containers/podman v3.1.0-rc2

v3.1.0-RC2

on GitHub

This is the second release candidate for Podman v3.1.0

Preliminary release notes are below. Please note that these are subject to change until the final release.

Features

• A set of new commands has been added to manage secrets! The podman secret create, podman secret inspect, podman secret ls and podman secret rm commands have been added to handle secrets, along with the --secret option to podman run and podman create to add secrets to containers. The initial driver for secrets does not support encryption - this will be added in a future release.
• A new command to prune networks, podman network prune, has been added (#8673).
• The -v option to podman run and podman create now supports a new volume option, :U, to chown the volume's source directory on the host to match the UID and GID of the container and prevent permissions issues (#7778).
• Three new commands, podman network exists, podman volume exists, and podman manifest exists, have been added to check for the existence of networks, volumes, and manifest lists.
• The podman cp command can now copy files into directories mounted as tmpfs in a running container.
• The podman volume prune command will now list volumes that will be pruned when prompting the user whether to continue and perform the prune (#8913).
• The Podman remote client's podman build command now supports the --disable-compression, --excludes, and --jobs options.
• The Podman remote client's podman push command now supports the --format option.
• The Podman remote client's podman rm command now supports the --all and --ignore options.
• The Podman remote client's podman search command now supports the --no-trunc and --list-tags options.
• The podman play kube command can now read in Kubernetes YAML from STDIN when - is specified as file name (podman play kube -), allowing input to be piped into the command for scripting (#8996).
• The podman generate systemd command now supports a --no-header option, which disables creation of the header comment automatically added by Podman to generated unit files.

Changes

• The Podman remote client's podman build command no longer allows the -v flag to be used. Volumes are not yet supported with remote Podman when the client and service are on different machines.
• The podman kill and podman stop commands now print the name given by the user for each container, instead of the full ID.
• When the --security-opt unmask=ALL or --security-opt unmask=/sys/fs/cgroup options to podman create or podman run are given, Podman will mount cgroups into the container as read-write, instead of read-only (#8441).
• The podman rmi command has been changed to better handle cases where an image is incomplete or corrupted, which can be caused by interrupted image pulls.
• The podman rename command has been improved to be more atomic, eliminating many race conditions that could potentially render a renamed container unusable.
• Detection of which OCI runtimes run using virtual machines and thus require custom SELinux labelling has been improved (#9582).
• The hidden --trace option to podman has been turned into a no-op. It was used in very early versions for performance tracing, but has not been supported for some time.

Bugfixes

• Fixed a bug where rootless Podman containers joined to CNI networks could not receive traffic from forwarded ports (#9065).
• Fixed a bug where podman network create with the --macvlan flag did not honor the --gateway, --subnet, and --opt options (#9167).
• Fixed a bug where the podman generate kube command generated invalid YAML for privileged containers (#8897).
• Fixed a bug where the podman generate kube command could not be used with containers that were not running.
• Fixed a bug where Podman did not add annotations specified in containers.conf to containers.
• Foxed a bug where Podman did not respect the no_hosts default in containers.conf when creating containers.
• Fixed a bug where the --tail=0, --since, and --follow options to the podman logs command did not function properly when using the journald log backend.
• Fixed a bug where specifying more than one container to podman logs when the journald log backend was in use did not function correctly.
• Fixed a bug where the podman run and podman create commands would panic if a memory limit was set, but the swap limit was set to unlimited (#9429).
• Fixed a bug where the --network option to podman run, podman create, and podman pod create would error if the user attempted to specify CNI networks by ID, instead of name (#9451).
• Fixed a bug where Podman's cgroup handling for cgroups v1 systems did not properly handle cases where a cgroup existed on some, but not all, controllers, resulting in errors from the podman stats command (#9252).
• Fixed a bug where the podman cp did not properly handle cases where /dev/stdout was specified as the destination (it was treated identically to -) (#9362).
• Fixed a bug where the podman cp command would create files with incorrect ownership (#9526).
• Fixed a bug where the podman cp command did not properly handle cases where the destination directory did not exist.
• Fixed a bug where the podman cp command did not properly evaluate symlinks when copying out of containers.
• Fixed a bug where the podman rm -fa command would error when attempting to remove containers created with --rm (#9479).
• Fixed a bug where the ordering of capabilities was nondeterministic in the CapDrop field of the output of podman inspect on a container (#9490).
• Fixed a bug where the podman network connect command could be used with containers that were not initially connected to a CNI bridge network (e.g. containers created with --net=host) (#9496).
• Fixed a bug where DNS search domains required by the dnsname CNI plugin were not being added to container's resolv.conf under some circumstances.
• Fixed a bug where the --ignorefile option to podman build was nonfunctional (#9570).
• Fixed a bug where the --timestamp option to podman build was nonfunctional (#9569).
• Fixed a bug where the --iidfile option to podman build could cause Podman to panic if an error occurred during the build.
• Fixed a bug where the --dns-search option to podman build was nonfunctional (#9574).
• Fixed a bug where the --build-arg option to podman build would, when given a key but not a value, error (instead of attempting to look up the key as an environment variable) (#9571).
• Fixed a bug where the podman network disconnect command could cause errors when the container that had a network removed was stopped and its network was cleaned up (#9602).
• Fixed a bug where the podman network rm command did not properly check what networks a container was present in, resulting in unexpected behavior if podman network connect or podman network disconnect had been used with the network (#9632).
• Fixed a bug where some errors with stopping a container could cause Podman to panic, and the container to be stuck in an unusable stopping state (#9615).
• Fixed a bug where the podman load command could return 0 even in cases where an error occurred (#9672).
• Fixed a bug where specifying storage options to Podman using the --storage-opt option would override all storage options. Instead, storage options are now overridden only when the --storage-driver option is used to override the current graph driver (#9657).
• Fixed a bug where containers created with --privileged could request more capabilities than were available to Podman.

API

• Fixed a bug where the X-Registry-Auth header did not accept null as a valid value.
• A new compat endpoint, /auth, has been added. This endpoint validates credentials against a registry (#9564).
• Fixed a bug where the compat Build endpoint for Images specified labels using the wrong type (array vs map). Both formats will be accepted now.
• Fixed a bug where the compat Build endpoint for Images did not report that it successfully tagged the built image in its response.
• Fixed a bug where the compat Create endpoint for Images did not provide progress information on pulling the image in its response.
• Fixed a bug where the compat Push endpoint for Images did not properly handle the destination (used a query parameter, instead of a path parameter).
• Fixed a bug where the compat Push endpoint for Images did not send the progress of the push and the digest of the pushed image in the response body.
• Fixed a bug where the compat List endpoint for Networks returned null, instead of an empty array ([]), when no networks were present (#9293).
• Fixed a bug where the compat List endpoint for Networks returned nulls, instead of empty maps, for networks that do not have Labels and/or Options.
• The Libpod Inspect endpoint for networks (/libpod/network/$ID/json) now has an alias at /libpod/network/$ID (#9691).
• Fixed a bug where the libpod Inspect endpoint for Networks returned a 1-size array of results, instead of a single result (#9690).
• The Compat List endpoint for Networks now supports the legacy format for filters in parallel with the current filter format (#9526).
• Fixed a bug where the compat Create endpoint for Containers did not properly handle tmpfs filesystems specified with options (#9511).
• Fixed a bug where the compat Create endpoint for Containers did not create bind-mount source directories (#9510).
• Fixed a bug where the compat Create endpoint for Containers did not properly handle the NanoCpus option (#9523).
• Fixed a bug where the compat List endpoint for Containers did not populate information on forwarded ports (#9553)
• Fixed a bug where the compat List endpoint for Containers did not populate information on container CNI networks (#9529).
• Fixed a bug where the compat and libpod Stop endpoints for Containers would ignore a timeout of 0.
• Fixed a bug where the compat Remove endpoint for Containers would not return 404 when attempting to remove a container that does not exist (#9675).
• Fixed a bug where the compat Prune endpoint for Volumes would still prune even if an invalid filter was specified.

Misc

• Updated Buildah to v1.19.8
• Updated the containers/storage library to v1.28.0
• Updated the containers/image library to v5.10.5
• Updated the containers/common library to v0.35.3