Conversation
…for free (#1659) Fixes #1658. ## Measured before writing Podman 5.7.0, user-level `containers-policy.json` with a `reject` rule scoped to `docker.io/library/hello-world`: - image absent: `up` fails at the pull with `Source image rejected: Running image docker://hello-world:latest is rejected by policy.`, no container created; - image already in local storage, `pull_policy: missing`: the container starts, the policy is never asked; - `pull_policy: always`: refused again. A first attempt with an unresolvable registry never reached the policy: containers/image pings the registry before evaluating it, so the error was DNS. The doc says the policy is consulted at pull time only, and which pull policies make it bite on every `up`. `userns_mode: auto`: the `/etc/subuid` requirement, the `:U` consequence on bind mounts and the `size=` override, checked against `podman-run(1)`; Podman estimates the range size from the image, so no default number is claimed. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
…1660) Fixes #1656. ## What One compose extension, `x-podman-autoupdate: registry|local` under a service, and two executors: - `up`/`create`: the container carries `io.containers.autoupdate=<value>`; a `registry` service is pulled with policy `newer` on every `up` unless `--pull` was given, which wins. `local` changes no pull; the image-ID comparison from 5.7.0 already recreates on a locally rebuilt tag. An invalid value is rejected at create time naming the two allowed ones. - `generate quadlet`: `AutoUpdate=<value>` in `[Container]`, no duplicate `Label=` (Quadlet derives it); an invalid value is a warning there, since an unknown `AutoUpdate=` would make Quadlet drop the unit at daemon-reload. - `autostart --mode service --auto-update hourly|daily|weekly`: a oneshot unit with the same leading arguments and `up -d`, plus a timer (`OnCalendar=<word>`, `Persistent=true`, `WantedBy=timers.target`); rejected with the other modes; uninstall removes both. Without the flag the rendered unit is byte-identical, and a test holds that. - Docs: the extension in `docs/commands.md`, which executor runs where in `docs/autostart.md` (Quadlet: `podman-auto-update.timer`; service mode: the timer above; neither: the same line in cron), and the supply-chain note in `docs/security-model.md`. ## Verified - Unit: 1790 pass; every test name the issue asked for exists. Integration on Podman 5.7.0: the label is read back through inspect, and a `podman tag` that moves the tag recreates the container on a plain `up` with the `Recreating` vocabulary. - `cargo mutants` over the six files with the new controls (`--lib` as the test command): every mutant of the new code caught except the options builder, which now has a test. The sweep also lists 60 field deletions on the `SpecGenerator` literal in `create_and_start` that only the live lane can catch today; that is a pre-existing gap and a separate issue. - The test double now captures request bodies, so a unit test can assert on the `SpecGenerator` JSON sent to `/containers/create`. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
…t ask for (#1662) Fixes #1657. ## What `podup audit [-f ...] [--strict] [--format table|json]`: the project loads the way `config` loads it, and one row per service lists the check ids of what it left open, with a reason line per finding under the table. Eleven checks: `privileged`, `host_namespace`, `dangerous_capability`, `writable_root`, `no_cap_drop_all`, `no_new_privileges_off`, `no_pids_limit`, `no_memory_limit`, `no_userns`, `secret_in_environment`, `unpinned_image`. Exit 0 by default; `--strict` exits 1 with any finding, for CI. No check changes what `up` does. Documented in `docs/commands.md` after `config`, and pointed at from the hardening section of the security model. Capabilities are read in every spelling compose files carry (`CAP_SYS_ADMIN`, `sys_admin`, `all`), and `no-new-privileges:false` counts as off; both have tests. ## Verified - Unit: 35 tests in the module, one positive and one negative per check plus the hardened-service, placeholder and digest cases; 4 binary tests on exit codes and output shape. - `cargo mutants` over the module with the binary tests as the command: 53 caught, 15 unviable, 0 missed after two rounds (the first round left `has_findings`, `by_service`, `ordered_services`, one `&&` and the table renderer untested; each got a test). Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
…1663) Fixes #1661. One test, `create_sends_every_compose_field_in_the_spec_generator`: a service that sets every compose key mapped onto the `SpecGenerator` literal, a fake Podman that answers the create path, and field-by-field assertions on the decoded body of the `POST /containers/create`. The fixture lives beside the test as a YAML file so the assertions stay readable. It uses the request-body capture the test double gained in #1660. Proof: with the `cap_drop:` line deleted from the literal the test fails on `assert_eq!(body["cap_drop"], ...)` with `left: Null`; restored, it passes. The next mutation sweep should report the 60 field deletions as caught. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --------- Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Fixes #1655. The lane already validates 6.1.1: rawhide moved, and the Podman 6 leg installs what rawhide ships. Run 33777673264 (PR #1663) on it: ``` GREEN: podup core PASSED on Podman 6.1.1 (196 tests >= baseline 165; 0 in the nested-virt-noisy subset). image: Fedora-Cloud-Base-Generic-Rawhide-20260903.n.0.x86_64.qcow2 Podman 6.1.1: 196 passed, 0 failed (0 look like connection-drop flakes) Podman 6.1.1: every failure is on the classified list (0 entries). ``` The same leg was green on #1660 and #1662 today. This moves the record to what the lane exercises. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Fixes #1665. ## What `x-podman-pod: true` at the top level puts every service of the project into one Podman pod named after the project: only the network namespace shared, ports published by the pod as the union of every service's list, the project's networks, and a `<service>:127.0.0.1` host entry per service so `db:5432` keeps resolving. A hash of ports, networks and host entries is a label on the pod; a later `up` that computes a different one recreates the pod and creates every container afresh. `down` removes the pod after the containers. `ps` hides the infra container. `generate quadlet` writes a `<project>.pod` unit and each `.container` references it. `network_mode`, divergent `networks:` sets and duplicate host ports are refused before anything is created. Docs: a Pods section in `docs/commands.md`, a row in the threat model. ## How it was built MiniMax wrote steps 1 to 3 (types, refusals, engine) with 11 unit tests and stopped when its plan ran out of tokens; I finished the Quadlet unit, the docs and the integration tests, and reviewed the rest. What the review and the real engine found, each with a test now: - `up` fetched the container list before ensuring the pod, so a pod recreate (which removes the members) left `up` reading gone containers as unchanged and only starting them. `ensure_pod` now reports a recreate and `up` forgets the list; the test fails without that line. - libpod refuses a pod that names networks without `netns: bridge`; the fake did not know. Added, asserted on the create body. - The infra container carries the project label and no service label, so it was reported, and would have been removed, as an orphan. Excluded by `IsInfra`. - The `.pod` unit references declared networks through their `.network` units, like `.container` units do. ## Verified - Unit: 1806 pass. Integration on Podman 5.7.0: one pod with both services and `SharedNamespaces: [net]`; `getent hosts db` inside `web` gives `127.0.0.1` and a TCP connect to `db:5432` by name succeeds; a port change recreates the pod (new ID, `Recreated` printed, no orphan warning); `down` leaves no pod. - `cargo mutants` over the pod module runs next; the result lands in this PR before merge. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --------- Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Bump for the minor release carrying pods, auto-update, audit, the signature-policy and userns docs, and the Podman 6.1.1 baseline. Nothing existing changes behaviour: every extension is opt-in and `audit` is new. ## Verified `release.yml`'s three version comparisons run locally: `crate=5.8.0 lock=5.8.0 deb=5.8.0`, GATE OK; `cargo metadata --locked` accepts the lockfile. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
… it alike (#1669) Fixes #1668. Under `x-podman-pod: true`, a `userns_mode` every service declares alike is applied to the pod and to no member; services that disagree (one sets it and another does not, or different values) are refused before anything is created; the value is part of the pod hash. `docs/commands.md` says so. ## Verified - Unit: 1815 pass; the pod create body carries `userns: {nsmode: auto}` and no member does; the hash differs with and without it; the refusal names both services. - Integration on Podman 5.7.0: a member of a project with `userns_mode: auto` on every service reads a `/proc/self/uid_map` different from a plain rootless container's; the other four pod tests still pass. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --------- Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Jaro-c
added
prio:P2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release
develop→mainfor 5.8.0. Merge commit, not squash:mainis the released state.What ships
Pods (#1665, PR #1666).
x-podman-pod: trueat the top level puts every service into one Podman pod named after the project: only the network namespace shared, ports published by the pod as the union of every service's list, one<service>:127.0.0.1host entry per service sodb:5432keeps resolving, a hash of ports, networks and host entries that decides reuse or recreate,downremoving the pod after the containers,pshiding the infra container, and a.podunit fromgenerate quadlet.network_mode, differing network sets, duplicate host ports and services that disagree onuserns_modeare refused before anything is created; auserns_modeevery service declares alike is the pod's (#1668, PR #1669: Podman refuses a member with its own). Measured with podup on 42 services:up1.50 s in a pod against 1.13 s on a network,down1.40 s against 1.76 to 1.91 s; the docs say what a pod is for.Auto-update (#1656, PR #1660).
x-podman-autoupdate: registry|localon a service putsio.containers.autoupdateon the container, pulls aregistryservice with policyneweron everyupunless--pullwas given, lands asAutoUpdate=in the exported Quadlet, andautostart --mode service --auto-update hourly|daily|weeklyinstalls a oneshot unit and a timer for stacks that are not under Quadlet.podup audit(#1657, PR #1662). One row per service naming the hardening it did not ask for, eleven checks, a reason line per finding,--format json,--strictfor CI. No check changes whatupdoes.Docs (#1658, PR #1659): the host's image signature policy applies to every pull podup asks for, consulted at pull time only, measured;
userns_mode: autoand what it costs. Baseline (#1655, PR #1664): Podman 6.1.1, on the lane run that already exercised it.What changed under the hood, no behaviour
SpecGeneratorthatcreate_and_startsends (Nothing in the unit suite reads the SpecGenerator that create_and_start sends #1661, PR test(engine): read every SpecGenerator field off the create request #1663): a sweep had deleted 60 of them one by one with the suite green; 62 of 62 are caught now.run_up/up_one_servicemoved tolifecycle/up.rs/up_one.rsand the spec builder tocontainer/spec.rs, under the line limit.Verified before opening this
release.yml's three version comparisons locally:crate=5.8.0 lock=5.8.0 deb=5.8.0, GATE OK.Signed-off-by: Jaro-c 75870284+Jaro-c@users.noreply.github.com