Same failure #29910 fixed for create: with no pids limit to lift, there
is nothing to change, and the controller is often not delegated.
Signed-off-by: Victor Irzak <victor.irzak@zomp.com>
Problem:
When image scp transfers an image between local users, the save, load,
and tag subprocesses inherit the caller's working directory. Running
the transfer from a directory such as /root can fail because the
destination user cannot access that directory during rootless
initialization.
Fix:
Use the caller's physical directory to preserve relative paths and
avoid inaccessible symlinks in PWD. Return working-directory lookup
errors.
If subprocess startup fails with a permission error, retry once from /.
Restrict the retry to fork/exec errors so a Podman command that has
already started is never executed a second time. For the retry, create
a fresh command with the same credentials, environment, and output
handling.
Tests:
Extend the transfer test to use an inaccessible directory.
Run its sudo checks from /.
Add coverage for relative and absolute configuration paths and
missing-image errors.
Fixes#24247
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
Fix rootless Quadlet generator failure when a rootless templated unit
contains a dependency (e.g., Conflicts=) that points to a rootful
templated Quadlet unit.
The translateUnitDependencies function only looked up dependencies in
unitsInfoMap, which contains only units found in rootless directories.
When a rootless unit referenced a rootful template (e.g., test1@.container
in /etc/containers/systemd), the lookup failed with "unable to translate
dependency for %s".
This fix follows systemd's template dependency semantics: when a template
unit references another template unit, the instance name is propagated from
the source to the target. For example, test2@instance1.container with
Conflicts=test1@.container resolves to test1@instance1.service.
The implementation:
- Detects uninstantiated template dependencies (e.g., test1@.container)
- Extracts the instance name from the current unit if it's a template
- Generates the instance filename (e.g., test1@instance1.container)
- Checks if the generated instance exists in unitsInfoMap
- Returns an error if not found (no fallback to preserve typo detection)
- Does not propagate instance name for already-instantiated dependencies
- Does not propagate instance name when the source is not a template
This approach preserves the existing file-existence validation while
allowing template-to-instance resolution for symlinked rootful templates
in rootless directories.
Also adds regression tests for non-container resource types (volumes,
networks) to verify the fix works correctly for all Quadlet types.
Fixes: #29819
Signed-off-by: Rajkaran Yadav <yadavrajkaran854@gmail.com>
`podman wait --condition=exited` (and `=stopped`) returns immediately with
exit code 0 for a container that was created but never started. This
matches Docker's `not-running` semantics, but leaves no way to block until
the container has actually run and exited.
Move the Docker wait conditions from the compat API into libpod, so that
they are available to the CLI and the libpod REST API, and let the compat
handler use them instead of its own implementation:
* next-exit: wait for the next "died" event regardless of the current
state and return its exit code. Like Docker, removal also ends the wait
* not-running: the same as exited
* removed: wait until the container has been removed and return its exit
code, or 0 if it never ran
The docker compat handler uses the new `ready` callback in
`WaitForConditionWithInterval` to send its headers to keep the fix for #28514
Behavior changes of the compat API:
* not-running on a never-started container now always returns 0, before
they could ping-pong between -1 and 0
* next-exit returns when the container is removed, instead of blocking
forever, and fails if the event stream ends without a died event
* removed polls the container state at the wait interval
Fixes: #27423
Co-authored-by: Jan Rodák <hony.com@seznam.cz>
Co-authored-by: Tom Sweeney <tsweeney@redhat.com>
Signed-off-by: Dan Čermák <dcermak@suse.com>
Assisted-by: Claude Opus 5.5
Assisted-by: Gemini 4 Argon
ContainerWait() reports errors of the individual waits in the report and
not as its own error, which WaitContainerLibpod ignored. Wait failures then
result in a 200 instead of erroring out
Also do not write a second response after an internal server error
Signed-off-by: Dan Čermák <dcermak@suse.com>
Assisted-by: Claude Opus 5.5
podman kube down and podman play kube --down kept the last secret
removal error, then printed it only when a pod removal had also
failed. PrintErrors already writes every earlier error and returns
the last one, so a single secret failure produced no error line.
A pod failure with every secret removed printed Error: %!s(<nil>).
Print that saved error when it is set. Pod stop, pod removal, and
volume removal reporting stay as they were. The command still
returns only volume removal errors. Those errors are printed and
not returned.
The remote client JSON-decodes SecretRmReport. json-iterator writes
Err as a string, and encoding/json rejected that string, so kube
down exited 125 before it could print the secret error. ID and Err
use omitempty, so a nil error stays off the wire. The helper type
is secretRmReportHelper. Marshal and unmarshal are covered the same
way as PruneReport.
The secret teardown e2e replaces secretsdata.json with a directory,
so the delete fails for root and for an unprivileged user. kube down
stays exit 0 and the error is on stderr. AfterEach deletes the test
root, so the data file is not restored.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
As of conmon 2.2.0, conmon supports log file rotation via --log-rotate
and --log-max-files. This commit exposes those options through Podman's
REST API, specgen model, CLI (--log-opt), and libpod container runtime
so that users managing containers through the API can configure conmon
log rotation settings.
New --log-opt keys accepted:
max-file=<n> Maximum number of rotated log backup files.
Setting this implicitly enables log rotation.
log-rotate=true|false Explicitly enable or disable log rotation.
Options flow:
CLI / REST API
-> specgenutil parses and validates new opts
-> specgen.LogConfig.Options carries max-file and log-rotate
-> generate.MakeContainerFromSpec calls WithLogMaxFiles/WithLogRotate
-> libpod stores LogMaxFiles and LogRotate in ContainerConfig
-> oci_conmon_common.go passes --log-max-files/--log-rotate to conmon
podman inspect now reflects rotation settings in HostConfig.LogConfig.Config.
Fixes: https://github.com/containers/podman/issues/29543
Signed-off-by: prabhat-kumar96 <prabhatmathur9927@gmail.com>
Since gvisor-tap-vsock v0.9.0 (containers/gvisor-tap-vsock#718),
gvproxy and win-sshproxy no longer delete a leftover unix socket before
listening on it; they only remove it on a clean exit. When the proxy is
killed instead (host shutdown or restart, crash, SIGKILL), the API
socket is left behind and the next proxy fails to bind it:
- WSL: win-sshproxy exits and takes the named pipes with it, while
`machine start` still reports success.
- Hyper-V, macOS and Linux: gvproxy exits, which also breaks SSH
forwarding, so `machine start` fails (or hangs on macOS).
Remove the API socket in startNetworking, after cleanupStaleHostForwarder
has handled any orphaned proxy. On WSL a failed delete only warns, since
win-sshproxy serves only the API and SSH goes through wslrelay.
On macOS and Linux, `machine stop` also failed after gvproxy was killed
("looking up PID ...: process does not exist"); treat a missing gvproxy
as already stopped, as the Windows code does.
The "client connect to machine socket" e2e test now also kills the proxy
by the PID from its pid/tid file, restarts the machine and checks the API
again, and runs on Windows too.
Fixes: #29971
Signed-off-by: Srilal Sachintha <SrilalSachintha@Gmail.com>
systemd attributes a notification to a unit by the cgroup of its sender
when it reads the message. The podman process that sends READY for
--sdnotify=healthy exits right after sending it, and when systemd reads
the message only then, it is dropped and the unit runs into its start
timeout.
Add SendMessageWithBarrier, which sends BARRIER=1 with a pipe fd after
the message and waits up to five seconds until the receiver closes it,
as sd_notify_barrier(3) does. Use it where podman may exit after
notifying: MAINPID (and READY) after starting a container, READY once it
is healthy, and the fast path of kube play. A failed barrier is only
logged at debug level since the message itself was sent.
Also parse only the received control message in the proxy's listener.
It parsed the whole buffer, failed, and never closed the barrier fds.
The sdnotify system tests now receive on the notify socket with a new
podman-testing sd-notify-listen command instead of socat. socat keeps
the fds it receives, so every barrier ran into its timeout; the new
command closes them right away. BARRIER=1 is not logged.
Fixes: #29998
Signed-off-by: Tobias Wiesing <tobias@hueske.digital>
The remote secret rm looks every secret up first and only special-cases
a 404 from the server. Any other error response falls through to the
removal path with a nil inspect report, and podman-remote crashes on
secret.ID. This is easy to hit: if the given name is not a secret name
but matches the start of more than one secret ID, the server answers
with a 500 "secret is ambiguous".
Report the error for that secret instead, like the local code does, and
don't try to remove it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Update the generated Swagger specification so that Libpod API paths include the required version prefix. Keep the unversioned ping endpoint unchanged, reuse the version path parameter, and add tests for the path rewriting logic.
Fixes: #15376
Signed-off-by: JJordan0K <69581081+JJordan0C@users.noreply.github.com>
Fix four file descriptor leaks:
1. tunnel/images.go Import: os.Open(opts.Source) never closed
2. tunnel/images.go Save: second os.Open for oci-dir/docker-dir never closed
3. bindings/checkpoint.go Restore: os.Open(importPath) never closed
4. container_internal_common.go: os.Create in checkpoint volume export
loop not closed on five error paths
These are the same class of bug fixed in #28723 and #28724.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
When podman.service is socket-activated at user login it races with the
other podman units to set up the rootless pause process. If the
re-executed child loses the race for the pause PID file, podman falls
back to reexec_userns_join(), which forks again.
The parent of reexec_in_user_namespace() used to close the LISTEN_FDS
socket (fd 3) before this fallback, so the final child inherited a stale
fd 3 (the CLOEXEC user-namespace handle) and the journald datagram socket
then reused fd 3. The API service tried to accept(2) on a datagram
socket and failed with "accept4: operation not supported", leaving
podman.service failed at boot while a manual restart worked.
Move the close out of reexec_in_user_namespace() into a new
close_systemd_activation_fds() helper that the parent calls only after the
pause PID race is resolved. On the success path the fds are still closed
so they are not leaked for the lifetime of the child; on the race-lost
path they stay open so reexec_userns_join() can hand them to the final
child.
Fixes: https://github.com/podman-container-tools/podman/issues/29964
Signed-off-by: Jianqiang Liu <liujianqiang@uniontech.com>
Allows 'status!=value' in container filters, matching the existing
'label!' handling and the negation syntax of 'podman image list'.
Also treats 'status!' as an explicit status filter in ps so that
non-running containers are considered without --all.
Fixes#21398
Signed-off-by: shounakpatil <shounakpatil77@gmail.com>
Add [Quadlet] SetMountsDependency to select RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths.
Keep Requires as the default to preserve existing behavior and retain the required dependency on Podman's container storage directory.
Document the available values and the systemd version requirement for WantsMountsFor.
Add Quadlet integration fixtures covering Wants, Requires, None, and invalid values.
Fixes: #29946
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
Add a 30-second context timeout to the VM readiness SSH check in
conductVMReadinessCheck(). This prevents indefinite blocking when the SSH
server hangs (e.g., due to OpenSSH 10.2p1 interoperability issues).
LocalhostSSH and LocalhostSSHSilent remain uncapped to preserve indefinite
execution for legitimate long-running SSH commands like ansible-playbook
or Hyper-V client9p.
Add stale Starting-state recovery at the beginning of startLocked() to clear
mc.Starting=true when the provider reports the machine is Stopped or Running.
This recovers from hard process termination where deferred cleanup cannot execute.
The recovery only clears Starting when State() returns Stopped or Running,
preserving it for Starting, Unknown, and error cases to respect provider state
semantics.
Adds an E2E test that simulates persisted stale Starting=true state and
verifies that the next podman machine start recovers the state and starts
the machine successfully.
Fixes: #29880
Signed-off-by: Rajkaran Yadav <yadavrajkaran854@gmail.com>
- Read system_cpu_usage from /proc/stat (first 7 CPU fields, including idle) instead of cgroups.SystemCPUUsage(), matching Docker semantics.
- Use CPU values from GetContainerStats() instead of a second cgroup read to avoid a timing gap.
- Populate precpu_stats on stream=false with a 100 ms sampling pauseso the Docker CPU% formula returns a directionally correc snapshot. This only affects the compat per-container endpoint; podman-remote stats uses a separate libpod handler.
- Return cpu_stats.cpu as 0 for one-shot=true since the two samples are only milliseconds apart.
- Replace direct precpu copy instead of JSON marshal/unmarshal round-trip.
- Propagate errors via fmt.Errorf instead of logrus.Errorf, letting callers decide how to handle them. Parse errors in /proc/stat fields are hard errors instead of silently returning partial data.
- Document that --no-stream CPU% is a coarse ~100 ms snapshot; streaming gives 5-second interval readings.
Fixes: https://github.com/podman-container-tools/podman/issues/28761
Fixes: https://github.com/podman-container-tools/podman/issues/24730
Fixes: https://github.com/podman-container-tools/podman/issues/29912
Fixes: https://github.com/podman-container-tools/podman/issues/25709
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Jan Rodák