Add [Quadlet] SetMountsDependency to select RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths.
Keep Requires as the default to preserve existing behavior and retain the required dependency on Podman's container storage directory.
Document the available values and the systemd version requirement for WantsMountsFor.
Add Quadlet integration fixtures covering Wants, Requires, None, and invalid values.
Fixes: #29946
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
OCI runtime initialization errors are only logged at debug level, so
podman fails with a misleading `default OCI runtime "crun" not found`
even if crun exists but, for example, the exits directory below a
non-writable tmp dir could not be created. Keep the error of the default
runtime and return it when its initialization failed.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
- Read system_cpu_usage from /proc/stat (first 7 CPU fields, including idle) instead of cgroups.SystemCPUUsage(), matching Docker semantics.
- Use CPU values from GetContainerStats() instead of a second cgroup read to avoid a timing gap.
- Populate precpu_stats on stream=false with a 100 ms sampling pauseso the Docker CPU% formula returns a directionally correc snapshot. This only affects the compat per-container endpoint; podman-remote stats uses a separate libpod handler.
- Return cpu_stats.cpu as 0 for one-shot=true since the two samples are only milliseconds apart.
- Replace direct precpu copy instead of JSON marshal/unmarshal round-trip.
- Propagate errors via fmt.Errorf instead of logrus.Errorf, letting callers decide how to handle them. Parse errors in /proc/stat fields are hard errors instead of silently returning partial data.
- Document that --no-stream CPU% is a coarse ~100 ms snapshot; streaming gives 5-second interval readings.
Fixes: https://github.com/podman-container-tools/podman/issues/28761
Fixes: https://github.com/podman-container-tools/podman/issues/24730
Fixes: https://github.com/podman-container-tools/podman/issues/29912
Fixes: https://github.com/podman-container-tools/podman/issues/25709
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Adds a -l/--label CLI flag to podman kube play and wires it through
the API, bindings, and ABI so user-provided labels are applied to pods,
PVCs, and secrets created from Kubernetes YAML.
Key features:
- Labels are merged with YAML labels (CLI takes precedence)
- Validation uses Kubernetes qualified-name rules (RFC1123 subdomains)
- Value validation enforces 63-char limit and charset rules
- Separate merge and validate functions (SOLID principle)
- Uses maps.Clone for cleaner merging
Fixes:
- Removed incorrect annotations size limit from label validation
- Refactored to call annotations.IsQualifiedName for key validation
- Added proper documentation for max key length enforcement
Closes#26450
Signed-off-by: Sakthi Harish <sakthi.harish@edgeverve.com>
Rootless containers created with --userns=keep-id store host-mapped IDs
in their mounted root filesystem, so podman export showed host IDs in the
tar headers instead of the container ownership: files owned by container
UID/GID 1000 were exported as 0/0.
Pass the container's UID/GID mappings to the archive tar operation so the
tar headers are converted back to container IDs, like podman cp already
does. Containers without ID mappings pass an empty mapping, and the
archive code skips the conversion in that case.
Add an e2e regression test that follows the reproducer of the issue.
Fixes: #29856
Signed-off-by: Yanxin Li <462004436@qq.com>
Rootless with the cgroupfs manager the pids controller is often not
delegated, as on WSL machines. The default path already skips the pids
limit there, but an explicit unlimited value (--pids-limit -1 or 0, the
PidsLimit=0 every Docker client sends, or pids.limit 0 on the libpod
API) still reached crun, which then failed with "controller `pids` is
not available".
A new cgroup has no pids limit anyway, so drop an unlimited limit in
that case. Finite limits are left as they are.
Fixes: https://github.com/podman-container-tools/podman/issues/29909
Signed-off-by: Victor Irzak <victor.irzak@zomp.com>
The moby swagger.yaml was changed to quote HTTP status codes as string
as part of moby commit 79658025a2fd.
Thus fix the key lookup here to use a string as well.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Test case bind mounts host's /bin to /hostbin and tries to exec
/hostbin/ls, and expects a particular exit code.
It does not work on Ubuntu 26.04 because it ships with coreutils-rs
by default, in which:
/bin/ls -> ../lib/cargo/bin/coreutils/ls
and so we get ENOENT instead of EPERM.
Fix by replacing ls with true. The funny thing is, it's also a symlink
on Ubuntu 26.04:
/bin/true -> gnutrue
but it works since the destination is in the same directory.
(NOTE the whole test relies on the fact that the kernel checks
permissions first -- a dynamic binary from a different distro
won't be able to run anyway.)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Quadlet currently requires an explicit instance file or symlink
before it reads that instance's drop-ins.
Discover instance-specific drop-in directories that match a loaded
template and create an in-memory copy of the template for each
instance. Apply the existing drop-in merging and service generation
logic to these copies. Explicit instance files and symlinks retain
priority.
An empty instance drop-in directory also creates an instance. It
inherits the template's settings and applicable drop-ins, including
[Install] settings that can create startup symlinks. Document this
behavior in the Quadlet man page.
Reject empty and dot instance names during discovery. Avoid extra
stat calls for ordinary directories while continuing to follow
symlinks to drop-in directories. Use Quadlet's existing debug logger.
Add table-driven unit tests with case-specific input files covering
drop-in precedence, instance isolation, empty directories, explicit
instances, separate search paths, supported unit types, and symlink
handling. Add an E2E test that checks generated services, inherited
settings, and startup symlinks without explicit instance files.
Fixes: #27636
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
Volume.Export() previously deferred v.unmount(false) inside the function body, which unmounted the volume before the caller could read the tar contents from the returned io.ReadCloser stream.
Introduce volumeExportReadCloser wrapper to delay v.unmount(false) until Close() is called on the stream. Also handle unmounting on tar creation failure and add a system test for exporting mounted volumes with multiple files.
Signed-off-by: Mandar Joshi <mandarjoshi1045@gmail.com>
When copying files from created or stopped containers, podman cp resolves
named volumes on the host instead of using the container mount namespace.
The host-side resolution currently starts at the volume root and ignores the
mount's configured subpath, so cp can read a different file than the one
visible inside the container.
Apply the configured volume subpath before resolving the remaining container
path. Keep the path within the volume using secure path resolution and add
coverage for created, running, and stopped containers.
Fixes: #29840
Signed-off-by: pooyanazad <pooyan.azadparvar@gmail.com>
We now just cache 3.5-nowin which is a manifest without windows images
that we never need and are super large otherwise.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Table headings for `podman ps` and `podman pod ps` use a plain
`map[string]string`. A table template that calls `.Label` with an
argument fails while rendering the headings, before listing rows
are printed. For example: `podman ps --format 'table {{.Label "app"}}'`
Add a shared `PsHeader` type in `cmd/podman/common` with a `Label`
method that returns the requested label name as the column heading.
Use this type for both container and pod listings.
Add container unit tests and extend the existing container and pod
e2e tests to check label headings, label values, missing labels,
unlabeled objects, and `--noheading` output.
Fixes: #29831
Signed-off-by: Garv Changrani <154041471+Garvity@users.noreply.github.com>
GetPort() may return the same port twice, ensure we avoid the case to
not make the startup fail on a port conflict.
I saw this fail in CI once:
$ podman [options] kube play -q --multiple-pods --publish 5811:80,5811:80 /tmp/podman-e2e-759165132/subtest-4128675097/p/ptemp/kube.yaml
starting container b0aea9c7e396: rootlessport listen tcp :5811: bind: address already in use
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The kube down test does the exact same thing already so there is really
no need to duplicate this in the interest of test runtime.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Buildah added some variants of APIs that should improve support for
cancellation, so let's use them.
Remove the import alias for its copier package in
cmd/podman/containers/cp.go and libpod/container_copy_common.go to be
more friendly to grep.
Update the "prune leftover build containers" test to intentionally leave
some behind during its setup instead of SIGKILLing a build process.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Docker documents `dead` and `restarting` as valid values for the
`status` filter on `/containers/json`. Podman returns HTTP 500 when
either of them is used even though no Podman container can ever be in
those states.
Ignore these values in the compat API. If they are the only status
filters, return an empty list like Docker does. Invalid status values
still return an error.
The libpod API still rejects these values since they are Docker
specific. Update the libpod API docs to list the states Podman
actually supports.
Reference:
https://docs.docker.com/reference/api/engine/version/v1.51/#tag/Container/operation/ContainerListFixes: #28904
Signed-off-by: Rudraksha Singh <rudraksharss@gmail.com>
Docker clients send the seccomp profile JSON itself in
HostConfig.SecurityOpt (the docker CLI reads the profile file
client-side and inlines it). The compat API treated the value as a path
to a profile file, so container create failed with "file name too
long". This breaks docker-compat tooling that passes seccomp profiles
through the socket, like Nextcloud AIO and forgejo-runner.
Add a SeccompProfile field to specgen for inline profile content,
next to the existing SeccompProfilePath, as requested in review of the
earlier PR that tried to fix this (#28985). The compat create handler
extracts inline profiles (values starting with "{") from SecurityOpt
and sets the new field. Path-based values and "unconfined" keep their
current meaning, and duplicate seccomp options resolve last-one-wins,
like docker.
Fixes: #27710
Signed-off-by: r-vdp <ramses@well-founded.dev>
Docker documents HostConfig.PidsLimit 0 as unlimited, but runc sets
pids.max=1 for OCI pids.limit 0. Normalize 0 to -1 when building the
OCI spec so native CLI, compat API, and kube play behave consistently.
Fixes: https://github.com/podman-container-tools/podman/issues/29826
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
fix: return tty size in container_inspect_linux.go
This PR updates the console size field for containers with terminal enabled.
For cases where there is an issue with getting the size, suitable debug information is given, no update happens and default [0,0] is returned.
This implementation is only for Linux systems.
For FreeBSD, the console size is not implemented yet so, adds a todo for that.
Fixes: #28368
Signed-off-by: Priyansh Sao <saopriyansh06@gmail.com>
fix: add system test for podman inspect
Adds system test to verify console size is correctly updated, includes two cases:
When a tty is attached to the container - non-zero console size.
When a tty is not attached to the container - zero console size.
Fixes: #28368
Signed-off-by: Priyansh Sao <saopriyansh06@gmail.com>
Docker API v1.44 omits the Created field (previously,
it was the zero value of 0001-01-01T00:00:00Z) if
the Created field is missing from the image config.
Omit it when zero from the compat API GET /images/{id}/json
(using `info.Created` instead of the previous `l.Created()`
that is set to `Now()` in storage/images.go when empty).
Add a test creating an image with the Created field missing.
Fixes: https://redhat.atlassian.net/browse/RUN-3317
Signed-off-by: Marek Simek <msimek@redhat.com>
Paul Holzinger