Implement rootless container introspection - #2617
Conversation
This lets us read os-release files from other forms of sources.
This will let us later use a custom fs implementation to read from other types of sources.
|
|
||
| dataHome := os.Getenv("XDG_DATA_HOME") | ||
| if dataHome == "" { | ||
| dataHome = filepath.Join(os.Getenv("HOME"), ".local", "share") |
There was a problem hiding this comment.
What if both are unset, then we end up with a relative path. Maybe that should blow up instead?
There was a problem hiding this comment.
It seems very unlikely that HOME is not set. I just made it return the global store in that case.
| return entries, nil | ||
| } | ||
|
|
||
| func (fsys podmanUnshareFS) Open(name string) (fs.File, error) { |
There was a problem hiding this comment.
I think that we're supposed to be able to call Open() on a directory but that would fail with this implementation right?
|
|
||
| // Ensure os.IsNotExist() works on the errors | ||
| func (fsys podmanUnshareFS) wrapErr(op, name string, err error) error { | ||
| if !fsys.exists(name) { |
There was a problem hiding this comment.
I don't have a better idea but this triggers a second subprocess for each error case.
There was a problem hiding this comment.
The alternative is an "exists" subprocess for each operation, doesn't seem better...
supakeen
left a comment
supakeen
left a comment
There was a problem hiding this comment.
The previous PR was supposed to be an approval since I had only nitpicky small things but apparently I had hit the wrong checkbox.
1a728f7 to
3c093e1
Compare
supakeen
left a comment
supakeen
left a comment
There was a problem hiding this comment.
Thank you for fixing my nits however unlikely they are to be triggered.
3c093e1 to
65d64f3
Compare
To make "podman mount" work in the rootless case we run it inside a "podman unshare" wrapper. However, this means the mount is not visible in the current namespace, all access to the mount must be done in another process that is also inside a "podman unshare". For this to work we switch Container.Root() to Container.RootFS(), which in the rootless case is a new fs.FS implementation that accesses the mount using standard tools (test/cat/stat/find) from the host inside a "podman unshare".
If we're not uid 0, use the per-user container store instead of the system global one.
65d64f3 to
43288e2
Compare
2 participants
This makes container introspection (osinfo) work when run as non-root, by using unprivileged podman and looking in the per-user podman container storage.
Fixes #2568
This means something like
image-builder manifest --bootc-default-fs ext4 --bootc-ref quay.io/fedora/fedora-bootc:44 qcow2now works as a user.NOTE;
image-builder build, doesn't yet work as it needs some additional work to have osbuild look into the right container store.