- drop debug logs
- no need to restart upgraded containers, they restart automatically
- fix ordering in volume prune (when containers are removed)
- skip directories in container activation (inbox -> execd queue)
- Fix 'container pull IMG creds USER[:PASS]' bug, extra '=' variable
assignment inside infix.xml
- Fix 'container run IMG CMD ARGS' to actually put the CMD in
ENTRYPOINT and append ARGS to image. The podman run and create
commands are *not* behaving the same way
- Rename 'attach' to 'exec', execute command inside an running container
- Add 'container [shell | connect]' to start shell in -- " -- " -- " --
- Add 'container [stat | cleanup | usage stats]' commands
- Add in="tty" to commands thay may end up being interactive
- Split <ACTION> line into multiple lines for readability
- Fix container shift logic:
root@infix-00-00-00:/> show container
/usr/sbin/container: line 361: shift: shift count out of range
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, update container YANG model descriptions and ensure 'path' is
mandatory for each list element and attach a regexp pattern to fix
the mountpoint to an absolute path inside the container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the container configuration context:
edit file ntp.conf
set path /etc/ntp.conf
set content
The last command opens a text editor where you can paste the contents
of the file. This is stored base64 encoded in the datastore as well
as in JSON/XML.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new CLI command 'container upgrade foo', where 'foo'
is the name of the container. If more than one container use the same
image, multiple upgrades must be done because a container runs not on
the 'image:tag' but on the hash of the 'image:tag' it was created from.
Rename "done" queue to "active", since we want to recreate an active
container after fetching an updated base image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for writable container volumes. A volume, when
compared to a mount, is a writable directory created when the container
starts and is automatically rsync'ed with the underlying directory it
is mounted on on first use. A mount otoh does not rsync so it results
only in an empty directory inside the container.
The podman/docker mount feature will be used later to bind mount single
files or sharing directories from the host, e.g., /sys/class/leds/ to
one of more containers.
Note: unused volumes are automatically pruned. Hence, a volume
currently cannot be moved to another container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows containers created with "podman create" to surivce
rebots, and even reconfigurations at runtime, as long as their config
has not changed. Allowing some level of persistence in the writable
layer given to containers.
For even more persistency, support for volumes (they sync with dir in
container on first use) and mounts (creates empty writable dirs in the
container) must be added. A third option, a variant of mounts, is to
allow a leaf-list "file", where binary content can be added and then
mounted into the container, e.g.
/run/containers/files/$name/file.ext -> container://$name/etc/file.ext
None of this is available yet, but seems likely we need to add in the
very near term.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was a tough nut to crack. Turns out the trick to changing the
ENTRYPOINT is to set --entrypoint=command and then call 'podman create
... command args'. Not entirely obvious since the documented approach
is to use a JSON array as the argument: podman create
--entrypoint='["command", "args" ]'.
Admittedly, encoding this in C to transfer it via a POSIX shell script
to the command line, is not the easiest task I've undertaken. So I gave
up and found this workaround.
Worth noting, however, is that one *must* set `--entrypoint`, it is not
enough to just append the command to the 'podman create' command line.
Due to differences in docker and podman, we cannot supply the full args
to an alternate entrypoint command. But for the command to actually run
we need to override the image's ENTRYPOINT and send the command and args
as the last arguments on the command line to podman create.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, ensure the deleted container is actually deleted before recreating
it with a new configuration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds 'manual:yes' to the container's Finit service
configuration and changes from pod: to container: prefix for a
unique namespace to prevent collision with regular services.
The prefix container: is more correct that pod:, which should
be reserved for any future pod support.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd: fix missing variable in container script condition
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This bump adds support for 'set foo' to set foo=true, but also two new
commands from srp_helper@: 'change password', 'text-editor content'.
- ietf-system: 'change password' now starts an interactive session that
results in a random-salted sha512 encrypted hash.
- 'text-editor <node-of-binary-type>', starts 'editor file | base64'
- 'set <node-of-bool-type>', sets node=true
A prototype askpass script has been added as a proof-of-concept. It
follows the design of other askpass style programs, like ssh-askpass,
that pass the resulting password on stdout. With the additional support
for also writing it to an output file, e.g., a pipe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When "plopping" back an interface from another network namespace, e.g.,
when removing a container network interface, we cannot just rely on the
'ethernet' node *not* being available for an interface.
Experience shows that sysrepo might send us a curve ball (see comment)
which we interpret to be a true Ethernet interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This resolves the regression where configured etherlike interface mac
addresses where not deleted from the system.
Signed-off-by: Richard Alpe <richard@bit42.se>
Instead of "ethernet". Prior to this patch virtio interfaces where
identified as "ethernet", which resulted in /run/net trying to enable
autoneg on them. Which isn't supported and resulted in an ABANDONED
"default config".
Signed-off-by: Richard Alpe <richard@bit42.se>
Needed for devices that share a lot of properties with an ethernet
device but doesn't support "ethtool" and such. An example is TAP
interfaces.
Signed-off-by: Richard Alpe <richard@bit42.se>
Rely on the interface diff to figure out if any autoneg related config
has changed; if so, generate the resulting configuration based on the
current interface config.
- Remove loopback check, the model only allows ethernet config on
interfaces of type "ethernet".
- Split up the input validation of speed/duplex to give the user an
error message with as much specificity as possible.
- Validate that the configured speed/duplex is supported.
- Move the generated script to execute earlier to avoid unnecessary
link flapping.
- Use negative POSIX error codes, these are (or at least should be)
mapped to sysrepo errors in netdag_gen_iface.
Add the ability to configure interface speed, duplex and autoneg.
Initially this was pared with YANG model deviations that restricted
explicit interface speed and duplex when autoneg was enabled. But due
to conflicting default states in YANG, this code was dropped.
Signed-off-by: Richard Alpe <richard@bit42.se>
The DHCP client YANG model saw a lot of changes added in the 23.12
sprint, fortunately there was never an official release.
This commit bumps the model version for v24.01.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For maximum flexibility we allow the user to full control over the DHCP
options the client requests. For this to work we must tell udhcpc to
not set any of its defaults behind the scenes, so we call it with '-o'.
This commit adds support for inferring these udhcpc default options in
NETCONF. So when enabling the DHCP client we now get the same set of
sane options as udhcpc otherwise hides from us.
Fixes#278, at least wrt. the lack of sent options. Allowing the client
script to set the hostname will be added in a later commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No need to guard the hostname option in quotes, it must not contain
whitespace. If user configured more than one word, use first.
Fixes#283
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg