Add [Quadlet] SetMountsDependency to select RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths.
Keep Requires as the default to preserve existing behavior and retain the required dependency on Podman's container storage directory.
Document the available values and the systemd version requirement for WantsMountsFor.
Add Quadlet integration fixtures covering Wants, Requires, None, and invalid values.
Fixes: #29946
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
- Read system_cpu_usage from /proc/stat (first 7 CPU fields, including idle) instead of cgroups.SystemCPUUsage(), matching Docker semantics.
- Use CPU values from GetContainerStats() instead of a second cgroup read to avoid a timing gap.
- Populate precpu_stats on stream=false with a 100 ms sampling pauseso the Docker CPU% formula returns a directionally correc snapshot. This only affects the compat per-container endpoint; podman-remote stats uses a separate libpod handler.
- Return cpu_stats.cpu as 0 for one-shot=true since the two samples are only milliseconds apart.
- Replace direct precpu copy instead of JSON marshal/unmarshal round-trip.
- Propagate errors via fmt.Errorf instead of logrus.Errorf, letting callers decide how to handle them. Parse errors in /proc/stat fields are hard errors instead of silently returning partial data.
- Document that --no-stream CPU% is a coarse ~100 ms snapshot; streaming gives 5-second interval readings.
Fixes: https://github.com/podman-container-tools/podman/issues/28761
Fixes: https://github.com/podman-container-tools/podman/issues/24730
Fixes: https://github.com/podman-container-tools/podman/issues/29912
Fixes: https://github.com/podman-container-tools/podman/issues/25709
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Adds a -l/--label CLI flag to podman kube play and wires it through
the API, bindings, and ABI so user-provided labels are applied to pods,
PVCs, and secrets created from Kubernetes YAML.
Key features:
- Labels are merged with YAML labels (CLI takes precedence)
- Validation uses Kubernetes qualified-name rules (RFC1123 subdomains)
- Value validation enforces 63-char limit and charset rules
- Separate merge and validate functions (SOLID principle)
- Uses maps.Clone for cleaner merging
Fixes:
- Removed incorrect annotations size limit from label validation
- Refactored to call annotations.IsQualifiedName for key validation
- Added proper documentation for max key length enforcement
Closes#26450
Signed-off-by: Sakthi Harish <sakthi.harish@edgeverve.com>
Some commands inside existing man-page code fences were missing
the $ or # prompt described in MANPAGE_SYNTAX.md. Added the missing
prompts and documented how the new check works.
Added a check to xref-helpmsgs-manpages for fenced blocks in EXAMPLE
and EXAMPLES sections. It checks unlabelled blocks and blocks labelled
sh, bash, shell, or console. After skipping blank lines and ###
comments, it reports an error if the first remaining line starts
with bare podman or sudo podman. The error includes the file and
line number.
Only that first remaining line is checked, since later lines may
contain command output. Blocks labelled for Windows shells are
excluded from the Unix prompt check. Added powershell labels to
the existing Hyper-V example fences.
Added regression tests and included them in the tooling self-tests.
These tests do not need a built Podman binary or generated docs.
Also fixed the existing volume-prune test, which still looked for
driver and opt rows that were removed from the man page. Using the
existing label and until rows restores both checks for a misplaced
negated filter and a duplicate filter entry.
Fixes: https://github.com/podman-container-tools/podman/issues/26428
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
Unqualified names with --all-tags always resolve via docker.io rather
than registries.conf search lists. Spell that out, and note that
--include-volumes only applies when set to true.
Fixes#23625Fixes#15387
Signed-off-by: Dean Chen <862469039@qq.com>
Quadlet currently requires an explicit instance file or symlink
before it reads that instance's drop-ins.
Discover instance-specific drop-in directories that match a loaded
template and create an in-memory copy of the template for each
instance. Apply the existing drop-in merging and service generation
logic to these copies. Explicit instance files and symlinks retain
priority.
An empty instance drop-in directory also creates an instance. It
inherits the template's settings and applicable drop-ins, including
[Install] settings that can create startup symlinks. Document this
behavior in the Quadlet man page.
Reject empty and dot instance names during discovery. Avoid extra
stat calls for ordinary directories while continuing to follow
symlinks to drop-in directories. Use Quadlet's existing debug logger.
Add table-driven unit tests with case-specific input files covering
drop-in precedence, instance isolation, empty directories, explicit
instances, separate search paths, supported unit types, and symlink
handling. Add an E2E test that checks generated services, inherited
settings, and startup symlinks without explicit instance files.
Fixes: #27636
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
Support for these was removed in 3721ff82ff as the feature is
inherently insecure. Checkpoints imply an extremely privileged
operation that is incompatible with the constraints of a
`podman run` command. However, we should still tell folks that
it no longer works with a clear error message. This is done
during Specgen processing, server side, which should be safer
than the previous client-side processing for these.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Add an example to podman-container-inspect(1) demonstrating how to query whether a container is an init container and check its type using --format.
Follow-up to #29818.
Signed-off-by: Malhar Jivrajani <mjivraja@redhat.com>
Allow deployments and scheduled jobs to update a selected group of
containers without checking every auto-update-enabled application.
Reuse the existing container filters and expose them through the CLI,
remote bindings, and REST API.
Filter update candidates while preserving systemd unit and pod restart
behavior. Document the selection semantics and cover filtered updates,
invalid input, remote requests, and pod restarts in the existing tests.
Signed-off-by: Evan Purkhiser <git@evanpurkhiser.com>
Podman 6 dropped cgroups v1 support, and the kernel real-time
scheduler cgroup settings only exist on cgroups v1. That means the
--cpu-rt-period and --cpu-rt-runtime options can never take effect
anymore: on cgroups v2 the values only produce a warning and are
discarded.
As agreed in the linked issue, the full removal of the options is
deferred to the next major release (7.0) to avoid a breaking change
for anyone still setting them. For 6.x this commit implements the
agreed interim step:
- remove the option documentation (docs/source/markdown/options/
cpu-rt-period.md and cpu-rt-runtime.md) and drop the @@option
references from the podman-create, podman-run, podman-update and
podman-container-clone man pages
- hide both flags from --help output
- change the existing warning to state that the option is a NOP,
that the value is ignored, and that the option will be removed in
the next major release
The e2e tests are updated to match the new warning text. Actual
removal of the flags and the spec fields is left for Podman 7.0.
Part of #29750
Signed-off-by: seonghun lee <harrisleesh@gmail.com>
The value given to --ulimit is passed to the container unchanged and is
interpreted by setrlimit(2), so size limits such as memlock are in bytes.
The ulimit shell builtin scales most of those values when printing them
(kbytes for -d, -l, -m, -s, 512-byte blocks for -c, -f), which makes the
value reported inside the container look wrong.
Document the unit used by each limit type, add an example, and note that
unit suffixes are not accepted. No behavior change.
Fixes: #25236
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
podman events --filter network=<name> was unconditionally returning
'NETWORK is an invalid filter' because the NETWORK case was absent
from the generateEventFilter switch statement in filters.go.
All other first-class event types (container, image, pod, volume)
had corresponding filter cases, but the Network type - despite being
fully defined in config.go along with NetworkConnect/NetworkDisconnect
statuses and the Event.Network field - had no handler.
Add the NETWORK case to filter by network name (e.Network), consistent
with Docker's --filter network= behaviour. ID-prefix matching is
intentionally omitted: for network connect/disconnect events e.ID
holds the container ID, not the network ID, so prefix matching would
only work for create/remove events and silently miss join/leave events.
Also add unit tests (filters_test.go), integration tests
(test/e2e/events_test.go, test/system/090-events.bats), shell
completion support for --filter network= (completion.go), and
document the new filter key in the man page.
Fixes: https://github.com/podman-container-tools/podman/issues/29387
Signed-off-by: Aftab Ali <aftab123215@gmail.com>
Until now the default could only be expressed by leaving the option off, which
reads as an omission rather than a choice and gives a script no way to say it
wants the archive transferred as podman save wrote it.
Accept none as a format meaning exactly that. It is taken on the API path too,
so both interfaces share one vocabulary, and it is treated as the absence of a
format throughout: nothing is compressed, a level attached to it is rejected the
same way a level with no format is, and the local user to user transfer has
nothing to warn about ignoring.
The remote client still leaves it off the request, so naming the default does
not make a transfer fail against a service that predates these options.
Signed-off-by: Scott Callaway <github@scottcallaway.co.uk>
Expose the compression the transfer already knows how to do, and document what
each option means on each path.
--compression-format takes gzip or zstd, matching the vocabulary
--compression-format already uses on podman push, minus the algorithms this
cannot produce or detect. --compression-level takes the level, and is rejected
without a format to apply it to rather than being silently ignored.
The level needs one caveat spelling out in the man page. A remote source passes
it to the command line compressor, where every value is distinct. A local source
compresses through c/image, which groups zstd levels into four bands, so 10 and
above are the same there. The accepted zstd range also stops at 19 rather than
podman push's 20, because the command line compressor needs --ultra past that.
The flags are validated before the engine is reached, so podman --remote reports
a bad combination without a round trip; the transfer validates again for callers
arriving over the API.
Fixes: #23192
Signed-off-by: Scott Callaway <github@scottcallaway.co.uk>
Do not set RemainAfterExit=yes by default when converting Quadlet
.volume files to systemd oneshot services.
Setting RemainAfterExit=yes causes systemd to consider the volume
service active even after the volume is deleted manually, preventing
systemd from re-executing volume creation when dependent container
services restart.
Fixes#27862
Signed-off-by: Sachin Mahajan <sachinmahajan903@gmail.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
Problem: podman artifact ls has no way to print just artifact
identifiers. Scripts that want to act on artifacts (e.g. remove them)
have to parse table output or use --format {{.Digest}}. Every other
listing command in podman (images, ps, artifact push/pull) already
supports -q/--quiet for this.
Impact: users can now run `podman artifact ls --quiet` to get one
digest per line, no header, suitable for piping into other podman
commands.
Change: adds a --quiet/-q bool flag to the list command. When set (and
--format is not also given), output.Digest is printed for each
artifact instead of the table.
Signed-off-by: umar11b <uzaman2018@gmail.com>
Several of the examples given for `podman manifest add` were missing the manifest name argument and one had a `sudo` prefix.
Signed-off-by: Jonathan Dowland <jdowland@redhat.com>
Document the default_host_ips option here to make it more visible. And
clarify the default v4/v6 bind behavior.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The 'podman artifact ls' command supports a --format flag accepting a go template string. Some commands (eg 'podman image ls') accept a --format=json parameter, and export pure json object to stdout.
This change adds a --format=json output mode to artifact lists too.
Includes simple documentation mention of --format=json option alongside go template description.
Signed-off-by: ellieayla <1447600+me@users.noreply.github.com>
podman farm build pushes each per-arch image to the registry by
appending `UnknownDigestSuffix` to the image specified using --tag. This
fails because a tag is not expected when UnknownDigestSuffix is used.
Parse the image reference and pass only the untagged image
reference when podman does this suffixed push to the registry.
Fixes#25039
Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Paul Holzinger