containers-common-1-52.el8

- update vendored components - Related: #2176055 Signed-off-by: Jindrich Novy <jnovy@redhat.com>
2023-07-08 04:23:23 +02:00 · 2023-07-08 04:23:23 +02:00 · 5cb62db757
commit 5cb62db757
parent 5152333795
11 changed files with 572 additions and 144 deletions
--- a/001-rhel-shortnames-pyxis.conf
+++ b/001-rhel-shortnames-pyxis.conf
--- a/containers-auth.json.5.md
+++ b/containers-auth.json.5.md
@ -18,8 +18,8 @@ Except the primary (read/write) file, other files are read-only, unless the user

 ## FORMAT

-The auth.json file stores encrypted authentication information for the
-user to container image registries.  The file can have zero to many entries and
+The auth.json file stores, or references, credentials that allow the user to authenticate
+to container image registries.  The file can have zero to many entries and
 is created by a `login` command from a container tool such as `podman login`,
 `buildah login` or `skopeo login`. Each entry either contains a single
 hostname (e.g. `docker.io`) or a namespace (e.g. `quay.io/user/image`) as a key
--- a/containers-common.spec
+++ b/containers-common.spec
@ -4,15 +4,15 @@
 # pick the oldest version on c/image, c/common, c/storage vendored in
 # podman/skopeo/podman.
 %global skopeo_branch main
-%global image_branch v5.24.1
-%global common_branch v0.51.0
-%global storage_branch v1.45.3
+%global image_branch v5.25.0
+%global common_branch v0.52.0
+%global storage_branch v1.46.1
 %global shortnames_branch main

 Epoch: 2
 Name: containers-common
 Version: 1
-Release: 51%{?dist}
+Release: 52%{?dist}
 Summary: Common configuration and documentation for containers
 License: ASL 2.0
 # arch limitation because of go-md2man (missing on i686)
@ -175,6 +175,10 @@ EOF
 %{_datadir}/rhel/secrets/*

 %changelog
+* Sat Jul 08 2023 Jindrich Novy <jnovy@redhat.com> - 2:1-52
+- update vendored components
+- Related: #2176055
+
 * Tue Mar 21 2023 Jindrich Novy <jnovy@redhat.com> - 2:1-51
 - be sure default_capabilities contain SYS_CHROOT
 - Resolves: #2166195
--- a/containers-policy.json.5.md
+++ b/containers-policy.json.5.md
@ -282,7 +282,7 @@ signed by the provided public key.
 The `signedIdentity` field has the same semantics as in the `signedBy` requirement described above.
 Note that `cosign`-created signatures only contain a repository, so only `matchRepository` and `exactRepository` can be used to accept them (and that does not protect against substitution of a signed image with an unexpected tag).

-To use this with images hosted on image registries, the relevant registry or repository must have the `use-sigstore-attachments` option enabled in containers-registries.d(5).
+To use this with images hosted on image registries, the `use-sigstore-attachments` option needs to be enabled for the relevant registry or repository in the client's containers-registries.d(5).

 ## Examples

--- a/containers-signature.5.md
+++ b/containers-signature.5.md
@ -68,7 +68,9 @@ the consumer MUST verify at least the following aspects of the signature
 (like the `github.com/containers/image/signature` package does):

 - The blob MUST be a “Signed Message” as defined RFC 4880 section 11.3.
-  (e.g. it MUST NOT be an unsigned “Literal Message”, or any other non-signature format).
+  (e.g. it MUST NOT be an unsigned “Literal Message”,
+  a “Cleartext Signature” as defined in RFC 4880 section 7,
+  or any other non-signature format).
 - The signature MUST have been made by an expected key trusted for the purpose (and the specific container image).
 - The signature MUST be correctly formed and pass the cryptographic validation.
 - The signature MUST correctly authenticate the included JSON payload
--- a/containers-storage.conf.5.md
+++ b/containers-storage.conf.5.md
@ -64,6 +64,12 @@ Default directory to store all temporary writable content created by container s
 By default, the storage driver is set via the `driver` option. If it is not defined, then the best driver will be picked according to the current platform. This option allows you to override this internal priority list with a custom one to prefer certain drivers.
 Setting this option only has an effect if the local storage has not been initialized yet and the driver name is not set.

+**transient_store** = "false" | "true"
+
+Transient store mode makes all container metadata be saved in temporary storage
+(i.e. runroot above). This is faster, but doesn't persist across reboots.
+Additional garbage collection must also be performed at boot-time, so this option should remain disabled in most configurations. (default: false)
+
 ### STORAGE OPTIONS TABLE

 The `storage.options` table supports the following options:
--- a/containers.conf
+++ b/containers.conf
@ -33,6 +33,11 @@
 #
 #base_hosts_file = ""

+# List of cgroup_conf entries specifying a list of cgroup files to write to and
+# their values. For example `memory.high=1073741824` sets the
+# memory.high limit to 1GB.
+# cgroup_conf = []
+
 # Default way to to create a cgroup namespace for the container
 # Options are:
 # `private` Create private Cgroup Namespace for the container.
@ -53,7 +58,6 @@
 # the default capabilities defined in the container engine will be added.
 #
 default_capabilities = [
-  "SYS_CHROOT",
  "NET_RAW",
  "CHOWN",
  "DAC_OVERRIDE",
@ -65,6 +69,7 @@ default_capabilities = [
  "SETGID",
  "SETPCAP",
  "SETUID",
+  "SYS_CHROOT",
 ]

 # A list of sysctls to be set in containers by default,
@ -200,6 +205,10 @@ log_driver = "k8s-file"
 #
 #no_hosts = false

+# Tune the host's OOM preferences for containers
+# (accepts values from -1000 to 1000).
+#oom_score_adj = 0
+
 # Default way to to create a PID namespace for the container
 # Options are:
 # `private` Create private PID Namespace for the container.
@ -298,6 +307,15 @@ network_backend = "cni"
 #  "/opt/cni/bin",
 #]

+# List of directories that will be searched for netavark plugins.
+#
+#netavark_plugin_dirs = [
+#  "/usr/local/libexec/netavark",
+#	 "/usr/libexec/netavark",
+#	 "/usr/local/lib/netavark",
+#	 "/usr/lib/netavark",
+#]
+
 # The network name of the default network to attach pods to.
 #
 #default_network = "podman"
@ -452,7 +470,7 @@ events_logger = "file"
 #
 #image_parallel_copies = 0

-# Tells container engines how to handle the builtin image volumes.
+# Tells container engines how to handle the built-in image volumes.
 #   * bind: An anonymous named volume will be created and mounted
 #     into the container.
 #   * tmpfs: The volume is mounted onto the container as a tmpfs,
@ -468,13 +486,17 @@ events_logger = "file"

 # Infra (pause) container image name for pod infra containers.  When running a
 # pod, we start a `pause` process in a container to hold open the namespaces
-# associated with the  pod.  This container does nothing other then sleep,
-# reserving the pods resources for the lifetime of the pod. By default container
-# engines run a builtin container using the pause executable. If you want override
+# associated with the  pod.  This container does nothing other than sleep,
+# reserving the pod's resources for the lifetime of the pod. By default container
+# engines run a built-in container using the pause executable. If you want override
 # specify an image to pull.
 #
 #infra_image = ""

+# Default Kubernetes kind/specification of the kubernetes yaml generated with the `podman kube generate` command.
+# The possible options are `pod` and `deployment`.
+#kube_generate_type = "pod"
+
 # Specify the locking mechanism to use; valid values are "shm" and "file".
 # Change the default only if you are sure of what you are doing, in general
 # "file" is useful only on platforms where cgo is not available for using the
@ -699,7 +721,7 @@ runtime = "runc"
 # "https://example.com/linux/amd64/foobar.ami" on a Linux AMD machine.
 # The default value is `testing`.
 #
-# image = "testing"
+#image = "testing"

 # Memory in MB a machine is created with.
 #
@ -715,10 +737,15 @@ runtime = "runc"
 # the source and destination. An optional third field `:ro` can be used to
 # tell the container engines to mount the volume readonly.
 #
-# volumes = [
+#volumes = [
 #  "$HOME:$HOME",
 #]

+# Virtualization provider used to run Podman machine.
+# If it is empty or commented out, the default provider will be used.
+#
+#provider = ""
+
 # The [machine] table MUST be the last entry in this file.
 # (Unless another table is added)
 # TOML does not provide a way to end a table other than a further table being
--- a/containers.conf.5.md
+++ b/containers.conf.5.md
@ -9,11 +9,12 @@ Container engines like Podman & Buildah read containers.conf file, if it exists
 and modify the defaults for running containers on the host. containers.conf uses
 a TOML format that can be easily modified and versioned.

-Container engines read the /usr/share/containers/containers.conf and
-/etc/containers/containers.conf, and /etc/containers/containers.conf.d/*.conf files
-if they exist. When running in rootless mode, they also read
-$HOME/.config/containers/containers.conf and
-$HOME/.config/containers/containers.conf.d/*.conf files.
+Container engines read the __/usr/share/containers/containers.conf__,
+__/etc/containers/containers.conf__, and __/etc/containers/containers.conf.d/\*.conf__
+files if they exist.
+When running in rootless mode, they also read
+__$HOME/.config/containers/containers.conf__ and
+__$HOME/.config/containers/containers.conf.d/\*.conf__ files.

 Fields specified in containers conf override the default options, as well as
 options in previously read containers.conf files.
@ -22,10 +23,10 @@ Config files in the `.d` directories, are added in alpha numeric sorted order an

 Not all options are supported in all container engines.

-Note container engines also use other configuration files for configuring the environment.
+Note, container engines also use other configuration files for configuring the environment.

 * `storage.conf` for configuration of container and images storage.
-* `registries.conf` for definition of container registires to search while pulling.
+* `registries.conf` for definition of container registries to search while pulling.
 container images.
 * `policy.conf` for controlling which images can be pulled to the system.

@ -50,6 +51,7 @@ TOML can be simplified to:
 The containers table contains settings to configure and manage the OCI runtime.

 **annotations** = []
+
 List of annotations. Specified as "key=value" pairs to be added to all containers.

 Example: "run.oci.keep_original_groups=1"
@ -66,6 +68,12 @@ file. This must be either an absolute path or as special values "image" which
 uses the hosts file from the container image or "none" which means
 no base hosts file is used. The default is "" which will use /etc/hosts.

+**cgroup_conf**=[]
+
+List of cgroup_conf entries specifying a list of cgroup files to write to and
+their values. For example `memory.high=1073741824` sets the
+memory.high limit to 1GB.
+
 **cgroups**="enabled"

 Determines  whether  the  container will create CGroups.
@ -98,6 +106,7 @@ default_capabilities = [
      "SETGID",
      "SETPCAP",
      "SETUID",
+      "SYS_CHROOT",
 ]
 ```

@ -227,6 +236,10 @@ Options are:
 Create /etc/hosts for the container. By default, container engines manage
 /etc/hosts, automatically adding  the container's  own  IP  address.

+**oom_score_adj**=0
+
+Tune the host's OOM preferences for containers (accepts values from -1000 to 1000).
+
 **pidns**="private"

 Default way to to create a PID namespace for the container.
@ -324,6 +337,20 @@ cni_plugin_dirs = [
 ]
 ```

+**netavark_plugin_dirs**=[]
+
+List of directories that will be searched for netavark plugins.
+
+The default list is:
+```
+netavark_plugin_dirs = [
+  "/usr/local/libexec/netavark",
+  "/usr/libexec/netavark",
+  "/usr/local/lib/netavark",
+  "/usr/lib/netavark",
+]
+```
+
 **default_network**="podman"

 The network name of the default network to attach pods to.
@ -355,8 +382,8 @@ default_subnet_pools = [
 **network_config_dir**="/etc/cni/net.d/"

 Path to the directory where network configuration files are located.
-For the CNI backend the default is "/etc/cni/net.d" as root
-and "$HOME/.config/cni/net.d" as rootless.
+For the CNI backend the default is __/etc/cni/net.d__ as root
+and __$HOME/.config/cni/net.d__ as rootless.
 For the netavark backend "/etc/containers/networks" is used as root
 and "$graphroot/networks" as rootless.

@ -462,12 +489,14 @@ with detailed information about the container.  Set to false by default.
 A is a list of directories which are used to search for helper binaries.

 The default paths on Linux are:
+
 - `/usr/local/libexec/podman`
 - `/usr/local/lib/podman`
 - `/usr/libexec/podman`
 - `/usr/lib/podman`

 The default paths on macOS are:
+
 - `/usr/local/opt/podman/libexec`
 -	`/opt/homebrew/bin`
 -	`/opt/homebrew/opt/podman/libexec`
@ -478,6 +507,7 @@ The default paths on macOS are:
 -	`/usr/lib/podman`

 The default path on Windows is:
+
 - `C:\Program Files\RedHat\Podman`

 **hooks_dir**=["/etc/containers/oci/hooks.d", ...]
@ -502,7 +532,7 @@ Not setting this field will fall back to containers/image defaults. (6)

 **image_volume_mode**="bind"

-Tells container engines how to handle the builtin image volumes.
+Tells container engines how to handle the built-in image volumes.

 * bind: An anonymous named volume will be  created  and  mounted into the container.
 * tmpfs: The volume is mounted onto the container as a tmpfs, which allows the users to create content that disappears when the container is stopped.
@ -512,18 +542,22 @@ Tells container engines how to handle the builtin image volumes.

 Infra (pause) container image command for pod infra containers. When running a
 pod, we start a `/pause` process in a container to hold open the namespaces
-associated with the pod. This container does nothing other then sleep,
-reserving the pods resources for the lifetime of the pod.
+associated with the pod. This container does nothing other than sleep,
+reserving the pod's resources for the lifetime of the pod.

 **infra_image**=""

 Infra (pause) container image for pod infra containers. When running a
 pod, we start a `pause` process in a container to hold open the namespaces
-associated with the pod. This container does nothing other then sleep,
-reserving the pods resources for the lifetime of the pod. By default container
-engines run a builtin container using the pause executable. If you want override
+associated with the pod. This container does nothing other than sleep,
+reserving the pod's resources for the lifetime of the pod. By default container
+engines run a built-in container using the pause executable. If you want override
 specify an image to pull.

+**kube_generate_type**="pod"
+
+Default Kubernetes kind/specification of the kubernetes yaml generated with the `podman kube generate` command. The possible options are `pod` and `deployment`.
+
 **lock_type**="shm"

 Specify the locking mechanism to use; valid values are "shm" and "file".
@ -595,6 +629,7 @@ Pull image before running or creating a container. The default is **missing**.
 - **never**: do not pull the image from the registry, use only the local version. Raise an error if the image is not present locally.

 **remote** = false
+
 Indicates whether the application should be running in remote mode. This flag modifies the
 --remote option on container engines. Setting the flag to true will default `podman --remote=true` for access to the remote Podman service.

@ -745,29 +780,45 @@ Environment variables like $HOME as well as complete paths are supported for
 the source and destination. An optional third field `:ro` can be used to
 tell the container engines to mount the volume readonly.

-On Mac, the default volumes are: `"/Users:/Users", "/private:/private", "/var/folders:/var/folders"`
+On Mac, the default volumes are:
+
+   [ "/Users:/Users", "/private:/private", "/var/folders:/var/folders" ]
+
+**provider**=""
+
+Virtualization provider to be used for running a podman-machine VM. Empty value
+is interpreted as the default provider for the current host OS. On Linux/Mac
+default is `QEMU` and on Windows it is `WSL`.

 # FILES

 **containers.conf**

-Distributions often provide a `/usr/share/containers/containers.conf` file to
-define default container configuration. Administrators can override fields in
-this file by creating `/etc/containers/containers.conf` to specify their own
-configuration. Rootless users can further override fields in the config by
-creating a config file stored in the `$HOME/.config/containers/containers.conf` file.
+Distributions often provide a __/usr/share/containers/containers.conf__ file to
+provide a default configuration. Administrators can override fields in this
+file by creating __/etc/containers/containers.conf__ to specify their own
+configuration. They may also drop `.conf` files in
+__/etc/containers/containers.conf.d__ which will be loaded in alphanumeric order.
+Rootless users can further override fields in the config by creating a config
+file stored in the __$HOME/.config/containers/containers.conf__ file or __.conf__ files in __$HOME/.config/containers/containers.conf.d__.

-If the `CONTAINERS_CONF` path environment variable is set, just
-this path will be used. This is primarily used for testing.
+If the `CONTAINERS_CONF` environment variable is set, all system and user
+config files are ignored and only the specified config file will be loaded.

-Fields specified in the containers.conf file override the default options, as
-well as options in previously read containers.conf files.
+If the `CONTAINERS_CONF_OVERRIDE` path environment variable is set, the config
+file will be loaded last even when `CONTAINERS_CONF` is set.
+
+The values of both environment variables may be absolute or relative paths, for
+instance, `CONTAINERS_CONF=/tmp/my_containers.conf`.
+
+Fields specified in a containers.conf file override the default options, as
+well as options in previously loaded containers.conf files.

 **storage.conf**

 The `/etc/containers/storage.conf` file is the default storage configuration file.
 Rootless users can override fields in the storage config by creating
-`$HOME/.config/containers/storage.conf`.
+__$HOME/.config/containers/storage.conf__.

 If the `CONTAINERS_STORAGE_CONF` path environment variable is set, this path
 is used for the storage.conf file rather than the default.
--- a/pyxis.sh
+++ b/pyxis.sh
@ -24,6 +24,7 @@ while [ $IDX -lt ${#lines[@]} ]; do
  RELEASE=`echo ${lines[$IDX+4]} | tr -d '"'`
  if [ "$PUBLISHED" == "true" ] &&
     [ "$RELEASE" == "Generally Available" ] &&
+     [ ! -z "$REPOSITORY" ] &&
     [  $REPOSITORY != \"\" ] &&
     [[ $REPOSITORY != *[@:]* ]] &&
     [[ $REPOSITORY != *[* ]] &&
--- a/shortnames.conf
+++ b/shortnames.conf
@ -2,6 +2,8 @@
  # almalinux
  "almalinux" = "docker.io/library/almalinux"
  "almalinux-minimal" = "docker.io/library/almalinux-minimal"
+  # Amazon Linux
+  "amazonlinux" = "public.ecr.aws/amazonlinux/amazonlinux"
  # Arch Linux
  "archlinux" = "docker.io/library/archlinux"
  # centos
--- a/storage.conf
+++ b/storage.conf
@ -34,6 +34,8 @@ graphroot = "/var/lib/containers/storage"

 # Transient store mode makes all container metadata be saved in temporary storage
 # (i.e. runroot above). This is faster, but doesn't persist across reboots.
+# Additional garbage collection must also be performed at boot-time, so this
+# option should remain disabled in most configurations.
 # transient_store = true

 [storage.options]