|
| 1 | +From d4b3e3655deb7d55792e52fe6a11c609fb24e3b8 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Dusty Mabe <dusty@dustymabe.com> |
| 3 | +Date: Tue, 24 Oct 2023 14:08:44 -0400 |
| 4 | +Subject: [PATCH] objectstore: also mount /etc/containers for "host" buildroot |
| 5 | + |
| 6 | +In the case we are not using a buildroot (i.e. we are using |
| 7 | +the host as the buildroot) let's also mount in /etc/containers |
| 8 | +into the environment. There are sometimes where software running |
| 9 | +from /usr can't operate without configuration in /etc and this |
| 10 | +will allow it to work. |
| 11 | + |
| 12 | +An example of software hitting this problem is skopeo. With a |
| 13 | +simple config like: |
| 14 | + |
| 15 | +``` |
| 16 | +version: '2' |
| 17 | +mpp-vars: |
| 18 | + release: 38 |
| 19 | +pipelines: |
| 20 | + - name: skopeo-tree |
| 21 | + # build: name:build |
| 22 | + source-epoch: 1659397331 |
| 23 | + stages: |
| 24 | + - type: org.osbuild.skopeo |
| 25 | + inputs: |
| 26 | + images: |
| 27 | + type: org.osbuild.containers |
| 28 | + origin: org.osbuild.source |
| 29 | + mpp-resolve-images: |
| 30 | + images: |
| 31 | + - source: quay.io/fedora/fedora-coreos |
| 32 | + tag: stable |
| 33 | + name: localhost/fcos |
| 34 | + options: |
| 35 | + destination: |
| 36 | + type: containers-storage |
| 37 | + storage-path: /usr/share/containers/storage |
| 38 | +``` |
| 39 | + |
| 40 | +We end up hitting an error like this: |
| 41 | + |
| 42 | +``` |
| 43 | +time="2023-10-24T18:27:14Z" level=fatal msg="Error loading trust policy: open /etc/containers/policy.json: no such file or directory" |
| 44 | +Traceback (most recent call last): |
| 45 | + File "/run/osbuild/bin/org.osbuild.skopeo", line 90, in <module> |
| 46 | + r = main(args["inputs"], args["tree"], args["options"]) |
| 47 | + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 48 | + File "/run/osbuild/bin/org.osbuild.skopeo", line 73, in main |
| 49 | + subprocess.run(["skopeo", "copy", image_source, dest], check=True) |
| 50 | + File "/usr/lib64/python3.11/subprocess.py", line 571, in run |
| 51 | + raise CalledProcessError(retcode, process.args, |
| 52 | +subprocess.CalledProcessError: Command '['skopeo', 'copy', 'dir:/tmp/tmp5_qcng99/image', 'containers-storage:[overlay@/run/osbuild/tree/usr/share/containers/storage+/run/containers/storage]localhost/fcos']' returned non-zero exit status 1. |
| 53 | +``` |
| 54 | + |
| 55 | +This PR adds in a mount for /etc/containers from the host so that |
| 56 | +/etc/containers/policy.json can be accessed. |
| 57 | +--- |
| 58 | + osbuild/objectstore.py | 12 ++++++++++-- |
| 59 | + 1 file changed, 10 insertions(+), 2 deletions(-) |
| 60 | + |
| 61 | +diff --git a/osbuild/objectstore.py b/osbuild/objectstore.py |
| 62 | +index 4a19ce9..922d5ee 100644 |
| 63 | +--- a/osbuild/objectstore.py |
| 64 | ++++ b/osbuild/objectstore.py |
| 65 | +@@ -283,14 +283,22 @@ class HostTree: |
| 66 | + self._root = self.store.tempdir(prefix="host") |
| 67 | + |
| 68 | + root = self._root.name |
| 69 | +- # Create a bare bones root file system |
| 70 | +- # with just /usr mounted from the host |
| 71 | ++ # Create a bare bones root file system. Starting with just |
| 72 | ++ # /usr mounted from the host. |
| 73 | + usr = os.path.join(root, "usr") |
| 74 | + os.makedirs(usr) |
| 75 | ++ # Also add in /etc/containers, which will allow us to access |
| 76 | ++ # /etc/containers/policy.json and enable moving containers |
| 77 | ++ # (skopeo): https://github.com/osbuild/osbuild/pull/1410 |
| 78 | ++ # If https://github.com/containers/image/issues/2157 ever gets |
| 79 | ++ # fixed we can probably remove this bind mount. |
| 80 | ++ etc_containers = os.path.join(root, "etc", "containers") |
| 81 | ++ os.makedirs(etc_containers) |
| 82 | + |
| 83 | + # ensure / is read-only |
| 84 | + mount(root, root) |
| 85 | + mount("/usr", usr) |
| 86 | ++ mount("/etc/containers", etc_containers) |
| 87 | + |
| 88 | + @property |
| 89 | + def tree(self) -> os.PathLike: |
| 90 | +-- |
| 91 | +2.41.0 |
| 92 | + |
0 commit comments