diff --git a/go.mod b/go.mod index 2b519adc235..4efaa2c1b66 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/containernetworking/cni v0.8.1 github.com/containernetworking/plugins v0.9.1 github.com/containers/buildah v1.21.1-0.20210628174543-eadb10a12336 - github.com/containers/common v0.40.2-0.20210702074932-9d34b37ba77e + github.com/containers/common v0.41.1-0.20210715132209-383a7e384446 github.com/containers/conmon v2.0.20+incompatible github.com/containers/image/v5 v5.13.2 github.com/containers/ocicrypt v1.1.2 diff --git a/go.sum b/go.sum index 3210088091f..21a117976c9 100644 --- a/go.sum +++ b/go.sum @@ -241,8 +241,8 @@ github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRD github.com/containers/buildah v1.21.1-0.20210628174543-eadb10a12336 h1:LAjAsDE6sxZnDoSzE384o/cRuTGGn1OMjkd9YIPT2bg= github.com/containers/buildah v1.21.1-0.20210628174543-eadb10a12336/go.mod h1:HZ2k0W/EREpNxr+AnRZQzjjBdhXLItp9yuzwAaVa6zM= github.com/containers/common v0.40.1/go.mod h1:X4F+6vmeAWKMMTNHlOBwOnkf5TQAkQACcuNsKjfcodw= -github.com/containers/common v0.40.2-0.20210702074932-9d34b37ba77e h1:ubkW5+D74+JrEL6qFmdAQpZ2L1jdGrRYPpkgKdV2YEw= -github.com/containers/common v0.40.2-0.20210702074932-9d34b37ba77e/go.mod h1:dbz5oauwVA4I/9HMe7YQUt6LWUmrYQlwQH9LQ35bm/U= +github.com/containers/common v0.41.1-0.20210715132209-383a7e384446 h1:MyIEkyfFF4SOCkw8nnC26d9SpQFt2soxjql9XH6Dpv0= +github.com/containers/common v0.41.1-0.20210715132209-383a7e384446/go.mod h1:w0CLPB8nH75msgISbE/z8TMIxK9disFsmvFNd2SDid8= github.com/containers/conmon v2.0.20+incompatible h1:YbCVSFSCqFjjVwHTPINGdMX1F6JXHGTUje2ZYobNrkg= github.com/containers/conmon v2.0.20+incompatible/go.mod h1:hgwZ2mtuDrppv78a/cOBNiCm6O0UMWGx1mu7P00nu5I= github.com/containers/image/v5 v5.13.2 h1:AgYunV/9d2fRkrmo23wH2MkqeHolFd6oQCkK+1PpuFA= @@ -844,7 +844,6 @@ github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE= github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI= github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo= -github.com/spf13/cobra v1.2.0/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk= github.com/spf13/cobra v1.2.1 h1:+KmjbUw1hriSNMF55oPrkZcb27aECyrj8V2ytv7kWDw= github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk= github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= diff --git a/vendor/github.com/containers/common/libimage/filters.go b/vendor/github.com/containers/common/libimage/filters.go index 280e067615d..eae18fd9c77 100644 --- a/vendor/github.com/containers/common/libimage/filters.go +++ b/vendor/github.com/containers/common/libimage/filters.go @@ -63,14 +63,14 @@ func (r *Runtime) compileImageFilters(ctx context.Context, filters []string) ([] switch key { case "after", "since": - img, _, err := r.LookupImage(value, &LookupImageOptions{IgnorePlatform: true}) + img, _, err := r.LookupImage(value, nil) if err != nil { return nil, errors.Wrapf(err, "could not find local image for filter %q", filter) } filterFuncs = append(filterFuncs, filterAfter(img.Created())) case "before": - img, _, err := r.LookupImage(value, &LookupImageOptions{IgnorePlatform: true}) + img, _, err := r.LookupImage(value, nil) if err != nil { return nil, errors.Wrapf(err, "could not find local image for filter %q", filter) } diff --git a/vendor/github.com/containers/common/libimage/image_tree.go b/vendor/github.com/containers/common/libimage/image_tree.go index b8b9cb21605..d48aeeada34 100644 --- a/vendor/github.com/containers/common/libimage/image_tree.go +++ b/vendor/github.com/containers/common/libimage/image_tree.go @@ -80,6 +80,10 @@ func (i *Image) Tree(traverseChildren bool) (string, error) { } func imageTreeTraverseChildren(node *layerNode, parent gotree.Tree) error { + if node.layer == nil { + return nil + } + var tags string repoTags, err := node.repoTags() if err != nil { diff --git a/vendor/github.com/containers/common/libimage/import.go b/vendor/github.com/containers/common/libimage/import.go index 2addfdf9876..9926aaec7bb 100644 --- a/vendor/github.com/containers/common/libimage/import.go +++ b/vendor/github.com/containers/common/libimage/import.go @@ -86,16 +86,12 @@ func (r *Runtime) Import(ctx context.Context, path string, options *ImportOption return "", err } - name := options.Tag - if name == "" { - name, err = getImageDigest(ctx, srcRef, r.systemContextCopy()) - if err != nil { - return "", err - } - name = "sha256:" + name[1:] // strip leading "@" + id, err := getImageDigest(ctx, srcRef, r.systemContextCopy()) + if err != nil { + return "", err } - destRef, err := storageTransport.Transport.ParseStoreReference(r.store, name) + destRef, err := storageTransport.Transport.ParseStoreReference(r.store, id) if err != nil { return "", err } @@ -110,5 +106,19 @@ func (r *Runtime) Import(ctx context.Context, path string, options *ImportOption return "", err } - return name, nil + // Strip the leading @ off the id. + name := id[1:] + + // If requested, tag the imported image. + if options.Tag != "" { + image, _, err := r.LookupImage(name, nil) + if err != nil { + return "", errors.Wrap(err, "looking up imported image") + } + if err := image.Tag(options.Tag); err != nil { + return "", err + } + } + + return "sha256:" + name, nil } diff --git a/vendor/github.com/containers/common/libimage/manifest_list.go b/vendor/github.com/containers/common/libimage/manifest_list.go index 73678131cf5..4e8959004bf 100644 --- a/vendor/github.com/containers/common/libimage/manifest_list.go +++ b/vendor/github.com/containers/common/libimage/manifest_list.go @@ -78,7 +78,6 @@ func (r *Runtime) LookupManifestList(name string) (*ManifestList, error) { func (r *Runtime) lookupManifestList(name string) (*Image, manifests.List, error) { lookupOptions := &LookupImageOptions{ - IgnorePlatform: true, lookupManifest: true, } image, _, err := r.LookupImage(name, lookupOptions) diff --git a/vendor/github.com/containers/common/libimage/pull.go b/vendor/github.com/containers/common/libimage/pull.go index ee91b17ab0e..fbe3b466df4 100644 --- a/vendor/github.com/containers/common/libimage/pull.go +++ b/vendor/github.com/containers/common/libimage/pull.go @@ -61,7 +61,7 @@ func (r *Runtime) Pull(ctx context.Context, name string, pullPolicy config.PullP if pullPolicy == config.PullPolicyAlways { return nil, errors.Errorf("pull policy is always but image has been referred to by ID (%s)", name) } - local, _, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + local, _, err := r.LookupImage(name, nil) if err != nil { return nil, err } @@ -146,7 +146,7 @@ func (r *Runtime) Pull(ctx context.Context, name string, pullPolicy config.PullP localImages := []*Image{} for _, name := range pulledImages { - local, _, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + local, _, err := r.LookupImage(name, nil) if err != nil { return nil, errors.Wrapf(err, "error locating pulled image %q name in containers storage", name) } @@ -362,15 +362,13 @@ func (r *Runtime) copySingleImageFromRegistry(ctx context.Context, imageName str // resolved name for pulling. Assume we're doing a `pull foo`. // If there's already a local image "localhost/foo", then we should // attempt pulling that instead of doing the full short-name dance. - lookupOptions := &LookupImageOptions{ - // NOTE: we must ignore the platform of a local image when - // doing lookups. Some images set an incorrect or even invalid - // platform (see containers/podman/issues/10682). Doing the - // lookup while ignoring the platform checks prevents - // redundantly downloading the same image. - IgnorePlatform: true, - } - localImage, resolvedImageName, err = r.LookupImage(imageName, lookupOptions) + // + // NOTE: we must ignore the platform of a local image when doing + // lookups here, even if arch/os/variant is set. Some images set an + // incorrect or even invalid platform (see containers/podman/issues/10682). + // Doing the lookup while ignoring the platform checks prevents + // redundantly downloading the same image. + localImage, resolvedImageName, err = r.LookupImage(imageName, nil) if err != nil && errors.Cause(err) != storage.ErrImageUnknown { logrus.Errorf("Looking up %s in local storage: %v", imageName, err) } diff --git a/vendor/github.com/containers/common/libimage/push.go b/vendor/github.com/containers/common/libimage/push.go index 1896b796f14..7203838aa61 100644 --- a/vendor/github.com/containers/common/libimage/push.go +++ b/vendor/github.com/containers/common/libimage/push.go @@ -31,8 +31,7 @@ func (r *Runtime) Push(ctx context.Context, source, destination string, options // Look up the local image. Note that we need to ignore the platform // and push what the user specified (containers/podman/issues/10344). - lookupOptions := &LookupImageOptions{IgnorePlatform: true} - image, resolvedSource, err := r.LookupImage(source, lookupOptions) + image, resolvedSource, err := r.LookupImage(source, nil) if err != nil { return nil, err } diff --git a/vendor/github.com/containers/common/libimage/runtime.go b/vendor/github.com/containers/common/libimage/runtime.go index d07d6a83acb..1fd2973cbc2 100644 --- a/vendor/github.com/containers/common/libimage/runtime.go +++ b/vendor/github.com/containers/common/libimage/runtime.go @@ -4,7 +4,6 @@ import ( "context" "os" "path/filepath" - "runtime" "strings" "github.com/containers/image/v5/docker/reference" @@ -142,7 +141,7 @@ func (r *Runtime) storageToImage(storageImage *storage.Image, ref types.ImageRef // Exists returns true if the specicifed image exists in the local containers // storage. Note that it may return false if an image corrupted. func (r *Runtime) Exists(name string) (bool, error) { - image, _, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + image, _, err := r.LookupImage(name, nil) if err != nil && errors.Cause(err) != storage.ErrImageUnknown { return false, err } @@ -158,11 +157,6 @@ func (r *Runtime) Exists(name string) (bool, error) { // LookupImageOptions allow for customizing local image lookups. type LookupImageOptions struct { - // If set, the image will be purely looked up by name. No matching to - // the current platform will be performed. This can be helpful when - // the platform does not matter, for instance, for image removal. - IgnorePlatform bool - // Lookup an image matching the specified architecture. Architecture string // Lookup an image matching the specified OS. @@ -173,13 +167,23 @@ type LookupImageOptions struct { // If set, do not look for items/instances in the manifest list that // match the current platform but return the manifest list as is. lookupManifest bool + + // If the image resolves to a manifest list, we usually lookup a + // matching instance and error if none could be found. In this case, + // just return the manifest list. Required for image removal. + returnManifestIfNoInstance bool } -// Lookup Image looks up `name` in the local container storage matching the -// specified SystemContext. Returns the image and the name it has been found -// with. Note that name may also use the `containers-storage:` prefix used to -// refer to the containers-storage transport. Returns storage.ErrImageUnknown -// if the image could not be found. +// Lookup Image looks up `name` in the local container storage. Returns the +// image and the name it has been found with. Note that name may also use the +// `containers-storage:` prefix used to refer to the containers-storage +// transport. Returns storage.ErrImageUnknown if the image could not be found. +// +// Unless specified via the options, the image will be looked up by name only +// without matching the architecture, os or variant. An exception is if the +// image resolves to a manifest list, where an instance of the manifest list +// matching the local or specified platform (via options.{Architecture,OS,Variant}) +// is returned. // // If the specified name uses the `containers-storage` transport, the resolved // name is empty. @@ -221,23 +225,17 @@ func (r *Runtime) LookupImage(name string, options *LookupImageOptions) (*Image, name = strings.TrimPrefix(name, "sha256:") } - // Set the platform for matching local images. - if !options.IgnorePlatform { - if options.Architecture == "" { - options.Architecture = r.systemContext.ArchitectureChoice - } - if options.Architecture == "" { - options.Architecture = runtime.GOARCH - } - if options.OS == "" { - options.OS = r.systemContext.OSChoice - } - if options.OS == "" { - options.OS = runtime.GOOS - } - if options.Variant == "" { - options.Variant = r.systemContext.VariantChoice - } + // Unless specified, set the platform specified in the system context + // for later platform matching. Builder likes to set these things via + // the system context at runtime creation. + if options.Architecture == "" { + options.Architecture = r.systemContext.ArchitectureChoice + } + if options.OS == "" { + options.OS = r.systemContext.OSChoice + } + if options.Variant == "" { + options.Variant = r.systemContext.VariantChoice } // First, check if we have an exact match in the storage. Maybe an ID @@ -327,10 +325,8 @@ func (r *Runtime) lookupImageInLocalStorage(name, candidate string, options *Loo } instance, err := manifestList.LookupInstance(context.Background(), options.Architecture, options.OS, options.Variant) if err != nil { - // NOTE: If we are not looking for a specific platform - // and already found the manifest list, then return it - // instead of the error. - if options.IgnorePlatform { + if options.returnManifestIfNoInstance { + logrus.Debug("No matching instance was found: returning manifest list instead") return image, nil } return nil, errors.Wrap(storage.ErrImageUnknown, err.Error()) @@ -342,10 +338,6 @@ func (r *Runtime) lookupImageInLocalStorage(name, candidate string, options *Loo image = instance } - if options.IgnorePlatform { - return image, nil - } - matches, err := r.imageReferenceMatchesContext(ref, options) if err != nil { return nil, err @@ -440,7 +432,7 @@ func (r *Runtime) ResolveName(name string) (string, error) { if name == "" { return "", nil } - image, resolvedName, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + image, resolvedName, err := r.LookupImage(name, nil) if err != nil && errors.Cause(err) != storage.ErrImageUnknown { return "", err } @@ -460,9 +452,10 @@ func (r *Runtime) ResolveName(name string) (string, error) { // imageReferenceMatchesContext return true if the specified reference matches // the platform (os, arch, variant) as specified by the lookup options. func (r *Runtime) imageReferenceMatchesContext(ref types.ImageReference, options *LookupImageOptions) (bool, error) { - if options.IgnorePlatform { + if options.Architecture+options.OS+options.Variant == "" { return true, nil } + ctx := context.Background() img, err := ref.NewImage(ctx, &r.systemContext) if err != nil { @@ -473,12 +466,18 @@ func (r *Runtime) imageReferenceMatchesContext(ref types.ImageReference, options if err != nil { return false, err } - if options.OS == data.Os && options.Architecture == data.Architecture { - if options.Variant == "" || options.Variant == data.Variant { - return true, nil - } + + if options.Architecture != "" && options.Architecture != data.Architecture { + return false, err } - return false, nil + if options.OS != "" && options.OS != data.Os { + return false, err + } + if options.Variant != "" && options.Variant != data.Variant { + return false, err + } + + return true, nil } // ListImagesOptions allow for customizing listing images. @@ -503,9 +502,8 @@ func (r *Runtime) ListImages(ctx context.Context, names []string, options *ListI var images []*Image if len(names) > 0 { - lookupOpts := LookupImageOptions{IgnorePlatform: true} for _, name := range names { - image, _, err := r.LookupImage(name, &lookupOpts) + image, _, err := r.LookupImage(name, nil) if err != nil { return nil, err } @@ -604,9 +602,8 @@ func (r *Runtime) RemoveImages(ctx context.Context, names []string, options *Rem // Look up the images one-by-one. That allows for removing // images that have been looked up successfully while reporting // lookup errors at the end. - lookupOptions := LookupImageOptions{IgnorePlatform: true} for _, name := range names { - img, resolvedName, err := r.LookupImage(name, &lookupOptions) + img, resolvedName, err := r.LookupImage(name, &LookupImageOptions{returnManifestIfNoInstance: true}) if err != nil { appendError(err) continue diff --git a/vendor/github.com/containers/common/libimage/save.go b/vendor/github.com/containers/common/libimage/save.go index 10d26bebff6..e1b8c3f75ba 100644 --- a/vendor/github.com/containers/common/libimage/save.go +++ b/vendor/github.com/containers/common/libimage/save.go @@ -74,7 +74,7 @@ func (r *Runtime) Save(ctx context.Context, names []string, format, path string, // saveSingleImage saves the specified image name to the specified path. // Supported formats are "oci-archive", "oci-dir" and "docker-dir". func (r *Runtime) saveSingleImage(ctx context.Context, name, format, path string, options *SaveOptions) error { - image, imageName, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + image, imageName, err := r.LookupImage(name, nil) if err != nil { return err } @@ -155,7 +155,7 @@ func (r *Runtime) saveDockerArchive(ctx context.Context, names []string, path st visitedNames := make(map[string]bool) // filters duplicate names for _, name := range names { // Look up local images. - image, imageName, err := r.LookupImage(name, &LookupImageOptions{IgnorePlatform: true}) + image, imageName, err := r.LookupImage(name, nil) if err != nil { return err } diff --git a/vendor/github.com/containers/common/pkg/config/config.go b/vendor/github.com/containers/common/pkg/config/config.go index 68076b1170d..84876026da2 100644 --- a/vendor/github.com/containers/common/pkg/config/config.go +++ b/vendor/github.com/containers/common/pkg/config/config.go @@ -158,6 +158,13 @@ type ContainersConfig struct { // PidNS indicates how to create a pid namespace for the container PidNS string `toml:"pidns,omitempty"` + // Copy the content from the underlying image into the newly created + // volume when the container is created instead of when it is started. + // If false, the container engine will not copy the content until + // the container is started. Setting it to true may have negative + // performance implications. + PrepareVolumeOnCreate bool `toml:"prepare_volume_on_create,omitempty"` + // RootlessNetworking depicts the "kind" of networking for rootless // containers. Valid options are `slirp4netns` and `cni`. Default is // `slirp4netns` @@ -384,6 +391,10 @@ type EngineConfig struct { // will refer to the plugin as) mapped to a path, which must point to a // Unix socket that conforms to the Volume Plugin specification. VolumePlugins map[string]string `toml:"volume_plugins,omitempty"` + + // ChownCopiedFiles tells the container engine whether to chown files copied + // into a container to the container's primary uid/gid. + ChownCopiedFiles bool `toml:"chown_copied_files"` } // SetOptions contains a subset of options in a Config. It's used to indicate if diff --git a/vendor/github.com/containers/common/pkg/config/containers.conf b/vendor/github.com/containers/common/pkg/config/containers.conf index 0c8c7532e37..f429b96edb6 100644 --- a/vendor/github.com/containers/common/pkg/config/containers.conf +++ b/vendor/github.com/containers/common/pkg/config/containers.conf @@ -189,6 +189,13 @@ default_sysctls = [ # # pids_limit = 2048 +# Copy the content from the underlying image into the newly created volume +# when the container is created instead of when it is started. If false, +# the container engine will not copy the content until the container is started. +# Setting it to true may have negative performance implications. +# +# prepare_volume_on_create = false + # Indicates the networking to be used for rootless containers # rootless_networking = "slirp4netns" @@ -243,6 +250,12 @@ default_sysctls = [ # The network table contains settings pertaining to the management of # CNI plugins. +[secrets] +# driver = "file" + +[secrets.opts] +# root = "/example/directory" + [network] # Path to directory where CNI plugin binaries are located. @@ -503,9 +516,3 @@ default_sysctls = [ # TOML does not provide a way to end a table other than a further table being # defined, so every key hereafter will be part of [volume_plugins] and not the # main config. - -[secret] -# driver = "file" - -[secret.opts] -# root = "/example/directory" diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go index 5abb6326f49..a16dd0e023c 100644 --- a/vendor/github.com/containers/common/pkg/config/default.go +++ b/vendor/github.com/containers/common/pkg/config/default.go @@ -340,6 +340,8 @@ func defaultConfigFromMemory() (*EngineConfig, error) { c.LockType = "shm" c.MachineEnabled = false + c.ChownCopiedFiles = true + return c, nil } diff --git a/vendor/github.com/containers/common/version/version.go b/vendor/github.com/containers/common/version/version.go index 8907e21ab92..47dca527c2f 100644 --- a/vendor/github.com/containers/common/version/version.go +++ b/vendor/github.com/containers/common/version/version.go @@ -1,4 +1,4 @@ package version // Version is the version of the build. -const Version = "0.40.2-dev" +const Version = "0.41.1-dev" diff --git a/vendor/modules.txt b/vendor/modules.txt index 19b8d0a474c..43243a4ac5d 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -93,7 +93,7 @@ github.com/containers/buildah/pkg/overlay github.com/containers/buildah/pkg/parse github.com/containers/buildah/pkg/rusage github.com/containers/buildah/util -# github.com/containers/common v0.40.2-0.20210702074932-9d34b37ba77e +# github.com/containers/common v0.41.1-0.20210715132209-383a7e384446 github.com/containers/common/libimage github.com/containers/common/libimage/manifests github.com/containers/common/pkg/apparmor