Affected by GO-2024-3042 and 1 other vulnerabilities

GO-2024-3042: Podman vulnerable to memory-based denial of service in github.com/containers/podman

GO-2025-3961: Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

compat

package

v5.7.0-rc1 Latest Latest Go to latest Published: Oct 24, 2025 License: Apache-2.0 Imports: 98 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/containers/podman

Links

Open Source Insights

Documentation ¶

Rendered for

Index ¶

func Archive(w http.ResponseWriter, r *http.Request)
func AttachContainer(w http.ResponseWriter, r *http.Request)
func Auth(w http.ResponseWriter, r *http.Request)
func BuildImage(w http.ResponseWriter, r *http.Request)
func Changes(w http.ResponseWriter, r *http.Request)
func CommitContainer(w http.ResponseWriter, r *http.Request)
func Connect(w http.ResponseWriter, r *http.Request)
func CreateContainer(w http.ResponseWriter, r *http.Request)
func CreateImageFromImage(w http.ResponseWriter, r *http.Request)
func CreateImageFromSrc(w http.ResponseWriter, r *http.Request)
func CreateNetwork(w http.ResponseWriter, r *http.Request)
func CreateSecret(w http.ResponseWriter, r *http.Request)
func CreateVolume(w http.ResponseWriter, r *http.Request)
func Disconnect(w http.ResponseWriter, r *http.Request)
func ExecCreateHandler(w http.ResponseWriter, r *http.Request)
func ExecInspectHandler(w http.ResponseWriter, r *http.Request)
func ExecRemoveHandler(w http.ResponseWriter, r *http.Request)
func ExecStartHandler(w http.ResponseWriter, r *http.Request)
func ExportContainer(w http.ResponseWriter, r *http.Request)
func ExportImage(w http.ResponseWriter, r *http.Request)
func ExportImages(w http.ResponseWriter, r *http.Request)
func GetContainer(w http.ResponseWriter, r *http.Request)
func GetDiskUsage(w http.ResponseWriter, r *http.Request)
func GetEvents(w http.ResponseWriter, r *http.Request)
func GetImage(w http.ResponseWriter, r *http.Request)
func GetImages(w http.ResponseWriter, r *http.Request)
func GetInfo(w http.ResponseWriter, r *http.Request)
func HistoryImage(w http.ResponseWriter, r *http.Request)
func InspectNetwork(w http.ResponseWriter, r *http.Request)
func InspectSecret(w http.ResponseWriter, r *http.Request)
func InspectVolume(w http.ResponseWriter, r *http.Request)
func KillContainer(w http.ResponseWriter, r *http.Request)
func LibpodToContainer(l *libpod.Container, sz bool) (*handlers.Container, error)
func LibpodToContainerJSON(l *libpod.Container, sz bool) (*container.InspectResponse, error)
func ListContainers(w http.ResponseWriter, r *http.Request)
func ListNetworks(w http.ResponseWriter, r *http.Request)
func ListSecrets(w http.ResponseWriter, r *http.Request)
func ListVolumes(w http.ResponseWriter, r *http.Request)
func LoadImages(w http.ResponseWriter, r *http.Request)
func LocalBuildImage(w http.ResponseWriter, r *http.Request)
func LogsFromContainer(w http.ResponseWriter, r *http.Request)
func PauseContainer(w http.ResponseWriter, r *http.Request)
func Ping(w http.ResponseWriter, r *http.Request)
func Prune(w http.ResponseWriter, r *http.Request)
func PruneContainers(w http.ResponseWriter, r *http.Request)
func PruneContainersHelper(r *http.Request, filterFuncs []libpod.ContainerFilter) ([]*reports.PruneReport, error)
func PruneImages(w http.ResponseWriter, r *http.Request)
func PruneVolumes(w http.ResponseWriter, r *http.Request)
func PushImage(w http.ResponseWriter, r *http.Request)
func RemoveContainer(w http.ResponseWriter, r *http.Request)
func RemoveImage(w http.ResponseWriter, r *http.Request)
func RemoveNetwork(w http.ResponseWriter, r *http.Request)
func RemoveSecret(w http.ResponseWriter, r *http.Request)
func RemoveVolume(w http.ResponseWriter, r *http.Request)
func RenameContainer(w http.ResponseWriter, r *http.Request)
func ResizeTTY(w http.ResponseWriter, r *http.Request)
func RestartContainer(w http.ResponseWriter, r *http.Request)
func SaveFromBody(f *os.File, r *http.Request) error
func SearchImages(w http.ResponseWriter, r *http.Request)
func StartContainer(w http.ResponseWriter, r *http.Request)
func StatsContainer(w http.ResponseWriter, r *http.Request)
func StopContainer(w http.ResponseWriter, r *http.Request)
func TagImage(w http.ResponseWriter, r *http.Request)
func TopContainer(w http.ResponseWriter, r *http.Request)
func UnpauseContainer(w http.ResponseWriter, r *http.Request)
func UnsupportedHandler(w http.ResponseWriter, r *http.Request)
func UpdateContainer(w http.ResponseWriter, r *http.Request)
func UpdateSecret(w http.ResponseWriter, _ *http.Request)
func VersionHandler(w http.ResponseWriter, r *http.Request)
func WaitContainer(w http.ResponseWriter, r *http.Request)
type BuildContext
type BuildQuery
type CPUStats
type DockerStatsJSON
type Stats
type StatsJSON

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Archive ¶

func Archive(w http.ResponseWriter, r *http.Request)

func AttachContainer ¶

func AttachContainer(w http.ResponseWriter, r *http.Request)

func Auth ¶

func Auth(w http.ResponseWriter, r *http.Request)

func BuildImage ¶

func BuildImage(w http.ResponseWriter, r *http.Request)

BuildImage handles HTTP requests for building container images using the Docker-compatible API.

Extracts build contexts from the request body (tar/multipart), processes build parameters, executes the build using buildah, and streams output back to the client.

func Changes ¶

func Changes(w http.ResponseWriter, r *http.Request)

func CommitContainer ¶

func CommitContainer(w http.ResponseWriter, r *http.Request)

func CreateContainer ¶

func CreateContainer(w http.ResponseWriter, r *http.Request)

func CreateImageFromImage ¶

func CreateImageFromImage(w http.ResponseWriter, r *http.Request)

func CreateImageFromSrc ¶

func CreateImageFromSrc(w http.ResponseWriter, r *http.Request)

func CreateNetwork ¶

func CreateNetwork(w http.ResponseWriter, r *http.Request)

func CreateSecret ¶

func CreateSecret(w http.ResponseWriter, r *http.Request)

func CreateVolume ¶

func CreateVolume(w http.ResponseWriter, r *http.Request)

func Disconnect ¶

func Disconnect(w http.ResponseWriter, r *http.Request)

Disconnect removes a container from a network

func ExecCreateHandler ¶

func ExecCreateHandler(w http.ResponseWriter, r *http.Request)

ExecCreateHandler creates an exec session for a given container.

func ExecInspectHandler ¶

func ExecInspectHandler(w http.ResponseWriter, r *http.Request)

ExecInspectHandler inspects a given exec session.

func ExecRemoveHandler ¶

func ExecRemoveHandler(w http.ResponseWriter, r *http.Request)

ExecRemoveHandler removes a exec session.

func ExecStartHandler ¶

func ExecStartHandler(w http.ResponseWriter, r *http.Request)

ExecStartHandler runs a given exec session.

func ExportContainer ¶

func ExportContainer(w http.ResponseWriter, r *http.Request)

func ExportImage ¶

func ExportImage(w http.ResponseWriter, r *http.Request)

func ExportImages ¶

func ExportImages(w http.ResponseWriter, r *http.Request)

func GetContainer ¶

func GetContainer(w http.ResponseWriter, r *http.Request)

func GetDiskUsage ¶

func GetDiskUsage(w http.ResponseWriter, r *http.Request)

func GetEvents ¶

func GetEvents(w http.ResponseWriter, r *http.Request)

GetEvents endpoint serves both the docker-compatible one and the new libpod one

func GetImage ¶

func GetImage(w http.ResponseWriter, r *http.Request)

func GetImages ¶

func GetImages(w http.ResponseWriter, r *http.Request)

func GetInfo ¶

func GetInfo(w http.ResponseWriter, r *http.Request)

func HistoryImage ¶

func HistoryImage(w http.ResponseWriter, r *http.Request)

func InspectNetwork ¶

func InspectNetwork(w http.ResponseWriter, r *http.Request)

func InspectSecret ¶

func InspectSecret(w http.ResponseWriter, r *http.Request)

func InspectVolume ¶

func InspectVolume(w http.ResponseWriter, r *http.Request)

func KillContainer ¶

func KillContainer(w http.ResponseWriter, r *http.Request)

func LibpodToContainer ¶

func LibpodToContainer(l *libpod.Container, sz bool) (*handlers.Container, error)

func LibpodToContainerJSON ¶

func LibpodToContainerJSON(l *libpod.Container, sz bool) (*container.InspectResponse, error)

func ListContainers ¶

func ListContainers(w http.ResponseWriter, r *http.Request)

func ListNetworks ¶

func ListNetworks(w http.ResponseWriter, r *http.Request)

func ListSecrets ¶

func ListSecrets(w http.ResponseWriter, r *http.Request)

func ListVolumes ¶

func ListVolumes(w http.ResponseWriter, r *http.Request)

func LoadImages ¶

func LoadImages(w http.ResponseWriter, r *http.Request)

func LocalBuildImage ¶

func LocalBuildImage(w http.ResponseWriter, r *http.Request)

LocalBuildImage handles HTTP requests for building container images using the Local API.

Uses localcontextdir and additionalbuildcontexts query parameters to specify build contexts from the server's local filesystem. All paths must be absolute and exist on the server. Processes build parameters, executes the build using buildah, and streams output to the client.

func LogsFromContainer ¶

func LogsFromContainer(w http.ResponseWriter, r *http.Request)

func PauseContainer ¶

func PauseContainer(w http.ResponseWriter, r *http.Request)

func Ping ¶

func Ping(w http.ResponseWriter, r *http.Request)

Ping returns headers to client about the service

This handler must always be the same for the compatibility and libpod URL trees! Clients will use the Header availability to test which backend engine is in use. Note: Additionally handler supports GET and HEAD methods

func Prune ¶

func Prune(w http.ResponseWriter, r *http.Request)

Prune removes unused networks

func PruneContainers ¶

func PruneContainers(w http.ResponseWriter, r *http.Request)

func PruneContainersHelper ¶

func PruneContainersHelper(r *http.Request, filterFuncs []libpod.ContainerFilter) ([]*reports.PruneReport, error)

func PruneImages ¶

func PruneImages(w http.ResponseWriter, r *http.Request)

func PruneVolumes ¶

func PruneVolumes(w http.ResponseWriter, r *http.Request)

func PushImage ¶

func PushImage(w http.ResponseWriter, r *http.Request)

PushImage is the handler for the compat http endpoint for pushing images.

func RemoveContainer ¶

func RemoveContainer(w http.ResponseWriter, r *http.Request)

func RemoveImage ¶

func RemoveImage(w http.ResponseWriter, r *http.Request)

func RemoveNetwork ¶

func RemoveNetwork(w http.ResponseWriter, r *http.Request)

func RemoveSecret ¶

func RemoveSecret(w http.ResponseWriter, r *http.Request)

func RemoveVolume ¶

func RemoveVolume(w http.ResponseWriter, r *http.Request)

func RenameContainer ¶

func RenameContainer(w http.ResponseWriter, r *http.Request)

func ResizeTTY ¶

func ResizeTTY(w http.ResponseWriter, r *http.Request)

func RestartContainer ¶

func RestartContainer(w http.ResponseWriter, r *http.Request)

func SaveFromBody ¶

func SaveFromBody(f *os.File, r *http.Request) error

func SearchImages ¶

func SearchImages(w http.ResponseWriter, r *http.Request)

func StartContainer ¶

func StartContainer(w http.ResponseWriter, r *http.Request)

func StatsContainer ¶

func StatsContainer(w http.ResponseWriter, r *http.Request)

func StopContainer ¶

func StopContainer(w http.ResponseWriter, r *http.Request)

func TagImage ¶

func TagImage(w http.ResponseWriter, r *http.Request)

func TopContainer ¶

func TopContainer(w http.ResponseWriter, r *http.Request)

func UnpauseContainer ¶

func UnpauseContainer(w http.ResponseWriter, r *http.Request)

func UnsupportedHandler ¶

func UnsupportedHandler(w http.ResponseWriter, r *http.Request)

func UpdateContainer ¶ added in v5.1.0

func UpdateContainer(w http.ResponseWriter, r *http.Request)

func UpdateSecret ¶

func UpdateSecret(w http.ResponseWriter, _ *http.Request)

func VersionHandler ¶

func VersionHandler(w http.ResponseWriter, r *http.Request)

func WaitContainer ¶

func WaitContainer(w http.ResponseWriter, r *http.Request)

Types ¶

type BuildContext ¶

type BuildContext struct {
	ContextDirectory        string
	AdditionalBuildContexts map[string]*buildahDefine.AdditionalBuildContext
	ContainerFiles          []string
	IgnoreFile              string
}

BuildContext represents processed build context and metadata for container image builds.

type BuildQuery ¶

type BuildQuery struct {
	AddHosts                string             `schema:"extrahosts"`
	AdditionalCapabilities  string             `schema:"addcaps"`
	AdditionalBuildContexts string             `schema:"additionalbuildcontexts"`
	AllPlatforms            bool               `schema:"allplatforms"`
	Annotations             string             `schema:"annotations"`
	AppArmor                string             `schema:"apparmor"`
	BuildArgs               string             `schema:"buildargs"`
	CacheFrom               string             `schema:"cachefrom"`
	CacheTo                 string             `schema:"cacheto"`
	CacheTTL                string             `schema:"cachettl"`
	CgroupParent            string             `schema:"cgroupparent"`
	CompatVolumes           bool               `schema:"compatvolumes"`
	Compression             uint64             `schema:"compression"`
	ConfigureNetwork        string             `schema:"networkmode"`
	CPPFlags                string             `schema:"cppflags"`
	CpuPeriod               uint64             `schema:"cpuperiod"`
	CpuQuota                int64              `schema:"cpuquota"`
	CpuSetCpus              string             `schema:"cpusetcpus"`
	CpuSetMems              string             `schema:"cpusetmems"`
	CpuShares               uint64             `schema:"cpushares"`
	CreatedAnnotation       types.OptionalBool `schema:"createdannotation"`
	DNSOptions              string             `schema:"dnsoptions"`
	DNSSearch               string             `schema:"dnssearch"`
	DNSServers              string             `schema:"dnsservers"`
	Devices                 string             `schema:"devices"`
	Dockerfile              string             `schema:"dockerfile"`
	DropCapabilities        string             `schema:"dropcaps"`
	Envs                    []string           `schema:"setenv"`
	Excludes                string             `schema:"excludes"`
	ForceRm                 bool               `schema:"forcerm"`
	From                    string             `schema:"from"`
	GroupAdd                []string           `schema:"groupadd"`
	HTTPProxy               bool               `schema:"httpproxy"`
	IDMappingOptions        string             `schema:"idmappingoptions"`
	IdentityLabel           bool               `schema:"identitylabel"`
	Ignore                  bool               `schema:"ignore"`
	InheritLabels           types.OptionalBool `schema:"inheritlabels"`
	InheritAnnotations      types.OptionalBool `schema:"inheritannotations"`
	Isolation               string             `schema:"isolation"`
	Jobs                    int                `schema:"jobs"`
	LabelOpts               string             `schema:"labelopts"`
	Labels                  string             `schema:"labels"`
	LayerLabels             []string           `schema:"layerLabel"`
	Layers                  bool               `schema:"layers"`
	LogRusage               bool               `schema:"rusage"`
	Manifest                string             `schema:"manifest"`
	MemSwap                 int64              `schema:"memswap"`
	Memory                  int64              `schema:"memory"`
	NamespaceOptions        string             `schema:"nsoptions"`
	NoCache                 bool               `schema:"nocache"`
	NoHosts                 bool               `schema:"nohosts"`
	OmitHistory             bool               `schema:"omithistory"`
	OSFeatures              []string           `schema:"osfeature"`
	OSVersion               string             `schema:"osversion"`
	OutputFormat            string             `schema:"outputformat"`
	Platform                []string           `schema:"platform"`
	Pull                    bool               `schema:"pull"`
	PullPolicy              string             `schema:"pullpolicy"`
	Quiet                   bool               `schema:"q"`
	Registry                string             `schema:"registry"`
	Rm                      bool               `schema:"rm"`
	RusageLogFile           string             `schema:"rusagelogfile"`
	Remote                  string             `schema:"remote"`
	RewriteTimestamp        bool               `schema:"rewritetimestamp"`
	Retry                   int                `schema:"retry"`
	RetryDelay              string             `schema:"retry-delay"`
	Seccomp                 string             `schema:"seccomp"`
	Secrets                 string             `schema:"secrets"`
	SecurityOpt             string             `schema:"securityopt"`
	ShmSize                 int                `schema:"shmsize"`
	SkipUnusedStages        bool               `schema:"skipunusedstages"`
	SourceDateEpoch         int64              `schema:"sourcedateepoch"`
	Squash                  bool               `schema:"squash"`
	TLSVerify               bool               `schema:"tlsVerify"`
	Tags                    []string           `schema:"t"`
	Target                  string             `schema:"target"`
	Timestamp               int64              `schema:"timestamp"`
	Ulimits                 string             `schema:"ulimits"`
	UnsetEnvs               []string           `schema:"unsetenv"`
	UnsetLabels             []string           `schema:"unsetlabel"`
	UnsetAnnotations        []string           `schema:"unsetannotation"`
	Volumes                 []string           `schema:"volume"`
	SBOMOutput              string             `schema:"sbom-output"`
	SBOMPURLOutput          string             `schema:"sbom-purl-output"`
	ImageSBOMOutput         string             `schema:"sbom-image-output"`
	ImageSBOMPURLOutput     string             `schema:"sbom-image-purl-output"`
	ImageSBOM               string             `schema:"sbom-scanner-image"`
	SBOMCommands            string             `schema:"sbom-scanner-command"`
	SBOMMergeStrategy       string             `schema:"sbom-merge-strategy"`
}

BuildQuery represents query parameters for the container image build API endpoint. Uses struct tags to map HTTP query parameters to Go fields for automatic parsing.

type CPUStats ¶

type CPUStats struct {
	// CPU Usage. Linux and Windows.
	CPUUsage container.CPUUsage `json:"cpu_usage"`

	// System Usage. Linux only.
	SystemUsage uint64 `json:"system_cpu_usage,omitempty"`

	// Online CPUs. Linux only.
	OnlineCPUs uint32 `json:"online_cpus,omitempty"`

	// Usage of CPU in %. Linux only.
	CPU float64 `json:"cpu"`

	// Throttling Data. Linux only.
	ThrottlingData container.ThrottlingData `json:"throttling_data"`
}

CPUStats aggregates and wraps all CPU related info of container

type DockerStatsJSON ¶

type DockerStatsJSON struct {
	Stats

	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
	// Networks request version >=1.21
	Networks map[string]container.NetworkStats `json:"networks,omitempty"`
}

DockerStatsJSON is the same as StatsJSON except for the lowercase "id" in the JSON tag. This is needed for docker compat but we should not change the libpod API output for backwards compat reasons.

type Stats ¶

type Stats struct {
	// Common stats
	Read    time.Time `json:"read"`
	PreRead time.Time `json:"preread"`

	// Linux specific stats, not populated on Windows.
	PidsStats  container.PidsStats  `json:"pids_stats"`
	BlkioStats container.BlkioStats `json:"blkio_stats"`

	// Windows specific stats, not populated on Linux.
	NumProcs     uint32                 `json:"num_procs"`
	StorageStats container.StorageStats `json:"storage_stats"`

	// Shared stats
	CPUStats    CPUStats              `json:"cpu_stats"`
	PreCPUStats CPUStats              `json:"precpu_stats"` // "Pre"="Previous"
	MemoryStats container.MemoryStats `json:"memory_stats"`
}

Stats is Ultimate struct aggregating all types of stats of one container

type StatsJSON ¶

type StatsJSON struct {
	Stats

	Name string `json:"name,omitempty"`
	ID   string `json:"Id,omitempty"`

	// Networks request version >=1.21
	Networks map[string]container.NetworkStats `json:"networks,omitempty"`
}

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL