- Read system_cpu_usage from /proc/stat (first 7 CPU fields, including idle) instead of cgroups.SystemCPUUsage(), matching Docker semantics.
- Use CPU values from GetContainerStats() instead of a second cgroup read to avoid a timing gap.
- Populate precpu_stats on stream=false with a 100 ms sampling pauseso the Docker CPU% formula returns a directionally correc snapshot. This only affects the compat per-container endpoint; podman-remote stats uses a separate libpod handler.
- Return cpu_stats.cpu as 0 for one-shot=true since the two samples are only milliseconds apart.
- Replace direct precpu copy instead of JSON marshal/unmarshal round-trip.
- Propagate errors via fmt.Errorf instead of logrus.Errorf, letting callers decide how to handle them. Parse errors in /proc/stat fields are hard errors instead of silently returning partial data.
- Document that --no-stream CPU% is a coarse ~100 ms snapshot; streaming gives 5-second interval readings.
Fixes: https://github.com/podman-container-tools/podman/issues/28761
Fixes: https://github.com/podman-container-tools/podman/issues/24730
Fixes: https://github.com/podman-container-tools/podman/issues/29912
Fixes: https://github.com/podman-container-tools/podman/issues/25709
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Unqualified names with --all-tags always resolve via docker.io rather
than registries.conf search lists. Spell that out, and note that
--include-volumes only applies when set to true.
Fixes#23625Fixes#15387
Signed-off-by: Dean Chen <862469039@qq.com>
Allow deployments and scheduled jobs to update a selected group of
containers without checking every auto-update-enabled application.
Reuse the existing container filters and expose them through the CLI,
remote bindings, and REST API.
Filter update candidates while preserving systemd unit and pod restart
behavior. Document the selection semantics and cover filtered updates,
invalid input, remote requests, and pod restarts in the existing tests.
Signed-off-by: Evan Purkhiser <git@evanpurkhiser.com>
Podman 6 dropped cgroups v1 support, and the kernel real-time
scheduler cgroup settings only exist on cgroups v1. That means the
--cpu-rt-period and --cpu-rt-runtime options can never take effect
anymore: on cgroups v2 the values only produce a warning and are
discarded.
As agreed in the linked issue, the full removal of the options is
deferred to the next major release (7.0) to avoid a breaking change
for anyone still setting them. For 6.x this commit implements the
agreed interim step:
- remove the option documentation (docs/source/markdown/options/
cpu-rt-period.md and cpu-rt-runtime.md) and drop the @@option
references from the podman-create, podman-run, podman-update and
podman-container-clone man pages
- hide both flags from --help output
- change the existing warning to state that the option is a NOP,
that the value is ignored, and that the option will be removed in
the next major release
The e2e tests are updated to match the new warning text. Actual
removal of the flags and the spec fields is left for Podman 7.0.
Part of #29750
Signed-off-by: seonghun lee <harrisleesh@gmail.com>
The value given to --ulimit is passed to the container unchanged and is
interpreted by setrlimit(2), so size limits such as memlock are in bytes.
The ulimit shell builtin scales most of those values when printing them
(kbytes for -d, -l, -m, -s, 512-byte blocks for -c, -f), which makes the
value reported inside the container look wrong.
Document the unit used by each limit type, add an example, and note that
unit suffixes are not accepted. No behavior change.
Fixes: #25236
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
Document the default_host_ips option here to make it more visible. And
clarify the default v4/v6 bind behavior.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When --group-add keep-groups (or GroupAdd=keep-groups in Quadlet) is
used, supplementary groups are inherited from the calling process. When
Podman is launched via a systemd user service, the calling process is
the systemd --user manager, which only has the groups assigned to the
user at the time the manager was started.
If the user was added to new groups after the systemd user session
started (e.g. via usermod), those groups will not be visible to the
container. This is expected Linux process credential behavior, but was
undocumented, causing confusion for Quadlet users.
Add notes to both option and Quadlet docs explaining this behavior and
the workaround (restarting the user's systemd manager).
Fixes: #27876
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
With netavark v2 we require true not 1.
This was correctly changed in commit bb02e49080 but then reverted in
commit 7612af4c0e again as it did not properly rebase and solve the
conflicts.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The docs, the create/run --help text and the shell completion all show
"bind" as the main/default value for --image-volume. That's wrong: the
accepted values are ignore | tmpfs | anonymous
(pkg/specgen/container_validate.go), the default is anonymous
(pkg/specgen/specgen.go), and "bind" is only a deprecated alias the code
maps to anonymous (pkg/specgenutil/specgen.go,
pkg/specgen/generate/kube/kube.go).
Show "anonymous" everywhere (options man page, the Quadlet ImageVolume=
key, --help, completion) and note that "bind" still works as a deprecated
alias. Behavior is unchanged.
Fixes: #27674
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
Extract the --reload-systemd option text into a shared option file
at docs/source/markdown/options/reload-systemd.md and reference it
with @@option in both podman-quadlet-install and podman-quadlet-rm
manpages, following the established pattern for shared options.
Rename the manpages from .md to .md.in to indicate preprocessing.
Fixes#28370
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Clarify that auto-generated names may use underscores, that DNS-enabled
networks resolve container names as given, and that container_name_as_hostname
changes the UTS hostname only.
Fixes: https://github.com/containers/podman/issues/28754
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Buildah v1.44.0 now uses --compression-format, --compression-level, and
--force-compression options. Add these options to the build and farm
man pages.
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
This commit does the following:
- Splits the podman-systemd.unit.5.md into multiple files - one for each quadlet file type.
- Adds the podman-quadlet-basic-usage.7.md for quadlet examples.
- Majority of the text in the new files is copied from the podman-systemd.unit.5.md
- Adds support for very simple condditional in the markdown_preprocess.
- Uses new logic in markdown_preprocess in options/*.md to use a single .md file for both
podman subcommands man-pages and quadlet man-pages. This deduplicates the Quadlet man-pages a lot.
- Adds new `@@option quadlet:source.md`` preprocess command to import such .md files from options directory.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
These are two new Buildah flags that we need to wire into Podman
(both local and remote) and document, with the interesting note
that one requires the other and a check needed to be added for
that.
Also: secret parsing was tightened up in Buildah, and was
breaking the remote build tests. Rewire it to use the new parser
Buildah made, which ends up simplifying the code considerably.
Tests are back to passing afterwards.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Update all documentation files to remove slirp4netns references
and update to pasta as the only rootless networking backend.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add tests for multiple static IPs per container across single and multi-subnet networks.
Document --network option for comma-separated IPs and subnet-based IP ordering.
Fixes: https://issues.redhat.com/browse/RHEL-98277
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
This allows things like compose project names to be associated with log
messages and later used in log processing and analysis.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
Quadlet list always reports the heading, even when using custom
formatting strings. This doesn't follow the behavior of other podman
list commands. Borrow some logic and the "--noheading" flag from the
container list command to make this behavior uniform.
Signed-off-by: Randolph Sapp <rs@ti.com>
Add a per-volume 'nocreate' option that prevents automatic creation of
named volumes when they don't exist. When specified, Podman will fail
if the volume is not found instead of creating it automatically.
Usage: -v myvolume:/data:nocreate
--mount type=volume,src=myvolume,dst=/data,nocreate
See: #27862
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
Jan Rodák