[healthcheck] preserve arguments with spaces in healthcheck test

pkg/api/handlers/compat/containers_create.go

@@ -604,14 +604,13 @@ func cliOpts(cc handlers.CreateContainerConfig, rtc *config.Config) (*entities.C
 		cliOpts.OOMKillDisable = *cc.HostConfig.OomKillDisable
 	}
 	if cc.Config.Healthcheck != nil {
-		finCmd := ""
-		for _, str := range cc.Config.Healthcheck.Test {
-			finCmd = finCmd + str + " "
-		}
-		if len(finCmd) > 1 {
-			finCmd = finCmd[:len(finCmd)-1]
+		// Encode healthcheck test as JSON to preserve arguments with spaces.
+		// MakeHealthCheckFromCli will unmarshal this back to the original array.
+		cmdJSON, err := json.Marshal(cc.Config.Healthcheck.Test)
+		if err != nil {
+			return nil, nil, err
 		}
-		cliOpts.HealthCmd = finCmd
+		cliOpts.HealthCmd = string(cmdJSON)
 		if cc.Config.Healthcheck.Interval > 0 {
 			cliOpts.HealthInterval = cc.Config.Healthcheck.Interval.String()
 		}

pkg/specgenutil/specgen.go

@@ -986,7 +986,10 @@ func MakeHealthCheckFromCli(inCmd, interval string, retries uint, timeout, start
 
 	var concat string
 	if strings.ToUpper(cmdArr[0]) == define.HealthConfigTestCmd || strings.ToUpper(cmdArr[0]) == define.HealthConfigTestNone { // this is for compat, we are already split properly for most compat cases
-		cmdArr = strings.Fields(inCmd)
+		// Only re-split if the input was not already a JSON array (isArr == false); otherwise preserve the unmarshaled array structure
+		if !isArr {
+			cmdArr = strings.Fields(inCmd)
+		}
 	} else if strings.ToUpper(cmdArr[0]) != define.HealthConfigTestCmdShell { // this is for podman side of things, won't contain the keywords
 		if isArr && len(cmdArr) > 1 { // an array of consecutive commands
 			cmdArr = append([]string{define.HealthConfigTestCmd}, cmdArr...)

test/apiv2/20-containers.at

@@ -593,6 +593,29 @@ t GET containers/$cid/json 200 \
   .Config.Healthcheck.Timeout=30000000000 \
   .Config.Healthcheck.Retries=3
 
+t DELETE containers/$cid?v=true 204
+
+# Test Compat Create with healthcheck preserving arguments with spaces (issue #26519)
+cat >$TMPD/healthcheck-spaces.json <<EOF
+{
+  "Image": "$IMAGE",
+  "Cmd": ["top"],
+  "Healthcheck": {
+    "Test": ["CMD", "/usr/bin/test", "--arg=value with spaces", "another arg"]
+  }
+}
+EOF
+t POST containers/create $TMPD/healthcheck-spaces.json 201 \
+  .Id~[0-9a-f]\\{64\\}
+cid=$(jq -r '.Id' <<<"$output")
+t GET containers/$cid/json 200 \
+  .Config.Healthcheck.Test[0]="CMD" \
+  .Config.Healthcheck.Test[1]="/usr/bin/test" \
+  .Config.Healthcheck.Test[2]="--arg=value with spaces" \
+  .Config.Healthcheck.Test[3]="another arg"
+
+t DELETE containers/$cid?v=true 204
+
 # compat api: Test for mount options support
 # Sigh, JSON can't handle octal. 0755(octal) = 493(decimal)
 payload='{"Mounts":[{"Type":"tmpfs","Target":"/mnt/scratch","TmpfsOptions":{"SizeBytes":1024,"Mode":493}}]}'