[policy] - Add rootless container support and log-line limiting by snagoor · Pull Request #4446 · sosreport/sos

snagoor · 2026-08-12T08:47:40Z

This PR extends the container runtime helpers so sos plugins can collect data from rootless containers (containers started by a non-root user) and optionally limit the number of log lines collected per container.

Changes at a glance

sos/policies/runtimes/__init__.py

get_containers() gains a runas parameter. When set, the ps command is run as that user via sos_get_command_output(runas=...), making the user's rootless containers visible.
get_logs_command() gains a log_lines parameter. When set, --tail N is appended to the logs command so output is capped.

sos/policies/runtimes/podman.py

Adds four new helper methods to PodmanContainerRuntime:
- info_command(run_debug=False) — returns podman info [--debug]
- list_command(get_all, list_fmt) — returns a podman ps command with a format string (defaults to JSON)
- inspect_command(container) — returns podman inspect <container>
- exec_command(container, cmd) — returns podman exec <container> <cmd>
These let plugins build the correct Podman commands without hardcoding the binary name.

sos/report/plugins/__init__.py

New get_containers_by_user(user, get_all=False) method on Plugin. Queries the loaded runtime as user so plugins can discover rootless containers owned by a specific user.
add_container_logs() gains two new parameters:
- runas — when set, containers are looked up in the named user's rootless runtime using an exact name match instead of a regex.
- log_lines — passed through to get_logs_command() to cap log output.
Assisted-by: Claude Code

packit-as-a-service · 2026-08-12T08:50:34Z

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

sudo dnf install -y 'dnf*-command(copr)'
dnf copr enable packit/sosreport-sos-4446
And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

…container helpers Signed-off-by: Nagoor Shaik <nshaik@redhat.com> Assisted-by: Claude Code

TurboTurtle · 2026-08-12T21:41:41Z

+            elif _runtime is not None:
                _cons = self.get_all_containers_by_regex(container, get_all)
-                for _con in _cons:
-                    cmd = _runtime.get_logs_command(_con[1])
-                    self.add_cmd_output(cmd, **kwargs)
+            else:
+                self._log_debug(f"No container runtime available to collect "
+                                f"logs for '{container}'")
+                continue
+            if _runtime is None:
+                self._log_debug(f"No container runtime available to collect "
+                                f"logs for '{container}'")


We shouldn't be doing this check with every container in the list.

The runtime check should remain outside the loop, as it is currently.

Thanks for the review @TurboTurtle , agreed. I've moved the runtime check and resolution back out of the loop with an early return if no runtime is available.

While restructuring, I also noticed get_containers_by_user() was being called once per container in the runas branch. Since the exact-match filtering doesn't depend on per-container runtime state, the user's rootless runtime is now queried just once before the loop and matched inside it.

TurboTurtle · 2026-08-12T21:43:39Z

        return vols

-    def get_logs_command(self, container):
+    def get_logs_command(self, container, log_lines=None):


If we're going to add this parameter, we should hook it up to the actual collection for the runtime. If the runtime doesn't support it, then we shouldn't make it available as a parameter.

LXD collects logs via lxc info --show-log, which doesn't support limiting line output, so the parameter can't be meaningfully hooked up there.

Changes made:

Reverted LxdContainerRuntime.get_logs_command() to its original signature without log_lines.

Added a log_line_limit capability attribute to ContainerRuntime (default True, False on LXD). add_container_logs() now checks this capability and falls back to full logs with a debug message if line limits aren't supported.

Applied the same logic to runas: removed it from the CRI-O and LXD get_containers() overrides (since they are daemon-based and don't support rootless mode) and added a rootless capability check.

Overrode CrioContainerRuntime.get_logs_command() so it uses crictl logs --tail N correctly (crictl uses -t for --tail, unlike Docker/Podman where -t means timestamps).

TurboTurtle · 2026-08-12T21:46:08Z

I don't see where we're using any of these new methods?

Also, I don't see why these would be methods at all. If they aren't class attrs being set like we do with PackageManager() classes, then they'd probably need to be properties.

These four helpers form the runtime API surface is consumed by dependent PR #4450 (which refactors aap_containerized plugin to remove hardcoded su - <user> -c 'podman ...' strings). Because #4450 stacks on this PR, they appear unused in isolation.

On methods vs. properties: They are methods because they accept parameters (like container, cmd, get_all, or list_fmt), which properties can't do. This matches the established parameterized pattern on ContainerRuntime (e.g., get_logs_command() and get_copy_command()).

Fixed a docstring copy-paste error in info_command() and refactored exec_command() to reuse the self.run_cmd prefix as well.

snagoor · 2026-08-13T12:39:28Z

Summary of current changes:

Moved the runtime check outside the loop in add_container_logs() and limited rootless user runtime queries to a single call.
Removed log_lines from LXD and gated it behind a new log_line_limit capability.
Gated runas behind a rootless capability and cleaned up CRI-O / LXD overrides.
Fixed CRI-O log tail syntax (crictl logs --tail).

pmoravec · 2026-08-14T07:57:16Z

+        :returns: Formatted runtime command to get logs from `container`
+        :rtype: ``str``
+        """
+        if log_lines is not None:


Ditto wrt log_line_limit

Same change applied to the CRI-O override, crictl logs --tail N is only emitted when log_line_limit is set.

pmoravec · 2026-08-14T07:58:20Z

+                    _log_lines = None
+                else:
+                    _log_lines = log_lines
+                if _log_lines is not None:


This condition is redundant; if _log_lines is None, we can still call get_logs_command with log_lines=_log_lines due to the if log_lines is not None: test there.

Agreed, the if _log_lines is not None: branch was redundant, since get_logs_command(..., log_lines=None) and get_logs_command(...) are equivalent (the parameter defaults to None).

I've dropped the intermediate _log_lines variable and pass log_lines straight through; the runtime itself now decides whether to append --tail (see the log_line_limit guard), and the plugin keeps only the debug message when the capability is off.

pmoravec · 2026-08-14T08:56:38Z

+            return f"{self.binary} info --debug"
+        return f"{self.binary} info"
+
+    def list_command(self, get_all=False, list_fmt=None):


The list_fmt is not used even in the #4450, is it worth having it?

Further, calling this method makes sense "only" for non-root users (with runas set), right? Since runtime does automatically collect this info already (just for root). Since the #4450 uses this method for runas set, we cant reuse the runtime's collected info and the method is really necessary. (this took me a while to understand rationale for the method).

pmoravec · 2026-08-14T09:47:38Z

+                            system-level runtime. Container names are then
+                            treated as *exact* matches, not regexes, against


Couldnt this inconsistency (regexp for root containers, exact match for rootless) be confusing for users using this method?

Good catch, you're right that the inconsistency is confusing. A plugin author passing a regex like my-app.* would get regex semantics on the system-level runtime but silent no-matches on the rootless path.

Fixed: the rootless path now also uses re.match() when filtering the pre-fetched user container list, so both code paths behave identically.

…ontainer helpers Signed-off-by: Nagoor Shaik <nshaik@redhat.com> Assisted-by: Claude Code

pmoravec

LGTM

[runtime] - Add rootless container support and log-line limiting for …

acbd9a7

…container helpers Signed-off-by: Nagoor Shaik <nshaik@redhat.com> Assisted-by: Claude Code

snagoor force-pushed the feature/container-helpers branch from 629730f to acbd9a7 Compare August 12, 2026 10:41

snagoor mentioned this pull request Aug 12, 2026

[aap_containerized] Replace su-wrapped podman shell commands with container-helper APIs #4449

Open

snagoor force-pushed the feature/container-helpers branch from fc7b883 to 913e643 Compare August 12, 2026 16:21

snagoor mentioned this pull request Aug 12, 2026

[aap_containerized] Refactor plugin to use container-helper APIs #4450

Open

5 tasks

snagoor force-pushed the feature/container-helpers branch from 913e643 to 860c97b Compare August 12, 2026 16:29

snagoor changed the title ~~[runtime] - Add rootless container support and log-line limiting~~ [policy] - Add rootless container support and log-line limiting Aug 12, 2026

TurboTurtle requested changes Aug 12, 2026

View reviewed changes

TurboTurtle added Kind/Enhancement Status/Needs Review This issue still needs a review from project members Reviewed/Needs Iteration Review has been performed, change needs to be iterated on based on feedback before merge. labels Aug 12, 2026

snagoor force-pushed the feature/container-helpers branch from 860c97b to a8c97c6 Compare August 13, 2026 12:00

snagoor force-pushed the feature/container-helpers branch 2 times, most recently from b6239c4 to a7dba9e Compare August 13, 2026 13:29

pmoravec reviewed Aug 14, 2026

View reviewed changes

Comment thread sos/policies/runtimes/__init__.py

pmoravec reviewed Aug 14, 2026

View reviewed changes

Comment thread sos/report/plugins/__init__.py Outdated

pmoravec reviewed Aug 14, 2026

View reviewed changes

Comment thread sos/policies/runtimes/crio.py

snagoor force-pushed the feature/container-helpers branch 3 times, most recently from 981f09c to a6618a3 Compare August 14, 2026 12:42

[policy] - Add rootless container support and log-line limiting for c…

1e148c5

…ontainer helpers Signed-off-by: Nagoor Shaik <nshaik@redhat.com> Assisted-by: Claude Code

snagoor force-pushed the feature/container-helpers branch from a6618a3 to 1e148c5 Compare August 14, 2026 13:29

pmoravec approved these changes Aug 14, 2026

View reviewed changes

pmoravec added the Reviewed/Needs 2nd Ack Require a 2nd ack from a maintainer label Aug 14, 2026

snagoor marked this pull request as draft August 16, 2026 16:53

		system-level runtime. Container names are then
		treated as exact matches, not regexes, against

Uh oh!

Conversation

snagoor commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes at a glance

Uh oh!

packit-as-a-service Bot commented Aug 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

snagoor commented Aug 13, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pmoravec left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

snagoor commented Aug 12, 2026 •

edited

Loading