Bug 2136283

Setting to Post and assigning to @jnovy .  The fix from the cloned BZ in RHEL 8.7.0.ZeroDay will apply here too.

@ypu and Jindrich, can I get a QA and Dev ack please?

[test@kvm-08-guest24 ~]$ podman inspect gallant_mahavira|grep -iA2 Healthcheck
               "Healthcheck": {
                    "Test": [
                         "CMD-SHELL curl http://localhost || exit"
--
               "HealthcheckOnFailureAction": "invalid",
               "Umask": "0022",
               "Timeout": 0,

NOTE: the value of HealthcheckOnFailureAction is 'invalid' in here, please help confirm
whether it's acceptable, for details as follows, thanks!

[test@kvm-08-guest24 ~]$ cat /etc/redhat-release
Red Hat Enterprise Linux release 9.1 (Plow)

[test@kvm-08-guest24 ~]$ rpm -q python3-podman podman crun systemd kernel
python3-podman-4.2.1-1.el9_1.noarch
podman-4.2.0-5.el9_1.x86_64
crun-1.5-1.el9.x86_64
systemd-250-12.el9_1.x86_64
kernel-5.14.0-162.6.1.el9_1.x86_64

[test@kvm-08-guest24 ~]$ podman system service -t 0 &
[1] 21616

[test@kvm-08-guest24 ~]$ netstat -lanp|grep podman.sock
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
unix  2      [ ACC ]     STREAM     LISTENING     50341    21629/podman         /run/user/1000/podman/podman.sock

[test@kvm-08-guest24 ~]$ cat test.py 
"""Demonstrate PodmanClient."""
import json
from podman import PodmanClient

alpine_image = "quay.io/libpod/alpine:latest"
uri = "unix:///run/user/1000/podman/podman.sock"

def test_container_healtchecks():
    """Test passing various healthcheck options"""
    with PodmanClient(base_url=uri) as client:

        containers = []
        parameters = {}

        version = client.version()
        print("Release: ", version["Version"])
        print("Compatible API: ", version["ApiVersion"])
        print("Podman API: ", version["Components"][0]["Details"]["APIVersion"], "\n")

        parameters['healthcheck'] = {'Test': ['CMD-SHELL curl http://localhost || exit']}
        parameters['health_check_on_failure_action'] = 1
        container = client.containers.create(alpine_image, **parameters)
        print("current container:%s" % container)
        containers.append(container)


if __name__ == "__main__":
    test_container_healtchecks()

[test@kvm-08-guest24 ~]$ podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
[test@kvm-08-guest24 ~]$ podman pull quay.io/libpod/alpine:latest
Trying to pull quay.io/libpod/alpine:latest...
Getting image source signatures
Copying blob 9d16cba9fb96 done  
Copying config 9617696764 done  
Writing manifest to image destination
Storing signatures
961769676411f082461f9ef46626dd7a2d1e2b2a38e6a44364bcbecf51e66dd4

[test@kvm-08-guest24 ~]$ python3 test.py
Release:  4.2.0
Compatible API:  1.41
Podman API:  4.2.0 

current container:<Container: d1c762ab95>

[test@kvm-08-guest24 ~]$ podman ps -a
CONTAINER ID  IMAGE                         COMMAND     CREATED         STATUS      PORTS       NAMES
d1c762ab957f  quay.io/libpod/alpine:latest  /bin/sh     15 seconds ago  Created                 gallant_mahavira

[test@kvm-08-guest24 ~]$ podman inspect gallant_mahavira|grep -iA2 Healthcheck
               "Healthcheck": {
                    "Test": [
                         "CMD-SHELL curl http://localhost || exit"
--
               "HealthcheckOnFailureAction": "invalid",
               "Umask": "0022",
               "Timeout": 0,

NOTE: the value of HealthcheckOnFailureAction is 'invalid' in here, please help confirm if it's acceptable, thanks!

I think this is expected given: https://github.com/containers/podman/blob/7e7db23dbf163837ba3216fea09b31d2c8409fb3/libpod/define/healthchecks.go#L71-L82. Specifying 1 matches up with the invalid iota. Specgen is more robust leading users to be able to pick choices that don't necessarily help them... Can you try testing with 2 @ajia

(In reply to Charlie Doern from comment #10)
> I think this is expected given:
> https://github.com/containers/podman/blob/
> 7e7db23dbf163837ba3216fea09b31d2c8409fb3/libpod/define/healthchecks.go#L71-
> L82. Specifying 1 matches up with the invalid iota. Specgen is more robust
> leading users to be able to pick choices that don't necessarily help them...
> Can you try testing with 2 @ajia

Test results as expected when setting health_check_on_failure_action value to 2, thanks a lot!

[test@kvm-08-guest24 ~]$ grep health_check_on_failure_action test.py 
        parameters['health_check_on_failure_action'] = 2

[test@kvm-08-guest24 ~]$ podman inspect romantic_jang|grep -iA2 Healthcheck
               "Healthcheck": {
                    "Test": [
                         "CMD-SHELL curl http://localhost || exit"
--
               "HealthcheckOnFailureAction": "kill",
               "Umask": "0022",
               "Timeout": 0,

This bug has been verified on python-podman-4.2.1-1.el9_1.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (python-podman bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8439