When returning error http code (e.g. 4xx, 5xx) the body needs to contain
a JSON that has a key "message" in it,
we must not use jsonmessage.JSONMessage.
The JSON of shape jsonmessage.JSONMessage is used only when client
already received 200.
Signed-off-by: Matej Vašek <matejvasek@gmail.com>
With podman-remote we do not enter a our user namespace like we do with
local podman so we keep running with the real user id.
So if we then try to use chrootarchive as normal user it fails with:
creating mount namespace before pivot: operation not permitted
So simply revert back to the normal archive code.
Now the more interesting thing is we do have a test
"podman save to directory with oci format" but it never runs
rootless+remote in our CI system with our current matrix as we wanted to
reduce jobs.
So rethink the matrix and add one such job as this shows it is needed.
Fixes: 25aee24cbd ("use chrootarchive over plain archive package")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This fixes two problems when parsing ports.
First, check for host port conflicts. When we are given the same ip:host
port combo twice then we need to reject that as invalid, the backend
cannot bind the same port twice and thus we always get a runtime
failure. Failing early in the create code path is much better.
Second, when assigning random ports for expose we still have to check
for proper conflicts. The first error was using allUsedContainerPortsMap
to check for conflicts but this holds container side ports, we need to
ensure there are no conflicts on the host port.
Then there was the other issue that the array in the map was copied and
accessed by value on lookup. And because the code did not reassign the
value it then failed to actually update the correct ports.
To address that I switch the map to store the array by reference which
will avoid the bigger copies as we only need to update the pointer now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
systemd interprets % as specifier characters in unit configuration files
(e.g. %H, %u, %40). Proxy environment variable values that contain
percent-encoded URL characters (such as %40 for @ in usernames) cause
systemd to emit warnings and fail to parse the generated
/etc/systemd/system.conf.d/default-env.conf:
system.conf.d/default-env.conf:2: Failed to resolve specifiers in
HTTP_PROXY=http://user%40example.com@proxy:3128
Fix by adding a bash variable substitution that doubles every % to %%
before writing to the systemd unit conf files. The profile.d and
environment.d destinations do not need this escaping and continue to
use the original value.
Fixes#28698
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
Pause the container by default during commit. It is safer as it
avoids conflicts, and potentially security issues, when another
process is accessing the container rootfs.
Originally this was not done because it was a breaking change and
rootless containers weren't able to use the freezer cgroup controller.
Now that we support only cgroup v2, there is no gap anymore with
root (exotic configurations can still use --pause=false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
log_path is currently set at the client side and is ignored by
the server in a remote session. This leads to either incorrect log_path
being considered by the server or not honored at all. Move the handling
from client to the server, in line with other flags such as log_driver.
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
I was not able to find any external users of pkg/selinux but kept it
for now (and marked as deprecated) so we can remove it later.
PS pkg/selinux adds go:fix directives which are not (yet) recognized
by the gocheckcompilerdirectives linter, so add a temporary exception).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add CDI information to podman info and podman system info.
The host info now includes the configured CDI spec directories and the
currently discovered CDI devices. The devices are resolved when the info
endpoint is called and there is no need to refresh these in the background.
Also map the same data into the Docker-compatible /info response as CDISpecDirs and DiscoveredDevices.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Commit cf021c4ba9 switched the logic to also allow golangci-lint in
$PATH but forgot to update the call here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Change isHyperVAdminMember from returning a bool to returning an error so that callers surface the specific failure reason — particularly distinguishing "not in the group" from "in the group but session not updated" (new ErrHypervUserSessionNotUpdated sentinel). This gives users actionable guidance instead of a generic permission error.
Signed-off-by: lstocchi <lstocchi@redhat.com>
Using modernize (aka go fix) from Go 1.26.3, implement the following
changes:
> pkg/rootless/rootless_linux.go:319:30: fmtappendf: Replace []byte(fmt.Sprintf...) with fmt.Appendf (modernize)
> err = os.WriteFile(uidMap, []byte(fmt.Sprintf("%d %d 1\n", 0, os.Geteuid())), 0o666)
> ^
> pkg/rootless/rootless_linux.go:339:30: fmtappendf: Replace []byte(fmt.Sprintf...) with fmt.Appendf (modernize)
> err = os.WriteFile(gidMap, []byte(fmt.Sprintf("%d %d 1\n", 0, os.Getegid())), 0o666)
> ^
> pkg/rootless/rootless_linux.go:381:6: rangeint: for loop can be modernized using range over int (modernize)
> for sig := 0; sig < numSig; sig++ {
> ^
> pkg/rootless/rootless_linux.go:432:24: stringsseq: Ranging over SplitSeq is more efficient (modernize)
> for _, entry := range bytes.Split(data, []byte{0}) {
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
- Populate the Docker-compatible container summary HostConfig from the
container inspect data
- Remove the unused ContainerCreateConfig wrapper from the compat
handler
- Add APIv2 test
Signed-off-by: Christopher Bii <christopherbii@hyub.org>
The swagger spec generated from pkg/api/server/doc.go sets the contact
URL to https://podman.io/community/. That URL now returns 404, while
https://podman.io/community (no trailing slash) returns 200 and is what
the live site links to from its own navigation. Issue #28298 reports
the link as broken at the top of the rendered API reference, which is
where ReDoc surfaces the contact field.
Drop the trailing slash so the contact link in the generated swagger
spec resolves.
Signed-off-by: Matt Van Horn <mvanhorn@gmail.com>
