From 5522def65aec4ce6f74a17c9cacb8a60aeb0c04c Mon Sep 17 00:00:00 2001
From: Paul Holzinger <pholzing@redhat.com>
Date: Wed, 22 Jan 2025 19:03:08 +0100
Subject: [PATCH] do not set the CreateCommand for API users

This should be set only by podman as it is used for the podman generate
systemd --new command. For the api it was set to the system service
command which is simply pointless. It must be empty in these cases.

Fixes #25026

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
---
 cmd/podman/containers/create.go |  3 +++
 cmd/podman/containers/run.go    |  4 ++++
 pkg/api/handlers/libpod/pods.go |  1 -
 pkg/specgenutil/specgen.go      |  6 ------
 test/apiv2/20-containers.at     | 10 +++++++++-
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 547911404c..921e904610 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -161,6 +161,9 @@ func create(cmd *cobra.Command, args []string) error {
 	}
 	s.RawImageName = rawImageName
 
+	// Include the command used to create the container.
+	s.ContainerCreateCommand = os.Args
+
 	if err := createPodIfNecessary(cmd, s, cliVals.Net); err != nil {
 		return err
 	}
diff --git a/cmd/podman/containers/run.go b/cmd/podman/containers/run.go
index 924f1198ee..102891c8e2 100644
--- a/cmd/podman/containers/run.go
+++ b/cmd/podman/containers/run.go
@@ -206,6 +206,10 @@ func run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 	s.RawImageName = rawImageName
+
+	// Include the command used to create the container.
+	s.ContainerCreateCommand = os.Args
+
 	s.ImageOS = cliVals.OS
 	s.ImageArch = cliVals.Arch
 	s.ImageVariant = cliVals.Variant
diff --git a/pkg/api/handlers/libpod/pods.go b/pkg/api/handlers/libpod/pods.go
index 68c089774e..7727c607e8 100644
--- a/pkg/api/handlers/libpod/pods.go
+++ b/pkg/api/handlers/libpod/pods.go
@@ -73,7 +73,6 @@ func PodCreate(w http.ResponseWriter, r *http.Request) {
 		// a few extra that do not have the same json tags
 		psg.InfraContainerSpec.Name = psg.InfraName
 		psg.InfraContainerSpec.ConmonPidFile = psg.InfraConmonPidFile
-		psg.InfraContainerSpec.ContainerCreateCommand = psg.InfraCommand
 		psg.InfraContainerSpec.Image = psg.InfraImage
 		psg.InfraContainerSpec.RawImageName = psg.InfraImage
 	}
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index 6ab70b1cc3..f516a8ab14 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -550,12 +550,6 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 		s.Entrypoint = entrypoint
 	}
 
-	// Include the command used to create the container.
-
-	if len(s.ContainerCreateCommand) == 0 {
-		s.ContainerCreateCommand = os.Args
-	}
-
 	if len(inputCommand) > 0 {
 		s.Command = inputCommand
 	}
diff --git a/test/apiv2/20-containers.at b/test/apiv2/20-containers.at
index 874f2bb878..14379f4751 100644
--- a/test/apiv2/20-containers.at
+++ b/test/apiv2/20-containers.at
@@ -191,12 +191,15 @@ cid=$(jq -r '.Id' <<<"$output")
 t POST   libpod/containers/${cid}/start 204
 # Container should exit almost immediately. Wait for it, confirm successful run
 t POST   "libpod/containers/${cid}/wait?condition=stopped&condition=exited"  200 '0'
+
+# Regression check for #15036 (Umask) and #25026 (CreateCommand)
 t GET    libpod/containers/${cid}/json 200 \
   .Id=$cid \
   .State.Status~\\\(exited\\\|stopped\\\) \
   .State.Running=false \
   .State.ExitCode=0 \
-  .Config.Umask=0022 # regression check for #15036
+  .Config.Umask=0022 \
+  .Config.CreateCommand=null
 t DELETE libpod/containers/$cid 200 .[0].Id=$cid
 
 CNAME=myfoo
@@ -309,6 +312,11 @@ t GET containers/$cid/json 200 \
   .Path="echo" \
   .Args[0]="param1" \
   .Args[1]="param2"
+# Regression check for #25026 (CreateCommand)
+t GET    libpod/containers/${cid}/json 200 \
+  .Id=$cid \
+  .Config.CreateCommand=null
+
 t DELETE containers/$cid 204
 
 # test only set the entrypoint, Cmd should be []