Allow passing the OCI runtime an empty command

[albertofaria]

Some OCI runtimes (cf. [1]) may tolerate container images that don't specify an entrypoint together with no entrypoint being specified in the command line. In those cases, it's annoying for the user to have to pass a "" argument to podman.

[1] https://github.com/containers/crun-vm

Does this PR introduce a user-facing change?

podman-create and podman-run no longer require specifying an entrypoint on the command line when the container image does not define one. In this case, an empty command will be passed to the OCI runtime, and the resulting behavior is runtime-specific.

[rhatdan]

You need to add [NO NEW TESTS NEEDED] or add a test to allow tests to run.

What does crun report if you don't have an entrypoint or cmd in the image?

[rhatdan]

/approve
LGTM

[vrothberg]

You need to add [NO NEW TESTS NEEDED] or add a test to allow tests to run.

Since it's a new behavior, we really need a test.

@giuseppe PTAL

[vrothberg]

I am not sure how the runtimes would deal with it. Assuming we go forward, a debug log may be appropriate to leave some breadcrumbs.

[giuseppe]

could we just use a dummy entrypoint for the image?

With this change, the error code is more difficult to understand:

$ bin/podman --runtime crun run --entrypoint="" --rm -ti alpine 
{"msg":"executable path not specified","level":"error","time":"2024-01-22T11:20:52.470646Z"}
$ bin/podman --runtime runc run --entrypoint="" --rm -ti alpine 
Error: OCI runtime error: runc: runc create failed: args must not be empty

The nice thing about catching it early in Podman is that we can give a suggestion about either the CMD or ENTRYPOINT being empty, which is not known to the OCI runtime:

$ podman run --entrypoint="" --rm -ti alpine 
Error: no command or entrypoint provided, and no CMD or ENTRYPOINT from image

[rhatdan]

Would it make sense to default the entrypoint to "/bin/sh -c" for this case rather then failing, with a Debug message stating the default?

[vrothberg]

Would it make sense to default the entrypoint to "/bin/sh -c" for this case rather then failing, with a Debug message stating the default?

Let's figure out what Docker does. We aim at being compatible but for sure can punch some holes where needed.

[albertofaria]

Would it make sense to default the entrypoint to "/bin/sh -c" for this case rather then failing, with a Debug message stating the default?

Let's figure out what Docker does. We aim at being compatible but for sure can punch some holes where needed.

Docker also complains when there is no entrypoint: docker: Error response from daemon: No command specified.

[rhatdan]

I think it is fine to be compatibile with Docker, but we can do better in this case. Bottom line, I don't want a failure if running an OCI Runtime that does not require a command and a command makes little sense when running a image.

podman run --runtime crun-vm --rootfs PATHTOQCOW "" sucks.
podman run --runtime crun-vm --rootfs PATHTOQCOW is much better.
If I have to do
docker run --runtime crun-vm --rootfs PATHTOQCOW codx not work.

[albertofaria]

You need to add [NO NEW TESTS NEEDED] or add a test to allow tests to run.

Since it's a new behavior, we really need a test.

Are we talking of unit tests or integration tests? Where should this test go?

[rhatdan]

I would test with system tests.
tests/system ...

Basically build an image with Command="" and Entrypoint="" then try to run it.

[albertofaria]

This new version passes the OCI runtime an empty string entrypoint instead of no entrypoint at all, so that the resulting error message is the same as if an inexistent entrypoint was set.

[TomSweeneyRedHat]

Changes LGTM, but the tests are very red.

[vrothberg]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: albertofaria, rhatdan, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[albertofaria]

The single test failure seems to be transient.

[vrothberg]

The single test failure seems to be transient.

Yes, that job flakes a lot at the moment. I restarted it ✔️

[rhatdan]

/lgtm