[WIP] Add podman machine Containerfile #21251

rhatdan · 2024-01-13T12:40:22Z

Move some of the functionality in ignition into the building of a bootc based podman-machine.

Does this PR introduce a user-facing change?

none

openshift-ci · 2024-01-13T12:40:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rhatdan · 2024-01-13T12:43:06Z

@baude @ashley-cui @cgwalters PTAL

Once we have the design here approved, I can go and remove a lot of code from ignition.go that sets these up.

@cgwalters I do question whether I should setup the config files in /usr/etc or /etc?

cgwalters · 2024-01-13T13:33:49Z

contrib/podmanimage/machine/Containerfile

+RUN systemctl enable podman.service
+RUN printf "\nconfdir /etc/chrony.d\n" >> /etc/chrony.conf
+
+COPY 10-inotify-instances.conf /usr/etc/sysctl.d/10-inotify-instances.conf


The preference here is is actually to use /usr/lib/sysctl.d. This configuration is part of the OS.

Otherwise, use /etc. Don't use /usr/etc.

cgwalters · 2024-01-13T13:34:10Z

contrib/podmanimage/machine/Containerfile

+COPY subuid /usr/etc/subgid
+COPY subuid /usr/etc/subuid
+RUN groupadd -g 501 core; useradd -u 501 -g 501 core
+RUN --mount=type=tmpfs,destination=/var ostree container commit


This can just be dropped currently.

cgwalters · 2024-01-13T13:35:43Z

contrib/podmanimage/machine/Containerfile

+COPY linger-example.service /home/core/.config/systemd/user/linger-example.service
+COPY containers-home.conf /home/core/.config/containers/containers.conf
+
+RUN mkdir -p /home/core/.config/systemd/user/default.target.wants; \


What I'd recommend instead of this is to write these files into /etc/skel - and have the user created on firstboot via systemd-sysusers (per above).

There is no support for /etc/subuid and /etc/subgid there though? Or just create those files and let systemd-sysusers create it.

Now using /etc/skel

cgwalters · 2024-01-13T13:35:56Z

contrib/podmanimage/machine/Containerfile

+COPY podman-docker.conf /usr/etc/tmpfiles.d/podman-docker.conf
+COPY subuid /usr/etc/subgid
+COPY subuid /usr/etc/subuid
+RUN groupadd -g 501 core; useradd -u 501 -g 501 core


This one is tricky...I know we're adding it for compatibility, but going forward I think it'd probably make sense to allocate a podman user for example.

But even more importantly it will work better if we change things to allocate the user on firstboot today.

More on this in https://centos.github.io/centos-bootc/builds/#injecting-users-at-build-time (that could be expanded too)

Also, why 501 versus the default?

Just going by the entries in ignition.go.

Looks like the default user on a MAC is UID=501

cgwalters · 2024-01-13T13:37:09Z

contrib/podmanimage/machine/Containerfile

+
+RUN mkdir -p /home/core/.config/systemd/user/default.target.wants; \
+ln -s /home/core/.config/systemd/user/linger-example.service /home/core/.config/systemd/user/default.target.wants/linger-example.service
+RUN --mount=type=tmpfs,destination=/var ostree container commit


This is a no-op and unnecessary.

cgwalters · 2024-01-13T13:37:38Z

contrib/podmanimage/machine/Containerfile

+COPY containers-etc.conf /usr/etc/containers/containers.conf
+COPY delegate.conf /usr/etc/systemd/system/[email protected]/delegate.conf
+COPY docker-host.sh /usr/etc/profile.d/docker-host.sh
+COPY podman-docker.conf /usr/etc/tmpfiles.d/podman-docker.conf


And this should be /usr/lib/tmpfiles.d etc.

cgwalters · 2024-01-13T13:43:24Z

contrib/podmanimage/machine/subuid

@@ -0,0 +1 @@
+core:100000:1000000


Hmm, is there really no way to tweak this on the useradd commandline? That'd work better...

None that I found.

cgwalters · 2024-01-13T15:09:08Z

contrib/podmanimage/machine/Containerfile

+RUN printf "\nconfdir /etc/chrony.d\n" >> /etc/chrony.conf
+
+COPY 10-inotify-instances.conf /usr/etc/sysctl.d/10-inotify-instances.conf
+COPY 50-podman-makestep.conf /usr/etc/chrony.d/50-podman-makestep.conf


Also what IMO is way nicer to read and maintain is just to have:

COPY rootfs/etc etc COPY rootfs/usr usr

And then just drop your files in those directories in git.

There's one example of this here

I just used usr and etc, but this was a good idea.

vrothberg

I will start nasty and request to have comments in all configs and dockerfiles.

Since we can replace some parts that ignition would take at provisiong time to build time, we need comments to keep it maintianable and avoid collective amnesia why something is done the way it is.

vrothberg · 2024-01-15T14:49:44Z

contrib/podmanimage/machine/Containerfile

+
+RUN dnf -y update; \
+rpm --setcaps shadow-utils 2>/dev/null; \
+dnf -y install podman subscription-manager crun crun-wasm crun-krun chrony \


Why do we need skopeo and buildah?

We don't but I think it is useful for debugging and difficult to install if they don't exist.

They add 60M to the disk / container so I feel rather hesitant.

Ok I can remove.

Personally I've quite often wanted the ability to inspect a remote image without fetching it...and that's just in skopeo right? (It would make sense to me to have something like this in podman too...podman image remote-inspect? Dunno)

As far as buildah, I think it's basically because it's been promoted as a peer to podman build, and so it goes where podman goes.

The funning thing, my story of skopeo being created is exactly this. we wanted docker inspect --remote. So maybe it is time to add podman image inspect --remote One issue there is inspecting images versus manifest.

--raw versus default. Also --remote might be misinterpreted by CLI.

I think this should be a separate issue. Note that skopeo runs on Win and Mac as well. So I don't think this must be part of the podman machine where IMO the focus should be on what Podman needs rather than what some developers may find useful. Ideally, users shouldn't need to ssh into the machine.

baude · 2024-01-15T15:34:59Z

contrib/podmanimage/machine/Containerfile

+ADD usr usr
+ADD etc etc
+
+RUN groupadd -g 501 core; useradd -u 501 -g 501 core


the user cannot be made in containerfile due to podman machine init --username

also, if you want to push forward on this, should be user 1000

I would be fine with removing this, but do we want to set the default user for the case where these is no specified --username and then allow the user to modify it. Might be a case where want to use sysusers.

baude · 2024-01-15T15:38:03Z

contrib/podmanimage/machine/Containerfile

+
+RUN dnf -y update; \
+rpm --setcaps shadow-utils 2>/dev/null; \
+dnf -y install podman subscription-manager crun crun-wasm crun-krun chrony \


long term, i dont think this will work as we will need versioned content ... i.e. podman 5.0, podman 5.1 (or even 5.1.1). I think fedora-coreos-config does this reasonably nicely with YAML that gets read and converted to what you want above. perhaps there is some variable magic we can do here.

baude · 2024-01-15T15:47:47Z

No code in podman is changed here ... we could make the claim this is all for hacking ... though I would like to see the claim added to the commit and the containerfile. I have a series of long term questions that remain unanswered here but i'll just note them the best i can (given I had intended to do this work but you beat me to it).

I'm not confident this is the right place for this ... but i see the dilemma too. You are are trying to move "stuff" from code to containerfiles. Clearly we want that living in podman or podman-machine. However, you are also laying groundwork for a long-term goal of podman-machine operating systems. And that, I'm confident should not live here; however, this approach now mixes the proverbial peanut butter and chocolate. I'd be generally in favor of supporting dev work here ... but no code removal yet.
as i said earlier, i think fcos and related has set a nice model for using YAML to control packaging ... it makes it clear, diffs in git are nicer, etc.
we need to force a long-term conversation on what the podman-machine os looks like in the future. I will own that. The answer to this question is critical for Podman 5.

rhatdan · 2024-01-15T17:52:23Z

I think we want to make it easy for people to find an easy example of building a podman machine. We need to figure out the best way of selecting the podman machine perhaps using build-args. Perhaps something like:

ARG PODMAN_VERSION
RUN dnf -y install podman${PODMAN_VERSION}

Then build with:
$ podman build --buildarg PODMAN_VERSION="5.1.*" --tag quay.io/podman/podman-machine:5.1 .

This Containerfile would be just be installing
quay.io/podman/podman-machine:latest
or should it be
quay.io/podman/machine:latest

To eliminate the stutter.

vrothberg · 2024-01-15T18:52:47Z

Then build with:
$ podman build --buildarg PODMAN_VERSION="5.1.*" --tag quay.io/podman/podman-machine:5.1 .

An alternative may be to build podman directly inside the Dockerfile. A multistage build with injecting the source. The benefit is that it can be built directly in the upstream release process without any downstream delay/lag. This certainly comes at a cost of it not being a distro build.

Just to further sketch out what I mean:

FROM $base-image as podman-build
COPY ./ /src/podman
WORKDIR /src/podman
RUN dnf install -y $build-dependencies
RUN make podman

FROM $base-image
COPY --from=podman-build /src/podman/bin/podman /usr/bin/podman
# All the rest

Move some of the functionality in ignition into the building of a bootc based podman-machine. Signed-off-by: Daniel J Walsh <[email protected]>

cgwalters · 2024-02-08T21:34:02Z

OK so to enable Ignition in derived images, just off the top of my head there are probably two major parts:

The stuff in e.g. https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree (and https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition) ...really, may be hard to avoid just copying all that stuff in the overlays. There was an attempt to RPM-package the Ignition glue but I am not sure how maintained/tested it is. (And of course, regenerating the initramfs, which sadly is a bit harder than just running dracut right now, which is its own bug)
Setting ignition.platform.id on the kernel cmdline (now see bootc install config which supports injecting kargs, but it may actually be maximally convenient to do this in the disk images, which isn't yet exposed in bib but would likely be easy)

rhatdan · 2024-02-29T20:51:06Z

@baude can we update this Containerfile to match the current one you are using?

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none labels Jan 13, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 13, 2024

github-actions bot added the machine label Jan 13, 2024

rhatdan force-pushed the bootc branch from a61421c to 8864fd8 Compare January 13, 2024 12:40

cgwalters reviewed Jan 13, 2024

View reviewed changes

rhatdan force-pushed the bootc branch from 8864fd8 to 1c4d5cc Compare January 14, 2024 12:10

vrothberg reviewed Jan 15, 2024

View reviewed changes

baude reviewed Jan 15, 2024

View reviewed changes

rhatdan force-pushed the bootc branch from 1c4d5cc to 1e03180 Compare January 15, 2024 16:20

cgwalters mentioned this pull request Jan 18, 2024

Add podman machine bootc #21243

Closed

Add podman machine Containerfile

0bf4900

Move some of the functionality in ignition into the building of a bootc based podman-machine. Signed-off-by: Daniel J Walsh <[email protected]>

rhatdan force-pushed the bootc branch from 1e03180 to 0bf4900 Compare January 30, 2024 21:24

rhatdan closed this May 16, 2024

stale-locking-app bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 15, 2024

stale-locking-app bot locked as resolved and limited conversation to collaborators Aug 15, 2024

		@@ -0,0 +1 @@
		core:100000:1000000

[WIP] Add podman machine Containerfile #21251

[WIP] Add podman machine Containerfile #21251

Conversation

rhatdan commented Jan 13, 2024

Does this PR introduce a user-facing change?

openshift-ci bot commented Jan 13, 2024

rhatdan commented Jan 13, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vrothberg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vrothberg Jan 15, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

baude commented Jan 15, 2024

rhatdan commented Jan 15, 2024 • edited Loading

vrothberg commented Jan 15, 2024 • edited Loading

cgwalters commented Feb 8, 2024 • edited Loading

rhatdan commented Feb 29, 2024

vrothberg Jan 15, 2024 •

edited

Loading

rhatdan commented Jan 15, 2024 •

edited

Loading

vrothberg commented Jan 15, 2024 •

edited

Loading

cgwalters commented Feb 8, 2024 •

edited

Loading