0xdvc 35c602bfbb fix: improve userns validation when joining pods ...

- remove old CLI validation that only checked --pod flag
- add validation in namespaces.go to catch all paths (cli, quadlet, api)
- block userns mixing for all pods with infra, not just ipc/net
- update error message to be clearer
- fix test cleanup to use PodmanExitCleanly()
- use dynamic pod names in system tests to avoid conflicts

fixes #26848

Signed-off-by: 0xdvc <neilohene@gmail.com>

<MH: Fixed cherry-pick conflicts>

Signed-off-by: Matt Heon <matthew.heon@pm.me>

2026-02-06 15:36:47 -05:00

..

build

…

cdi

…

config

…

quadlet

Escape RequiresMountsFor value

2026-02-06 15:36:47 -05:00

sign

…

testdata

Add --sign-by-sq-fingerprint to push operations

2025-09-11 20:32:32 +02:00

artifact_created_test.go

Add creation timestamp to podman artifacts

2025-09-25 08:39:28 -04:00

artifact_mount_test.go

feat: add Podman artifact support to Go bindings and remote clients

2025-08-01 00:10:50 +10:00

artifact_test.go

Fixes #27421 aritfact push and pull with authfile

2026-02-06 15:36:47 -05:00

attach_test.go

Use PodmanExitCleanly in attach_test.go

2025-01-09 18:47:37 +01:00

build_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

buildx_inspect_test.go

podman buildx inspect support

2025-06-03 11:07:08 -04:00

checkpoint_image_test.go

…

checkpoint_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

cleanup_test.go

…

commit_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

common_test.go

chore: fix the inconsistent method names in the comments

2026-02-06 15:36:47 -05:00

config_amd64.go

ci: rm allow-unused from nolintlint settings

2025-03-31 12:27:55 -07:00

config_arm64.go

Fix directive //nolint:revive is unused for linter "revive" on ARM

2025-04-16 16:17:28 +02:00

config_ppc64le.go

pasta udp tests: new bytecheck helper

2024-10-16 10:15:19 -06:00

config_test.go

test/e2e: fix unused linter warning

2025-03-31 12:30:43 -07:00

config.go

test/e2e: fix unused linter warning

2025-03-31 12:30:43 -07:00

container_clone_test.go

Fix container clone with configured Healthcheck

2025-03-26 11:01:18 +01:00

container_create_volume_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

container_iface_name_test.go

…

container_inspect_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

containers_conf_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

cp_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

create_staticip_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

create_staticmac_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

create_test.go

fix: improve userns validation when joining pods

2026-02-06 15:36:47 -05:00

diff_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

events_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

exec_test.go

feat(exec): Add --no-session flag for improved performance

2026-02-06 15:36:47 -05:00

exists_test.go

…

export_test.go

Fix container export emitting incorrect event type.

2026-02-06 13:46:36 -05:00

farm_test.go

…

generate_kube_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

generate_spec_test.go

…

generate_systemd_test.go

…

healthcheck_run_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

history_test.go

…

image_scp_test.go

Implement TLS API Support

2025-09-26 09:09:54 -06:00

image_sign_test.go

…

images_test.go

…

import_test.go

…

info_test.go

Implement TLS API Support

2025-09-26 09:09:54 -06:00

init_test.go

…

inspect_test.go

Add artifact fallback to podman inspect command

2025-10-02 06:52:32 -04:00

kill_test.go

…

libpod_suite_remote_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

libpod_suite_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

load_test.go

…

login_logout_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

logs_test.go

fix(logs): add tests for nanosecond precision in log timestamps

2026-02-06 13:46:36 -05:00

manifest_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

mount_rootless_test.go

Pass all of PodmanExecOptions to various [mM]akeOptions functions

2025-01-23 00:03:52 +01:00

mount_test.go

…

negative_test.go

…

network_connect_disconnect_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

network_create_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

network_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

pause_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

play_build_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

play_kube_test.go

[play_kube] Add validation to container image field

2026-02-06 15:36:47 -05:00

pod_clone_test.go

…

pod_create_test.go

fix: improve userns validation when joining pods

2026-02-06 15:36:47 -05:00

pod_infra_container_test.go

…

pod_initcontainers_test.go

…

pod_inspect_test.go

…

pod_kill_test.go

…

pod_pause_test.go

…

pod_pod_namespaces_test.go

…

pod_prune_test.go

…

pod_ps_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

pod_restart_test.go

…

pod_rm_test.go

…

pod_start_test.go

…

pod_stats_test.go

…

pod_stop_test.go

Refactor graph traversal & use for pod stop

2025-02-06 18:28:12 -05:00

pod_top_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

port_test.go

…

prune_test.go

test/e2e: try to fix clean up after terminated build flake

2025-11-10 15:14:48 +00:00

ps_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

pull_chunked_test.go

lint: reenable revive unused-parameter check

2025-10-01 10:42:08 -04:00

pull_test.go

Revert "test/e2e: try debug potential pasta issue"

2025-09-15 19:28:41 +02:00

push_test.go

Add --sign-by-sq-fingerprint to push operations

2025-09-11 20:32:32 +02:00

quadlet_test.go

Introduce assert-has-key assertion

2026-02-06 15:36:47 -05:00

rename_test.go

…

restart_test.go

…

rm_test.go

…

rmi_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

run_aardvark_test.go

…

run_apparmor_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

run_cgroup_parent_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

run_cleanup_test.go

Pass all of PodmanExecOptions to various [mM]akeOptions functions

2025-01-23 00:03:52 +01:00

run_cpu_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

run_device_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

run_dns_test.go

…

run_entrypoint_test.go

oci: report empty exec path as ENOENT

2025-02-18 22:01:08 +01:00

run_env_test.go

…

run_exit_test.go

oci: report empty exec path as ENOENT

2025-02-18 22:01:08 +01:00

run_memory_test.go

…

run_networking_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

run_ns_test.go

…

run_passwd_test.go

libpod: --user works with --hostuser entries

2025-04-07 18:11:06 +02:00

run_privileged_test.go

test/e2e: Skip privileged container test if NoNewPrivs is set

2026-02-06 15:36:47 -05:00

run_restart_test.go

…

run_seccomp_test.go

test/e2e: fix 'block all syscalls' seccomp for runc

2026-02-06 15:36:47 -05:00

run_security_labels_test.go

…

run_selinux_test.go

…

run_signal_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

run_staticip_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

run_test.go

Fix missing newlines in stderr error messages

2026-02-06 13:46:36 -05:00

run_transient_test.go

Don't use all of tempdir as podman's --tmpdir

2025-02-05 22:52:46 +01:00

run_userns_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

run_volume_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

run_working_dir_test.go

libpod: simplify resolveWorkDir()

2025-12-04 16:09:56 +00:00

runlabel_test.go

…

save_test.go

Merge pull request #26618 from mtrmac/sequoia

2025-10-21 11:06:38 +00:00

search_mock_registry.go

test: Replace external registry deps with mock server in search tests

2025-11-04 17:48:20 +00:00

search_test.go

test: organize search tests with BeforeEach/AfterEach patterns

2025-11-04 17:48:20 +00:00

secret_test.go

secrets/create: remove pipe check and allow interactive stdin

2026-02-06 13:46:36 -05:00

start_test.go

…

stats_test.go

run modernize -fix ./...

2025-09-10 16:17:04 +02:00

stop_test.go

…

system_connection_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

system_df_test.go

…

system_dial_stdio_test.go

test/system: remove system dial-stdio test

2024-12-17 17:04:17 +01:00

system_reset_test.go

Output headers for volume ls when empty

2025-04-21 17:07:57 -05:00

systemd_activate_test.go

Pass all of PodmanExecOptions to various [mM]akeOptions functions

2025-01-23 00:03:52 +01:00

systemd_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

tag_test.go

…

toolbox_test.go

…

top_test.go

…

tree_test.go

…

trust_test.go

…

unshare_test.go

…

untag_test.go

…

update_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

version_test.go

…

volume_create_test.go

Merge pull request #26434 from mheon/import_export

2025-06-25 19:48:14 +00:00

volume_exists_test.go

Switch common, storage and image to monorepo.

2025-09-01 12:33:04 +02:00

volume_inspect_test.go

…

volume_ls_test.go

Output headers for volume ls when empty

2025-04-21 17:07:57 -05:00

volume_plugin_test.go

fileperms: newer Go 1.13+ octal literal format

2025-10-16 14:11:29 -04:00

volume_prune_test.go

Output headers for volume ls when empty

2025-04-21 17:07:57 -05:00

volume_rm_test.go

Fix SQLite volume lookup queries matching too liberally

2025-05-28 13:10:10 -04:00

wait_test.go

Fixes: #26691

2025-08-06 22:34:18 +03:00