Healthcheck property of a container image cannot be printed via go template with podman inspect

[dcermak]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

Podman understands the HEALTHCHECK property of container images and can output them via podman image inspect:

❯ podman inspect registry.opensuse.org/devel/bci/sle-15-sp4/containerfile/suse/pcp:5.2|jq '.[0]["Healthcheck"]'
{
  "Test": [
    "CMD-SHELL",
    "/usr/local/bin/healthcheck"
  ],
  "StartPeriod": 30000000000,
  "Interval": 10000000000,
  "Timeout": 20000000000,
  "Retries": 3
}

However, it is not possible to use a go template for this, in contrast to other properties of the image like Id, History, etc.:

❯ podman inspect -f "{{.Healthcheck}}" registry.opensuse.org/devel/bci/sle-15-sp4/containerfile/suse/pcp:5.2
ERRO[0000] Error printing inspect output: template: all inspect:1:14: executing "all inspect" at <.Healthcheck>: can't evaluate field Healthcheck in type interface {} 

Steps to reproduce the issue:

1. podman inspect -f "{{.Healthcheck}}" url/to/any/image/with/HEALTHCHECK

Describe the results you received:

ERRO[0000] Error printing inspect output: template: all inspect:1:14: executing "all inspect" at <.Healthcheck>: can't evaluate field Healthcheck in type interface {}

Describe the results you expected:

what docker provides:

 ❯ docker inspect -f "{{.Config.Healthcheck}}" registry.opensuse.org/devel/bci/sle-15-sp4/containerfile/suse/pcp:5.2
{[CMD-SHELL /usr/local/bin/healthcheck] 10s 20s 30s 3}

Output of podman version:

❯ ./bin/podman version
Client:       Podman Engine
Version:      4.2.0-dev
API Version:  4.2.0-dev
Go Version:   go1.18
Git Commit:   55052c6b9807b5a51b50abc90e391e872be450c2
Built:        Mon Jun 20 13:54:54 2022
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.27.0-dev
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.0-2.fc35.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.0, commit: '
  cpuUtilization:
    idlePercent: 84.87
    systemPercent: 3.36
    userPercent: 11.76
  cpus: 12
  distribution:
    distribution: fedora
    version: "35"
  eventLogger: journald
  hostname: Boreas
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 10000
      size: 65536
    - container_id: 65537
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 10000
      size: 65536
    - container_id: 65537
      host_id: 100000
      size: 65536
  kernel: 5.18.5-100.fc35.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 1063092224
  memTotal: 33323225088
  networkBackend: cni
  ociRuntime:
    name: crun
    package: crun-1.4.5-1.fc35.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.4.5
      commit: c381048530aa750495cf502ddb7181f2ded5b400
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.1.12-2.fc35.x86_64
    version: |-
      slirp4netns version 1.1.12
      commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 8587046912
  swapTotal: 8589930496
  uptime: 13h 25m 3.00s (Approximately 0.54 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
  - registry.suse.com
store:
  configFile: /home/dan/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 1
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/dan/.local/share/containers/storage
  graphRootAllocated: 1022488477696
  graphRootUsed: 703443562496
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1665
  runRoot: /run/user/1000/containers
  volumePath: /home/dan/.local/share/containers/storage/volumes
version:
  APIVersion: 4.2.0-dev
  Built: 1655726094
  BuiltTime: Mon Jun 20 13:54:54 2022
  GitCommit: 55052c6b9807b5a51b50abc90e391e872be450c2
  GoVersion: go1.18
  Os: linux
  OsArch: linux/amd64
  Version: 4.2.0-dev

Package info (e.g. output of rpm -q podman or apt list podman):

Build from source and tried with podman-3.4.7-1.fc35.x86_64 as well

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)

Yes

[Luap99]

The key name is HealthCheck, the json names do not have to match the template names.

I recommend to use shell completion to get the names: podman image inspect --format {{.[TAB]

[dcermak]

The key name is HealthCheck, the json names do not have to match the template names.

Oh! Ok, that works. Could it be changed so that the names are consistent?

I recommend to use shell completion to get the names: podman image inspect --format {{.[TAB]

Hm, that doesn't work on my end on Fedora 35.

[Luap99]

The key name is HealthCheck, the json names do not have to match the template names.

Oh! Ok, that works. Could it be changed so that the names are consistent?

I don't think we should change these field names.

I have no experience with the image code but if {{.Config.Healthcheck}} works with docker it should work with podman too, unless there is some specific reason why it shouldn't?
@rhatdan @vrothberg PTAL

[dcermak]

I have no experience with the image code but if {{.Config.Healthcheck}} works with docker it should work with podman too, unless there is some specific reason why it shouldn't?

That would be great if such an alias could be added. It would greatly help with portability.

[vrothberg]

Getting Config.Healthcheck to work is probably a breaking change since Podman's .Config is an OCI config. Docker is using the Docker config. I suggest to alias .Config.Healthcheck with .HealthCheck to fix this bug. IIRC, we do similar aliasing for other filters as well.

@mheon @ashley-cui, I think this could be a good thing for interns in case you are looking for work items.

[mheon]

@vrothberg In the context of Inspect, it's not an OCI config, it's a *define.InspectContainerConfig - which already includes a Healthcheck field. I'm surprised this isn't working already given that.

[vrothberg]

@vrothberg In the context of Inspect, it's not an OCI config, it's a *define.InspectContainerConfig - which already includes a Healthcheck field. I'm surprised this isn't working already given that.

The issue relates to image inspect, not container inspect. image inspect's data structure is here: https://github.com/containers/common/blob/main/libimage/inspect.go#L23

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@vrothberg @mheon any movement on this one?

[vrothberg]

No. My pipeline is long and full :^)

[rhatdan]

@cdoern @flouthoc @nalind @giuseppe Any chance one of you could look at this?

[flouthoc]

Above PR closes this: #15424 , @vrothberg PTAL I think this is the place where we maintain all aliases.