.conf.d/default-env.conf:
system.conf.d/default-env.conf:2: Failed to resolve specifiers in
HTTP_PROXY=http://user%40example.com@proxy:3128
Fix by adding a bash variable substitution that doubles every % to %%
before writing to the systemd unit conf files. The profile.d and
environment.d destinations do not need this escaping and continue to
use the original value.
Fixes#28698
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
log_path is currently set at the client side and is ignored by
the server in a remote session. This leads to either incorrect log_path
being considered by the server or not honored at all. Move the handling
from client to the server, in line with other flags such as log_driver.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
I was not able to find any external users of pkg/selinux but kept it
for now (and marked as deprecated) so we can remove it later.
PS pkg/selinux adds go:fix directives which are not (yet) recognized
by the gocheckcompilerdirectives linter, so add a temporary exception).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add CDI information to podman info and podman system info.
The host info now includes the configured CDI spec directories and the
currently discovered CDI devices. The devices are resolved when the info
endpoint is called and there is no need to refresh these in the background.
Also map the same data into the Docker-compatible /info response as CDISpecDirs and DiscoveredDevices.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Commit cf021c4ba9 switched the logic to also allow golangci-lint in
$PATH but forgot to update the call here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Change isHyperVAdminMember from returning a bool to returning an error so that callers surface the specific failure reason — particularly distinguishing "not in the group" from "in the group but session not updated" (new ErrHypervUserSessionNotUpdated sentinel). This gives users actionable guidance instead of a generic permission error.
Signed-off-by: lstocchi <lstocchi@redhat.com>
