From 5b8c851ece5ef3ccd1aaa6b895a0c5ebc24b270d Mon Sep 17 00:00:00 2001 From: Jindrich Novy Date: Wed, 10 Nov 2021 15:37:12 +0100 Subject: [PATCH] containers-common-1-10.el9 - update vendored components - Related: #2000051 Signed-off-by: Jindrich Novy --- containers-common.spec | 9 ++++++--- containers.conf | 25 +++++-------------------- containers.conf.5.md | 40 ++++++++-------------------------------- seccomp.json | 34 +++++++++++++++++++++++----------- shortnames.conf | 3 +++ 5 files changed, 45 insertions(+), 66 deletions(-) diff --git a/containers-common.spec b/containers-common.spec index 6aa1bd5..99d3923 100644 --- a/containers-common.spec +++ b/containers-common.spec @@ -4,16 +4,15 @@ # pick the oldest version on c/image, c/common, c/storage vendored in # podman/skopeo/podman. %global skopeo_branch main -%global podman_branch main %global image_branch v5.16.0 -%global common_branch v0.46.0 +%global common_branch v0.44.3 %global storage_branch v1.36.0 %global shortnames_branch main Epoch: 2 Name: containers-common Version: 1 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Common configuration and documentation for containers License: ASL 2.0 BuildArch: noarch @@ -161,6 +160,10 @@ EOF %{_datadir}/rhel/secrets/* %changelog +* Wed Nov 10 2021 Jindrich Novy - 2:1-10 +- update vendored components +- Related: #2000051 + * Tue Nov 02 2021 Jindrich Novy - 2:1-9 - make log_driver = "k8s-file" default in containers.conf - Related: #2000051 diff --git a/containers.conf b/containers.conf index a9f3a48..ccf84cb 100644 --- a/containers.conf +++ b/containers.conf @@ -422,7 +422,7 @@ infra_image = "registry.access.redhat.com/ubi9/pause" # Default options to pass to the slirp4netns binary. # For example "allow_host_loopback=true" # -#network_cmd_options = ["enable_ipv6=true",] +#network_cmd_options = [] # Whether to use chroot instead of pivot_root in the runtime # @@ -452,25 +452,15 @@ runtime = "crun" # List of the OCI runtimes that support --format=json. When json is supported # engine will use it for reporting nicer errors. # -#runtime_supports_json = ["crun", "runc", "kata", "runsc", "krun"] +#runtime_supports_json = ["crun", "runc", "kata", "runsc"] # List of the OCI runtimes that supports running containers with KVM Separation. # -#runtime_supports_kvm = ["kata", "krun"] +#runtime_supports_kvm = ["kata"] # List of the OCI runtimes that supports running containers without cgroups. # -#runtime_supports_nocgroups = ["crun", "krun"] - -# Default location for storing temporary container image content. Can be overridden with the TMPDIR environment -# variable. If you specify "storage", then the location of the -# container/storage tmp directory will be used. -# image_copy_tmp_dir="/var/tmp" - -# Number of seconds to wait without a connection -# before the `podman system service` times out and exits -# -#service_timeout = 5 +#runtime_supports_nocgroups = ["crun"] # Directory for persistent engine files (database, etc) # By default, this will be configured relative to where the containers/storage @@ -509,7 +499,7 @@ runtime = "crun" # #volume_path = "/var/lib/containers/storage/volumes" -# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, krun, etc) +# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, etc) [engine.runtimes] #crun = [ # "/usr/bin/crun", @@ -552,11 +542,6 @@ runtime = "crun" # "/run/current-system/sw/bin/runsc", #] -#krun = [ -# "/usr/bin/krun", -# "/usr/local/bin/krun", -#] - [engine.volume_plugins] #testplugin = "/run/podman/plugins/test.sock" diff --git a/containers.conf.5.md b/containers.conf.5.md index 1499211..e58a099 100644 --- a/containers.conf.5.md +++ b/containers.conf.5.md @@ -47,7 +47,8 @@ TOML can be simplified to: option = value ## CONTAINERS TABLE -The containers table contains settings to configure and manage the OCI runtime. +The containers table contains settings pertaining to the OCI runtime that can +configure and manage the OCI runtime. **annotations** = [] List of annotations. Specified as "key=value" pairs to be added to all containers. @@ -461,23 +462,11 @@ and pods are visible. Path to the slirp4netns binary. -**network_cmd_options**=["enable_ipv6=true",] +**network_cmd_options**=[] Default options to pass to the slirp4netns binary. -Valid options values are: - - - **allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`, which is added to `/etc/hosts` as `host.containers.internal` for your convenience). Default is false. - - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). - - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). - - **enable_ipv6=true|false**: Enable IPv6. Default is false. (Required for `outbound_addr6`). - - **outbound_addr=INTERFACE**: Specify the outbound interface slirp should bind to (ipv4 traffic only). - - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp should bind to. - - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp should bind to (ipv6 traffic only). - - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp should bind to. - - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. - Note: Rootlesskit changes the source IP address of incoming packets to a IP address in the container network namespace, usually `10.0.2.100`. If your application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. - - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. +Example "allow_host_loopback=true" **no_pivot_root**=false @@ -508,31 +497,18 @@ Default OCI specific runtime in runtimes that will be used by default. Must refer to a member of the runtimes table. Default runtime will be searched for on the system using the priority: "crun", "runc", "kata". -**runtime_supports_json**=["crun", "runc", "kata", "runsc", "krun"] +**runtime_supports_json**=["crun", "runc", "kata", "runsc"] The list of the OCI runtimes that support `--format=json`. -**runtime_supports_kvm**=["kata", "krun"] +**runtime_supports_kvm**=["kata"] The list of OCI runtimes that support running containers with KVM separation. -**runtime_supports_nocgroups**=["crun", "krun"] +**runtime_supports_nocgroups**=["crun"] The list of OCI runtimes that support running containers without CGroups. -**image_copy_tmp_dir**="/var/tmp" - -Default location for storing temporary container image content. Can be -overridden with the TMPDIR environment variable. If you specify "storage", then -the location of the container/storage tmp directory will be used. If set then it -is the users responsibility to cleanup storage. Configure tmpfiles.d(5) to -cleanup storage. - -**service_timeout**=**5** - -Number of seconds to wait without a connection before the -`podman system service` times out and exits - **static_dir**="/var/lib/containers/storage/libpod" Directory for persistent libpod files (database, etc). @@ -647,6 +623,6 @@ is used for the storage.conf file rather than the default. This is primarily used for testing. # SEE ALSO -containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5), tmpfiles.d(5) +containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5) [toml]: https://github.com/toml-lang/toml diff --git a/seccomp.json b/seccomp.json index 7f79d25..4d66196 100644 --- a/seccomp.json +++ b/seccomp.json @@ -1,6 +1,7 @@ { "defaultAction": "SCMP_ACT_ERRNO", "defaultErrnoRet": 38, + "defaultErrno": "ENOSYS", "archMap": [ { "architecture": "SCMP_ARCH_X86_64", @@ -87,7 +88,8 @@ "comment": "", "includes": {}, "excludes": {}, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -651,7 +653,8 @@ "CAP_DAC_READ_SEARCH" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -694,7 +697,8 @@ "CAP_SYS_ADMIN" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -723,7 +727,8 @@ "CAP_SYS_CHROOT" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -758,7 +763,8 @@ "CAP_SYS_MODULE" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -787,7 +793,8 @@ "CAP_SYS_PACCT" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -824,7 +831,8 @@ "CAP_SYS_PTRACE" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -855,7 +863,8 @@ "CAP_SYS_RAWIO" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -890,7 +899,8 @@ "CAP_SYS_TIME" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -919,7 +929,8 @@ "CAP_SYS_TTY_CONFIG" ] }, - "errnoRet": 1 + "errnoRet": 1, + "errno": "EPERM" }, { "names": [ @@ -947,7 +958,8 @@ "CAP_AUDIT_WRITE" ] }, - "errnoRet": 22 + "errnoRet": 22, + "errno": "EINVAL" }, { "names": [ diff --git a/shortnames.conf b/shortnames.conf index 0f6827c..76f3015 100644 --- a/shortnames.conf +++ b/shortnames.conf @@ -1,4 +1,7 @@ [aliases] + # almalinux + "almalinux" = "docker.io/library/almalinux" + "almalinux-minimal" = "docker.io/library/almalinux-minimal" # centos "centos" = "quay.io/centos/centos" # containers