Backports for v3.2.2 #10778
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -98,7 +98,7 @@ func pushFlags(cmd *cobra.Command) { | |
| _ = cmd.RegisterFlagCompletionFunc(digestfileFlagName, completion.AutocompleteDefault) | ||
|
|
||
| formatFlagName := "format" | ||
| flags.StringVarP(&pushOptions.Format, formatFlagName, "f", "", "Manifest type (oci, v2s2, or v2s1) to use in the destination (default is manifest type of source, with fallbacks)") | ||
| _ = cmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteManifestFormat) | ||
|
|
||
| flags.BoolVarP(&pushOptions.Quiet, "quiet", "q", false, "Suppress output information when pushing images") | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,7 +20,7 @@ require ( | |
| github.com/containers/storage v1.31.3 | ||
| github.com/coreos/go-systemd/v22 v22.3.2 | ||
| github.com/coreos/stream-metadata-go v0.0.0-20210225230131-70edb9eb47b3 | ||
| github.com/cri-o/ocicni v0.2.1-0.20210621164014-d0acc7862283 | ||
| github.com/cyphar/filepath-securejoin v0.2.2 | ||
| github.com/davecgh/go-spew v1.1.1 | ||
| github.com/digitalocean/go-qemu v0.0.0-20210209191958-152a1535e49f | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -265,8 +265,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do | |
| github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= | ||
| github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw= | ||
| github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= | ||
| github.com/cri-o/ocicni v0.2.1-0.20210621164014-d0acc7862283 h1:7FyIYKksGvRF8XjMkG5T6uIxg8PcgZoPyO+f6kHT5+s= | ||
| github.com/cri-o/ocicni v0.2.1-0.20210621164014-d0acc7862283/go.mod h1:vingr1ztOAzP2WyTgGbpMov9dFhbjNxdLtDv0+PhAvY= | ||
| github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg= | ||
| github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4= | ||
| github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ= | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -276,9 +276,10 @@ func (c *Container) ExecStart(sessionID string) error { | |
| } | ||
|
|
||
| // ExecStartAndAttach starts and attaches to an exec session in a container. | ||
| // newSize resizes the tty to this size before the process is started, must be nil if the exec session has no tty | ||
| // TODO: Should we include detach keys in the signature to allow override? | ||
| // TODO: How do we handle AttachStdin/AttachStdout/AttachStderr? | ||
| func (c *Container) ExecStartAndAttach(sessionID string, streams *define.AttachStreams, newSize *define.TerminalSize) error { | ||
| if !c.batched { | ||
| c.lock.Lock() | ||
| defer c.lock.Unlock() | ||
|
|
@@ -309,7 +310,7 @@ func (c *Container) ExecStartAndAttach(sessionID string, streams *define.AttachS | |
| return err | ||
| } | ||
|
|
||
| pid, attachChan, err := c.ociRuntime.ExecContainer(c, session.ID(), opts, streams, newSize) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
@@ -372,7 +373,9 @@ func (c *Container) ExecStartAndAttach(sessionID string, streams *define.AttachS | |
| } | ||
|
|
||
| // ExecHTTPStartAndAttach starts and performs an HTTP attach to an exec session. | ||
| // newSize resizes the tty to this size before the process is started, must be nil if the exec session has no tty | ||
| func (c *Container) ExecHTTPStartAndAttach(sessionID string, r *http.Request, w http.ResponseWriter, | ||
| streams *HTTPAttachStreams, detachKeys *string, cancel <-chan bool, hijackDone chan<- bool, newSize *define.TerminalSize) error { | ||
| // TODO: How do we combine streams with the default streams set in the exec session? | ||
|
|
||
| // Ensure that we don't leak a goroutine here | ||
|
|
@@ -430,7 +433,7 @@ func (c *Container) ExecHTTPStartAndAttach(sessionID string, r *http.Request, w | |
| close(holdConnOpen) | ||
| }() | ||
|
|
||
| pid, attachChan, err := c.ociRuntime.ExecContainerHTTP(c, session.ID(), execOpts, r, w, streams, cancel, hijackDone, holdConnOpen, newSize) | ||
| if err != nil { | ||
| session.State = define.ExecStateStopped | ||
| session.ExitCode = define.TranslateExecErrorToExitCode(define.ExecErrorCodeGeneric, err) | ||
|
|
@@ -733,7 +736,10 @@ func (c *Container) Exec(config *ExecConfig, streams *define.AttachStreams, resi | |
| // API there. | ||
| // TODO: Refactor so this is closed here, before we remove the exec | ||
| // session. | ||
| var size *define.TerminalSize | ||
| if resize != nil { | ||
| s := <-resize | ||
| size = &s | ||
| go func() { | ||
| logrus.Debugf("Sending resize events to exec session %s", sessionID) | ||
| for resizeRequest := range resize { | ||
|
|
@@ -751,7 +757,7 @@ func (c *Container) Exec(config *ExecConfig, streams *define.AttachStreams, resi | |
| }() | ||
| } | ||
|
|
||
| if err := c.ExecStartAndAttach(sessionID, streams, size); err != nil { | ||
| return -1, err | ||
| } | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -427,7 +427,7 @@ func (c *Container) setupStorage(ctx context.Context) error { | |
| }, | ||
| LabelOpts: c.config.LabelOpts, | ||
| } | ||
| if c.restoreFromCheckpoint && !c.config.Privileged { | ||
| // If restoring from a checkpoint, the root file-system | ||
| // needs to be mounted with the same SELinux labels as | ||
| // it was mounted previously. | ||
|
|
@@ -1061,7 +1061,7 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error { | |
| } | ||
|
|
||
| for _, v := range c.config.NamedVolumes { | ||
| if err := c.fixVolumePermissions(v); err != nil { | ||
| return err | ||
| } | ||
| } | ||
|
|
@@ -1531,6 +1531,16 @@ func (c *Container) mountStorage() (_ string, deferredErr error) { | |
| }() | ||
| } | ||
|
|
||
| // If /etc/mtab does not exist in container image, then we need to | ||
| // create it, so that mount command within the container will work. | ||
| mtab := filepath.Join(mountPoint, "/etc/mtab") | ||
| if err := idtools.MkdirAllAs(filepath.Dir(mtab), 0755, c.RootUID(), c.RootGID()); err != nil { | ||
| return "", errors.Wrap(err, "error creating mtab directory") | ||
| } | ||
| if err = os.Symlink("/proc/mounts", mtab); err != nil && !os.IsExist(err) { | ||
| return "", err | ||
| } | ||
|
|
||
| // Request a mount of all named volumes | ||
| for _, v := range c.config.NamedVolumes { | ||
| vol, err := c.mountNamedVolume(v, mountPoint) | ||
|
|
@@ -1670,64 +1680,6 @@ func (c *Container) mountNamedVolume(v *ContainerNamedVolume, mountpoint string) | |
| return vol, nil | ||
| } | ||
|
|
||
| // cleanupStorage unmounts and cleans up the container's root filesystem | ||
| func (c *Container) cleanupStorage() error { | ||
| if !c.state.Mounted { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1659,9 +1659,13 @@ func (c *Container) generateResolvConf() (string, error) { | |
| // check if systemd-resolved is used, assume it is used when 127.0.0.53 is the only nameserver | ||
| if len(ns) == 1 && ns[0] == "127.0.0.53" { | ||
| // read the actual resolv.conf file for systemd-resolved | ||
| resolvedContents, err := ioutil.ReadFile("/run/systemd/resolve/resolv.conf") | ||
| if err != nil { | ||
| if !os.IsNotExist(err) { | ||
| return "", errors.Wrapf(err, "detected that systemd-resolved is in use, but could not locate real resolv.conf") | ||
| } | ||
| } else { | ||
| contents = resolvedContents | ||
| } | ||
| } | ||
|
|
||
|
|
@@ -1814,7 +1818,7 @@ func (c *Container) getHosts() string { | |
| if c.Hostname() != "" { | ||
| if c.config.NetMode.IsSlirp4netns() { | ||
| // When using slirp4netns, the interface gets a static IP | ||
| slirp4netnsIP, err := GetSlirp4netnsIP(c.slirp4netnsSubnet) | ||
| if err != nil { | ||
| logrus.Warn("failed to determine slirp4netnsIP: ", err.Error()) | ||
| } else { | ||
|
|
@@ -2424,3 +2428,77 @@ func (c *Container) createSecretMountDir() error { | |
|
|
||
| return err | ||
| } | ||
|
|
||
| // Fix ownership and permissions of the specified volume if necessary. | ||
| func (c *Container) fixVolumePermissions(v *ContainerNamedVolume) error { | ||
| vol, err := c.runtime.state.Volume(v.Name) | ||
| if err != nil { | ||
| return errors.Wrapf(err, "error retrieving named volume %s for container %s", v.Name, c.ID()) | ||
| } | ||
|
|
||
| vol.lock.Lock() | ||
| defer vol.lock.Unlock() | ||
|
|
||
| // The volume may need a copy-up. Check the state. | ||
| if err := vol.update(); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // TODO: For now, I've disabled chowning volumes owned by non-Podman | ||
| // drivers. This may be safe, but it's really going to be a case-by-case | ||
| // thing, I think - safest to leave disabled now and re-enable later if | ||
| // there is a demand. | ||
| if vol.state.NeedsChown && !vol.UsesVolumeDriver() { | ||
| vol.state.NeedsChown = false | ||
|
|
||
| uid := int(c.config.Spec.Process.User.UID) | ||
| gid := int(c.config.Spec.Process.User.GID) | ||
|
|
||
| if c.config.IDMappings.UIDMap != nil { | ||
| p := idtools.IDPair{ | ||
| UID: uid, | ||
| GID: gid, | ||
| } | ||
| mappings := idtools.NewIDMappingsFromMaps(c.config.IDMappings.UIDMap, c.config.IDMappings.GIDMap) | ||
| newPair, err := mappings.ToHost(p) | ||
| if err != nil { | ||
| return errors.Wrapf(err, "error mapping user %d:%d", uid, gid) | ||
| } | ||
| uid = newPair.UID | ||
| gid = newPair.GID | ||
| } | ||
|
|
||
| vol.state.UIDChowned = uid | ||
| vol.state.GIDChowned = gid | ||
|
|
||
| if err := vol.save(); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| mountPoint, err := vol.MountPoint() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if err := os.Lchown(mountPoint, uid, gid); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // Make sure the new volume matches the permissions of the target directory. | ||
| // https://github.com/containers/podman/issues/10188 | ||
| st, err := os.Lstat(filepath.Join(c.state.Mountpoint, v.Dest)) | ||
| if err == nil { | ||
| if err := os.Chmod(mountPoint, st.Mode()|0111); err != nil { | ||
| return err | ||
| } | ||
| stat := st.Sys().(*syscall.Stat_t) | ||
| atime := time.Unix(int64(stat.Atim.Sec), int64(stat.Atim.Nsec)) | ||
| if err := os.Chtimes(mountPoint, atime, st.ModTime()); err != nil { | ||
| return err | ||
| } | ||
| } else if !os.IsNotExist(err) { | ||
| return err | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -57,3 +57,8 @@ func (c *Container) reloadNetwork() error { | |
| func (c *Container) getUserOverrides() *lookup.Overrides { | ||
| return nil | ||
| } | ||
|
|
||
| // Fix ownership and permissions of the specified volume if necessary. | ||
| func (c *Container) fixVolumePermissions(v *ContainerNamedVolume) error { | ||
| return define.ErrNotImplemented | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,7 +7,7 @@ import ( | |
| "github.com/pkg/errors" | ||
| ) | ||
|
|
||
| var initInodes = map[string]bool{ | ||
| "/dev": true, | ||
| "/etc/hostname": true, | ||
| "/etc/hosts": true, | ||
|
|
@@ -17,6 +17,7 @@ var containerMounts = map[string]bool{ | |
| "/run/.containerenv": true, | ||
| "/run/secrets": true, | ||
| "/sys": true, | ||
| "/etc/mtab": true, | ||
| } | ||
|
|
||
| // GetDiff returns the differences between the two images, layers, or containers | ||
|
|
@@ -36,7 +37,7 @@ func (r *Runtime) GetDiff(from, to string) ([]archive.Change, error) { | |
| changes, err := r.store.Changes(fromLayer, toLayer) | ||
| if err == nil { | ||
| for _, c := range changes { | ||
| if initInodes[c.Path] { | ||
| continue | ||
| } | ||
| rchanges = append(rchanges, c) | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Soft suggestion if you've others