Skip to content

Commit 2a044da

Browse files
rhatdanrhatdan
committed
Verify images in manifest list are not dangling and pruned
Vendor in latest containers/common Currently if you create an un tagged image and add it to a manifest list, podman image prune will remove the image, and leave you with a broken manifest list. This PR removes the image from dangling in this situation and prevents the pruning. We have seen this trigger issues with RamaLama which is creating manifest lists in this manner, and then users pruning the images. Verifing: containers/common#2360 Signed-off-by: Daniel J Walsh <[email protected]>
1 parent 39da6cd commit 2a044da

File tree

160 files changed

+2264
-7077
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

160 files changed

+2264
-7077
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ $(IN_CONTAINER): %-in-container:
363363
$(PODMANCMD) run --rm --env HOME=/root \
364364
-v $(CURDIR):/src -w /src \
365365
--security-opt label=disable \
366-
docker.io/library/golang:1.22 \
366+
docker.io/library/golang:1.23 \
367367
make $(*)
368368

369369

‎go.mod

+16-11
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@ module github.com/containers/podman/v5
66
go 1.23.0
77

88
require (
9-
github.com/BurntSushi/toml v1.4.0
9+
github.com/BurntSushi/toml v1.5.0
1010
github.com/Microsoft/go-winio v0.6.2
1111
github.com/blang/semver/v4 v4.0.0
1212
github.com/buger/goterm v1.0.4
1313
github.com/checkpoint-restore/checkpointctl v1.3.0
1414
github.com/checkpoint-restore/go-criu/v7 v7.2.0
15-
github.com/containernetworking/plugins v1.5.1
15+
github.com/containernetworking/plugins v1.6.2
1616
github.com/containers/buildah v1.39.2
1717
github.com/containers/common v0.62.2-0.20250311121556-b27979403716
1818
github.com/containers/conmon v2.0.20+incompatible
1919
github.com/containers/gvisor-tap-vsock v0.8.4
20-
github.com/containers/image/v5 v5.34.2-0.20250306154130-12497efe55ac
20+
github.com/containers/image/v5 v5.34.3-0.20250311194052-d84dbab374e7
2121
github.com/containers/libhvee v0.10.0
2222
github.com/containers/ocicrypt v1.2.1
2323
github.com/containers/psgo v1.9.0
@@ -53,8 +53,9 @@ require (
5353
github.com/moby/sys/user v0.3.0
5454
github.com/moby/term v0.5.2
5555
github.com/nxadm/tail v1.4.11
56-
github.com/onsi/ginkgo/v2 v2.22.2
56+
github.com/onsi/ginkgo/v2 v2.23.0
5757
github.com/onsi/gomega v1.36.2
58+
github.com/opencontainers/cgroups v0.0.1
5859
github.com/opencontainers/go-digest v1.0.0
5960
github.com/opencontainers/image-spec v1.1.1
6061
github.com/opencontainers/runc v1.2.6
@@ -70,7 +71,7 @@ require (
7071
github.com/stretchr/testify v1.10.0
7172
github.com/vbauerster/mpb/v8 v8.9.3
7273
github.com/vishvananda/netlink v1.3.1-0.20250221194427-0af32151e72b
73-
go.etcd.io/bbolt v1.3.11
74+
go.etcd.io/bbolt v1.4.0
7475
golang.org/x/crypto v0.36.0
7576
golang.org/x/net v0.37.0
7677
golang.org/x/sync v0.12.0
@@ -81,7 +82,7 @@ require (
8182
gopkg.in/inf.v0 v0.9.1
8283
gopkg.in/yaml.v3 v3.0.1
8384
sigs.k8s.io/yaml v1.4.0
84-
tags.cncf.io/container-device-interface v0.8.1
85+
tags.cncf.io/container-device-interface v1.0.0
8586
)
8687

8788
require (
@@ -95,6 +96,7 @@ require (
9596
github.com/bytedance/sonic v1.11.6 // indirect
9697
github.com/bytedance/sonic/loader v0.1.1 // indirect
9798
github.com/chzyer/readline v1.5.1 // indirect
99+
github.com/cilium/ebpf v0.17.3 // indirect
98100
github.com/cloudwego/base64x v0.1.4 // indirect
99101
github.com/cloudwego/iasm v0.2.0 // indirect
100102
github.com/containerd/cgroups/v3 v3.0.5 // indirect
@@ -166,7 +168,7 @@ require (
166168
github.com/mattn/go-colorable v0.1.13 // indirect
167169
github.com/mattn/go-isatty v0.0.20 // indirect
168170
github.com/mattn/go-runewidth v0.0.16 // indirect
169-
github.com/mdlayher/socket v0.5.0 // indirect
171+
github.com/mdlayher/socket v0.5.1 // indirect
170172
github.com/miekg/pkcs11 v1.1.1 // indirect
171173
github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
172174
github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -184,7 +186,7 @@ require (
184186
github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
185187
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
186188
github.com/pkg/errors v0.9.1 // indirect
187-
github.com/pkg/sftp v1.13.7 // indirect
189+
github.com/pkg/sftp v1.13.8 // indirect
188190
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
189191
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
190192
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
@@ -222,14 +224,17 @@ require (
222224
go.opentelemetry.io/otel/trace v1.32.0 // indirect
223225
golang.org/x/arch v0.8.0 // indirect
224226
golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c // indirect
225-
golang.org/x/mod v0.22.0 // indirect
227+
golang.org/x/mod v0.23.0 // indirect
226228
golang.org/x/oauth2 v0.26.0 // indirect
227229
golang.org/x/time v0.9.0 // indirect
228-
golang.org/x/tools v0.29.0 // indirect
230+
golang.org/x/tools v0.30.0 // indirect
229231
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
230232
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
231233
google.golang.org/grpc v1.70.0 // indirect
232234
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
233235
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
234-
tags.cncf.io/container-device-interface/specs-go v0.8.0 // indirect
236+
gopkg.in/yaml.v2 v2.4.0 // indirect
237+
tags.cncf.io/container-device-interface/specs-go v1.0.0 // indirect
235238
)
239+
240+
replace github.com/containers/common => github.com/rhatdan/common v0.47.1-0.20250318135319-2242b2e1f465

‎go.sum

+39-27
Large diffs are not rendered by default.

‎libpod/oci_conmon_linux.go

+15-16
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,14 @@ import (
1313
"strings"
1414
"sync"
1515

16-
runcconfig "github.com/opencontainers/runc/libcontainer/configs"
17-
"github.com/opencontainers/runc/libcontainer/devices"
18-
1916
"github.com/containers/common/pkg/cgroups"
2017
"github.com/containers/common/pkg/config"
2118
"github.com/containers/common/pkg/systemd"
2219
"github.com/containers/podman/v5/pkg/errorhandling"
2320
"github.com/containers/podman/v5/pkg/rootless"
2421
pmount "github.com/containers/storage/pkg/mount"
22+
cgroupsConfig "github.com/opencontainers/cgroups"
23+
devices "github.com/opencontainers/cgroups/devices/config"
2524
spec "github.com/opencontainers/runtime-spec/specs-go"
2625
"github.com/opencontainers/selinux/go-selinux/label"
2726
"github.com/sirupsen/logrus"
@@ -231,11 +230,11 @@ func (r *ConmonOCIRuntime) moveConmonToCgroupAndSignal(ctr *Container, cmd *exec
231230
}
232231

233232
// GetLimits converts spec resource limits to cgroup consumable limits
234-
func GetLimits(resource *spec.LinuxResources) (runcconfig.Resources, error) {
233+
func GetLimits(resource *spec.LinuxResources) (cgroupsConfig.Resources, error) {
235234
if resource == nil {
236235
resource = &spec.LinuxResources{}
237236
}
238-
final := &runcconfig.Resources{}
237+
final := &cgroupsConfig.Resources{}
239238
devs := []*devices.Rule{}
240239

241240
// Devices
@@ -262,29 +261,29 @@ func GetLimits(resource *spec.LinuxResources) (runcconfig.Resources, error) {
262261
final.Devices = devs
263262

264263
// HugepageLimits
265-
pageLimits := []*runcconfig.HugepageLimit{}
264+
pageLimits := []*cgroupsConfig.HugepageLimit{}
266265
for _, entry := range resource.HugepageLimits {
267-
pageLimits = append(pageLimits, &runcconfig.HugepageLimit{
266+
pageLimits = append(pageLimits, &cgroupsConfig.HugepageLimit{
268267
Pagesize: entry.Pagesize,
269268
Limit: entry.Limit,
270269
})
271270
}
272271
final.HugetlbLimit = pageLimits
273272

274273
// Networking
275-
netPriorities := []*runcconfig.IfPrioMap{}
274+
netPriorities := []*cgroupsConfig.IfPrioMap{}
276275
if resource.Network != nil {
277276
for _, entry := range resource.Network.Priorities {
278-
netPriorities = append(netPriorities, &runcconfig.IfPrioMap{
277+
netPriorities = append(netPriorities, &cgroupsConfig.IfPrioMap{
279278
Interface: entry.Name,
280279
Priority: int64(entry.Priority),
281280
})
282281
}
283282
}
284283
final.NetPrioIfpriomap = netPriorities
285-
rdma := make(map[string]runcconfig.LinuxRdma)
284+
rdma := make(map[string]cgroupsConfig.LinuxRdma)
286285
for name, entry := range resource.Rdma {
287-
rdma[name] = runcconfig.LinuxRdma{HcaHandles: entry.HcaHandles, HcaObjects: entry.HcaObjects}
286+
rdma[name] = cgroupsConfig.LinuxRdma{HcaHandles: entry.HcaHandles, HcaObjects: entry.HcaObjects}
288287
}
289288
final.Rdma = rdma
290289

@@ -329,25 +328,25 @@ func GetLimits(resource *spec.LinuxResources) (runcconfig.Resources, error) {
329328
if resource.BlockIO != nil {
330329
if len(resource.BlockIO.ThrottleReadBpsDevice) > 0 {
331330
for _, entry := range resource.BlockIO.ThrottleReadBpsDevice {
332-
throttle := runcconfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
331+
throttle := cgroupsConfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
333332
final.BlkioThrottleReadBpsDevice = append(final.BlkioThrottleReadBpsDevice, throttle)
334333
}
335334
}
336335
if len(resource.BlockIO.ThrottleWriteBpsDevice) > 0 {
337336
for _, entry := range resource.BlockIO.ThrottleWriteBpsDevice {
338-
throttle := runcconfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
337+
throttle := cgroupsConfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
339338
final.BlkioThrottleWriteBpsDevice = append(final.BlkioThrottleWriteBpsDevice, throttle)
340339
}
341340
}
342341
if len(resource.BlockIO.ThrottleReadIOPSDevice) > 0 {
343342
for _, entry := range resource.BlockIO.ThrottleReadIOPSDevice {
344-
throttle := runcconfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
343+
throttle := cgroupsConfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
345344
final.BlkioThrottleReadIOPSDevice = append(final.BlkioThrottleReadIOPSDevice, throttle)
346345
}
347346
}
348347
if len(resource.BlockIO.ThrottleWriteIOPSDevice) > 0 {
349348
for _, entry := range resource.BlockIO.ThrottleWriteIOPSDevice {
350-
throttle := runcconfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
349+
throttle := cgroupsConfig.NewThrottleDevice(entry.Major, entry.Minor, entry.Rate)
351350
final.BlkioThrottleWriteIOPSDevice = append(final.BlkioThrottleWriteIOPSDevice, throttle)
352351
}
353352
}
@@ -366,7 +365,7 @@ func GetLimits(resource *spec.LinuxResources) (runcconfig.Resources, error) {
366365
if entry.LeafWeight != nil {
367366
lw = *entry.LeafWeight
368367
}
369-
weight := runcconfig.NewWeightDevice(entry.Major, entry.Minor, w, lw)
368+
weight := cgroupsConfig.NewWeightDevice(entry.Major, entry.Minor, w, lw)
370369
final.BlkioWeightDevice = append(final.BlkioWeightDevice, weight)
371370
}
372371
}

‎libpod/stats_linux.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
"syscall"
1010
"time"
1111

12-
runccgroup "github.com/opencontainers/runc/libcontainer/cgroups"
12+
runccgroup "github.com/opencontainers/cgroups"
1313

1414
"github.com/containers/common/pkg/cgroups"
1515
"github.com/containers/podman/v5/libpod/define"

‎pkg/api/handlers/compat/containers_stats_linux.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import (
1515
api "github.com/containers/podman/v5/pkg/api/types"
1616
"github.com/containers/storage/pkg/system"
1717
"github.com/docker/docker/api/types/container"
18-
runccgroups "github.com/opencontainers/runc/libcontainer/cgroups"
18+
cgroupsConfig "github.com/opencontainers/cgroups"
1919
"github.com/sirupsen/logrus"
2020
)
2121

@@ -238,7 +238,7 @@ streamLabel: // A label to flatten the scope
238238
}
239239
}
240240

241-
func toBlkioStatEntry(entries []runccgroups.BlkioStatEntry) []container.BlkioStatEntry {
241+
func toBlkioStatEntry(entries []cgroupsConfig.BlkioStatEntry) []container.BlkioStatEntry {
242242
results := make([]container.BlkioStatEntry, len(entries))
243243
for i, e := range entries {
244244
bits, err := json.Marshal(e)

‎pkg/domain/infra/abi/images.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -597,7 +597,7 @@ func (ir *ImageEngine) Tree(ctx context.Context, nameOrID string, opts entities.
597597
if err != nil {
598598
return nil, err
599599
}
600-
tree, err := image.Tree(opts.WhatRequires)
600+
tree, err := image.Tree(ctx, opts.WhatRequires)
601601
if err != nil {
602602
return nil, err
603603
}

‎test/system/012-manifest.bats

+26
Original file line numberDiff line numberDiff line change
@@ -324,4 +324,30 @@ function manifestListAddArtifactOnce() {
324324
manifestListAddArtifactOnce
325325
done
326326
}
327+
328+
@test "manifest list images should not be marked as dangling" {
329+
# build image and attach it to a manifest list
330+
mlist=m-$(safename)
331+
run_podman build -q -f - <<< "from scratch"
332+
iid=${output}
333+
run_podman manifest create ${mlist} ${iid}
334+
335+
# verify image is not dangling, and is not remove via prune
336+
run_podman images --filter dangling=true
337+
assert "$output" != "sha256:${iid}" "Verify the filter dangling does not list the image"
338+
run_podman image prune --force
339+
assert "$output" != "${iid}" "Verify the prune does not remove the non dangling image"
340+
run_podman image exists ${iid}
341+
342+
# Remove manifes
343+
run_podman manifest rm ${mlist}
344+
345+
# verify the image is now dangling, and is removed via prune
346+
run_podman images -q --filter dangling=true --no-trunc
347+
assert "$output" == "sha256:${iid}" "Verify the filter dangling does list the image"
348+
run_podman image prune --force
349+
assert "$output" == "${iid}" "Verify that prune does not remove the dangling image"
350+
run_podman 1 image exists ${iid}
351+
}
352+
327353
# vim: filetype=sh

‎vendor/github.com/BurntSushi/toml/README.md

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/BurntSushi/toml/decode.go

+28-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)