Why RHEL 9 podman package still explicitly depends on runc ?

[Romain-Geissler-1A]

Hi,

With RHEL 9 being released, I am starting toying a bit with it in my company. However I don't understand why the podman package still explicitly depends on runc ? From what I understand, in presence of both crun and runc, podman will favor crun, however runc is still explicitly mentioned in the "requires" dependencies:

From a "quay.io/centos/centos:stream9" image, you depend explicitly on "oci-runtime" and "runc"

[root@fc352c537362 /]# dnf repoquery --requires podman|grep run
Last metadata expiration check: 0:08:46 ago on Fri May 20 22:29:33 2022.
oci-runtime
runc >= 1.0.0-57

Yet from a "fedora:latest" image you don't depend on "runc" at all

[root@74d999bf2f7c /]# dnf repoquery --requires podman|grep run
Last metadata expiration check: 0:11:58 ago on Fri May 20 22:26:28 2022.

In both cases, installing only the package "oci-runtime" correctly installs only "crun".

Should'nt you udpate the RHEL 9 packages to stop explicitly depending on runc, so only crun is installed by default ? Right now it's impossible to "dnf install -y podman" and then "dnf remove runc" on RHEL 9, as it will uninstall podman, while on fedora it's possible.

Cheers,
Romain

[afbjorklund]

We had to add crun as an explicit dependency for Ubuntu, otherwise it would pick runc - and fail.

I think that particular issue with runc is fixed now, but it could happen again since only crun is tested.

[Romain-Geissler-1A]

Ah ok, thanks for clarifying.

In my case, technically I should not really bother about it, as from a user point of view, installing runc while you don't need it because crun is there already shall normally not be a big deal, these packages aren't huge. But because of some silly docker packaging issues (docker/containerd-packaging#210) and the fact that having pull requests merged in the docker projects seems rather complicated when you don't work in Docker Inc (two pull requests are pending for months to fix this simple issue), these becomes a concern for people like me who try to co-install podman and docker on a RHEL 8/9 machine. If podman didn't depend on runc, the issue docker/containerd-packaging#210 would not be fixed, but worked around by default, like it's currently the case on fedora.

[afbjorklund]

The ubuntu package looks like this:

Depends: init-system-helpers (>= 1.52), libc6 (>= 2.34), libdevmapper1.02.1 (>= 2:1.02.97), libgpgme11 (>= 1.4.1), libseccomp2 (>= 2.4.1), conmon (>= 2.0.18~), containernetworking-plugins (>= 0.8.7), golang-github-containers-common, crun | runc (>= 1.0.0~rc92~)
Recommends: buildah (>= 1.21.0), fuse-overlayfs (>= 1.0.0~), slirp4netns (>= 0.4.1~), catatonit | tini | dumb-init, uidmap, golang-github-containernetworking-plugin-dnsname
Suggests: containers-storage, docker-compose, iptables
Breaks: buildah (<< 1.10.1-6), fuse-overlayfs (<< 0.7.1), slirp4netns (<< 0.4.1)

So it would prefer runc, workaround:

apt-get install -y podman crun

---

For docker, we have already given up years ago... They put their runc into the "containerd.io" package.

containerd.io: /usr/bin/runc
containerd.io: /usr/bin/containerd

The workaround was to move the system packages to the proper directory, and to split runc/containerd.

runc: /usr/sbin/runc
containerd: /usr/bin/containerd

[Romain-Geissler-1A]

Yep if this ubuntu workaround would work for RHEL 9 that we have already adopted in many of our production/devlopment images, I would be ok, but it doesn't.

From a "quay.io/centos/centos:stream9" image:

[root@858d09b154f9 /]# dnf install -y podman crun                                                                                                    
CentOS Stream 9 - BaseOS                                                                                                                             4.5 MB/s | 5.6 MB     00:01
CentOS Stream 9 - AppStream                                                                                                                          9.4 MB/s |  13 MB     00:01
CentOS Stream 9 - Extras packages                                                                                                                     13 kB/s | 8.2 kB     00:00
Dependencies resolved. 
=====================================================================================================================================================================================
 Package                                                 Architecture                       Version                                      Repository                             Size
=====================================================================================================================================================================================
Installing:
 crun                                                    x86_64                             1.4.5-1.el9                                  appstream                             187 k
 podman 
...
 runc                                                    x86_64                             3:1.1.0-2.el9                                appstream                             3.0 M
...

and then, if you try to remove just runc, it removes all of podman as well:

[root@858d09b154f9 /]# dnf remove runc
Dependencies resolved.
=====================================================================================================================================================================================
 Package                                                 Architecture                       Version                                     Repository                              Size
=====================================================================================================================================================================================
Removing:
 runc                                                    x86_64                             3:1.1.0-2.el9                               @appstream                              11 M
Removing dependent packages:
 podman
...

[afbjorklund]

I guess the fix will eventually be backported to Fedora LTS, and it'll work there too.

Probably something for the RHEL packaging team, rather than a discussion here ?

[Romain-Geissler-1A]

I will see here first what the Red Hat folks say (technically it impacts CentOS Stream too, which might be used by non Red Hat customers). If Red Hat folks prefers that I open a ticket in the paying Red Hat customer portal, I will. However I do agree that working around a Docker packaging issue on podman side is... weird... I definitely wish Docker folks would merge more contributions not originating from Docker Inc employees...

[mheon]

You'd probably be better off creating a Bugzilla for this, RHEL-specific packaging issues are easier to manage over there.

[jnovy]

This should be fixed by https://gitlab.com/redhat/centos-stream/rpms/podman/-/merge_requests/176/diffs?commit_id=f327e88a08ca224b4d20b93a44f234dfb525e0b5

[Romain-Geissler-1A]

Thanks ! Looking forward to have this released to RHEL users ;)