Add support for podman (Fedora 31+, RHEL8+)#128
Add support for podman (Fedora 31+, RHEL8+)#128AaronDMarasco wants to merge 2 commits intopackpack:masterfrom
Conversation
|
Thank you! That is new for me: I'll need some time to learn necessary context and to test the patch. |
|
OK feel free to let me know if there are any questions. Basically, there is an RPM called The other change forces mounts to map SELinux contexts to the running user; it's a lot more lenient when running as |
|
It's been some time... do you need more info or anything? (Resolved conflicts.) |
|
My apologizes for the delay! I'll take a look at the week. |
| # This might be needed for all SELinux installs | ||
| EXTRA_MOUNT=,Z |
There was a problem hiding this comment.
Not sure it is safe default. At least source tree, cache and packpack directory directory may be intended to use from other containers and from the host system as well (it seems some services may lost access to those directories after labeling).
I read several related articles:
moby/moby#30934
https://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/
And now I'm not ever sure whether we'll able to run packpack on the same source tree several times. Or docker/podman will relabel it each time (remove old label and add a new one)? So only parallel builds will fail?
What do you think? Should not we make this choice explicit rather than default?
There was a problem hiding this comment.
I have no idea; I am not an SELinux expert. I just know that without it, I couldn't read the files.
There was a problem hiding this comment.
Just obserted the following call in the packpack script:
#
# Fix security context for selinux
#
chcon -Rt svirt_sandbox_file_t ${PACKDIR} ${SOURCEDIR} ${BUILDDIR} \
1> /dev/null 2> /dev/null || :AFAIU (I'm not an expert too), it doing the same (but like ,z, not ,Z) for all host directories that will be used as volumes except ${CACHE_DIR}.
Can you share precise error? Maybe we should just add ${CACHE_DIR} here?
There was a problem hiding this comment.
OK, when I comment out my EXTRA_MOUNT, this is the result:
+ docker run --volume /home/user/git_stuff/packpack/pack:/pack:ro --volume /home/user/git_stuff/packpack:/source:ro --volume /home/user/git_stuff/packpack/build:/build:rw --env-file /home/user/git_stuff/packpack/build/env --workdir /source --rm=true --tty=true --entrypoint=/build/userwrapper.sh -e XDG_CACHE_HOME=/cache -e CCACHE_DIR=/cache/ccache -e TMPDIR=/tmp -e CI= --volume /home/user/.cache/packpack:/cache:rw packpack/packpack:fedora-33 make -f /pack/Makefile -C /source BUILDDIR=/build -j
Emulate Docker CLI using podman. Create /etc/containers/nodocker to quiet msg.
/bin/sh: /build/userwrapper.sh: Permission denied
There was a problem hiding this comment.
OK that SELinux line is already in there for me as well and doesn't seem to be doing anything. I took out the dev/null redirects to ensure no error messages were being ignored.
There was a problem hiding this comment.
I tried only applying the ",Z" to the rw volume, and it still didn't work.
+ make -f /pack/Makefile -C /source BUILDDIR=/build -j
make: *** /source: Permission denied. Stop.
Let me know if there's anything else you want me to test, otherwise, this is what needs to be done to work on Fedora hosts.
There was a problem hiding this comment.
That looks unexpected, because we set the label for the build directory. Is it on a new project clone or after previous run with ,Z?
|
@AaronDMarasco Thanks for patience! Please, look at several questions above. BTW, I suggest to rebase on top of |
7b80d8c to
e3ea52a
Compare
Also just built for F33 without a problem
|
(I have no rights to add a review notes to pull request, so I'll add them as a separate comment) First of all, @AaronDMarasco, thanks for your pull request! I've checked build of packpack for CentOS target oS using podman on CentOS 8 host OS and docker on Ubuntu 20.04 host OS. Content of binary and src packages are the same, also compared using command line Aaron, @AaronDMarasco, changes in commit "Add support for podman (Fedora 31+, RHEL8+)" look trivial, but could you add a couple of lines about changes? Not everyone knows about 'z' option in Docker, it's worth to add a link to documentation (https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label). We have a PackPack CI ( |
Sorry, but no. I made an attempt nearly a year ago to help out on a project that I don't even personally use, but just happen to know a decent amount about its subject (RPMs). I rebased it a few months ago as requested after it was already "approved" in Sept and it still wasn't merged in. If you have explicit specific questions, feel free to ask. But I think every line at this point has been covered. |
Red Hat (the company) is moving towards root-less containers with
podman. This fixespackpackto use the proper flags for the container to build RPMs as well as fixing the "Requires" of its own RPM when built.