magges/unraid-podman
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

Browse Source 
- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
magges
2026-07-12 11:51:17 +00:00
co-authored by Claude Sonnet 5
parent 5944ddf722
commit 5b47b4cc0a
33 changed files with 1075 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webui/plugins/podman/ajax/compose.php
+20 -5
View File
@@ -121,8 +121,19 @@ function compose_status(string $composeDir, string $project): string
if ($result['exitCode'] !== 0) {
return 'unknown';
}
$decoded = json_decode($result['output'], true);
return (is_array($decoded) && count($decoded) > 0) ? 'up' : 'down';
// `podman compose ps --format json` emits one JSON object PER LINE
// (JSONL), not a single JSON array — decoding the whole blob in one
// json_decode() call fails silently (-> null) as soon as a project has
// more than one service (verified live with a 2-service project).
// stdout only, too: the "external compose provider" banner goes to
// stderr and would otherwise corrupt this either way.
$running = 0;
foreach (explode("\n", trim($result['stdout'])) as $line) {
if (trim($line) !== '' && is_array(json_decode($line, true))) {
$running++;
}
}
return $running > 0 ? 'up' : 'down';
}
function compose_read(string $composeDir, string $project): string
@@ -155,7 +166,7 @@ function compose_run(string $composeDir, string $project, array $subcommand): ar
* surface even though $project has already been validated above too).
*
* @param array<int,string> $subcommand
* @return array{exitCode:int,output:string}
* @return array{exitCode:int,stdout:string,output:string}
*/
function run_compose_command(string $composeDir, string $project, array $subcommand, int $timeoutSeconds): array
{
@@ -165,7 +176,7 @@ function run_compose_command(string $composeDir, string $project, array $subcomm
$descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
$process = proc_open($argv, $descriptors, $pipes, $composeDir . '/' . $project);
if (!is_resource($process)) {
return ['exitCode' => 127, 'output' => 'Could not start podman compose process'];
return ['exitCode' => 127, 'stdout' => '', 'output' => 'Could not start podman compose process'];
}
stream_set_timeout($pipes[1], $timeoutSeconds);
@@ -175,5 +186,9 @@ function run_compose_command(string $composeDir, string $project, array $subcomm
fclose($pipes[2]);
$exitCode = proc_close($process);
return ['exitCode' => $exitCode, 'output' => trim($stdout . $stderr)];
// 'stdout' (raw) for callers that need to parse machine-readable
// output (e.g. compose_status()'s JSON); 'output' (combined,
// trimmed) for human-facing success/error messages, where seeing
// podman's own stderr banner/warnings is actually useful context.
return ['exitCode' => $exitCode, 'stdout' => $stdout, 'output' => trim($stdout . $stderr)];
}
webui/plugins/podman/ajax/containers.php
+124
View File
@@ -14,6 +14,11 @@
* restart POST {"id": "...", "timeout": 10}
* remove POST {"id": "...", "force": false}
* logs GET (&id=...&tail=200) -> plain text
* create POST {"image": "...", "name": "...", "networkMode": "bridge"|"host"|"none"|"<custom-network-name>",
* "ports": [{"hostPort": 8080, "containerPort": 80, "protocol": "tcp"}],
* "volumes": [{"kind": "named"|"path", "source": "myvol"|"/mnt/...", "containerPath": "/data"}],
* "env": [{"key": "...", "value": "..."}], "restartPolicy": "no",
* "privileged": false, "startAfterCreate": true}
*/
declare(strict_types=1);
@@ -68,10 +73,129 @@ switch ($action) {
podman_json_response(['status' => 'removed']);
break;
case 'create':
$body = podman_read_json_body();
$image = trim((string) ($body['image'] ?? ''));
if ($image === '') {
podman_json_error('Missing image in request body', 400);
}
$spec = build_container_spec($image, $body);
// Unlike `podman run`, /containers/create does NOT auto-pull a
// missing image — it fails outright with a 404 "no such image"
// (found by live-testing the Create Container form against a
// freshly-typed image reference that wasn't pulled yet). Retry
// once after an explicit pull rather than always pulling
// up-front, so re-creating with an image the user already has
// stays fast and offline-friendly.
try {
$id = $client->createContainer($spec);
} catch (PodmanApiException $e) {
if ($e->httpStatus !== 404) {
throw $e;
}
$client->pullImage($image);
$id = $client->createContainer($spec);
}
if ($body['startAfterCreate'] ?? true) {
$client->startContainer($id);
}
podman_json_response(['id' => $id, 'status' => ($body['startAfterCreate'] ?? true) ? 'started' : 'created']);
break;
default:
podman_json_error("Unknown action '{$action}'", 400);
}
/**
* Builds a libpod SpecGenerator body (POST /containers/create) from the
* WebUI's Create Container form fields. Field names/shapes here
* (portmappings, netns, networks, mounts, volumes, restart_policy) were
* verified live against a real podman system service — see
* PodmanClient::createContainer()'s header comment.
*
* @param array<string,mixed> $body
* @return array<string,mixed>
*/
function build_container_spec(string $image, array $body): array
{
$spec = ['image' => $image];
$name = trim((string) ($body['name'] ?? ''));
if ($name !== '') {
$spec['name'] = $name;
}
$env = [];
foreach (($body['env'] ?? []) as $row) {
$key = trim((string) ($row['key'] ?? ''));
if ($key !== '') {
$env[$key] = (string) ($row['value'] ?? '');
}
}
if ($env !== []) {
$spec['env'] = $env;
}
$ports = [];
foreach (($body['ports'] ?? []) as $row) {
$hostPort = (int) ($row['hostPort'] ?? 0);
$containerPort = (int) ($row['containerPort'] ?? 0);
if ($hostPort > 0 && $containerPort > 0) {
$ports[] = [
'host_ip' => '',
'host_port' => $hostPort,
'container_port' => $containerPort,
'protocol' => (string) ($row['protocol'] ?? 'tcp'),
];
}
}
if ($ports !== []) {
$spec['portmappings'] = $ports;
}
$mounts = [];
$volumes = [];
foreach (($body['volumes'] ?? []) as $row) {
$source = trim((string) ($row['source'] ?? ''));
$containerPath = trim((string) ($row['containerPath'] ?? ''));
if ($source === '' || $containerPath === '') {
continue;
}
if (($row['kind'] ?? 'named') === 'path') {
$mounts[] = ['destination' => $containerPath, 'type' => 'bind', 'source' => $source, 'options' => ['rbind']];
} else {
$volumes[] = ['name' => $source, 'dest' => $containerPath];
}
}
if ($mounts !== []) {
$spec['mounts'] = $mounts;
}
if ($volumes !== []) {
$spec['volumes'] = $volumes;
}
// "bridge"/"host"/"none" are podman's own reserved netns modes; any
// other value is an existing custom podman network's name, attached
// via the "networks" field instead (verified live: passing a
// network name through "networks" attaches it without needing an
// explicit netns mode at all).
$networkMode = (string) ($body['networkMode'] ?? 'bridge');
if (in_array($networkMode, ['bridge', 'host', 'none'], true)) {
$spec['netns'] = ['nsmode' => $networkMode];
} elseif ($networkMode !== '') {
$spec['networks'] = [$networkMode => new \stdClass()];
}
if (isset($body['restartPolicy']) && $body['restartPolicy'] !== '') {
$spec['restart_policy'] = (string) $body['restartPolicy'];
}
if ($body['privileged'] ?? false) {
$spec['privileged'] = true;
}
return $spec;
}
/** @param array<string,mixed> $body */
function require_id(array $body): string
{
webui/plugins/podman/ajax/system.php
+4 -1
View File
@@ -59,7 +59,10 @@ function system_summary(PodmanClient $client, PodmanConfig $config): array
return [
'reachable' => true,
'socketPath' => $config->socketPath,
'podmanVersion' => $info['Version']['Version'] ?? null,
// libpod's /info nests the version block under lowercase "version"
// (unlike most other libpod endpoints, which are PascalCase
// throughout) — verified live against a real podman system service.
'podmanVersion' => $info['version']['Version'] ?? null,
'containers' => [
'total' => count($containers),
'running' => $running,
webui/plugins/podman/ajax/volumes.php
+15 -2
View File
@@ -9,7 +9,7 @@
*
* Actions (?action=...):
* list GET -> normalized volume list, with usedBy counts
* create POST {"name": "...", "driver": "local"}
* create POST {"name": "...", "driver": "local", "path": "/mnt/cache/..." (optional)}
* remove POST {"name": "...", "force": false}
*/
@@ -30,7 +30,11 @@ switch ($action) {
if ($name === '') {
podman_json_error('Missing name in request body', 400);
}
podman_json_response($client->createVolume($name, (string) ($body['driver'] ?? 'local')));
$path = trim((string) ($body['path'] ?? ''));
if ($path !== '' && !str_starts_with($path, '/')) {
podman_json_error("Host path ({$path}) must be an absolute path.", 400);
}
podman_json_response($client->createVolume($name, (string) ($body['driver'] ?? 'local'), $path !== '' ? $path : null));
break;
case 'remove':
@@ -65,10 +69,19 @@ function volumes_list(PodmanClient $client): array
$out = [];
foreach ($raw as $v) {
$name = (string) ($v['Name'] ?? '');
$options = $v['Options'] ?? [];
// A volume created with our "Host path" field carries
// type=none,o=bind,device=<path> (see PodmanClient::createVolume)
// — surfaced separately from 'mountpoint' (podman's own internal
// storage path, which stays populated even for bind-backed
// volumes) so the UI can show users the host path they actually
// asked for.
$hostPath = (is_array($options) && ($options['o'] ?? '') === 'bind') ? (string) ($options['device'] ?? '') : null;
$out[] = [
'name' => $name,
'driver' => (string) ($v['Driver'] ?? 'local'),
'mountpoint' => (string) ($v['Mountpoint'] ?? ''),
'hostPath' => $hostPath,
'createdAt' => podman_parse_time($v['CreatedAt'] ?? null),
'usedBy' => $usageCounts[$name] ?? 0,
];