Feature implementation from commits 6510d81..a218dfa

.packit.yaml

@@ -106,9 +106,7 @@ jobs:
     packages: [podman-fedora]
     notifications: *packit_generic_failure_notification
     targets:
-      - fedora-rawhide
-      - fedora-42
-      - fedora-41
+      - fedora-all
     tmt_plan: "/plans/system/*"
     tf_extra_params:
       environments:
@@ -144,13 +142,6 @@ jobs:
     dist_git_branches: &fedora_targets
       - fedora-all
 
-  - job: propose_downstream
-    trigger: release
-    update_release: false
-    packages: [podman-centos]
-    dist_git_branches:
-      - c10s
-
   - job: koji_build
     trigger: commit
     packages: [podman-fedora]

MAINTAINERS.md

@@ -26,6 +26,7 @@ Maintainers and Reviewers for the Skopeo and Buildah projects are found in their
 | Jake Correnti     | [jakecorrenti](https://github.com/jakecorrenti)          | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jason Greene      | [n1hility](https://github.com/n1hility)                  | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jhon Honce        | [jwhonce](https://github.com/jwhonce)                    | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
+| Craig Loewen      | [craigloewen-msft](https://github.com/craigloewen-msft)  | Reviewer                         | [Microsoft](https://github.com/microsoft)    |
 | Urvashi Mohnani   | [umohnani8](https://github.com/umohnani8)                | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Aditya Rajan      | [flouthoc](https://github.com/flouthoc)                  | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jan Rodák         | [Honny1](https://github.com/Honny1)                      | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |

Makefile

@@ -61,6 +61,7 @@ REMOTETAGS ?= remote exclude_graphdriver_btrfs containers_image_openpgp
 BUILDTAGS ?= \
 	$(shell hack/apparmor_tag.sh) \
 	$(shell hack/btrfs_installed_tag.sh) \
+	$(shell hack/sqlite_tag.sh) \
 	$(shell hack/systemd_tag.sh) \
 	$(shell hack/libsubid_tag.sh) \
 	$(if $(filter linux,$(GOOS)), seccomp,)
@@ -361,7 +362,7 @@ $(IN_CONTAINER): %-in-container:
 	$(PODMANCMD) run --rm --env HOME=/root \
 		-v $(CURDIR):/src -w /src \
 		--security-opt label=disable \
-		docker.io/library/golang:1.22 \
+		quay.io/libpod/validatepr:latest \
 		make $(*)
 
 
@@ -478,21 +479,7 @@ podman-testing: bin/podman-testing
 
 .PHONY: generate-bindings
 generate-bindings: .install.golangci-lint
-ifneq ($(GOOS),darwin)
 	$(GOCMD) generate ./pkg/bindings/... ;
-endif
-
-# DO NOT USE: use local-cross instead
-bin/podman.cross.%:
-	TARGET="$*"; \
-	GOOS="$${TARGET%%.*}"; \
-	GOARCH="$${TARGET##*.}"; \
-	CGO_ENABLED=0 \
-		$(GO) build \
-		$(BUILDFLAGS) \
-		$(GO_LDFLAGS) '$(LDFLAGS_PODMAN)' \
-		-tags '$(BUILDTAGS_CROSS)' \
-		-o "$@" ./cmd/podman
 
 .PHONY: local-cross
 local-cross: $(CROSS_BUILD_TARGETS) ## Cross compile podman binary for multiple architectures

cmd/podman/common/build.go

@@ -523,7 +523,7 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 		Annotations:             flags.Annotation,
 		Args:                    args,
 		BlobDirectory:           flags.BlobCache,
-		BuildOutput:             flags.BuildOutput,
+		BuildOutputs:            flags.BuildOutputs,
 		CacheFrom:               cacheFrom,
 		CacheTo:                 cacheTo,
 		CacheTTL:                cacheTTL,

cmd/podman/images/buildx_inspect.go

@@ -0,0 +1,81 @@
+package images
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/containers/podman/v5/cmd/podman/registry"
+	"github.com/spf13/cobra"
+)
+
+type buildNode struct {
+	Name            string
+	Endpoint        string
+	Status          string
+	BuildkitVersion string
+	Platforms       []string
+}
+
+type buildxInspectOutput struct {
+	builderName string
+	driverName  string
+	Nodes       []buildNode
+}
+
+var buildxInspectCmd = &cobra.Command{
+	Use:   "inspect",
+	Short: "Inspects build capabilities",
+	Long:  "Displays information about the current builder instance (compatibility with Docker buildx inspect)",
+	RunE:  runBuildxInspect,
+	Example: `podman buildx inspect
+	podman buildx inspect --bootstrap`,
+}
+
+func init() {
+	buildxInspectCmd.Flags().Bool("bootstrap", false, "Currently a No Op for podman")
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Command: buildxInspectCmd,
+		Parent:  buildxCmd,
+	})
+}
+
+func runBuildxInspect(cmd *cobra.Command, args []string) error {
+	info, err := registry.ContainerEngine().Info(registry.Context())
+
+	if err != nil {
+		return fmt.Errorf("retrieving podman information: %w", err)
+	}
+
+	nativePlatform := fmt.Sprintf("%s/%s", info.Host.OS, info.Host.Arch)
+
+	// Constants are based on default values for Docker buildx inspect.
+	defaultNode := buildNode{
+		Name:            "default",
+		Endpoint:        "default",
+		Status:          "running",
+		BuildkitVersion: "N/A",
+		Platforms:       []string{nativePlatform},
+	}
+
+	defaultNode.Platforms = append(defaultNode.Platforms, info.Host.EmulatedArchitectures...)
+
+	out := buildxInspectOutput{
+		builderName: "default",
+		driverName:  "podman",
+		Nodes:       []buildNode{defaultNode},
+	}
+
+	fmt.Printf("Name:   %s\n", out.builderName)
+	fmt.Printf("Driver: %s\n", out.driverName)
+	fmt.Println()
+
+	fmt.Println("Nodes:")
+	fmt.Printf("Name:             %s\n", out.Nodes[0].Name)
+	fmt.Printf("Endpoint:         %s\n", out.Nodes[0].Endpoint)
+	fmt.Printf("Status:           %s\n", out.Nodes[0].Status)
+	fmt.Printf("Buildkit version: %s\n", out.Nodes[0].BuildkitVersion)
+
+	fmt.Printf("Platforms:        %s\n", strings.Join(out.Nodes[0].Platforms, ", "))
+	fmt.Println("Labels: ")
+	return nil
+}

cmd/podman/images/import.go

@@ -130,7 +130,7 @@ func importCon(cmd *cobra.Command, args []string) error {
 	}
 
 	errFileName := parse.ValidateFileName(source)
-	errURL := parse.ValidURL(source)
+	errURL := parse.ValidWebURL(source)
 	if errURL == nil {
 		importOpts.SourceIsURL = true
 	}

cmd/podman/kube/play.go

@@ -369,7 +369,7 @@ func readerFromArg(fileName string) (*bytes.Reader, error) {
 	switch {
 	case fileName == "-": // Read from stdin
 		reader = os.Stdin
-	case parse.ValidURL(fileName) == nil:
+	case parse.ValidWebURL(fileName) == nil:
 		response, err := http.Get(fileName)
 		if err != nil {
 			return nil, err

cmd/podman/machine/init.go

@@ -3,6 +3,7 @@
 package machine
 
 import (
+	"errors"
 	"fmt"
 	"os"
 
@@ -232,6 +233,14 @@ func initMachine(cmd *cobra.Command, args []string) error {
 
 	err = shim.Init(initOpts, provider)
 	if err != nil {
+		// The installation is partially complete and podman should
+		// exit gracefully with no error and no success message.
+		// Examples:
+		// - a user has chosen to perform their own reboot
+		// - reexec for limited admin operations, returning to parent
+		if errors.Is(err, define.ErrInitRelaunchAttempt) {
+			return nil
+		}
 		return err
 	}
 

cmd/podman/parse/net.go

@@ -157,14 +157,21 @@ func parseEnvOrLabelFile(envOrLabel map[string]string, filename, configType stri
 	return scanner.Err()
 }
 
-// ValidURL checks a string urlStr is a url or not
-func ValidURL(urlStr string) error {
-	url, err := url.ParseRequestURI(urlStr)
+// ValidWebURL checks a string urlStr is a url or not
+func ValidWebURL(urlStr string) error {
+	parsedURL, err := url.ParseRequestURI(urlStr)
 	if err != nil {
-		return fmt.Errorf("invalid url %q: %w", urlStr, err)
+		return fmt.Errorf("invalid URL %q: %w", urlStr, err)
 	}
-	if url.Scheme == "" {
-		return fmt.Errorf("invalid url %q: missing scheme", urlStr)
+
+	// to be a valid web url, scheme must be either http or https
+	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
+		return fmt.Errorf("invalid URL %q: unsupported scheme %q", urlStr, parsedURL.Scheme)
+	}
+
+	// ensure url contain a host
+	if parsedURL.Host == "" {
+		return fmt.Errorf("invalid URL %q: missing host", urlStr)
 	}
 	return nil
 }

cmd/podman/parse/net_test.go

@@ -158,3 +158,69 @@ func TestGetAllLabelsFile(t *testing.T) {
 	result, _ := GetAllLabels(fileLabels, Var1)
 	assert.Equal(t, len(result), 3)
 }
+
+func TestValidWebURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantErr bool
+	}{
+		{
+			name:    "Valid HTTP URL",
+			input:   "http://example.com",
+			wantErr: false,
+		},
+		{
+			name:    "Valid HTTPS URL",
+			input:   "https://example.com",
+			wantErr: false,
+		},
+		{
+			name:    "Missing scheme",
+			input:   "example.com",
+			wantErr: true,
+		},
+		{
+			name:    "Unsupported scheme - FTP",
+			input:   "ftp://example.com",
+			wantErr: true,
+		},
+		{
+			name:    "Missing host",
+			input:   "https://",
+			wantErr: true,
+		},
+		{
+			name:    "Local file path - Windows style",
+			input:   "C:/hello/world",
+			wantErr: true,
+		},
+		{
+			name:    "Local file path - Unix style",
+			input:   "/usr/local/bin",
+			wantErr: true,
+		},
+		{
+			name:    "Invalid URL characters",
+			input:   "https://example.com/%%%",
+			wantErr: true,
+		},
+		{
+			name:    "Valid URL with port",
+			input:   "https://example.com:8080",
+			wantErr: false,
+		},
+		{
+			name:    "Valid URL with path",
+			input:   "https://example.com/path/to/resource",
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidWebURL(tt.input)
+			assert.Equal(t, tt.wantErr, err != nil, "ValidWebURL(%q) = %v, wantErr %v", tt.input, err, tt.wantErr)
+		})
+	}
+}

contrib/validatepr/Containerfile

@@ -3,15 +3,15 @@ FROM registry.fedoraproject.org/fedora:latest
 WORKDIR /go/src/github.com/containers/podman
 
 RUN dnf install -y systemd-devel \
-	libassuan-devel \
-	libseccomp-devel \
-	gpgme-devel \
-	device-mapper-devel \
+	awk \
 	btrfs-progs-devel \
+	git \
 	golang \
+	gpgme-devel \
+	libassuan-devel \
+	libseccomp-devel \
 	make \
 	man-db \
-	git \
 	perl-Clone \
 	perl-FindBin \
-	pre-commit  && dnf clean all
+	pre-commit && dnf clean all

docs/source/markdown/options/mount.md

@@ -32,17 +32,28 @@ Options specific to type=**artifact**:
 - *title*: If the artifact source contains multiple blobs a title can be set
   which is compared against `org.opencontainers.image.title` annotation.
 
+- *name*: This can be used to overwrite the filename we use inside the container
+  for mounting. On a single blob artifact the name is used as is if *dst* is a
+  directory and otherwise ignored. With a multi blob artifact the name will be
+  used with an index suffix `<name>-x` where x is the layer index in the artifact
+  starting with 0.
+
 The *src* argument contains the name of the artifact, which must already exist locally.
 The *dst* argument contains the target path, if the path in the container is a
-directory or does not exist the blob title (`org.opencontainers.image.title`
-annotation) will be used as filename and joined to the path. If the annotation
-does not exist the digest will be used as filename instead. This results in all blobs
-of the artifact mounted into the container at the given path.
+directory the blob title (`org.opencontainers.image.title` annotation) will be used as
+filename and joined to the path. If the annotation does not exist the digest will be
+used as filename instead. This results in all blobs of the artifact mounted into the
+container at the given path.
 
 However, if the *dst* path is an existing file in the container, then the blob will be
 mounted directly on it. This only works when the artifact contains a single blob
 or when either *digest* or *title* are specified.
 
+If the *dst* path does not already exist in the container then if the artifact contains
+a single blob it behaves like existing file case and mounts directly to that path.
+If the artifact has more than one blob it works like the existing directory case and
+mounts each blob as file within the *dst* path.
+
 Options specific to type=**volume**:
 
 - *ro*, *readonly*: *true* or *false* (default if unspecified: *false*).

docs/source/markdown/options/network.md

@@ -27,7 +27,7 @@ Valid _mode_ values are:
 
 - **container:**_id_: Reuse another container's network stack.
 
-- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
+- **host**: Use the host's network namespace for the container instead of creating an isolated namespace. Warning: This gives the container full access to abstract Unix domain sockets and to TCP/UDP sockets bound to localhost. Since these mechanisms are often used to prevent access to sensitive system services, isolating them from access by external entities, use of this option may be considered a security vulnerability.
 
 - **ns:**_path_: Path to a network namespace to join.
 

docs/source/markdown/podman-container-diff.1.md.in

@@ -25,7 +25,7 @@ Alter the output into a different format. The only valid format for **podman con
 
 @@option latest
 
-## EXAMPLE
+## EXAMPLES
 
 ```
 # podman container diff container1
@@ -44,6 +44,11 @@ $ podman container diff --format json container1 container2
 }
 ```
 
+```
+$ podman container diff --latest
+C /etc
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**
 

docs/source/markdown/podman-container-inspect.1.md.in

@@ -76,7 +76,7 @@ Valid placeholders for the Go template are listed below:
 In addition to normal output, display the total file size if the type is a container.
 
 
-## EXAMPLE
+## EXAMPLES
 
 Inspect the specified container and print its information in json format.
 ```