[podman-6.0] Backports for podman 6.0.1

common/docs/containers.conf.5.md

@@ -496,6 +496,10 @@ Valid options are `rootlessport` (default) and `pasta`.
 which preserves the original source IP address inside the container.
 The `pasta` option is **experimental** and subject to change.
 
+**Important:** This option must only be changed when no containers are running.
+Switching while containers are active leads to port-forwarding rules being leaked
+or cleanup failures because the running netns was created with the previous setting.
+
 **network_config_dir**="/etc/containers/networks"
 
 Path to the directory where network configuration files are located.

common/libnetwork/internal/rootlessnetns/netns_freebsd.go

@@ -31,3 +31,7 @@ func (n *Netns) Run(lock *lockfile.LockFile, toRun func() error) error {
 func (n *Netns) Info() *types.RootlessNetnsInfo {
 	return &types.RootlessNetnsInfo{}
 }
+
+func (n *Netns) PestoSocketPath() string {
+	return ""
+}

common/libnetwork/internal/rootlessnetns/netns_linux.go

@@ -205,10 +205,8 @@ func (n *Netns) setupPasta(nsPath string) error {
 
 	extraOpts := []string{"--pid", pidPath}
 
-	var socketPath string
 	if n.config.Network.RootlessPortForwarder == config.RootlessPortForwarderPasta {
-		socketPath = n.getPath(pestoSocketFile)
-		extraOpts = append(extraOpts, "-c", socketPath)
+		extraOpts = append(extraOpts, "-c", n.getPath(pestoSocketFile))
 	}
 
 	pastaOpts := pasta.SetupOptions{
@@ -248,10 +246,9 @@ func (n *Netns) setupPasta(nsPath string) error {
 	}
 
 	n.info = &types.RootlessNetnsInfo{
-		IPAddresses:     res.IPAddresses,
-		DnsForwardIps:   res.DNSForwardIPs,
-		MapGuestIps:     res.MapGuestAddrIPs,
-		PestoSocketPath: socketPath,
+		IPAddresses:   res.IPAddresses,
+		DnsForwardIps: res.DNSForwardIPs,
+		MapGuestIps:   res.MapGuestAddrIPs,
 	}
 	if err := n.serializeInfo(); err != nil {
 		return wrapError("serialize info", err)
@@ -632,6 +629,11 @@ func (n *Netns) Info() *types.RootlessNetnsInfo {
 	return n.info
 }
 
+// PestoSocketPath returns the path to the pesto control socket.
+func (n *Netns) PestoSocketPath() string {
+	return n.getPath(pestoSocketFile)
+}
+
 func refCount(dir string, inc int) (int, error) {
 	file := filepath.Join(dir, refCountFile)
 	content, err := os.ReadFile(file)

common/libnetwork/netavark/run.go

@@ -215,3 +215,11 @@ func (n *netavarkNetwork) RootlessNetnsInfo() (*types.RootlessNetnsInfo, error)
 	}
 	return n.rootlessNetns.Info(), nil
 }
+
+func (n *netavarkNetwork) PestoSocketPath() string {
+	if n.rootlessNetns == nil {
+		logrus.Debug("PestoSocketPath: rootlessNetns is nil")
+		return ""
+	}
+	return n.rootlessNetns.PestoSocketPath()
+}

common/libnetwork/types/network.go

@@ -36,6 +36,10 @@ type ContainerNetwork interface {
 	// Only used as rootless and should return an error as root.
 	RootlessNetnsInfo() (*RootlessNetnsInfo, error)
 
+	// PestoSocketPath returns the path to the pesto control socket
+	// for dynamic port forwarding. Empty when not available.
+	PestoSocketPath() string
+
 	// Drivers will return the list of supported network drivers
 	// for this interface.
 	Drivers() []string
@@ -377,9 +381,6 @@ type RootlessNetnsInfo struct {
 	DnsForwardIps []string
 	// MapGuestIps should be used for the host.containers.internal entry when set
 	MapGuestIps []string
-	// PestoSocketPath is the path to the pasta control socket for dynamic
-	// port forwarding via pesto. Empty when pasta was started without -c.
-	PestoSocketPath string
 }
 
 // FilterFunc can be passed to NetworkList to filter the networks.

common/pkg/config/config.go

@@ -635,6 +635,10 @@ type NetworkConfig struct {
 	// bridge networks. Valid values are RootlessPortForwarderRootlessport
 	// (default, userspace TCP/UDP proxy) and RootlessPortForwarderPasta
 	// (experimental, pasta's kernel splice preserving the original source IP).
+	//
+	// Must only be changed when no containers are running. Switching while
+	// containers are active leads to leaked port-forwarding rules or cleanup
+	// failures.
 	RootlessPortForwarder string `toml:"rootless_port_forwarder,omitempty"`
 }
 

common/pkg/config/containers.conf

@@ -416,6 +416,11 @@ default_sysctls = [
 # via kernel splice, which preserves the original source IP address inside the
 # container. This option is experimental and subject to change.
 #
+# Important: This option must only be changed when no containers are running.
+# Switching while containers are active leads to port-forwarding rules being
+# leaked or cleanup failures because the running netns was created with the
+# previous setting.
+#
 #rootless_port_forwarder = "rootlessport"
 
 # Path to the directory where network configuration files are located.

common/rpm/00-storage-rootful.conf

@@ -0,0 +1,6 @@
+[storage.options]
+additionalimagestores = ["/usr/lib/containers/storage"]
+
+[storage.options.overlay]
+# mountopt specifies comma separated list of extra mount options
+mountopt = "nodev,metacopy=on"

common/rpm/00-storage-rootless.conf

@@ -0,0 +1,4 @@
+[storage.options.overlay]
+# mountopt specifies comma separated list of extra mount options
+# Note unlike the rootful config we cannot use metacopy=on as rootless user
+mountopt = "nodev"

common/rpm/00-storage.conf

@@ -1,6 +1,2 @@
 [storage]
 driver = "overlay"
-
-[storage.options.overlay]
-# mountopt specifies comma separated list of extra mount options
-mountopt = "nodev,metacopy=on"

common/rpm/containers-common.spec

@@ -114,7 +114,8 @@ install -Dp -m0644 storage/storage.conf %{buildroot}%{_datadir}/containers/stora
 # install custom vendor overwrites
 install -Dp -m0644 common/rpm/00-containers.conf %{buildroot}%{_datadir}/containers/containers.conf.d/00-vendor.conf
 install -Dp -m0644 common/rpm/00-storage.conf %{buildroot}%{_datadir}/containers/storage.conf.d/00-vendor.conf
-install -Dp -m0644 common/rpm/00-storage-additional-store.conf %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf
+install -Dp -m0644 common/rpm/00-storage-rootful.conf %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf
+install -Dp -m0644 common/rpm/00-storage-rootless.conf %{buildroot}%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf
 
 %if %{defined fedora}
 install -Dp -m0644 common/rpm/00-fedora-registries.conf %{buildroot}%{_datadir}/containers/registries.conf.d/00-vendor.conf
@@ -216,7 +217,9 @@ ln -s ../../../..%{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/
 %dir %{_datadir}/containers/storage.conf.d
 %{_datadir}/containers/storage.conf.d/00-vendor.conf
 %dir %{_datadir}/containers/storage.rootful.conf.d
-%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf
+%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf
+%dir %{_datadir}/containers/storage.rootless.conf.d
+%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf
 %dir %{_datadir}/rhel
 %dir %{_datadir}/rhel/secrets
 %{_datadir}/rhel/secrets/*