Add [Quadlet] SetMountsDependency to select RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths.
Keep Requires as the default to preserve existing behavior and retain the required dependency on Podman's container storage directory.
Document the available values and the systemd version requirement for WantsMountsFor.
Add Quadlet integration fixtures covering Wants, Requires, None, and invalid values.
Fixes: #29946
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
- Read system_cpu_usage from /proc/stat (first 7 CPU fields, including idle) instead of cgroups.SystemCPUUsage(), matching Docker semantics.
- Use CPU values from GetContainerStats() instead of a second cgroup read to avoid a timing gap.
- Populate precpu_stats on stream=false with a 100 ms sampling pauseso the Docker CPU% formula returns a directionally correc snapshot. This only affects the compat per-container endpoint; podman-remote stats uses a separate libpod handler.
- Return cpu_stats.cpu as 0 for one-shot=true since the two samples are only milliseconds apart.
- Replace direct precpu copy instead of JSON marshal/unmarshal round-trip.
- Propagate errors via fmt.Errorf instead of logrus.Errorf, letting callers decide how to handle them. Parse errors in /proc/stat fields are hard errors instead of silently returning partial data.
- Document that --no-stream CPU% is a coarse ~100 ms snapshot; streaming gives 5-second interval readings.
Fixes: https://github.com/podman-container-tools/podman/issues/28761
Fixes: https://github.com/podman-container-tools/podman/issues/24730
Fixes: https://github.com/podman-container-tools/podman/issues/29912
Fixes: https://github.com/podman-container-tools/podman/issues/25709
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Adds a -l/--label CLI flag to podman kube play and wires it through
the API, bindings, and ABI so user-provided labels are applied to pods,
PVCs, and secrets created from Kubernetes YAML.
Key features:
- Labels are merged with YAML labels (CLI takes precedence)
- Validation uses Kubernetes qualified-name rules (RFC1123 subdomains)
- Value validation enforces 63-char limit and charset rules
- Separate merge and validate functions (SOLID principle)
- Uses maps.Clone for cleaner merging
Fixes:
- Removed incorrect annotations size limit from label validation
- Refactored to call annotations.IsQualifiedName for key validation
- Added proper documentation for max key length enforcement
Closes#26450
Signed-off-by: Sakthi Harish <sakthi.harish@edgeverve.com>
Rootless with the cgroupfs manager the pids controller is often not
delegated, as on WSL machines. The default path already skips the pids
limit there, but an explicit unlimited value (--pids-limit -1 or 0, the
PidsLimit=0 every Docker client sends, or pids.limit 0 on the libpod
API) still reached crun, which then failed with "controller `pids` is
not available".
A new cgroup has no pids limit anyway, so drop an unlimited limit in
that case. Finite limits are left as they are.
Fixes: https://github.com/podman-container-tools/podman/issues/29909
Signed-off-by: Victor Irzak <victor.irzak@zomp.com>
Fixes#29749
It's the same fix as podman-container-tools/podman-machine-os#319 but
this PR fixes existing machines, the ones that have been created with an
older podman-machine-os image.
The podman-machine-os PR makes still sense for users that are creating a
new podman machine with a podman client with version <= v6.1.3.
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
The kernel can return ESRCH in addition to ESTALE from open_by_handle_at
when the process no longer exists.
Signed-off-by: Andrew McCabe <amccabe@users.noreply.github.com>
When fetching build context tarballs for use in a build, pay attention
to the tlsVerify setting at the command line (in non-remote cases) or in
the build query (in remote cases), and whatever proxy settings are set
in the current environment for whichever process is connecting to a
server that may or may not be using TLS.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Buildah added some variants of APIs that should improve support for
cancellation, so let's use them.
Remove the import alias for its copier package in
cmd/podman/containers/cp.go and libpod/container_copy_common.go to be
more friendly to grep.
Update the "prune leftover build containers" test to intentionally leave
some behind during its setup instead of SIGKILLing a build process.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Docker documents `dead` and `restarting` as valid values for the
`status` filter on `/containers/json`. Podman returns HTTP 500 when
either of them is used even though no Podman container can ever be in
those states.
Ignore these values in the compat API. If they are the only status
filters, return an empty list like Docker does. Invalid status values
still return an error.
The libpod API still rejects these values since they are Docker
specific. Update the libpod API docs to list the states Podman
actually supports.
Reference:
https://docs.docker.com/reference/api/engine/version/v1.51/#tag/Container/operation/ContainerListFixes: #28904
Signed-off-by: Rudraksha Singh <rudraksharss@gmail.com>
And tweak import formatting for one file which is now flagged.
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Support for these was removed in 3721ff82ff as the feature is
inherently insecure. Checkpoints imply an extremely privileged
operation that is incompatible with the constraints of a
`podman run` command. However, we should still tell folks that
it no longer works with a clear error message. This is done
during Specgen processing, server side, which should be safer
than the previous client-side processing for these.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
This reverts commit f4401567cd.
This commit has been identified as a serious security issue.
Running checkpoints via `podman run` introduces potentially
confusing behavior where all security for a container, even
options specified by the user at the command line, can be turned
off by the checkpoint. Checkpoints have special security
considerations and must be explicitly requested by the user to
ensure they are used safely. We recommend ensuring the lifecycle
of a checkpoint is fully monitored and integrity is ensured at
each stage to guarantee safety.
Signed-off-by: Matt Heon <matthew.heon@pm.me>
Docker clients send the seccomp profile JSON itself in
HostConfig.SecurityOpt (the docker CLI reads the profile file
client-side and inlines it). The compat API treated the value as a path
to a profile file, so container create failed with "file name too
long". This breaks docker-compat tooling that passes seccomp profiles
through the socket, like Nextcloud AIO and forgejo-runner.
Add a SeccompProfile field to specgen for inline profile content,
next to the existing SeccompProfilePath, as requested in review of the
earlier PR that tried to fix this (#28985). The compat create handler
extracts inline profiles (values starting with "{") from SecurityOpt
and sets the new field. Path-based values and "unconfined" keep their
current meaning, and duplicate seccomp options resolve last-one-wins,
like docker.
Fixes: #27710
Signed-off-by: r-vdp <ramses@well-founded.dev>
Docker documents HostConfig.PidsLimit 0 as unlimited, but runc sets
pids.max=1 for OCI pids.limit 0. Normalize 0 to -1 when building the
OCI spec so native CLI, compat API, and kube play behave consistently.
Fixes: https://github.com/podman-container-tools/podman/issues/29826
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Docker API v1.44 omits the Created field (previously,
it was the zero value of 0001-01-01T00:00:00Z) if
the Created field is missing from the image config.
Omit it when zero from the compat API GET /images/{id}/json
(using `info.Created` instead of the previous `l.Created()`
that is set to `Now()` in storage/images.go when empty).
Add a test creating an image with the Created field missing.
Fixes: https://redhat.atlassian.net/browse/RUN-3317
Signed-off-by: Marek Simek <msimek@redhat.com>
This is a small Docker compat fix with the API exec endpoints.
With Docker, sending a bare Exec Create (command only, nothing
else set) and then an Exec Start without Detach set performs
a detached exec. With Podman, we threw an error that at least one
stream must be attached to. Fix is trivial; look up the session
before start, check the config for attach streams, and force
detach on if none are set.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Added a done channel and select block to cleanly terminate the signal-forwarding goroutine when the VM starts or fails, preventing a goroutine leak on every 'podman machine start'.
Fixes: #29342
Signed-off-by: Sheikh Muneeb Ahmed <msheikh.bsai24seecs@seecs.edu.pk>
TestConvertAdditionalBuildContexts asserted that the additional build
context "C:\test" is rewritten to "/mnt/c/test". That rewrite is done by
specgen.ConvertWinMountPath, which is a no-op unless shouldResolveWinPaths()
is true: always on Windows, but on Linux only when the client runs inside a
WSL or Hyper-V guest. On an ordinary Linux host the value is passed through
unchanged and the test fails.
Keep the platform independent expectations (URLs, images and unix paths are
never rewritten) in the shared test and move the drive letter case to a
Windows only file, following the existing split in pkg/specgen.
Signed-off-by: Daksha1611 <mehtadaksha1611@gmail.com>
Remove duplicated ValidateSysctls logic and call
go.podman.io/common/pkg/sysctl.Validate instead. This change
picks up the latest validation from c/common.
Signed-off-by: Ijaj Mulani <ijajmulani786@gmail.com>
Fixed the compat container update path so it preserves the existing restart policy unless the request explicitly includes a new one, and added a regression test for it.
Fixes: #29790
Signed-off-by: Srijan Keshri <212402043+arcusbuilds@users.noreply.github.com>
Allow deployments and scheduled jobs to update a selected group of
containers without checking every auto-update-enabled application.
Reuse the existing container filters and expose them through the CLI,
remote bindings, and REST API.
Filter update candidates while preserving systemd unit and pod restart
behavior. Document the selection semantics and cover filtered updates,
invalid input, remote requests, and pod restarts in the existing tests.
Signed-off-by: Evan Purkhiser <git@evanpurkhiser.com>
Jan Rodák