This branch can be used to test push events which is especially
useful when working on the CI infrastructure.
Signed-off-by: Richard Alpe <richard@bit42.se>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually the CNI bridge plugin "takes care" of enabling IPv4 forwarding
on all interfaces, see issue #1125, but when the container tests are run
in a different order from the infix_containers.yaml, Infix may reset the
IPv4 forwarding on this critical interface.
This change is both future proof and also ensures the test works as it
was intended even if tests are run out-of-order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As Infix matures as an operating system it is quickly becoming more and
more useful also for end-device use-cases. The README should reflect
this change in focus.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
From the documentation:
> 'podman image prune' removes all dangling images from local storage.
> With the all option, all unused images are deleted (i.e., images not
> in use by any container).
>
> The image prune command does not prune cache images that only use
> layers that are necessary for other images.
So, when the container script is called in the cleanup phase of the
lifetime of a container, we can use the '--all' option to ensure we also
remove this container's loaded image. In the case this happens before
a reboot of the system, there will be no old version of the image loaded
to /var/lib/containers after boot.
Issue #1098
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There are 2 main reasons for this:
1) It's almost impossible to write complex logical expressions in GH
workflows. I wanted to pass "" as flavor when not building _minimal.
So that the end target string would become TARGET + FLAVOR where
FLAVOR is empty, making it x86_64 for example.
As it turns out "" is false in GH workflow logical expressions, this
in conjunction with the limitations the interpreter has made it hard
to actually write sane expressions in the "with:" variables when
calling downstream jobs via workflow calls.
Here's an example of what I was trying to do and could not:
with:
flavor: ${{ (
github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'ci:main')
) && '' || '_minimal' }}
As '' is false, the first sets of expressions always evaluates to
false making the string "_minimal". I tried bracing this in various
ways and to use "null" or various JSON objects, all in vain.
2) It reduces complexity instead of adding additional.
Signed-off-by: Richard Alpe <richard@bit42.se>
Previously, upgrading Podman containers with the same tag left
behind dangling images, causing overlay storage to grow and fill
disk space.
This change ensures dangling images are cleaned up using
podman image prune. The command is run without -a, so only
unreferenced images are removed. This provides safe cleanup while
preventing unnecessary overlay growth.
Fixes#1098
Signed-off-by: Richard Alpe <richard@bit42.se>
