Hello community,
here is the log from the commit of package libcontainers-common for
openSUSE:Factory checked in at 2019-02-24 16:52:51
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libcontainers-common (Old)
and /work/SRC/openSUSE:Factory/.libcontainers-common.new.28833 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcontainers-common"
Sun Feb 24 16:52:51 2019 rev:11 rq:677418 version:20190219
Changes:
--------
---
/work/SRC/openSUSE:Factory/libcontainers-common/libcontainers-common.changes
2019-02-04 15:33:07.587102808 +0100
+++
/work/SRC/openSUSE:Factory/.libcontainers-common.new.28833/libcontainers-common.changes
2019-02-24 16:52:57.708977869 +0100
@@ -1,0 +2,11 @@
+Tue Feb 19 15:34:54 UTC 2019 - Richard Brown <[email protected]>
+
+- Upgrade to storage v1.10
+ * enable parallel blob reads
+ * Teach images to hold multiple manifests
+ * Move structs for storage.conf to pkg/config
+- Upgrade to libpod v1.0.1
+ * Do not unmarshal into c.config.Spec
+ * spec: add nosuid,noexec,nodev to ro bind mount
+
+-------------------------------------------------------------------
Old:
----
libpod-1.0.0.tar.xz
storage-1.8.tar.xz
New:
----
libpod-1.0.1.tar.xz
storage-1.10.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libcontainers-common.spec ++++++
--- /var/tmp/diff_new_pack.Wh80Gn/_old 2019-02-24 16:53:00.592976516 +0100
+++ /var/tmp/diff_new_pack.Wh80Gn/_new 2019-02-24 16:53:00.596976514 +0100
@@ -16,16 +16,16 @@
#
# libpodver - version from containers/libpod
-%define libpodver 1.0.0
+%define libpodver 1.0.1
# storagever - version from containers/storage
-%define storagever 1.8
+%define storagever 1.10
# imagever - version from containers/image
%define imagever 1.3
Name: libcontainers-common
-Version: 20190125
+Version: 20190219
Release: 0
Summary: Configuration files common to github.com/containers
License: Apache-2.0
++++++ _service ++++++
--- /var/tmp/diff_new_pack.Wh80Gn/_old 2019-02-24 16:53:00.632976497 +0100
+++ /var/tmp/diff_new_pack.Wh80Gn/_new 2019-02-24 16:53:00.632976497 +0100
@@ -4,24 +4,24 @@
<param name="url">https://github.com/containers/storage.git</param>
<param name="scm">git</param>
<param name="filename">storage</param>
-<param name="versionformat"></param>
-<param name="revision">c57ac62f89f5496ae16a6273554f26301aa188e7</param>
+<param name="versionformat">1.10</param>
+<param name="revision">v1.10</param>
</service>
<service name="tar_scm" mode="disabled">
<param name="url">https://github.com/containers/image.git</param>
<param name="scm">git</param>
<param name="filename">image</param>
-<param name="versionformat"></param>
-<param name="revision">4b6d9cf918c1e79a605265568c93cb35185ad25d</param>
+<param name="versionformat">1.3</param>
+<param name="revision">v1.3</param>
</service>
<service name="tar_scm" mode="disabled">
<param name="url">https://github.com/containers/libpod.git</param>
<param name="scm">git</param>
<param name="filename">libpod</param>
-<param name="versionformat"></param>
-<param name="revision">v0.11.1</param>
+<param name="versionformat">1.0.1</param>
+<param name="revision">v1.0.1</param>
</service>
<service name="recompress" mode="disabled">
++++++ image-1.3.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/image-1.3/.gitignore new/image-1.3/.gitignore
--- old/image-1.3/.gitignore 2018-12-21 15:36:20.000000000 +0100
+++ new/image-1.3/.gitignore 1970-01-01 01:00:00.000000000 +0100
@@ -1,12 +0,0 @@
-vendor
-tools.timestamp
-
-# Idea IDE
-*.iml
-.idea
-
-# Visual Studio Code
-.vscode/*
-
-# trash
-trash.lock
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/image-1.3/signature/fixtures/.gitignore
new/image-1.3/signature/fixtures/.gitignore
--- old/image-1.3/signature/fixtures/.gitignore 2018-12-21 15:36:20.000000000
+0100
+++ new/image-1.3/signature/fixtures/.gitignore 1970-01-01 01:00:00.000000000
+0100
@@ -1,6 +0,0 @@
-/*.gpg~
-/.gpg-v21-migrated
-/private-keys-v1.d
-/random_seed
-/gnupg_spawn_agent_sentinel.lock
-/.#*
++++++ libpod-1.0.0.tar.xz -> libpod-1.0.1.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/.gitignore new/libpod-1.0.1/.gitignore
--- old/libpod-1.0.0/.gitignore 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/.gitignore 1970-01-01 01:00:00.000000000 +0100
@@ -1,19 +0,0 @@
-/.artifacts/
-/_output/
-/conmon/conmon.o
-/docs/*.[158]
-/docs/*.[158].gz
-*.o
-*.orig
-/pause/pause.o
-/bin/
-/test/bin2img/bin2img
-/test/checkseccomp/checkseccomp
-/test/copyimg/copyimg
-/build/
-.nfs*
-.ropeproject
-__pycache__
-/cmd/podman/varlink/ioprojectatomicpodman.go
-/cmd/podman/varlink/iopodman.go
-.gopathok
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/API.md new/libpod-1.0.1/API.md
--- old/libpod-1.0.0/API.md 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/API.md 2019-02-11 14:57:41.000000000 +0100
@@ -57,6 +57,8 @@
[func ImageExists(name: string) int](#ImageExists)
+[func ImagesPrune(all: bool) []string](#ImagesPrune)
+
[func ImportImage(source: string, reference: string, message: string, changes:
[]string) string](#ImportImage)
[func InspectContainer(name: string) string](#InspectContainer)
@@ -543,6 +545,12 @@
"exists": 1
}
~~~
+### <a name="ImagesPrune"></a>func ImagesPrune
+<div style="background-color: #E8E8E8; padding: 15px; margin: 10px;
border-radius: 10px;">
+
+method ImagesPrune(all: [bool](https://godoc.org/builtin#bool))
[[]string](#[]string)</div>
+ImagesPrune removes all unused images from the local store. Upon successful
pruning,
+the IDs of the removed images are returned.
### <a name="ImportImage"></a>func ImportImage
<div style="background-color: #E8E8E8; padding: 15px; margin: 10px;
border-radius: 10px;">
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/Makefile new/libpod-1.0.1/Makefile
--- old/libpod-1.0.0/Makefile 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/Makefile 2019-02-11 14:57:41.000000000 +0100
@@ -1,6 +1,6 @@
GO ?= go
DESTDIR ?= /
-EPOCH_TEST_COMMIT ?= 76c57f55cacb7916ca451e378d181b1c30c94032
+EPOCH_TEST_COMMIT ?= d32e2d1fecb80f74a727f857bacda08bea9b7d67
HEAD ?= HEAD
CHANGELOG_BASE ?= HEAD~
CHANGELOG_TARGET ?= HEAD
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/changelog.txt
new/libpod-1.0.1/changelog.txt
--- old/libpod-1.0.0/changelog.txt 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/changelog.txt 2019-02-11 14:57:41.000000000 +0100
@@ -1,3 +1,20 @@
+- Changelog for v1.0.1 (2019-02-11):
+ * Fix tests after cherry-picking
+ * rootless: join both userns and mount namespace with --pod
+ * spec: add nosuid,noexec,nodev to ro bind mount
+ * rootless: create the userns immediately when creating a new pod
+ * Preserve exited state across reboot
+ * libpod/image: Use RepoDigests() in Inspect()
+ * podman image prune -- implement all flag
+ * Add varlink support for prune
+ * Make --quiet work in podman create/run
+ * Show a better error message when podman info fails during a refresh
+ * Vendor in latest opencontainers/selinux
+ * rootless: fix --pid=host without --privileged
+ * Do not unmarshal into c.config.Spec
+ * podman-inspect: don't ignore errors
+ * Ensure that wait exits on state transition
+
- Changelog for v1.0.0 (2018-1-11)
* Update release notes for v1.0
* Remove clientintegration from Makefile
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/create.go
new/libpod-1.0.1/cmd/podman/create.go
--- old/libpod-1.0.0/cmd/podman/create.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/cmd/podman/create.go 2019-02-11 14:57:41.000000000
+0100
@@ -4,6 +4,8 @@
"context"
"encoding/json"
"fmt"
+ "io"
+ "io/ioutil"
"os"
"path/filepath"
"strconv"
@@ -127,7 +129,12 @@
var data *inspect.ImageData = nil
if rootfs == "" && !rootless.SkipStorageSetup() {
- newImage, err := runtime.ImageRuntime().New(ctx, c.Args()[0],
rtc.SignaturePolicyPath, "", os.Stderr, nil, image.SigningOptions{}, false)
+ var writer io.Writer
+ if !c.Bool("quiet") {
+ writer = os.Stderr
+ }
+
+ newImage, err := runtime.ImageRuntime().New(ctx, c.Args()[0],
rtc.SignaturePolicyPath, "", writer, nil, image.SigningOptions{}, false)
if err != nil {
return nil, nil, err
}
@@ -172,7 +179,11 @@
if err != nil {
return errors.Wrapf(err, "container %q not found",
config.PidMode.Container())
}
- labelOpts = append(labelOpts,
label.DupSecOpt(ctr.ProcessLabel())...)
+ secopts, err := label.DupSecOpt(ctr.ProcessLabel())
+ if err != nil {
+ return errors.Wrapf(err, "failed to duplicate label %q
", ctr.ProcessLabel())
+ }
+ labelOpts = append(labelOpts, secopts...)
}
if config.IpcMode.IsHost() {
@@ -182,7 +193,11 @@
if err != nil {
return errors.Wrapf(err, "container %q not found",
config.IpcMode.Container())
}
- labelOpts = append(labelOpts,
label.DupSecOpt(ctr.ProcessLabel())...)
+ secopts, err := label.DupSecOpt(ctr.ProcessLabel())
+ if err != nil {
+ return errors.Wrapf(err, "failed to duplicate label %q
", ctr.ProcessLabel())
+ }
+ labelOpts = append(labelOpts, secopts...)
}
for _, opt := range securityOpts {
@@ -421,6 +436,16 @@
}
if c.IsSet("pod") {
if strings.HasPrefix(originalPodName, "new:") {
+ if rootless.IsRootless() {
+ // To create a new pod, we must immediately
create the userns.
+ became, ret, err :=
rootless.BecomeRootInUserNS()
+ if err != nil {
+ return nil, err
+ }
+ if became {
+ os.Exit(ret)
+ }
+ }
// pod does not exist; lets make it
var podOptions []libpod.PodCreateOption
podOptions = append(podOptions,
libpod.WithPodName(podName), libpod.WithInfraContainer(),
libpod.WithPodCgroups())
@@ -785,11 +810,15 @@
if s != libpod.ContainerStateRunning && s !=
libpod.ContainerStatePaused {
continue
}
- pid, err := prevCtr.PID()
+ data, err :=
ioutil.ReadFile(prevCtr.Config().ConmonPidFile)
if err != nil {
- return false, -1, err
+ return false, -1, errors.Wrapf(err, "cannot
read conmon PID file %q", prevCtr.Config().ConmonPidFile)
+ }
+ conmonPid, err := strconv.Atoi(string(data))
+ if err != nil {
+ return false, -1, errors.Wrapf(err, "cannot
parse PID %q", data)
}
- return rootless.JoinNS(uint(pid))
+ return
rootless.JoinDirectUserAndMountNS(uint(conmonPid))
}
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/formats/formats.go
new/libpod-1.0.1/cmd/podman/formats/formats.go
--- old/libpod-1.0.0/cmd/podman/formats/formats.go 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/cmd/podman/formats/formats.go 2019-02-11
14:57:41.000000000 +0100
@@ -20,6 +20,8 @@
JSONString = "json"
// IDString const to save on duplicates for Go templates
IDString = "{{.ID}}"
+
+ parsingErrorStr = "Template parsing error"
)
// Writer interface for outputs
@@ -96,7 +98,7 @@
t.Template = strings.Replace(strings.TrimSpace(t.Template[5:]),
" ", "\t", -1)
headerTmpl, err :=
template.New("header").Funcs(headerFunctions).Parse(t.Template)
if err != nil {
- return errors.Wrapf(err, "Template parsing error")
+ return errors.Wrapf(err, parsingErrorStr)
}
err = headerTmpl.Execute(w, t.Fields)
if err != nil {
@@ -107,13 +109,12 @@
t.Template = strings.Replace(t.Template, " ", "\t", -1)
tmpl, err :=
template.New("image").Funcs(basicFunctions).Parse(t.Template)
if err != nil {
- return errors.Wrapf(err, "Template parsing error")
+ return errors.Wrapf(err, parsingErrorStr)
}
- for i, img := range t.Output {
+ for i, raw := range t.Output {
basicTmpl := tmpl.Funcs(basicFunctions)
- err = basicTmpl.Execute(w, img)
- if err != nil {
- return err
+ if err := basicTmpl.Execute(w, raw); err != nil {
+ return errors.Wrapf(err, parsingErrorStr)
}
if i != len(t.Output)-1 {
fmt.Fprintln(w, "")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/images_prune.go
new/libpod-1.0.1/cmd/podman/images_prune.go
--- old/libpod-1.0.0/cmd/podman/images_prune.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/cmd/podman/images_prune.go 2019-02-11 14:57:41.000000000
+0100
@@ -1,8 +1,9 @@
package main
import (
+ "fmt"
+
"github.com/containers/libpod/cmd/podman/libpodruntime"
- "github.com/containers/libpod/cmd/podman/shared"
"github.com/pkg/errors"
"github.com/urfave/cli"
)
@@ -13,13 +14,19 @@
Removes all unnamed images from local storage
`
-
+ pruneImageFlags = []cli.Flag{
+ cli.BoolFlag{
+ Name: "all, a",
+ Usage: "remove all unused images, not just dangling
ones",
+ },
+ }
pruneImagesCommand = cli.Command{
Name: "prune",
Usage: "Remove unused images",
Description: pruneImagesDescription,
Action: pruneImagesCmd,
OnUsageError: usageErrorHandler,
+ Flags: pruneImageFlags,
}
)
@@ -30,5 +37,13 @@
}
defer runtime.Shutdown(false)
- return shared.Prune(runtime.ImageRuntime())
+ // Call prune; if any cids are returned, print them and then
+ // return err in case an error also came up
+ pruneCids, err := runtime.ImageRuntime().PruneImages(c.Bool("all"))
+ if len(pruneCids) > 0 {
+ for _, cid := range pruneCids {
+ fmt.Println(cid)
+ }
+ }
+ return err
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/inspect.go
new/libpod-1.0.1/cmd/podman/inspect.go
--- old/libpod-1.0.0/cmd/podman/inspect.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/cmd/podman/inspect.go 2019-02-11 14:57:41.000000000
+0100
@@ -87,6 +87,9 @@
}
inspectedObjects, iterateErr := iterateInput(getContext(), c, args,
runtime, inspectType)
+ if iterateErr != nil {
+ return iterateErr
+ }
var out formats.Writer
if outputFormat != "" && outputFormat != formats.JSONString {
@@ -97,8 +100,7 @@
out = formats.JSONStructArray{Output: inspectedObjects}
}
- formats.Writer(out).Out()
- return iterateErr
+ return formats.Writer(out).Out()
}
// func iterateInput iterates the images|containers the user has requested and
returns the inspect data and error
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/shared/prune.go
new/libpod-1.0.1/cmd/podman/shared/prune.go
--- old/libpod-1.0.0/cmd/podman/shared/prune.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/cmd/podman/shared/prune.go 1970-01-01 01:00:00.000000000
+0100
@@ -1,24 +0,0 @@
-package shared
-
-import (
- "fmt"
- "github.com/pkg/errors"
-
- "github.com/containers/libpod/libpod/image"
-)
-
-// Prune removes all unnamed and unused images from the local store
-func Prune(ir *image.Runtime) error {
- pruneImages, err := ir.GetPruneImages()
- if err != nil {
- return err
- }
-
- for _, i := range pruneImages {
- if err := i.Remove(true); err != nil {
- return errors.Wrapf(err, "failed to remove %s", i.ID())
- }
- fmt.Println(i.ID())
- }
- return nil
-}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/cmd/podman/varlink/io.podman.varlink
new/libpod-1.0.1/cmd/podman/varlink/io.podman.varlink
--- old/libpod-1.0.0/cmd/podman/varlink/io.podman.varlink 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/cmd/podman/varlink/io.podman.varlink 2019-02-11
14:57:41.000000000 +0100
@@ -1015,6 +1015,10 @@
# ~~~
method UnmountContainer(name: string, force: bool) -> ()
+# ImagesPrune removes all unused images from the local store. Upon successful
pruning,
+# the IDs of the removed images are returned.
+method ImagesPrune(all: bool) -> (pruned: []string)
+
# This function is not implemented yet.
method ListContainerPorts(name: string) -> (notimplemented: NotImplemented)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/completions/bash/podman
new/libpod-1.0.1/completions/bash/podman
--- old/libpod-1.0.0/completions/bash/podman 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/completions/bash/podman 2019-02-11 14:57:41.000000000
+0100
@@ -2453,6 +2453,8 @@
"
local boolean_options="
+ -a
+ --all
-h
--help
"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/contrib/cirrus/packer/.gitignore
new/libpod-1.0.1/contrib/cirrus/packer/.gitignore
--- old/libpod-1.0.0/contrib/cirrus/packer/.gitignore 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/contrib/cirrus/packer/.gitignore 1970-01-01
01:00:00.000000000 +0100
@@ -1,7 +0,0 @@
-*json
-packer
-packer*zip
-packer_cache
-cidata*
-meta-data
-user-data
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/contrib/spec/podman.spec.in
new/libpod-1.0.1/contrib/spec/podman.spec.in
--- old/libpod-1.0.0/contrib/spec/podman.spec.in 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/contrib/spec/podman.spec.in 2019-02-11
14:57:41.000000000 +0100
@@ -39,7 +39,7 @@
%global shortcommit_conmon %(c=%{commit_conmon}; echo ${c:0:7})
Name: podman
-Version: 1.0.0
+Version: 1.0.1
Release: #COMMITDATE#.git%{shortcommit0}%{?dist}
Summary: Manage Pods, Containers and Container Images
License: ASL 2.0
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/docs/podman-image-prune.1.md
new/libpod-1.0.1/docs/podman-image-prune.1.md
--- old/libpod-1.0.0/docs/podman-image-prune.1.md 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/docs/podman-image-prune.1.md 2019-02-11
14:57:41.000000000 +0100
@@ -6,23 +6,38 @@
# SYNOPSIS
**podman image prune**
+[**-a**|**--all**]
[**-h**|**--help**]
# DESCRIPTION
-**podman image prune** removes all unused images from local storage. An unused
image
-is defined as an image that does not have any containers based on it.
+**podman image prune** removes all dangling images from local storage. With
the `all` option,
+you can delete all unused images. Unused images are dangling images as well
as any image that
+does not have any containers based on it.
+
+## OPTIONS
+**--all, -a**
+
+Remove dangling images and images that have no associated containers.
## Examples ##
-Remove all unused images from local storage
+Remove all dangling images from local storage
```
$ sudo podman image prune
f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e
324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907
+```
+
+Remove all unused images from local storage
+```
+$ sudo podman image prune -a
+f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e
+324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907
6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c
91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6
e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca
77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe
+
```
## SEE ALSO
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/container.go
new/libpod-1.0.1/libpod/container.go
--- old/libpod-1.0.0/libpod/container.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/libpod/container.go 2019-02-11 14:57:41.000000000
+0100
@@ -410,14 +410,15 @@
// config does not exist (e.g., because the container was never started) return
// the spec from the config.
func (c *Container) specFromState() (*spec.Spec, error) {
- spec := c.config.Spec
+ returnSpec := c.config.Spec
if f, err := os.Open(c.state.ConfigPath); err == nil {
+ returnSpec = new(spec.Spec)
content, err := ioutil.ReadAll(f)
if err != nil {
return nil, errors.Wrapf(err, "error reading container
config")
}
- if err := json.Unmarshal([]byte(content), &spec); err != nil {
+ if err := json.Unmarshal([]byte(content), &returnSpec); err !=
nil {
return nil, errors.Wrapf(err, "error unmarshalling
container config")
}
} else {
@@ -427,7 +428,7 @@
}
}
- return spec, nil
+ return returnSpec, nil
}
// ID returns the container's ID
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/container_easyjson.go
new/libpod-1.0.1/libpod/container_easyjson.go
--- old/libpod-1.0.0/libpod/container_easyjson.go 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/libpod/container_easyjson.go 2019-02-11
14:57:41.000000000 +0100
@@ -1,6 +1,6 @@
// +build seccomp ostree selinux varlink exclude_graphdriver_devicemapper
-// Code generated by easyjson for marshaling/unmarshaling. DO NOT EDIT.
+// Code generated by easyjson for marshaling/unmarshaling. DO NOT EDIT .
package libpod
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/container_internal.go
new/libpod-1.0.1/libpod/container_internal.go
--- old/libpod-1.0.0/libpod/container_internal.go 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/libpod/container_internal.go 2019-02-11
14:57:41.000000000 +0100
@@ -393,7 +393,9 @@
state.PID = 0
state.Mountpoint = ""
state.Mounted = false
- state.State = ContainerStateConfigured
+ if state.State != ContainerStateExited {
+ state.State = ContainerStateConfigured
+ }
state.ExecSessions = make(map[string]*ExecSession)
state.NetworkStatus = nil
state.BindMounts = make(map[string]string)
@@ -531,7 +533,7 @@
if err != nil {
return true, err
}
- return (c.state.State == ContainerStateStopped || c.state.State ==
ContainerStateExited), nil
+ return (c.state.State != ContainerStateRunning && c.state.State !=
ContainerStatePaused), nil
}
// save container state to the database
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/container_internal_linux.go
new/libpod-1.0.1/libpod/container_internal_linux.go
--- old/libpod-1.0.0/libpod/container_internal_linux.go 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/libpod/container_internal_linux.go 2019-02-11
14:57:41.000000000 +0100
@@ -227,7 +227,7 @@
Options: []string{"bind", "private"},
}
if c.IsReadOnly() && dstPath != "/dev/shm" {
- newMount.Options = append(newMount.Options, "ro")
+ newMount.Options = append(newMount.Options, "ro",
"nosuid", "noexec", "nodev")
}
if !MountExists(g.Mounts(), dstPath) {
g.AddMount(newMount)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/image/image.go
new/libpod-1.0.1/libpod/image/image.go
--- old/libpod-1.0.0/libpod/image/image.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/libpod/image/image.go 2019-02-11 14:57:41.000000000
+0100
@@ -824,9 +824,9 @@
return nil, err
}
- var repoDigests []string
- for _, name := range i.Names() {
- repoDigests = append(repoDigests, strings.SplitN(name, ":",
2)[0]+"@"+i.Digest().String())
+ repoDigests, err := i.RepoDigests()
+ if err != nil {
+ return nil, err
}
driver, err := i.DriverData()
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/image/prune.go
new/libpod-1.0.1/libpod/image/prune.go
--- old/libpod-1.0.0/libpod/image/prune.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/libpod/image/prune.go 2019-02-11 14:57:41.000000000
+0100
@@ -1,9 +1,11 @@
package image
+import "github.com/pkg/errors"
+
// GetPruneImages returns a slice of images that have no names/unused
-func (ir *Runtime) GetPruneImages() ([]*Image, error) {
+func (ir *Runtime) GetPruneImages(all bool) ([]*Image, error) {
var (
- unamedImages []*Image
+ pruneImages []*Image
)
allImages, err := ir.GetImages()
if err != nil {
@@ -11,16 +13,35 @@
}
for _, i := range allImages {
if len(i.Names()) == 0 {
- unamedImages = append(unamedImages, i)
+ pruneImages = append(pruneImages, i)
continue
}
- containers, err := i.Containers()
- if err != nil {
- return nil, err
+ if all {
+ containers, err := i.Containers()
+ if err != nil {
+ return nil, err
+ }
+ if len(containers) < 1 {
+ pruneImages = append(pruneImages, i)
+ }
}
- if len(containers) < 1 {
- unamedImages = append(unamedImages, i)
+ }
+ return pruneImages, nil
+}
+
+// PruneImages prunes dangling and optionally all unused images from the local
+// image store
+func (ir *Runtime) PruneImages(all bool) ([]string, error) {
+ var prunedCids []string
+ pruneImages, err := ir.GetPruneImages(all)
+ if err != nil {
+ return nil, errors.Wrap(err, "unable to get images to prune")
+ }
+ for _, p := range pruneImages {
+ if err := p.Remove(true); err != nil {
+ return nil, errors.Wrap(err, "failed to prune image")
}
+ prunedCids = append(prunedCids, p.ID())
}
- return unamedImages, nil
+ return prunedCids, nil
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/oci.go
new/libpod-1.0.1/libpod/oci.go
--- old/libpod-1.0.0/libpod/oci.go 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/libpod/oci.go 2019-02-11 14:57:41.000000000 +0100
@@ -357,18 +357,25 @@
// Set the label of the conmon process to be level :s0
// This will allow the container processes to talk to fifo-files
// passed into the container by conmon
- var plabel string
+ var (
+ plabel string
+ con selinux.Context
+ )
plabel, err = selinux.CurrentLabel()
if err != nil {
childPipe.Close()
return errors.Wrapf(err, "Failed to get current SELinux
label")
}
- c := selinux.NewContext(plabel)
+ con, err = selinux.NewContext(plabel)
+ if err != nil {
+ return errors.Wrapf(err, "Failed to get new context
from SELinux label")
+ }
+
runtime.LockOSThread()
- if c["level"] != "s0" && c["level"] != "" {
- c["level"] = "s0"
- if err = label.SetProcessLabel(c.Get()); err != nil {
+ if con["level"] != "s0" && con["level"] != "" {
+ con["level"] = "s0"
+ if err = label.SetProcessLabel(con.Get()); err != nil {
runtime.UnlockOSThread()
return err
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/libpod/runtime.go
new/libpod-1.0.1/libpod/runtime.go
--- old/libpod-1.0.0/libpod/runtime.go 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/libpod/runtime.go 2019-02-11 14:57:41.000000000 +0100
@@ -772,7 +772,11 @@
// Take advantage of a command that requires a new userns
// so that we are running as the root user and able to use refresh()
cmd := exec.Command(os.Args[0], "info")
- return cmd.Run()
+ err := cmd.Run()
+ if err != nil {
+ return errors.Wrapf(err, "Error running %s info while
refreshing state", os.Args[0])
+ }
+ return nil
}
// Reconfigures the runtime after a reboot
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/pkg/hooks/docs/.gitignore
new/libpod-1.0.1/pkg/hooks/docs/.gitignore
--- old/libpod-1.0.0/pkg/hooks/docs/.gitignore 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/pkg/hooks/docs/.gitignore 1970-01-01 01:00:00.000000000
+0100
@@ -1 +0,0 @@
-*.5
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/pkg/spec/spec.go
new/libpod-1.0.1/pkg/spec/spec.go
--- old/libpod-1.0.0/pkg/spec/spec.go 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/pkg/spec/spec.go 2019-02-11 14:57:41.000000000 +0100
@@ -376,6 +376,10 @@
}
func blockAccessToKernelFilesystems(config *CreateConfig, g
*generate.Generator) {
+ if config.PidMode.IsHost() && rootless.IsRootless() {
+ return
+ }
+
if !config.Privileged {
for _, mp := range []string{
"/proc/acpi",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/pkg/varlinkapi/images.go
new/libpod-1.0.1/pkg/varlinkapi/images.go
--- old/libpod-1.0.0/pkg/varlinkapi/images.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/pkg/varlinkapi/images.go 2019-02-11 14:57:41.000000000
+0100
@@ -620,3 +620,12 @@
}
return call.ReplyContainerRunlabel()
}
+
+// ImagesPrune ....
+func (i *LibpodAPI) ImagesPrune(call iopodman.VarlinkCall, all bool) error {
+ prunedImages, err := i.Runtime.ImageRuntime().PruneImages(all)
+ if err != nil {
+ return call.ReplyErrorOccurred(err.Error())
+ }
+ return call.ReplyImagesPrune(prunedImages)
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/test/e2e/prune_test.go
new/libpod-1.0.1/test/e2e/prune_test.go
--- old/libpod-1.0.0/test/e2e/prune_test.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/test/e2e/prune_test.go 2019-02-11 14:57:41.000000000
+0100
@@ -72,10 +72,11 @@
Expect(none.ExitCode()).To(Equal(0))
hasNoneAfter, _ := after.GrepString("<none>")
Expect(hasNoneAfter).To(BeFalse())
+ Expect(len(after.OutputToStringArray()) > 1).To(BeTrue())
})
It("podman image prune unused images", func() {
- prune := podmanTest.Podman([]string{"image", "prune"})
+ prune := podmanTest.Podman([]string{"image", "prune", "-a"})
prune.WaitWithDefaultTimeout()
Expect(prune.ExitCode()).To(Equal(0))
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/test/e2e/rootless_test.go
new/libpod-1.0.1/test/e2e/rootless_test.go
--- old/libpod-1.0.0/test/e2e/rootless_test.go 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/test/e2e/rootless_test.go 2019-02-11 14:57:41.000000000
+0100
@@ -274,6 +274,10 @@
runRootlessHelper([]string{"--net", "host"})
})
+ It("podman rootless rootfs --pid host", func() {
+ runRootlessHelper([]string{"--pid", "host"})
+ })
+
It("podman rootless rootfs --privileged", func() {
runRootlessHelper([]string{"--privileged"})
})
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/test/install/.gitignore
new/libpod-1.0.1/test/install/.gitignore
--- old/libpod-1.0.0/test/install/.gitignore 2019-01-11 21:17:03.000000000
+0100
+++ new/libpod-1.0.1/test/install/.gitignore 1970-01-01 01:00:00.000000000
+0100
@@ -1 +0,0 @@
-rpms/
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
---
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
2019-01-11 21:17:03.000000000 +0100
+++
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
2019-02-11 14:57:41.000000000 +0100
@@ -75,8 +75,8 @@
// DupSecOpt takes a process label and returns security options that
// can be used to set duplicate labels on future container processes
-func DupSecOpt(src string) []string {
- return nil
+func DupSecOpt(src string) ([]string, error) {
+ return nil, nil
}
// DisableSecOpt returns a security opt that can disable labeling
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
---
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
2019-01-11 21:17:03.000000000 +0100
+++
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
2019-02-11 14:57:41.000000000 +0100
@@ -4,6 +4,8 @@
import (
"fmt"
+ "os"
+ "os/user"
"strings"
"github.com/opencontainers/selinux/go-selinux"
@@ -35,8 +37,15 @@
ReleaseLabel(mountLabel)
}
}()
- pcon := selinux.NewContext(processLabel)
- mcon := selinux.NewContext(mountLabel)
+ pcon, err := selinux.NewContext(processLabel)
+ if err != nil {
+ return "", "", err
+ }
+
+ mcon, err := selinux.NewContext(mountLabel)
+ if err != nil {
+ return "", "", err
+ }
for _, opt := range options {
if opt == "disable" {
return "", mountLabel, nil
@@ -146,13 +155,56 @@
return nil
}
- exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true,
"/tmp": true, "/home": true, "/run": true, "/var": true, "/root": true}
+ exclude_paths := map[string]bool{
+ "/": true,
+ "/bin": true,
+ "/boot": true,
+ "/dev": true,
+ "/etc": true,
+ "/etc/passwd": true,
+ "/etc/pki": true,
+ "/etc/shadow": true,
+ "/home": true,
+ "/lib": true,
+ "/lib64": true,
+ "/media": true,
+ "/opt": true,
+ "/proc": true,
+ "/root": true,
+ "/run": true,
+ "/sbin": true,
+ "/srv": true,
+ "/sys": true,
+ "/tmp": true,
+ "/usr": true,
+ "/var": true,
+ "/var/lib": true,
+ "/var/log": true,
+ }
+
+ if home := os.Getenv("HOME"); home != "" {
+ exclude_paths[home] = true
+ }
+
+ if sudoUser := os.Getenv("SUDO_USER"); sudoUser != "" {
+ if usr, err := user.Lookup(sudoUser); err == nil {
+ exclude_paths[usr.HomeDir] = true
+ }
+ }
+
+ if path != "/" {
+ path = strings.TrimSuffix(path, "/")
+ }
if exclude_paths[path] {
return fmt.Errorf("SELinux relabeling of %s is not allowed",
path)
}
if shared {
- c := selinux.NewContext(fileLabel)
+ c, err := selinux.NewContext(fileLabel)
+ if err != nil {
+ return err
+ }
+
c["level"] = "s0"
fileLabel = c.Get()
}
@@ -195,7 +247,7 @@
// DupSecOpt takes a process label and returns security options that
// can be used to set duplicate labels on future container processes
-func DupSecOpt(src string) []string {
+func DupSecOpt(src string) ([]string, error) {
return selinux.DupSecOpt(src)
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go
---
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go
2019-01-11 21:17:03.000000000 +0100
+++
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/selinux_linux.go
2019-02-11 14:57:41.000000000 +0100
@@ -52,6 +52,8 @@
ErrMCSAlreadyExists = errors.New("MCS label already exists")
// ErrEmptyPath is returned when an empty path has been specified.
ErrEmptyPath = errors.New("empty path")
+ // InvalidLabel is returned when an invalid label is specified.
+ InvalidLabel = errors.New("Invalid Label")
assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`)
roFileLabel string
@@ -405,11 +407,14 @@
}
// NewContext creates a new Context struct from the specified label
-func NewContext(label string) Context {
+func NewContext(label string) (Context, error) {
c := make(Context)
if len(label) != 0 {
con := strings.SplitN(label, ":", 4)
+ if len(con) < 3 {
+ return c, InvalidLabel
+ }
c["user"] = con[0]
c["role"] = con[1]
c["type"] = con[2]
@@ -417,7 +422,7 @@
c["level"] = con[3]
}
}
- return c
+ return c, nil
}
// ClearLabels clears all reserved labels
@@ -630,12 +635,12 @@
roFileLabel = fileLabel
}
exit:
- scon := NewContext(processLabel)
+ scon, _ := NewContext(processLabel)
if scon["level"] != "" {
mcs := uniqMcs(1024)
scon["level"] = mcs
processLabel = scon.Get()
- scon = NewContext(fileLabel)
+ scon, _ = NewContext(fileLabel)
scon["level"] = mcs
fileLabel = scon.Get()
}
@@ -661,8 +666,14 @@
if err := SecurityCheckContext(dest); err != nil {
return "", err
}
- scon := NewContext(src)
- tcon := NewContext(dest)
+ scon, err := NewContext(src)
+ if err != nil {
+ return "", err
+ }
+ tcon, err := NewContext(dest)
+ if err != nil {
+ return "", err
+ }
mcsDelete(tcon["level"])
mcsAdd(scon["level"])
tcon["level"] = scon["level"]
@@ -714,15 +725,18 @@
// DupSecOpt takes an SELinux process label and returns security options that
// can be used to set the SELinux Type and Level for future container
processes.
-func DupSecOpt(src string) []string {
+func DupSecOpt(src string) ([]string, error) {
if src == "" {
- return nil
+ return nil, nil
+ }
+ con, err := NewContext(src)
+ if err != nil {
+ return nil, err
}
- con := NewContext(src)
if con["user"] == "" ||
con["role"] == "" ||
con["type"] == "" {
- return nil
+ return nil, nil
}
dup := []string{"user:" + con["user"],
"role:" + con["role"],
@@ -733,7 +747,7 @@
dup = append(dup, "level:"+con["level"])
}
- return dup
+ return dup, nil
}
// DisableSecOpt returns a security opt that can be used to disable SELinux
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go
---
old/libpod-1.0.0/vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go
2019-01-11 21:17:03.000000000 +0100
+++
new/libpod-1.0.1/vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go
2019-02-11 14:57:41.000000000 +0100
@@ -115,9 +115,9 @@
}
// NewContext creates a new Context struct from the specified label
-func NewContext(label string) Context {
+func NewContext(label string) (Context, error) {
c := make(Context)
- return c
+ return c, nil
}
// ClearLabels clears all reserved MLS/MCS levels
@@ -195,8 +195,8 @@
// DupSecOpt takes an SELinux process label and returns security options that
// can be used to set the SELinux Type and Level for future container
processes.
-func DupSecOpt(src string) []string {
- return nil
+func DupSecOpt(src string) ([]string, error) {
+ return nil, nil
}
// DisableSecOpt returns a security opt that can be used to disable SELinux
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/vendor/github.com/varlink/go/.gitignore
new/libpod-1.0.1/vendor/github.com/varlink/go/.gitignore
--- old/libpod-1.0.0/vendor/github.com/varlink/go/.gitignore 2019-01-11
21:17:03.000000000 +0100
+++ new/libpod-1.0.1/vendor/github.com/varlink/go/.gitignore 1970-01-01
01:00:00.000000000 +0100
@@ -1 +0,0 @@
-/cmd/varlink-go-certification/orgvarlinkcertification/orgvarlinkcertification.go
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/vendor.conf new/libpod-1.0.1/vendor.conf
--- old/libpod-1.0.0/vendor.conf 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/vendor.conf 2019-02-11 14:57:41.000000000 +0100
@@ -51,7 +51,7 @@
github.com/opencontainers/runc bbb17efcb4c0ab986407812a31ba333a7450064c
github.com/opencontainers/runtime-spec d810dbc60d8c5aeeb3d054bd1132fab2121968ce
github.com/opencontainers/runtime-tools master
-github.com/opencontainers/selinux 51c6c0a5dbc675792e953298cb9871819d6f9bb8
+github.com/opencontainers/selinux v1.1
github.com/ostreedev/ostree-go master
github.com/pkg/errors v0.8.0
github.com/pmezard/go-difflib 792786c7400a136282c1664665ae0a8db921c6c2
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/libpod-1.0.0/version/version.go
new/libpod-1.0.1/version/version.go
--- old/libpod-1.0.0/version/version.go 2019-01-11 21:17:03.000000000 +0100
+++ new/libpod-1.0.1/version/version.go 2019-02-11 14:57:41.000000000 +0100
@@ -4,4 +4,4 @@
// NOTE: remember to bump the version at the top
// of the top-level README.md file when this is
// bumped.
-const Version = "1.0.0"
+const Version = "1.0.1"
++++++ storage-1.8.tar.xz -> storage-1.10.tar.xz ++++++
++++ 9395 lines of diff (skipped)
