The Docker-compat secret inspect endpoint was incorrectly honoring
the showsecret query parameter, which could expose plaintext secret
data to clients using the Docker-compatible API.
This restricts showsecret to libpod-only requests. Docker-compat
clients always receive redacted secret data, matching Docker's own
behavior.
Add APIv2 tests covering the showsecret behavior on both the
Docker-compat and libpod endpoints, confirming secret data is never
returned from the compat endpoint while libpod continues to honor
the flag.
Fixes: #29570
Signed-off-by: Davoud Azari <davidmotral@gmail.com>
podman farm build pushes each per-arch image to the registry by
appending `UnknownDigestSuffix` to the image specified using --tag. This
fails because a tag is not expected when UnknownDigestSuffix is used.
Parse the image reference and pass only the untagged image
reference when podman does this suffixed push to the registry.
Fixes#25039
Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
The manifest push and create endpoints accept query parameters that
were never documented, so API users can't discover them.
Push was missing compressionFormat, compressionLevel, format and
removeSignatures. Create was missing annotation and annotations.
The wording matches the same parameters on the image push endpoint.
The deprecated v3 push and add endpoints are left alone.
Signed-off-by: Anisha Khairnar <anishakhairnar284@gmail.com>
POST /containers/create now takes Options as part of HostConfig.Mounts.TmpfsOptions to set options for tmpfs mounts.
Signed-off-by: Ashley Cui <acui@redhat.com>
Replaces regexp.MustCompile with regexp.Delayed from go.podman.io/storage/pkg/regexp
for global regular expressions. This avoids compiling regular expressions
during the global init scope, improving startup performance for all commands.
Tests are kept using regexp.MustCompile where applicable.
Fixes: #29510
Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>
When passing an error to fmt.Errorf or logrus with formatting verbs like
%v or %w, it is not necessary to explicitly call err.Error(). The format
functions will automatically call the Error() method because the value
implements the error interface. Removing these explicit calls makes the
code cleaner and more idiomatic.
Fixes: #29501
Signed-off-by: Vishnu Kothakapu <vishnukothakapu27@gmail.com>
ListenSetupWait() waited on errChan with no timeout, so podman machine
init/start could hang forever if the guest never signaled ready. Added
waitForReady(errChan, timeout) with a 30 second bound. Full details in
the issue.
Fixes: #29455
Signed-off-by: Rudra Dudhat <contact.rdudhat@gmail.com>
Replace deprecated swagger:alias with swagger:model for ImagePullStatus
and ArtifactPullStatus. Add explicit swagger:model annotations with
unique names to Podman types that collide with vendor types
(DriverData, PruneReport, RootFS, Secret, ThrottleDevice, WeightDevice,
Version) to resolve colliding model name warnings from go-swagger.
The types from libpod/define use a Libpod prefix, matching LibpodInfo
which already does that. Apart from the prefix the names are the ones
go-swagger derives on its own, so the annotations mostly just make the
naming explicit so the tool stops warning about it.
This does not close#29199 entirely. The two remaining name collisions
(Mount and Summary) are each between two vendored types, so they cannot
be controlled from the Podman side, and the dropped-ref-sibling
warnings are a separate problem.
Related: #29199
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
The InstalledProviders and SupportedProviders functions were only
used in their own tests and were otherwise dead code. Removing them
entirely cleans up the API surface.
Signed-off-by: Aryanbhargava18 <aryanbhargava644@gmail.com>
Remove an unnecessary null byte write after copying preexec hook names.
The write was performed one byte past the allocated buffer because the
filename copy already included the string terminator.
Signed-off-by: Artem Krasovskiy <aibure@altlinux.org>
Paul Holzinger