WIP: volume protection by pinning

[tobwen]

Does this PR introduce a user-facing change?

Yes.

* Added `--pinned` flag to `volume create` to create pinned volumes
* Added new `volume pin` commands to pin/unpin existing volumes
* Added `--include-pinned` flag to `volume rm` to allow removing pinned volumes
* Added pinned volume filtering support
* Added support for pinned volumes in `system prune` command
* Added HTTP API and ABI support for volume pinning
* Added runtime methods for handling pinned volumes and pruning

References

Reference #26807
Reference #23217

Actions required

• This is just the first step to demonstrate the function. Things like tunnel/remote implementation are still missing (it's just a stub).
• It needs to be discussed if we want to overload the CLI with volume unpin or rather use volume pin --unpin as supplied.

Note

Those are my first steps with the Podman code - please bear with me.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tobwen
Once this PR has been reviewed and has the lgtm label, please assign ygalblum for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mheon]

Should pinned volumes require --force to remove? It feels like they ought to

[mheon]

Probably better to stick this in state, since it can be toggled on/off

[mheon]

Yeah, this won't work with v.config - that's static data, never changes. You want v.state - which is refreshed by update() and saved by save()

[tobwen]

Should pinned volumes require --force to remove? It feels like they ought to

I've thought about that before, but I figured we should treat it like the immutable flag. If this flag is set, even root can't remove a file with rm -f either. My concern here is protecting important data, and maybe root has some stupid script that sets --force to keep the script running - but then the data is gone (excluding backups for now).

[packit-as-a-service]

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

[packit-as-a-service]

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

[packit-as-a-service]

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

[packit-as-a-service]

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.