Skip to content

Commit 3da083c

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #4671 from ggiguash/bootc-use-read-only-storage-preloaded
OCPBUGS-52420: Bootc images to use the /usr read-only storage for preloaded container images
2 parents a7c7a5a + d579aea commit 3da083c

7 files changed

+12
-118
lines changed

‎docs/config/Containerfile.bootc-embedded-rhel9

Lines changed: 3 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -2,50 +2,15 @@ ARG USHIFT_BASE_IMAGE_NAME
22
ARG USHIFT_BASE_IMAGE_TAG
33
FROM $USHIFT_BASE_IMAGE_NAME:$USHIFT_BASE_IMAGE_TAG
44

5-
# Pull the container image dependencies into /var/lib/containers/storage-preloaded
5+
# Pull the container image dependencies into /usr/lib/containers/storage
66
RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
77
images=$(jq -r '.images | .[]' "/usr/share/microshift/release/release-$(uname -m).json") ; \
88
for i in ${images} ; do \
99
podman pull \
1010
--authfile /run/secrets/pull-secret.json \
11-
--root /var/lib/containers/storage-preloaded \
11+
--root /usr/lib/containers/storage \
1212
"docker://${i}" ; \
1313
done
1414

1515
# Edit the container storage configuration file to include the new path
16-
RUN sed -i '/^additionalimagestores.*/a\ "/var/lib/containers/storage-preloaded",' /etc/containers/storage.conf
17-
18-
# Apply a workaround to set the SELinux context on the new storage directory and
19-
# also restore 'NET_BIND_SERVICE' capability that is currently lost when including
20-
# images in the container.
21-
#
22-
# Note: This requires setting the additional image stores path to a read-write
23-
# location on the file system. The images will still be treated as read-only by
24-
# the container subsystem.
25-
# See https://github.com/ostreedev/ostree-rs-ext/issues/654
26-
#
27-
# hadolint ignore=DL3059
28-
RUN cat > /usr/bin/microshift-imagestore-config <<'EOF'
29-
#!/bin/bash
30-
set -euxo pipefail
31-
DEF_IMGPATH="$1"
32-
NEW_IMGPATH="$2"
33-
semanage fcontext -a -e "${DEF_IMGPATH}" "${NEW_IMGPATH}"
34-
restorecon -R "${NEW_IMGPATH}"
35-
find "${NEW_IMGPATH}" -type f -path "*/usr/sbin/haproxy" -exec setcap "cap_net_bind_service=+ep" {} \;
36-
EOF
37-
38-
# hadolint ignore=DL3059
39-
RUN cat > /etc/systemd/system/microshift-imagestore-config.service <<'EOF'
40-
[Unit]
41-
Description=Configure the image store directory for MicroShift
42-
Before=microshift.service
43-
[Service]
44-
Type=oneshot
45-
ExecStart=/usr/bin/microshift-imagestore-config /var/lib/containers/storage /var/lib/containers/storage-preloaded
46-
[Install]
47-
WantedBy=multi-user.target
48-
EOF
49-
50-
RUN chmod 755 /usr/bin/microshift-imagestore-config && \
51-
systemctl enable microshift-imagestore-config.service
16+
RUN sed -i '/^additionalimagestores.*/a\ "/usr/lib/containers/storage",' /etc/containers/storage.conf

‎docs/config/Containerfile.bootc-rhel9

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
FROM registry.redhat.io/rhel9-eus/rhel-9.4-bootc:9.4
1+
FROM registry.redhat.io/rhel9-eus/rhel-9.6-bootc:9.6
22

3-
ARG USHIFT_VER=4.18
3+
ARG USHIFT_VER=4.19
44
# hadolint ignore=SC1091
55
RUN . /etc/os-release && dnf upgrade -y --releasever="${VERSION_ID}" && \
66
dnf config-manager \

‎test/image-blueprints-bootc/layer2-source/group2/microshift-imagestore-config.service.template

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎test/image-blueprints-bootc/layer2-source/group2/microshift-imagestore-config.sh.template

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎test/image-blueprints-bootc/layer2-source/group2/rhel96-bootc-source-ai-model-serving.containerfile

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
5454
for i in 1 2 3; do \
5555
GOMAXPROCS=8 podman pull \
5656
--authfile /run/secrets/pull-secret.json \
57-
--root /var/lib/containers/storage-preloaded \
57+
--root /usr/lib/containers/storage \
5858
"docker://${img}" && break; \
5959
if [ $i -eq 3 ] ; then \
6060
echo "ERROR: Failed to pull ${img} image after 3 attempts"; \
@@ -79,7 +79,7 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
7979
for i in 1 2 3; do \
8080
GOMAXPROCS=8 podman pull \
8181
--authfile /run/secrets/pull-secret.json \
82-
--root /var/lib/containers/storage-preloaded \
82+
--root /usr/lib/containers/storage \
8383
"docker://${img}" && break; \
8484
if [ $i -eq 3 ] ; then \
8585
echo "ERROR: Failed to pull ${img} image after 3 attempts"; \
@@ -91,19 +91,7 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
9191

9292

9393
# Edit the container storage configuration file to include the new path
94-
RUN sed -i '/^additionalimagestores.*/a\ "/var/lib/containers/storage-preloaded",' /etc/containers/storage.conf
95-
96-
# Apply a workaround to set the SELinux context on the new storage directory and
97-
# also restore 'NET_BIND_SERVICE' capability that is currently lost when including
98-
# images in the container.
99-
#
100-
# Note: This requires setting the additional image stores path to a read-write
101-
# location on the file system. The images will still be treated as read-only by
102-
# the container subsystem.
103-
# See https://github.com/ostreedev/ostree-rs-ext/issues/654
104-
COPY --chmod=755 ./bootc-images/microshift-imagestore-config.sh /usr/bin/microshift-imagestore-config
105-
COPY --chmod=644 ./bootc-images/microshift-imagestore-config.service /etc/systemd/system/microshift-imagestore-config.service
106-
RUN systemctl enable microshift-imagestore-config.service
94+
RUN sed -i '/^additionalimagestores.*/a\ "/usr/lib/containers/storage",' /etc/containers/storage.conf
10795

10896
# Create test data
10997
COPY --chmod=755 ./bootc-images/ai-model-serving-test-data.sh /tmp/ai-model-serving-test-data.sh

‎test/image-blueprints-bootc/layer2-source/group2/rhel96-bootc-source-isolated.containerfile

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
3232
for i in 1 2 3; do \
3333
GOMAXPROCS=8 podman pull \
3434
--authfile /run/secrets/pull-secret.json \
35-
--root /var/lib/containers/storage-preloaded \
35+
--root /usr/lib/containers/storage \
3636
"docker://{{ . }}" && break; \
3737
if [ $i -eq 3 ] ; then \
3838
echo "ERROR: Failed to pull {{ . }} image after 3 attempts"; \
@@ -43,16 +43,4 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
4343
# {{ end }}
4444

4545
# Edit the container storage configuration file to include the new path
46-
RUN sed -i '/^additionalimagestores.*/a\ "/var/lib/containers/storage-preloaded",' /etc/containers/storage.conf
47-
48-
# Apply a workaround to set the SELinux context on the new storage directory and
49-
# also restore 'NET_BIND_SERVICE' capability that is currently lost when including
50-
# images in the container.
51-
#
52-
# Note: This requires setting the additional image stores path to a read-write
53-
# location on the file system. The images will still be treated as read-only by
54-
# the container subsystem.
55-
# See https://github.com/ostreedev/ostree-rs-ext/issues/654
56-
COPY --chmod=755 ./bootc-images/microshift-imagestore-config.sh /usr/bin/microshift-imagestore-config
57-
COPY --chmod=644 ./bootc-images/microshift-imagestore-config.service /etc/systemd/system/microshift-imagestore-config.service
58-
RUN systemctl enable microshift-imagestore-config.service
46+
RUN sed -i '/^additionalimagestores.*/a\ "/usr/lib/containers/storage",' /etc/containers/storage.conf

‎test/image-blueprints-bootc/layer2-source/group3/cos9-bootc-source-isolated.containerfile

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
1212
for i in 1 2 3; do \
1313
GOMAXPROCS=8 podman pull \
1414
--authfile /run/secrets/pull-secret.json \
15-
--root /var/lib/containers/storage-preloaded \
15+
--root /usr/lib/containers/storage \
1616
"docker://{{ . }}" && break; \
1717
if [ $i -eq 3 ] ; then \
1818
echo "ERROR: Failed to pull {{ . }} image after 3 attempts"; \
@@ -23,23 +23,4 @@ RUN --mount=type=secret,id=pullsecret,dst=/run/secrets/pull-secret.json \
2323
# {{ end }}
2424

2525
# Edit the container storage configuration file to include the new path
26-
RUN sed -i '/^additionalimagestores.*/a\ "/var/lib/containers/storage-preloaded",' /etc/containers/storage.conf
27-
28-
# Apply a workaround to set the SELinux context on the new storage directory and
29-
# also restore 'NET_BIND_SERVICE' capability that is currently lost when including
30-
# images in the container.
31-
#
32-
# Note: This requires setting the additional image stores path to a read-write
33-
# location on the file system. The images will still be treated as read-only by
34-
# the container subsystem.
35-
# See https://github.com/ostreedev/ostree-rs-ext/issues/654
36-
COPY --chmod=755 ./bootc-images/microshift-imagestore-config.sh /usr/bin/microshift-imagestore-config
37-
RUN printf '[Unit]\n\
38-
Description=Configure the image store directory for MicroShift\n\
39-
Before=microshift.service\n\
40-
[Service]\n\
41-
Type=oneshot\n\
42-
ExecStart=/usr/bin/microshift-imagestore-config /var/lib/containers/storage /var/lib/containers/storage-preloaded\n\
43-
[Install]\n\
44-
WantedBy=multi-user.target\n' > /etc/systemd/system/microshift-imagestore-config.service && \
45-
systemctl enable microshift-imagestore-config.service
26+
RUN sed -i '/^additionalimagestores.*/a\ "/usr/lib/containers/storage",' /etc/containers/storage.conf

0 commit comments

Comments
 (0)