Like podman allow buildah and therefore podman build to use the network
mode pasta. The pasta integration is very simple and we do not even
need a teardown handler for that as pasta will exit on its own when the
netns path is removed.
However right now this is broken, pasta will fail to open
/proc/$pid/ns/net. I send a patch[1] to fix this upstream in pasta.
I assume this will land quickly so I like to get this in now just so we
have this included in podman v4.6. Thus the test is skipped for now.
[1] https://archives.passt.top/passt-dev/20230623082531.25947-2-pholzing@redhat.com/
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This uses the same code as podman for slirp4netns, this means
- ipv6 is enabled by default
- slirp4netns options are read from contianers.conf
- slirp4netns options can now be set on the cli. This required some
small rework on where we parse the network string.
Lastly I updated the --network docs, to document the new slirp4netns
mode. That included fixing up buildah-from and buildah-run pages which
were incomplete in that regard. Now we show the same for all options.
Fixes#3968
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Some tools depend on the hostname being present in /etc/hosts. I would
argue they are broken but its not like we can do anything about that.
This adds the hostname with the local host ip when the host network is
used. For private networking we already add the hostname.
We also now correctly force host networking in chroot mode, it was
silently ignored before thus causing extra confusion here.
Fixes#4446
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Restore SysProcAttr.Pdeathsig values for child processes that we start,
so that they get a SIGKILL when we exit for whatever reason. Lock the
calling goroutine to a native thread while that's happening, like we
should always have done.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
it is not safe to use prctl(PR_SET_PDEATHSIG) in a Go program since
the parent of the process is considered the *thread* that created the
child process, and the Go runtime can free a thread at any time. We
would either need to lock the thread, or simpler just not use it.
[NO NEW TESTS NEEDED]
Closes: https://github.com/containers/podman/issues/17918
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
change the heuristic to mount a fresh sysfs every time a new network
namespace is created. This modification ensures the creation of the
sysfs when the network namespace is created, which is better than
sharing the one from the host.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2164524
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
In the tutorial, switch to calling `DefaultStoreOptionsAutoDetectUID()`
instead of `DefaultStoreOptions()`, which should figure things out
better.
In the tutorial, add an example of using Run(), where for API backward
compatibility reasons, we can't tell the difference between "grant no
capabilties by default" and "grant the default set of capabilities by
default".
The default isolation can be set automatically, so start doing that at
run-time, but have the tutorial look it up anyway because the tutorial
on the web will be newer than our current release for at least a while.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
When working with `--mount=type=bind` and `--mount=type=cache` allow
`target` to accept relative paths w.r.t to the configured work dir.
Closes: https://github.com/containers/buildah/issues/4309
Signed-off-by: Aditya R <arajan@redhat.com>
In golang 1.19, `io/ioutil` is fully deprecated preventing Buildah from
compiling. Replace all calls with equivalent calls from the `os`
package.
Signed-off-by: Chris Evich <cevich@redhat.com>
... and use a more traditional error handling model,
where responsibility for the cleanup passes to the caller
_only_ if the called function succeeds.
To reinforce that, hard-code nil returns on error paths
instead of returning the locks.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
It can return at most one lock, so don't return an array.
Should not change behavior right now, but it will simplify
cleanup.
[NO NEW TESTS NEEDED]
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
They exist in memory anyway, so this is more efficient:
we avoid the need to manually touch the filesystem again,
the associated costs - and the error paths go away.
[NO NEW TESTS NEEDED]
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Podman adds an Error: to every error message. So starting an error
message with "error" ends up being reported to the user as
Error: error ...
This patch removes the stutter.
Also ioutil.ReadFile errors report the Path, so wrapping the err message
with the path causes a stutter.
Signed-off-by: Daniel J Walsh dwalsh@redhat.com
[NO NEW TESTS NEEDED]
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
If errors for which os.IsExist() or os.IsNotExist() would have returned
true have been wrapped using fmt.Errorf()'s "%w" verb, os.IsExist() and
os.IsNotExist(), not having been retrofitted to use errors.Is(), will
return false.
Use errors.Is() to check if an error is an os.ErrExist or os.ErrNotExist
error instead of calling os.IsExist() or os.IsNotExist().
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
We now use the golang error wrapping format specifier `%w` instead of
the deprecated github.com/pkg/errors package.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
Following PR adds support for OCI hooks attached to each of ephemeral
build contains which are created by `RUN` step invoked during `buildah
build` command.
Following PR also adds `--hooks-dir` flag to `buildah build` option
which allows end-users to specify one or more configuration directories
for OCI-hooks.
Note: Following PR migrates `pkg/hooks` from `podman` to `buildah` so
buildah could implement this feature and once merged `podman` can start
using `buildah/pkg/hooks`.
For usage see man-page and example test-case.
See: https://github.com/opencontainers/runtime-spec/blob/main/config.md#posix-platform-hooks
Closes: https://github.com/containers/buildah/issues/4068
Signed-off-by: Aditya R <arajan@redhat.com>
Podman and Buildah should use the same code the generate the resolv.conf
file. This mostly moved the podman code into c/common and created a
better API for it so buildah can use it as well.
[NO NEW TESTS NEEDED] All existing tests should continue to pass.
Fixes#3806
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Code Cleanup: Buildkit run mount setup functions no longer have 13
arguments and are slightly more readable. Use structs instead.
[NO NEW TESTS NEEDED]
Signed-off-by: Ashley Cui <acui@redhat.com>
Buildah now supports renaming devices while performing a build using
`--device <some-name>:<new-name>`. Implementation is similar to `podman`
where we prefer using `bind-mount` for devices instead of `mknod` in
`rootless` setups.
Usage
```console
buildah build -t test --device /dev/null:/test/dev/null .
```
Closes: https://github.com/containers/buildah/issues/4002
Signed-off-by: Aditya R <arajan@redhat.com>
If a secret is used in a RUN step it is created on host but we had a
check which expects a secret to not exist on the host however same
secret can be remounted on another step so it can already exists on host
so remove the check since a secret can be mounted again from host in
another RUN step.
Closes: https://github.com/containers/buildah/issues/3993
Signed-off-by: Aditya R <arajan@redhat.com>
Use the new etchosts package to generate the hosts file.
This will ensure that we use the same logic in podman and buildah.
New features are:
- no duplicated entries
- adds entries for the network/slirp4netns ips
- configure the host.containers.internal entry in containers.conf
- configure the base hosts file in containers.conf
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The current logic in setupRootlessSpecChanges has quite a few problems.
First of this logic is a noop for rootful and when we have a netns.
However pid and ipc could still need special mounts.
In Podman we have already working code for this so this reuses the same
logic and adapts it to buildah.
4ba71f955a/pkg/specgen/generate/oci.go (L178)
Since there is already logic to handle these mounts in buildah we will
add it there and also handle the special rootless case there.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Buildah ignores the container.conf settings. Commit 05d5d22dc6 tried
to fix this but I cannot see how this would have worked, there were also
no test added related to containers.conf.
The code below were we read the default just overwrites everything we
already set so the config settings are ignored.
Also there are many weird places were settings are just overwritten for
no particular reason. The namespaces code path looks like mess to me.
Namespaces are added/changed/removed in many different places and there
is no explanation why. Maybe I am just not familar enough with this code
base but I cannot really understand this. Hopefully a maintainer can
take a closer look to see if my changes are indeed correct.
Fixescontainers/podman#13294
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When the run child process exits early the parent still tries to read
from the ready pipe. Reading from the pipe should end when all writers
are closed. The problem is that the parent kept the writer open as well.
To fix the hang we just need to close the writer before we try to read
and after we gave it to the child.
To prevent closing the fd twice with defer I added a new fileCloser type
to store if the file was already closed.
This problem was noticed in the podman CI:
https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/6624611893772288/html/sys-podman-fedora-35-root-host-netavark.log.html
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Paul Holzinger
Nalin Dahyabhai
Giuseppe Scrivano
Aditya R
Chris Evich
Miloslav Trmač
Daniel J Walsh
Doug Rabson
Sascha Grunert
Ashley Cui
OpenShift Merge Robot