podman_container quadlet downloads image in checkrun

[mstinsky]

As the title stats.
When using podman_container with state quadlet and running in check mode the module downloads the image defined in the ansible task.
A checkrun should not do that and only show the quadlet file that is rendered.

Simple test:

- name: Test nginx
  containers.podman.podman_container:
    state: quadlet
    name: nginx-test
    image: docker.io/nginx:latest

Before running the task check podman images that shows the image does not exist.
Running the task in check mode shows:

TASK [test : Test nginx] ******************************************************************************************************************************************************************************************************************************
--- before
+++ after
@@ -1 +1,4 @@
+[Container]
+ContainerName=nginx-test
+Image=docker.io/nginx:latest

/etc/containers/systemd does not have the quadlet file as expected but the image was downloaded:

podman images | grep nginx
docker.io/library/nginx                                    latest               3b25b682ea82  5 weeks ago    196 MB

[sshnaidm]

Should be fixed by #872 in 1.16.2, please check your collection version

[mstinsky]

Thanks for the answer @sshnaidm
I updated from 1.16.1 to 1.16.2 and can confirm that the image is not downloaded anymore.

Just out of curiosity I tested the same without state: quadlet and there the image is still downloaded in a checkrun.
I would argue that should also not be the case?

[sshnaidm]

@mstinsky when you need to run the container it has to download the image of course, how would you run it otherwise?

[mstinsky]

In a checkrun the system should not be changed at all and I would count downloading a container image into that.
The module should only show that something is getting changed e.g container is getting started/altered or whatever but not download the respective image.

[sshnaidm]

What do you mean by "checkrun"? The check mode? If so, then yeah, we don't need to download it then.

[sshnaidm]

On the other hand when we compare images we must have it downloaded, Podman doesn't know to inspect images in registry, and having Skopeo as a requirement I think it's an overkill. So either we don't download and then don't have an exact comparison, or we do download in check mode and have exact results about changes in the container.